Abstract

Since two different types of side channel attacks based on passive information leakage and active
fault injection are independently considered as implementation threats on cryptographic modules,
most countermeasures have been separately developed according to each attack type. But then, Amiel
et al. proposed a combined side channel attack in which an attacker combines these two methods
to recover the secret key in an RSA implementation. In this paper, we show that the BNP (Boscher,
Naciri, and Prouff) algorithm for RSA, which is an SPA/FA-resistant exponentiation method, is also
vulnerable to the combined attack. In addition, we propose a new exponentiation algorithm resistant
to power analysis and fault attack as well as the combined attack. The proposed secure exponentia-
tion algorithm can be employed to strengthen the security of CRT-RSA.