1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
alarms are not acceptable (e.g. tot test can block the smart card, so the revision by
the producer is required for reusing it). Therefore the ranges of deviations from the
ideal randomness have to be set very carefully to do not decrease the security of the
system, but also do not block the TRNG by fake alarms. This is task is even more
difficult for short sequences of random bits tested inside the TRNG.
5.5 Attacks against TRNG
The main attacker’s goal of a cryptographic algorithm or implementation is to reveal
some part or even the whole secret key and then decrypt easily any encrypted
message. Attacking RNGs has a different motivation than finding the key. Inside
cryptographic systems the RNG plays crucial role in generation of secret keys, session
keys, etc. A random key is the outcome of the generation process. Therefore the
target of the attack is not only the generated value of the secret key but also any
information making possible to predict the succeeding or preceding values of the
keys.
In case of successful attack, the generated values may not be random anymore
and can be constant or strongly biased or attacker knows the algorithm for their
correct prediction with high probability. By this approach one tries to change the
random behaviour of the TRNG to deterministic one, or at least change the proba-
bility distribution of the generated sequence.
In case of PRNG, the knowledge of the seed or internal status can lead to breaking
the generator because its structure is usually known and public. In case of well-
deigned TRNG the information about actual internal status does not provide any
information about the previous or following one. Therefore focus of the attack is the
source of noise and randomness extraction method rather than the internal status
of the TRNG.
Attacks on cryptographic systems (including RNG) can be divided into algorith-
mic and implementation attacks.
Algorithmic attacks The first group of attacks, the algorithmic attacks, includes
mathematical analysis of the mechanism for randomness extraction or the structure
of the PRNG and does not require any access to the attacked unit. The analysis
can be used especially against PRNG designs with non-properly designed way of
obtaining the seed value [69]. If seed contains low level of entropy, then the output
of the generator has statistical properties not comparable to the random sequence
91