Dual modulus rsa variant improves fault detection under physical diversity
DM-RSA-OAEP: Formal Treatment of a Dual-Modulus Fault-Detection Countermeasure Based on Physical Diversity
Cryptography and SecurityInformation Theory
Summary
RSA is a common way to keep messages safe, but attackers can sometimes trick computers by causing faults during calculations. The authors look at a special RSA version called DM-RSA that uses two separate keys to spot mistakes caused by such faults. They fixed previous mistakes in this method and prove, with math, that it can detect different types of faults if the two keys are physically separate. However, if the faults affect both keys the same way, the protection fails. This work helps make secure systems better at noticing tampering.
What this means in practice
- •For hardware security engineers: Design cryptographic hardware that detects faults using dual independent keys under physical separation assumptions.
- •For embedded systems developers: Implement RSA with added fault detection guarantees when deploying on devices vulnerable to physical tampering.
A theory result. No direct application yet.
Authors
Ramamonjy Andriamifidisoa, Rufine Marius Lalasoa
Abstract
We revisit DM-RSA, an RSA variant that uses two independent moduli, whose original version was broken by Håstad's attack and contained an incorrect compromise-tolerance claim. We give a formal treatment of its repaired variant, DM-RSA-OAEP: (i) a complete IND-CCA2 security proof in the random-oracle model via a two-step hybrid argument, upper-bounding the security of the scheme by that of the weaker underlying RSA-OAEP instance, with an explicit simulation loss; (ii) a fault-detection theorem in an explicit adversary model that covers computation, key, and verification faults, including safe-error attacks, under a clearly stated physical-diversity assumption; (iii) an explicit analysis of why the countermeasure degrades to uselessness when the diversity assumption is violated (common-mode faults on a single chip). We position the scheme against the countermeasure landscape and against the broken dual-modulus literature. The contribution is deliberately framed as a fault countermeasure with a provable detection guarantee, not as a computationally stronger RSA. We conclude with a concrete instantiation and a detailed measurement protocol.