Implementation of RSA algorithm resistant to fault injection attack on system based on triple core LEON3 processor

Nowadays, cryptographic systems are used to verify the confidentiality, integrity and source of the data. Cryptographic systems can be grouped under two categories as symmetric and asymmetric crypto systems. In symmetric crypto systems,the screet key needs to be used for both encryption and decryption. For this reason, the screet key must be shared over a secure channel before communication. This situation creates difficulties in practice. Asymmetric crypto systems proposed by DiffieHellman overcome from this difficulty. Asymmetric crypto systems use two different keys for encryption and decryption named public and private and sharing only the public key is sufficient for communication. In this case it is not necessary to use a secure channel. The most widely used algorithm for asymmetric crypto systems is the Rivest Shamir Adleman (RSA) algorithm. Both symmetric and asymmetric cryptosystems are attacked by attacks which target mathematical infrastructures and side channel analysis attacks which target implementation. Major side channel analysis attacks are timing analysis, power analysis and fault injection attacks. Multi-core processors offer higher processing power and lower operation frequency than single-core processors. Multi-core processors also reduces system cost due to lower power consumption and less space occupancy. Multiprocessing consists of Asymmetric Multi Processing (AMP) and Symmetric Multi Processing (SMP) modes. In SMP mode, one operating system manages all processor cores and applications can use any of the processor cores. In AMP mode, each core runs a different operating system or a copy of the same operating system. In this thesis, Leon3 processor, a synthesizable processor designed by Gaisler Aeroflex, is used in SMP mode with 3 cores. The operating system running on Leon3 cores is chosen as Linux operating system compiled with SMP support. The Pthreads library is used to take advantage of multithreading support of Linux. Pthreads library provides facilities such as writing code that multiple threads work in the same program and inter-thread synchronization mechanisms. It also allows configuration of the desired thread so that it runs on the desired processor core. The purpose of this work is to implement the RSA algorithm to be resistant to fault injection attacks, which are implemented in the form of temporary bit errors on the secret key. For this purpose, a system on chip was designed and synthesized using 3 Leon3 core and it was run on Digilent's Nexys4DDR Field Programmable Gate Array (FPGA) development card. Then Linux operating system was compiled for the Leon3 microprocessor and it run on the Leon3 system on chip. Finally, the RSA algorithm is written in C ++ programming language. Software based Triple Modular Redundancy (TMR) is implemented by performing the same decryption process on each processor core. In this realization, the RSA algorithm running on each processorxviii is starting to work with a certain time difference. If one of the processor cores is affected by temporary bit errors and produces a wrong result, the result produced by the other two processors will be accepted correctly. For analysing the proposed method three case are compared with each other. First case is the one that only one thread is running for RSA decryption, that is, TMR method is not used. Second case is the one that three thread is running, that is TMR method is used, for RSA decryption of the same ciphertext with one copy of the same secret key. Third case which is the proposed method is the one that three thread is running, that is TMR method is used, for RSA decryption of the same ciphertext with the same secret key. In the proposed method, there is only one copy of the secret key and all of three threads are using this copy. After analysis of these three cases, effect of Cylic Redundancy Check(CRC) for checking integrity of the secret key is analyzed when used with the proposed method. Firstly, the proposed method is tested on Linux operating system running on triple core Leon3 processor. It is shown that the method is succesfully running on the system. After that, for detailed analysis of the proposed method, Linux operating system installed on PC is used because of performance constraint of Leon3 processor system I synthesized. In the analysis of the first case, that is only one thread is running for RSA decryption, the program written for analysis does different number of decryption at each step (from 50 to 2000 inreasing with 50 at each step). For each step percentage of succeeded fault attacks are calculated. Analysis results for first case shows that at each step approximately 13,33% of fault attacks are succeeded. The same test is done when CRC is performed on the secret key with 1 ms period. In this case, 1,348% of fault attacks are succeeded. For the second and third cases that TMR method is used, the most important situation is the situtation that the result of RSA decryption is wrong, while TMR method is succeeded, that is, at least two of three thread are generated the same result for RSA decryption. In this situation fault attack is succeeded, because the system generates faulty output. Another important situation is the situation that TMR method is failed, that is, all threads are generated different decryption results with each other. In this situation neither fault attack is succeeded, nor true result for decryption is generated. In the analysis of the second case, that is TMR method is used and all threads use one copy of the same secret key, the program written for analysis does different number of decryption at each step (from 500 to 32000 inreasing with 500 at each step). For each step percentage of succeeded fault attacks are calculated. At the same time the percentage of the situation that TMR is failed is calculated. Analysis results for second case shows that at each step approximately 0,1% of fault attacks are succeeded. Also 8,282% of fault attacks causes TMR method to fail. The same test is done when CRC is performed on each secret key with 1 ms period. In this case, 0,002578% of fault attacks are succeeded. In the analysis of the third case (the proposed method), that is TMR method is used and all threads use the same copy of the secret key, for different start delays between threads, analyzes are done. It is seen that when start delay is increasing, the success of fault attack is decreased, but not as much as in situation 2. The same test is done, when CRC period is performed on the secret key with different CRC period values. According to results, we can say that when CRC period and start delay of threads increasing, success rate of fault attack is decreasing. For every CRC period, if startxix delay between thread 1-2 and 2-3 is greater than a specific value, success rate of fault attack goes to 0%. When we compare the second and the third case, we see that third case which is the proposed method is more secure because of usage of one copy for the secret key. On the other hand, the second method has advantage over the proposed method in terms of time consumed for one RSA decryption operation. In terms of the situation that TMR is failed, the proposed method is more effective than the second case.