Two Operands of Multipliers in Side-Channel Attack⋆

Abstract. The single-shot collision attack on RSA proposed by Han-ley et al. is studied focusing on the difference between two operands of multipliers. There are two consequences. Firstly, designing order of operands can be a cost-effective countermeasure. We show a concrete example in which operand order determines success and failure of the attack. Secondly, countermeasures can be ineffective if the asymmetric leakage is considered. In addition to the main results, the attack by Han-ley et al. is extended using the signal-processing technique of the big mac attack. An experimental result to successfully analyze an FPGA imple-mentation of RSA with the multiply-always method is also presented