Power analysis infers computational behavior or secrets by observing a device’s power consumption. During RSA exponentiation, square-and-multiply can produce visibly different power levels because multiplication consumes more resources than squaring, allowing an observer to associate operations with exponent bits and recover a private exponent. section 10.4.2
A practical attack and its main limitation:
- Attach an oscilloscope between the power source and the target device, then inspect the exponentiation trace. section 10.4.2
- Distinguish multiplication from squaring and map the differing operations to 1 and 0 bits in the private exponent. section 10.4.2
- Account for noise and difficulty isolating operations on superscalar processors; machine learning increasingly automates that analysis. section 10.4.2
Constant-operation defense
The Montgomery powering ladder performs one multiplication, one squaring, and one swap for every exponent bit, regardless of whether the bit is 0 or 1. It produces the same result as square-and-multiply while reducing operation-dependent power differences. section 10.4.2
