Imagine you're a bank teller counting cash. You count the stack once, get $5,000. To catch errors, you count it again — but if both counts use the same tired brain at 4:59 PM, a systematic miscount (skipping every fifth bill) hits both passes identically. The only way the double-count actually catches faults is if the two passes are genuinely independent — different person, different method, different moment. That's the core mechanism of DM-RSA-OAEP: two RSA moduli on physically separate hardware, where fault detection works because the two computations can't fail in the same way simultaneously. The committed claim: DM-RSA-OAEP is the first formally treated dual-modulus RSA variant with (a) a complete IND-CCA2 security proof in the random-oracle model and (b) a provable fault-detection theorem under an explicit physical-diversity assumption. The original DM-RSA was broken by Håstad's broadcast attack and carried an incorrect claim about tolerating key compromise. This paper repairs both problems and is honest about what remains: this is a fault countermeasure, not a computationally stronger RSA. The security proof works via a two-step hybrid argument. You start with two independent RSA-OAEP instances operating under different moduli. The hybrid strips away one instance at a time, showing that breaking DM-RSA-OAEP requires breaking at least one of the underlying RSA-OAEP instances. The security bound is explicitly upper-bounded by the weaker of the two instances, with a stated simulation loss. This is textbook-grade reduction — clean, but not pushing any frontier in proof technique. The fault-detection theorem is where the real contribution lives. The adversary model covers three fault categories: computation faults (corrupted intermediate values), key faults (tampered private key material), and verification faults including safe-error attacks, where an attacker injects a fault and observes whether the output changes to learn secret bits. Under the physical-diversity assumption — meaning the two moduli are computed on genuinely independent hardware — any single-point fault is caught by the cross-check between the two computations. The paper is commendably explicit that if this diversity assumption fails (common-mode faults on a single chip), the countermeasure degrades to uselessness. Positioning against prior work is careful. The paper maps itself against the broader RSA fault-countermeasure landscape: Shamir's single-modulus check, Vigilant's improved verification, and the broken dual-modulus literature (the original DM-RSA). It does not claim to outperform these on computational efficiency or key size — the selling point is strictly the detection guarantee's formal rigor. The ladder here is about proof quality, not performance numbers. The integrity profile is strong for a 9-page theory paper. The security proof is a mathematical reduction, not a simulation — which means the validation is as solid as the random-oracle model itself (a well-understood assumption with known limitations). No benchmarks to cherry-pick; no datasets to overfit. The weakness is the absence of any implementation-level validation: no hardware prototype, no side-channel measurements, no timing data. The measurement protocol described is a specification, not a result. The obvious next experiment is a physical implementation on actual dual-chip hardware with fault-injection testing — laser glitching, voltage glitching, EM fault injection. The authors describe a measurement protocol but did not execute it. The honest read: this is a theory paper by design, and the physical validation is a separate (expensive, lab-intensive) project. It's not hidden — it's scoped out. But until someone builds it and faults it, the detection guarantee remains a theorem, not an empirical fact.
