finja report for "tests/crt-rsa_aumuller.fia"

Options:

transient faults: enabled.
fault types: zeroing randomizing.
Maximum number of faults: 2.

Summary PROTECTED

Total number of different fault injections: 7141.
Total number of successful attack: 0.

Computation

noprop error, m, e, r1, r2 ;
prime {p}, {q}, t ;
dp := { e^-1 mod (p − 1) } ;
dq := { e^-1 mod (q − 1) } ;
iq := { q^-1 mod p } ;
pp := p × t ;
dpp := dp + r1 × (p − 1) ;
Spp := m^dpp mod pp ;
if pp ≢ 0 [mod p] ∨ dpp ≢ dp [mod p − 1] abort with error ;
qq := q × t ;
dqq := dq + r2 × (q − 1) ;
Sqq := m^dqq mod qq ;
if qq ≢ 0 [mod q] ∨ dqq ≢ dq [mod q − 1] abort with error ;
Sp := Spp mod p ;
Sq := Sqq mod q ;
S := Sq + q × (iq × (Sp − Sq) mod p) ;
if S ≢ Spp [mod p] ∨ S ≢ Sqq [mod q] abort with error ;
Spt := Spp mod t ;
Sqt := Sqq mod t ;
dpt := dpp mod (t − 1) ;
dqt := dqq mod (t − 1) ;
if Spt^dqt ≢ Sqt^dpt [mod t] abort with error ;
return S ;

Attack success condition:

S ≠ @ ∧ (S ≡ @ [mod p] ∨ S ≡ @ [mod q])

Reduced computation

q × (-(m^{e⁻¹ mod (q − 1)} mod q) + m^{e⁻¹ mod (p − 1)} × q⁻¹ mod p) + (m^{e⁻¹ mod (q − 1)} mod q)