New partial key exposure attacks on RSA with additive exponent blinding

Abstract Partial key exposure attacks present a significant threat to RSA-type cryptosystems. These attacks factorize the RSA modulus by utilizing partial knowledge of the decryption exponent, which is typically revealed by side-channel attacks, cold boot attacks, etc. In practice, the RSA implementations typically employ countermeasures to resist physical attacks, such as additive exponent blinding $$d' = d + r \varphi (N)$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:msup> <mml:mi>d</mml:mi> <mml:mo>′</mml:mo> </mml:msup> <mml:mo>=</mml:mo> <mml:mi>d</mml:mi> <mml:mo>+</mml:mo> <mml:mi>r</mml:mi> <mml:mi>φ</mml:mi> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>N</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> with unknown random blinding factor r . Although there are a couple of partial key exposure attacks on blinding RSA, these attacks require a considerable amount of leakage and fail to work when e is up to full size. In this paper, we propose new partial key exposure attacks on RSA with additive exponent blinding, focusing on leakage scenarios where the Most Significant Bits (MSBs) or Least Significant Bits (LSBs) of $$d'$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msup> <mml:mi>d</mml:mi> <mml:mo>′</mml:mo> </mml:msup> </mml:math> are revealed. For the case where e is small, we first recover partial information of p by solving the quadratic congruence equation, and then find the small roots of the integer equation to recover entire private key. Our method relaxes the attack requirements, for instance, we reduce the amount of MSBs for a successful attack from 75 to 25% when $$e \approx N^{0.25}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>e</mml:mi> <mml:mo>≈</mml:mo> <mml:msup> <mml:mi>N</mml:mi> <mml:mrow> <mml:mn>0.25</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:math> and $$r\approx N^{0}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>r</mml:mi> <mml:mo>≈</mml:mo> <mml:msup> <mml:mi>N</mml:mi> <mml:mn>0</mml:mn> </mml:msup> </mml:mrow> </mml:math> . Furthermore, we propose new attacks using the unique algebraic relationship in blinding RSA, which extend the attack to the case where e is of full size.