Attacking RSACRT signatures with faults on montgomery multiplication
In this paper, we present several efficient fault attacks against implementations of RSACRT signatures that use modular exponentiation algorithms based on Montgomery multiplication. They apply to any padding function, including randomized paddings, and as such are the first fault attacks effective against RSAPSS. The new attacks are based on the assumption that a small register can be forced to either zero, or a constant value, or a value with zero high-order bits. We show that these models are quite realistic, as such faults can be achieved against many proposed hardware designs for RSA signatures.
rsacrt montgomery multiplication fault attacks rsapss