Paper gives DM-RSA-OAEP a formal fault-detection security treatment
Original title: DM-RSA-OAEP: Formal Treatment of a Dual-Modulus Fault-Detection Countermeasure Based on Physical Diversity
IND-CCA2 security is bounded by the weaker RSA-OAEP instance, and detection fails if both moduli share one chip’s faults.
A cs.CR paper revisits DM-RSA, a dual-modulus RSA variant whose original form was broken by Håstad’s attack and included an incorrect compromise-tolerance claim. For the repaired scheme DM-RSA-OAEP, the authors give an IND-CCA2 proof in the random-oracle model, a fault-detection theorem covering computation, key and verification faults including safe-error attacks, and an analysis showing the countermeasure becomes useless under common-mode faults when the physical-diversity assumption fails. They frame it as a detection countermeasure, not a stronger RSA, and end with a concrete instantiation and measurement protocol.
- The proof uses a two-step hybrid argument with an explicit simulation loss.
- The adversary model includes computation, key and verification faults and safe-error attacks.
- Detection relies on a stated physical-diversity assumption across independent moduli.
- The authors say the result is not a computationally stronger RSA.
From the original article
1 min read at arxiv.orgWe revisit DM-RSA, an RSA variant that uses two independent moduli, whose original version was broken by Håstad's attack and contained an incorrect compromise-tolerance claim.
By Ramamonjy Andriamifidisoa · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.