Fault Analysis on RSA Signing

Summary: A Trail of Bits intern modeled fault attacks on RSA signatures that use the Chinese Remainder Theorem, flipping bits in memory to corrupt one partial signature so that the greatest common denominator of n and s^e - m reveals the private factors p and q. In a toy C program, 45 of 938 bit flips (4.8%) produced the correct private keys, and in mbed TLS with PKCS#1 v1.5 padding, 28 of 566 flips (nearly 5%) leaked the keys after two runtime checks were bypassed with GDB.
What you should know: Roughly one in twenty single-bit flips was enough to hand over an RSA private key, and the mbed TLS run required defeating only two runtime checks - so the fault-injection defenses in an embedded TLS stack are the difference between a corrupted signature and a full key compromise.

Read the original at Trail of Bits Blog ↗