Consider the well-known oracle attack: somehow one gets a certain computation result as a function of a secret key from the secret key owner and tries to extract some information on the secret key. This attacking scenario is well understood in the cryptographic community. However, there are many protocols based on the discrete logarithm problem that turn out to leak many of the secret key bits from this oracle attack, unless suitable checkings are carried out. In this paper we present a key recovery attack on various discrete log-based schemes working in a prime order subgroup. Our attack may reveal part of, or the whole secret key in most Diffie-Hellman-type key exchange protocols and some applications of ElGamal encryption and signature schemes.

A key recovery attack on discrete log-based schemes using a prime order subgroup

Recent progress on NFS imposed a new estimation of the security of pairings. In this work we study the best attacks against some of the most popular pairings and propose new key sizes using an analysis which is more precise than the analysis in a recent article of Menezes, Sarkar and Singh. We also select pairing-friendly curves for standard security levels.

/pdf/updating-key-size-estimations-for-pairings-jec6qcoe2l.pdf

Updating Key Size Estimations for Pairings

This paper reports a constant-time CPU and GPU software implementation of the RSA exponentiation by using algorithms that offer a first-line defense against timing and cache attacks. In the case of GPU platforms the modular arithmetic layer was implemented using the Residue Number System (RNS) representation. We also present a CPU implementation of an RNS-based arithmetic that takes advantage of the parallelism provided by the Advanced Vector Extensions 2 (AVX2) instructions. Moreover, we carefully analyze the performance of two popular RNS modular reduction algorithms when implemented on many- and multi-core platforms. In the case of CPU platforms we also report that a combination of the schoolbook and Karatsuba algorithms for integer multiplication along with Montgomery reduction, yields our fastest modular multiplication procedure. In comparison with previous literature, our software library achieves faster timings for the computation of the RSA exponentiation using 1024-, 2048- and 3072-bit private keys.

/pdf/implementation-of-rsa-signatures-on-gpu-and-cpu-2jhja6khyi.pdf

Implementation of RSA Signatures on GPU and CPU Architectures

The residue number system (RNS) provides parallel, carry-free, and high-speed arithmetic and is therefore a good tool for high-performance computing. However, operations such as magnitude comparison, sign computation, overflow detection, scaling, and division are difficult to perform in RNS, since it is problematic to determine the magnitude of an RNS number. In order to resolve this problem, we propose to compute the interval evaluation of the fractional representation of an RNS number in floating-point arithmetic of limited precision. No matter what the size n of the moduli set and dynamic range, only small arithmetic operations are required, and most of the computations are performed in parallel with n threads, which allows for efficient implementation of our method on many general-purpose computing platforms. Using this method, we propose new algorithms for magnitude comparison and general division in RNS and implement them for GPUs using the CUDA platform. We evaluate the performance of our algorithms on an NVIDIA GTX 1080 GPU using sets of 4 to 256 RNS moduli that provide dynamic ranges from 64 to 4096 bits. Experimental results show that the proposed new algorithms are efficient for large moduli sets and clearly outperform the existing RNS magnitude comparison and division algorithms in terms of execution time.

/pdf/using-floating-point-intervals-for-non-modular-computations-q0sw91sze9.pdf

Using Floating-Point Intervals for Non-Modular Computations in Residue Number System

This paper presents a new approach to integer multiple precision (MP) modular exponentiation, using double-precision floating point (DPF) operations, that is suitable for GPU implementation. We show speedups ranging from 20 % to 34 % over the best prior G PU times for sizes corresponding to common RSA cryptographic operations (2048 to 4096 bits). Three techniques are described. First, by adding 2104to the high half of the product, and 252 to the low half, we set the implicit leading 1 in the DPF mantissa so that the full 52 explicit bits are available for each half of the 104-bit products of samples. Second, the DPF values are cast bitwise to 64-bit integers for adding the column sums to get the MP result. Normally the cast would require masking off the exponents, but because they are constant, we can include them in the column sums and correct just once for their total. Third, by initializing the column sums with the appropriate negative value to compensate for the exponent sums, no corrective subtraction is needed. Our implementation on an NVIDIA GTX Titan Black GPU achieves between 132.5K and 161.9K modular exponentiations per second of size 1024 bits, with latencies ranging from 21.7 ms to 17.8 ms, making it practical for online RSA applications. Proportional results are shown for 1536 and 2048 bits. The implementation is so efficient that its maximum sustained performance is actually bounded by the thermal limit of the GPU.

Faster Modular Exponentiation Using Double Precision Floating Point Arithmetic on the GPU

Historically, Elliptic Curve Cryptography (ECC) is an active field of applied cryptography where recent focus is on high speed, constant time, and formally verified implementations. While there are a handful of outliers where all these concepts join and land in real-world deployments, these are generally on a case-by-case basis: e.g. a library may feature such X25519 or P-256 code, but not for all curves. In this work, we propose and implement a methodology that fully automates the implementation, testing, and integration of ECC stacks with the above properties. We demonstrate the flexibility and applicability of our methodology by seamlessly integrating into three real-world projects: OpenSSL, Mozilla’s NSS, and the GOST OpenSSL Engine, achieving roughly 9.5x, 4.5x, 13.3x, and 3.7x speedup on any given curve for key generation, key agreement, signing, and verifying, respectively. Furthermore, we showcase the efficacy of our testing methodology by uncovering flaws and vulnerabilities in OpenSSL, and a specification-level vulnerability in a Russian standard. Our work bridges the gap between significant applied cryptography research results and deployed software, fully automating the process.

Set It and Forget It! Turnkey ECC for Instant Integration

/pdf/computing-discrete-logarithms-in-cryptographically-4at64we3eo.pdf

Computing discrete logarithms in cryptographically-interesting characteristic-three finite fields.

The implementation of the RSA private operation tends to be expensive since its computationally complexity is cubic with respect to the bit-size of its private key. As a consequence, considerable effort has been put into optimizing this operation. In this work, we present a parallel implementation of the RSA private operation using the Single Instruction Multiple Thread (SIMT) threading model of Graphics Processor Unit (GPU) platforms. The underlying modular arithmetic is performed by means of the Residue Number System (RNS) representation. By combining these two approaches, we present a GPU software library that achieves high-speed timings for the RSA private operation when using 1024-, 2048- and 3072-bit secret keys.

A GPU parallel implementation of the RSA private operation

Historically, Elliptic Curve Cryptography (ECC) is an active field of applied cryptography where recent focus is on high speed, constant time, and formally verified implementations. While there are a handful of outliers where all these concepts join and land in real-world deployments, these are generally on a case-by-case basis: e.g.\ a library may feature such X25519 or P-256 code, but not for all curves. In this work, we propose and implement a methodology that fully automates the implementation, testing, and integration of ECC stacks with the above properties. We demonstrate the flexibility and applicability of our methodology by seamlessly integrating into three real-world projects: OpenSSL, Mozilla's NSS, and the GOST OpenSSL Engine, achieving roughly 9.5x, 4.5x, 13.3x, and 3.7x speedup on any given curve for key generation, key agreement, signing, and verifying, respectively. Furthermore, we showcase the efficacy of our testing methodology by uncovering flaws and vulnerabilities in OpenSSL, and a specification-level vulnerability in a Russian standard. Our work bridges the gap between significant applied cryptography research results and deployed software, fully automating the process.

Luis Rivera-Zamarripa

Papers

Implementation of RSA Signatures on GPU and CPU Architectures

Set It and Forget It! Turnkey ECC for Instant Integration

Computing discrete logarithms in cryptographically-interesting characteristic-three finite fields.

A GPU parallel implementation of the RSA private operation

Set It and Forget It! Turnkey ECC for Instant Integration.