SPRUJB6B November 2024 – May 2025 AM2612
These commands perform the RSA private operation. They do the same thing, but in the future RSA_DECRYPT might have more blinding to protect against chosen-ciphertext DPA attacks. They verify that the resulting value is indeed an e’th root of m.
The RSA_SIGN and RSA_DECRYPT commands perform a left-to-right scan, so they reveal (through timing and power information) the highest set bit of d.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | c | A ciphertext to be decrypted | No |
| 2 | N | The public modulus | No |
| 3 | e | The public exponent used for blinding. It must be the case that (d*e1) is divisible by Phi(N), or at least Carmichael’s lambda(N). | No |
| 4 | d0 | First share of the XOR-blinded private exponent | No |
| 5 | d1 | Second share of the XOR-blinded private exponent | No |
The RSA_SIGN and RSA_DECRYPT commands raise an error if:
The RSA_DECRYPT multiplies the ciphertext by a random blinding value b and cancels it out by raising it to the (d*e-1) by the end of the calculation. Therefore if (d*e-1) is not divisible by Carmichael lambda(N) (or Euler’s Phi(N)), then this command will fail with a badParams error.
Furthermore, if GCD(N,b) != 1, then this calculation will give the wrong answer. The probability of this event is negligible for properly generated keys, but if the client executes this command with a very short or highly composite key, it may cause the command to fail with a badParams error.
On error, these commands clear slots 0 through 7. On success, they clear slots 1, 3, 6 and 7. Output map:
| Slot | Name | Description | |
|---|---|---|---|
| 0 | m | cd mod N |