Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption
In an effort to circumvent the high cost of standard countermeasures against side-channel attacks in post-quantum cryptography, some works have developed low-cost detection-based countermeasures. These countermeasures try to detect maliciously generated input ciphertexts and react to them by discar...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2024-03-01
|
| Series: | Transactions on Cryptographic Hardware and Embedded Systems |
| Subjects: | |
| Online Access: | https://tches.iacr.org/index.php/TCHES/article/view/11447 |
| _version_ | 1797262218410065920 |
|---|---|
| author | Prasanna Ravi Thales Paiva Dirmanto Jap Jan-Pieter D’Anvers Shivam Bhasin |
| author_facet | Prasanna Ravi Thales Paiva Dirmanto Jap Jan-Pieter D’Anvers Shivam Bhasin |
| author_sort | Prasanna Ravi |
| collection | DOAJ |
| description |
In an effort to circumvent the high cost of standard countermeasures against side-channel attacks in post-quantum cryptography, some works have developed low-cost detection-based countermeasures. These countermeasures try to detect maliciously generated input ciphertexts and react to them by discarding the ciphertext or secret key. In this work, we take a look at two previously proposed low-cost countermeasures: the ciphertext sanity check and the decapsulation failure check, and demonstrate successful attacks on these schemes. We show that the first countermeasure can be broken with little to no overhead, while the second countermeasure requires a more elaborate attack strategy that relies on valid chosen ciphertexts. Thus, in this work, we propose the first chosen-ciphertext based side-channel attack that only relies on valid ciphertexts for key recovery. As part of this attack, a third contribution of our paper is an improved solver that retrieves the secret key from linear inequalities constructed using side-channel leakage from the decryption procedure. Our solver is an improvement over the state-of-the-art Belief Propagation solvers by Pessl and Prokop, and later Delvaux. Our method is simpler, easier to understand and has lower computational complexity, while needing less than half the inequalities compared to previous methods.
|
| first_indexed | 2024-04-24T23:53:37Z |
| format | Article |
| id | doaj.art-071439e967aa4c0b8a193bfb85a899e7 |
| institution | Directory Open Access Journal |
| issn | 2569-2925 |
| language | English |
| last_indexed | 2024-04-24T23:53:37Z |
| publishDate | 2024-03-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | Transactions on Cryptographic Hardware and Embedded Systems |
| spelling | doaj.art-071439e967aa4c0b8a193bfb85a899e72024-03-14T16:24:43ZengRuhr-Universität BochumTransactions on Cryptographic Hardware and Embedded Systems2569-29252024-03-012024210.46586/tches.v2024.i2.795-818Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based EncryptionPrasanna Ravi0Thales Paiva1Dirmanto Jap2Jan-Pieter D’Anvers3Shivam Bhasin4Temasek Laboratories, Nanyang Technological University, Singapore, SingaporeFundep, Belo Horizonte, Brazil; CASNAV, Rio de Janeiro, BrazilTemasek Laboratories, Nanyang Technological University, Singapore, Singaporeimec-COSIC KU Leuven, Kasteelpark Arenberg 10 - bus 2452, 3001 Leuven, BelgiumTemasek Laboratories, Nanyang Technological University, Singapore, Singapore In an effort to circumvent the high cost of standard countermeasures against side-channel attacks in post-quantum cryptography, some works have developed low-cost detection-based countermeasures. These countermeasures try to detect maliciously generated input ciphertexts and react to them by discarding the ciphertext or secret key. In this work, we take a look at two previously proposed low-cost countermeasures: the ciphertext sanity check and the decapsulation failure check, and demonstrate successful attacks on these schemes. We show that the first countermeasure can be broken with little to no overhead, while the second countermeasure requires a more elaborate attack strategy that relies on valid chosen ciphertexts. Thus, in this work, we propose the first chosen-ciphertext based side-channel attack that only relies on valid ciphertexts for key recovery. As part of this attack, a third contribution of our paper is an improved solver that retrieves the secret key from linear inequalities constructed using side-channel leakage from the decryption procedure. Our solver is an improvement over the state-of-the-art Belief Propagation solvers by Pessl and Prokop, and later Delvaux. Our method is simpler, easier to understand and has lower computational complexity, while needing less than half the inequalities compared to previous methods. https://tches.iacr.org/index.php/TCHES/article/view/11447Lattice-based cryptographySide-Channel AttackKyberKey Encapsulation MechanismChosen Ciphertext Attack |
| spellingShingle | Prasanna Ravi Thales Paiva Dirmanto Jap Jan-Pieter D’Anvers Shivam Bhasin Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption Transactions on Cryptographic Hardware and Embedded Systems Lattice-based cryptography Side-Channel Attack Kyber Key Encapsulation Mechanism Chosen Ciphertext Attack |
| title | Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption |
| title_full | Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption |
| title_fullStr | Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption |
| title_full_unstemmed | Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption |
| title_short | Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption |
| title_sort | defeating low cost countermeasures against side channel attacks in lattice based encryption |
| topic | Lattice-based cryptography Side-Channel Attack Kyber Key Encapsulation Mechanism Chosen Ciphertext Attack |
| url | https://tches.iacr.org/index.php/TCHES/article/view/11447 |
| work_keys_str_mv | AT prasannaravi defeatinglowcostcountermeasuresagainstsidechannelattacksinlatticebasedencryption AT thalespaiva defeatinglowcostcountermeasuresagainstsidechannelattacksinlatticebasedencryption AT dirmantojap defeatinglowcostcountermeasuresagainstsidechannelattacksinlatticebasedencryption AT janpieterdanvers defeatinglowcostcountermeasuresagainstsidechannelattacksinlatticebasedencryption AT shivambhasin defeatinglowcostcountermeasuresagainstsidechannelattacksinlatticebasedencryption |