SPA-based Security Evaluation of RSA Implementation in Internet Banking USB Token

Almost all the commercial banks in China use USB Token with RSA-coprocessor tamper-resistant crypto-device to ensure the security of Internet Banking transactions. To evaluate the security of such Tokens objectively, finished practical SPA (Simple Power Analysis) attack on four kinds of USB Token from different suppliers in this paper, and all the correct RSA private keys were gotten successfully although the Tokens use different Montgomery or Sliding-Window implementations. This paper also presents some simple countermeasures against such attack.