Lattice-Based Signature Schemes and their Sensitivity to Fault Attacks
Nina Bindel and Johannes Buchmann and Juliane Krämer Technische Universität Darmstadt, Germany Email: {nbindel, buchmann, jkraemer}@cdc.informatik.tu-darmstadt.de
June 10, 2016 Technology (NIST): in 2015, NSA advertised lattice-based cryptography over elliptic curve cryptography [25] and in Abstract Due to their high efficiency and their strong security properties, lattice-based cryptographic 2016, NIST announced to start a standardization process schemes seem to be a very promising post-quantum for post-quantum cryptography [26]. These developments replacement for currently used public key cryptogra- show that post-quantum cryptography is standing on the phy. The security of lattice-based schemes has been edge of being used in practical applications. deeply analyzed mathematically, whereas little effort Lattice-based constructions promise to be a valuable has been spent on the analysis against implementa- post-quantum replacement for current public-key cryp- tion attacks. tography because of their broad applicability, their high In this paper, we start with the fault analysis of one of the most important cryptographic primitives: efficiency, and their strong security properties. However, signature schemes. We investigate the vulnerabil- when novel cryptographic schemes are brought into prac- ity and resistance of the currently most efficient tice, their mathematical security is not sufficient. Physical lattice-based signature schemes BLISS (CRYPTO attacks which target cryptographic schemes while they are 2013), ring-TESLA (AfricaCrypt 2016), and the GLP being executed also have to be considered to provide the scheme (CHES 2012) and their implementations. We desired level of security. For lattice-based cryptographic consider different kinds of (first-order) randomizing, schemes, until now, little effort has been spent in analyzing zeroing, and skipping faults. For each of the signature their vulnerability against such attacks. While lately the schemes, we found at least six effective attacks. research on side channel attacks has advanced [8], [28], To increase the security of lattice-based signature schemes, we propose countermeasures for each of there are no results on fault attacks against schemes over 1 the respective attacks. general lattices yet . Hence, the natural question arises Keywords. lattice-based cryptography, signature whether lattice-based primitives and their implementations scheme, fault attack, side channel analysis are vulnerable against fault attacks. 1) Contribution: In this paper, we start to investigate A preliminary version of this papers appears in the the vulnerability of lattice-based cryptography towards proceedings of FDTC 2016. This is the full version of fault attacks. We analyze signature schemes and their the paper, appearing as IACR ePrint Archive Record implementations and scrutinize whether certain schemes 2016/415. or instantiations thereof are more vulnerable than others. I.INTRODUCTION We consider the signature schemes BLISS [12], ring- TESLA [1], and the GLP scheme [17], since these are the Since the invention of Shor’s algorithm, which solves most promising ones with respect to efficiency, i.e., run- the discrete logarithm and the integer factorization prob- time, signature sizes, and key sizes. Concerning the faults lem in polynomial time using quantum computation, most that we consider, we focus on first-order fault attacks, of our daily used public key cryptography is on threat as regarding randomizing2, skipping, and zeroing faults. We soon as large enough quantum computers can be built. Due explore the reasons for the vulnerability and resistance, to the expectable development of large quantum computers respectively, of the key generation, sign, and verification in the near future, research on cryptographic construc- tions which are secure even in the presence of large quantum computers - called post-quantum cryptography 1A few results for fault attacks on NTRU-lattices and -schemes exist, e.g., [19]. These cannot be transfered to signature schemes over non- - has seen a boost in recent years. This is also reflected NTRU lattices which are used nowadays. in two current announcements by the National Security 2We do not analyze bit flips separately since they are either covered Agency (NSA) and the National Institute of Standards and by randomization faults or in practice considered as unrealistic [16]. algorithms. Furthermore, we propose countermeasures for lattice-based schemes with respect to fault attacks. In each of the developed attacks. standard-lattice-based schemes the underlying lattice is m×n To reduce the number of necessary faults, we propose defined by a uniformly sampled matrix A ∈ Zq , a hybrid approach of fault attacks and lattice analysis. whereas ideal lattices can be defined via a polynomial In the three analyzed signature schemes, the secret is a of degree n. The resulting additional structure of ideal n polynomial s ∈ Zq[x]/(x + 1) with small coefficients. lattices leads to much smaller key sizes and better run- The hybrid approach allows an attacker to determine not times. Up to know, mathematical cryptanalysis could not all, but only a necessary amount of the coefficients of exploit the additional cyclic structure of ideal lattices. the secret with the help of faults such that the remaining However, based on our results, we show that ideal-lattice- lattice problem can be solved mathematically. We gen- based schemes are indeed more vulnerable to zeroing erally analyze how many coefficients of the secret must attacks than schemes over standard lattice. Secondly, we be recovered by fault attacks in order to use the hybrid show that instantiating a scheme with common (ideal-) approach for BLISS, ring-TESLA, and the GLP scheme. lattice problems, i.e., choosing the secret polynomial to We apply this approach on our randomization fault attack. be Gaussian distributed, is less vulnerable than more Our research shows that all examined signature schemes efficient instantiations. For example, the GLP scheme and and their implementations are vulnerable to all three kinds BLISS3 are more vulnerable to randomizing faults since of considered fault attacks, since we find effective attacks the coefficients of the secret polynomial are chosen to against each of them. A summary of the analyzed attacks be in {−1, 0, 1} or {−2, ..., 3}, respectively, instead of and the respective vulnerabilities of the three signature Gaussian distributed as it is done for ring-TESLA. This schemes is given in TableI. Note that certain effects can has already been feared from a theoretical perspective [27] be achieved with different kinds of fault attacks, e.g., some and is now shown in this work from the practical point of variables can be zeroed out both with a zeroing fault and view. a skipping fault. Such fault attacks are only listed once We expect that our fault analysis and the proposed in TableI, but mentioned and explained in all relevant countermeasures are not limited to signature schemes, but sections in the remainder of this paper. that they can easily be transfered to most of the existing lattice-based constructions. TABLE I 2) Organization: In Sec.II, we introduce the analyzed COMPARISON OF THE GLP SCHEME,BLISS, ANDRING-TESLA signature schemes, i.e., GLP, BLISS, and ring-TESLA, WITHRESPECTTOTHEIRVULNERABILITYTOTHEATTACKS DESCRIBED IN THIS PAPER.THETABLESHOWSTHEALGORITHMS and explain the hybrid approach for combined fault attacks WHICH THE FAULT ATTACKS TARGET, I.E., KEY GENERATION (KG), and lattice analyses. In Sec. III, we present randomizing SIGNATURE GENERATION (S), ANDVERIFY (V), ANDIFTHE attacks on all three schemes. Skipping attacks for the same SCHEME IS VULNERABLE TO THE RESPECTIVE ATTACK, I.E., schemes are explained in Sec.IV and in Sec.V, their VULNERABLE G, VULNERABLEWITHAHUGENUMBEROFNEEDED FAULTS (G), NOTVULNERABLE H, NOTAPPLICABLE -. vulnerability towards zeroing faults is investigated. We present countermeasures against the attacks and guidelines Fault Attack Algorithm GLP BLISS ring- Section for fault-attack-resistant implementations in Sec.VI and TESLA conclude in Sec. VII. Rand. of secret S GGH III-A HHH Rand. of error S III-B ACKNOWLEDGMENTS Rand. of modulus S HHH III-C Rand. of randomness S HHH III-D This work has been supported by the the German Skip of mod-reduction KG H - H IV-A1 Research Foundation (DFG) as part of project P1 within Skip of addition KG GGG IV-A2 Skip of rejection S (G)(G)(G) IV-B1 the CRC 1119 CROSSING. Skip of addition S GHH IV-B2 Skip of mod-reduction S H - H IV-B3 II.PRELIMINARIES Skip of correct-check V GGG IV-C1 Skip of size-check V GGH IV-C2 A. Notation k Zero. of secret KG G - H V-A Let k ∈ N and n = 2 ∈ N throughout this Zero. of randomness S GGG V-B Zero. of hash value S HHH V-C paper. We define q ∈ N to be a prime with q = 1 Zero. of hash polynomial V GGG V-D (mod 2n). We denote by Zq the finite field Z/qZ with representatives in −q/2, q/2 ∩ Z. We write (mod q) We show that two commonly used tweaks in the con- struction of lattice-based signature schemes, which are 3We are aware of the fact that the publicly available implementation deployed for efficiency reasons, should only be carefully of BLISS is not to be used for security applications. However, it is one of the most efficient signature scheme implementations. By analyzing applied. First, our analysis shows a difference between the this software, the research community still can gain insights about how vulnerability of ideal-lattice-based schemes and standard- to implement schemes resistant against fault attacks.
2 to denote the unique representative in Zq. Furthermore, B. Description of the Lattice-Based Signature Schemes n we define the rings R = Z[x]/(x + 1) and Rq = In this subsection, we recall the signature schemes that n Pn−1 i Zq[x]/(x + 1) and the sets Rq,[B] = { i=0 aix | we analyze in this work. We describe the GLP scheme by ai ∈ [−B,B] ∩ Z} for B ∈ [0, q/2] ∩ Z and Bn,ω = Güneysu et al. [17], ring-TESLA by Akleylek et al. [1], n Pn−1 i 2 o a = i=0 aix | ai ∈ {0, 1},kak = ω for ω ∈ [0, n]∩ and BLISS by Ducas et al. [12]. We depict the three n Z. We indicate the Euclidean norm of a vector v ∈ R schemes in AppendixB in Fig.3,4, and5, respectively. q 2 2 by kvk. Similarly, we define kak = a0 + ... + an−1 for We follow the notation of the respective figures. Pn−1 i The security of the signature schemes is based on the a = i=0 aix . We denote polynomials by lower case letters (e.g., p) and (column) vectors by bold lower case ring learning with errors (R-LWE), the ring short integer letters (e.g., v). We write matrices by bold upper case solution (R-SIS), or the decisional compact knapsack letters (e.g., M) and the transpose of a matrix M by MT . (DCK) problem. We give formal definitions of the used Via the coefficient embedding, we identify a polynomial problems in Appendix A2. n−1 1) GLP: The secret key consist of two polynomi- a = a0 + a1x + ... + an−1x ∈ Rq with its coefficient T als s, e ← R with ternary coefficients, i.e., with vector a = (a0, . . . , an−1) . Without further mentioning, $ q,[1] coefficients in {−1, 0, 1}; the public key is a tuple of we denote the coefficient vector of a polynomial a ∈ Rq T a ← R and b = as + e (mod q). On input µ, the sign by a. We define rot(a) = (−an−1, a0, . . . , an−2) and $ q 2 n−1 n×n algorithm first samples y1, y2 ←$ Rq,[k]. Afterwards, it Rot(a) = (a, rot(a), rot (a),..., rot (a)) ∈ Zq . hashes the most significant bits of ay + y together with Polynomial multiplication of a, b ∈ Rq is equivalent to 1 2 µ. The signature polynomials z and z are computed. the matrix-vector multiplication Rot(a)b in Zq. For values 1 2 a, b ∈ , we write a << b if a is much smaller than b. To hide the secret, rejection sampling is applied, i.e., z2 R ? All logarithms are in base 2. is compressed to z2 and the signature is returned only with some probability (see [21] for further information Let d ∈ N, c ∈ Z. We denote by [c]2d the unique repre- on the rejection sampling). The verification algorithm d d−1 d−1 ? sentative of c modulo 2 in (−2 , 2 ]∩Z. Let b·ed be checks the size of z1 and z2 and the equality of c and d ? the rounding operator b·e : → , c 7→ (c − [c] d )/2 . d Z Z 2 H az1 + z2 − bc d,q , µ . Güneysu et al. [17] state the We naturally extend these definitions to vectors and poly- parameter set GLP-Set-I with n = 512 and q = 8383489. nomials by applying b·ed and [·]2d to each component This instantiation of the DCK gives a hardness of at least of the vector and to each coefficient of the polynomial, 80 bit [12]. respectively. We abbreviate v (mod q) d by bved,q. 2) ring-TESLA: The secret key sk is a tuple of three polynomials s, e1, and e2 with small coefficients; the pub- Let σ ∈ R>0. The centered discrete Gaussian distri- lic key vk consists of the polynomials a1, a2 ←$ Rq, b1 = bution Dσ on Z with standard deviation σ is defined a1s + e1 (mod q), and b2 = a2s + e2 (mod q). During as follows: For every z ∈ Z the probability of z is −z2 signing a message µ, a random polynomial y ←$ Rq,[B] is given by ρσ(z)/ρσ(Z), where ρσ(z) = exp( 2σ2 ) and 0 P∞ sampled. Afterwards, the hash value c of the most signif- ρσ(Z) = 1 + 2 ρσ(z). We denote by d ← Dσ the z=1 icant bits of the products a1y and a2y and µ is computed operation of sampling an element d with distribution Dσ. and encoded as the polynomial c ∈ Bn,ω. The signature σ When writing v ← Dn we mean sampling each coefficient σ of µ consists of c0 and the polynomial z = y + sc. Before of a polynomial v Gaussian distributed. For a finite set S, returning the signature, rejection sampling is applied. For we write s ← S to indicate that an element s is sampled $ verification of the signature (c0, z), the size of z and the uniformly at random from S. 0 equality of c and H(ba1z − b1ced,q , ba2z − b2ced,q , µ) is checked, where c is again the encoded polynomial of Let n ≥ k > 0.A k-dimensional lattice Λ is a 0 n c . Akleylek et al. [1] proposed the parameter set ring- discrete additive subgroup of R containing all integer linear combinations of k linearly independent vectors TESLA-II to achieve 128-bit hardness from the underlying k R-LWE problem: n = 512, σ = 52, q = 39960577. The {b1,..., bk} = B, i.e., Λ = Λ(B) = {Bx | x ∈ Z }. The determinant of a lattice is defined by det(Λ(B)) = scheme ring-TESLA is strongly based on the standard- pdet (B>B). The basis is not unique for a lattice and lattice-based scheme TESLA by Alkim et al. [4]. moreover, the determinant of a lattice is independent of the 3) BLISS: The key pair is chosen NTRU-like, i.e., the 2g+1 basis. Throughout this paper we are mostly concerned with public key is vk = (a1, a2) = 2 f (mod q), q − 2 , q-ary lattices. Λ ∈ n is called a q-ary lattice if q ⊂ Λ Pn−1 i Z Z where f, g ←$ Fd1,d2 = { i=0 hix |hi ∈ m×n for some q ∈ Z. Let A ←$ Zq . We define the q-ary {−2, −1, 0, 1, 2}, |{hi = ±1}| = d1, |{hi = ±2}| = d2} ⊥ n lattices Λq (A) = {x ∈ Z | Ax = 0 (mod q)} and and f is invertible modulo q. The secret key sk consists n m > T T Λq(A) = {x ∈ Z | ∃s ∈ Z s.t. x = A s (mod q)}. of sk = (s1, s2) = (f, 2g + 1) . Furthermore, the
3 T vectors (a1, a2), (s1, s2) , and ξ ∈ Z are chosen such To compute the minimal value of k, we first choose the T that (a1, a2)(s1, s2) = q = −q (mod 2q), ξ(q − 2) = time T (in seconds) how long the LWE solver should run, 1 (mod 2q), and hence ξ(a1, a2) = (ξa1, 1) (mod 2q). e.g., one day T = 86400. Afterwards, we compute the To sign a message µ, random vectors y1 and y2 are corresponding Hermite delta by the estimation made by sampled with Gaussian distribution. A hash value c is Linder and Peikert [20] computed from the randomness, the public key, ξ, and 1.8 log (δ(T )) = . (1) the message µ. Afterwards, the value b ←$ {0, 1} is 2 log (T ) + 110 b 2 chosen, the polynomials z1 = y1 + (−1) s1c and z2 = b y2+(−1) s2c are computed, rejection sampling is applied, The Hermite delta is a measurement for the quality of ? a basis reduction, for more information we refer to [20]. and z2 is compressed to z2. During verification of the ? ? Given n, m, and δ and following the embedding approach signature (z1, z2, c), the sizes of z1 and z2 and the equality ? proposed in [15], we can compute the value k. We of c and H ξa1z1 + ξqc(mod 2q) + z (mod p), µ d,2q 2 emphasize that we are aware that the embedding approach are checked. Ducas et al. [12] give two parameter sets is not always the best attack to solve LWE. Nevertheless, to achieve 128-bit hardness of the underlying problem: it yields an upper bound on the number of fault attacks BLISS-I with n = 512, σ = 215, q = 12289 and BLISS- needed. II with n = 512, σ = 107, q = 12289. Furthermore, we like to emphasize that in the instantiations BLISS-I and In the embedding approach the LWE instance is reduced to an instance of the unique shortest vector problem BLISS-II, d2 = 0. Hence, it holds true that (uSVP) [3], [5]. To this end, an embedding lattice Λ {−1, 0, 1} if j = 1, is defined in which the error vector e is embedded. sj,i ∈ {−1, 1, 3} if j = 2, i = 0, Following the explanation by Dagdelen et al. [32], we know that a short vector can be found if {−2, 0, 2} if j = 2, i ∈ {1, ..., n − 1}, 1 dim(Λ) dim(Λ) dim(Λ) Γ(1 + 2 ) 1 Pn i Pn i δ ≤ √ det(Λ) dim(Λ) , (2) where s1 = i=0 s1,ix and s2 = i=0 s2,ix . ||e||τ π C. Description of the Hybrid Approach of Lattice Analysis where τ ≈ 0.4 is constant and Γ(n) is the gamma and Fault Attacks function. In this section, we describe how to combine fault attacks Two different ways to define Λ were proposed, which and algorithms that solve lattice problems such as LWE or are described next. During the standard embedding ap- SIS. Via this combination, which we call hybrid approach, proach we apply a uSVP solver on the lattice Λ = 0! we can reduce the number of faults necessary to receive A2 b (m+1)×(n−k+1) Λq (Ast) with Ast = ∈ Zq . the secret drastically. Revealing all coefficients of the 0 1 secret of a lattice problem with high dimension might Hence, dim(Λq(Ast)) = m + 1 and det(Λq(Ast)) = require a huge amount of fault attacks. Instead, we analyze qm−n+k. Thus, Equation (2) gives the following inequal- that it is sufficient to reveal just enough coefficients with ity: the help of faults to solve the remaining instance with m+1 1 Γ(1 + ) (m+1) algorithms that solve lattice problems, e.g., the embedding δm+1 ≤ √ 2 · qk−n−1. (3) approach. We describe our hybrid approach for the LWE π||e|| · τ problem next. During the dual embedding approach we apply a ⊥ Let As + e = b (mod q) be an LWE instance, with uSVP solver on the lattice Λ = Λq (AD) with m×n n m A ∈ , s ∈ , and e ∈ . Assume that k 0 m×(n−k+m+1) Zq Zq Zq AD = A2|Im|b ∈ Zq . Hence, coefficients of the secret s are known. W.l.o.g., we can dim(Λ⊥(A )) = n−k+m+1 and det(Λ⊥(A )) = qm. assume that the first k coefficients of s are known, since q D q D Thus, Equation (2) gives the samples of an LWE instance can be reordered. Then, n−k+m+1 1 this instance can be written as Γ(1 + ) (n−k+m+1) δn−k+m+1 ≤ 2√ · qk−n−1. (4) T τ · πkek (A1|A2) s1, s2 + e = A1s1 + A2s2 + e = b, Assume that the computations should not run longer than m×k m×(n−k) k with A1 ∈ Zq , A2 ∈ Zq , and s1 ∈ Zq , s2 ∈ a day (resp., a week). By Equation (1) this corresponds n−k 0 0 Zq . Let b = b − A1s1. Thus, A2s2 + e = b (mod to the Hermite delta δ1 = 1.0099 (resp., δ2 = 1.0097). q) defines an LWE instance with the same number m of Finally, given n, m, and δ, we can compute the minimal samples but with a decreased dimension n−k of the secret value for k such that Equation (3) or Equation (4) is vector. fulfilled.
4 0 Applying the hybrid approach to BLISS, ring-TESLA, Hence, in case of a successful fault attack, i.e., si 6= si, and the GLP scheme with δ1 shows that it is sufficient an attacker finds out one coefficient of the secret for each to reveal k = 344, k = 405, and k = 118, respectively, injected fault. To our knowledge, there is no lattice-based instead of all secret coefficients by fault attacks. Given δ2 signature scheme instantiated over binary LWE. However, the minimal values are k = 337, k = 389, and k = 105, recent results on the hardness of binary LWE [2], [10], respectively. Note that the bit-security of the GLP scheme [22] show an interest in this instantiation and also a lattice- is 80-bit, whereas the proposed instantiations BLISS-I, based encryption scheme with binary secret was recently BLISS-II, and ring-TESLA-II give 128 bit of security. proposed [9]. With our description above we stand in line with those being cautious about instantiations of schemes III.RANDOMIZATION FAULTS with binary LWE. 1) Applying the Attack to the GLP Scheme: In this A randomization fault randomly changes the value of a section we describe a generalization of the attack by variable that is processed in the attacked alorithm, i.e., Bao et al. [6] to ternary secret keys, i.e., to secret keys the attacker does not know the value of the variable with coefficients in {−1, 0, 1}. We explain the attack by after the attack, but benefits from knowing that it has applying it to the GLP scheme, since its secret key is been changed within a certain range. Depending on the chosen to be ternary. Furthermore, we assume that the attacker’s abilities, the fault targets the whole variable or attack changes up to r consecutive coefficients instead of only some bytes or bits of it [30]. We analyze the effects of only a single coefficient of the secret. This is generally a randomization fault targeting the secret polynomial (Sec- considered to be a more realistic scenario [16]. tion III-A), the error polynomial (Section III-B), the mod- Assume that an attacker changes r consecutive co- ulus (Section III-C), and the randomness (Section III-D) efficients of the secret s, i.e., s0 = s + ε with ε = during the signature generation. Pj+r i 0 i=j εix , 0 ≤ j < n where all εi, si ∈ {−1, 0, 1}. The attack consists of three steps: inducing a random- A. Randomization of the Secret Polynomial ization fault, querying a signature on some message, σ0 = (z0 , z?, c) = (s0c + y, z?, c) s0 In 1996, Bao et al. introduced a method to attack sig- i.e., 1 2 2 with being nature schemes with binary secret keys [6]. In particular, the faulty secret, and analyzing the output by running a (·) they show how to attack RSA, the ElGamal scheme, software implementation of the algorithm GeneralBao and Schnorr signature schemes. In this section, we first that is depicted in Fig.1. The attacker repeats those three describe how to adjust the attack from [6] to lattice-based steps until sufficiently many coefficients of the secret are Schnorr-like signature schemes instantiated with binary determined such that the hybrid approach described in secret over standard lattices. Afterwards, we describe a Sec. II-C can be applied. more evolved attack on the GLP scheme. The algorithm GeneralBao(·) gets as input the public key, a signature of a message µ, and two lists: the list Take b = As + e (mod q) with s ∈ {0, 1}n and n secret where the determined coefficients of the secret e ← χ, where χ is some error distribution over Z . are saved and the list determined where the information The public key is (A, b) and the secret key consists whether or not a coefficient is already determined is saved. of (s, e). The signature of a message µ is computed as The algorithm GeneralBao(·) returns updated lists secret follows: choose randomness y, compute the hash value and determined. c = H(bAyed,q , µ), compute z = sc + y, and return σ = (z, c). Let α be the difference between the secret s and the faulty secret s0, i.e., α = Pn−1 α xi is a polynomial Assume one coefficient of s is changed via a fault i=0 i with α ∈ {−2, −1, 0, 1, 2}. The attacker checks whether attack, i.e., the secret s0 = (s , ..., s , s0 , s , ..., s )T is i 1 i−1 i i+1 n H(baz + z − bc − aαce , µ) = c with α , ..., α ∈ used to generate a signature. Hence, σ0 = (z0, c) = (s0c + 1 2 d,q i i+r {−2, −1, 0, 1, 2} for i ∈ {0, ..., n − 1 − r}. Thereby, the y, c) is returned as faulty signature of µ. Now, an attacker 0 attacker gains information about the value and index of checks whether H Az − bc − Avi,αc d,q , µ = c, 0 si. The possible values for si, si, and αi are shown in where vi,α is the zero vector except that the i-th entry TableII. is equal to α ∈ {−1, 0, 1}. Depending on the value of α and the index i, the attacker can determine the value of TABLE II 0 si: POSSIBLE COMBINATIONS FOR THE COEFFICIENTS OF s, s , AND α. 0 0 0 then si = s , run attack again, s 0 0 0 1 1 1 -1 -1 -1 i i If α = 1 then si = 1, si 0 1 -1 0 1 -1 0 1 -1 α = s0 − s 0 -1 1 1 0 2 -1 -2 0 −1 then si = 0. i i i
5 As indicated by Fig.1, the procedure GeneralBao(·) the whole secret via the hybrid approach. Hence, next we distinguishes between five different cases for each coef- analyze the expected number of faults that we have to ficient of α once the correct values of α0, ..., αn−1 are induce to determine k = 118 coefficients of s. We assume found. that the index of the first of the r changed coefficients is chosen uniformly random in {0, ..., n−1}. Since r << n, 2 then s = −1, we assume that the changed (and hence the determined) i coefficients are uniformly distributed over all coefficients −2 then si = 1, s , ..., s . Assume the j-th fault attack is induced after If α = 1 then s = 1 or s = 0, 0 n−1 i i i i coefficients have already been determined uniquely. j −1 then si = −1 or si = 0, Then the number of newly determined coefficients after 0 512−i 0 then s = s . 2 j−1 i i the j-th fault attack is given by 9 r n , since n is the number of coefficients of s and following TableII, the In the latter cases, the attacker can not determine s i probability that a coefficient is changed such that it can uniquely. Let s be a coefficient which was changed during j be determined uniquely is 2/9. Assume the fault attack a fault attack such that α = α = ±1. Assume that s is j,1 j j targets one byte. Since each coefficient can be saved in changed again by another fault attack with difference α . j,2 two bits, this corresponds to four changed coefficients, Then the attacker can determine s uniquely if α 6= α j j,1 j,2 i.e., r = 4. Hence, solving the following equation for m and α 6= 0. The list determined is used for exactly this j,2 gives us the number of m = 151 (expected) needed faults purpose: to remember which coefficients were changed but to determine k = 118 coefficients of the secret s: could not be determined uniquely. m X 2r 512 − ij−1 · ≥ k, 9 512 GeneralBao(·): j=1 ? Input: σ = (z1, z2 , c), µ, vk = (a, b), list determined, list secret; with i = 0. In case r = 1, the expected number of needed signature σ is computed with a faulty secret 0 fault attacks to uniquely determine k = 118 coefficients of Output: determined, secret Pn−1 i s is m = 604. Hence, the generalization to targeting more 1 poly α = 0 #α = i=0 αix 2 For i ∈ {0, ..., n − 1}: coefficients is not only more realistic, but also needs a 3 For αi ∈ {0, −2, −1, 1, 2}: much smaller number of fault attacks. On the other hand 4 For αi+1 ∈ {0, −2, −1, 1, 2}: the runtime of the software to find the polynomial α is 5 ... longer, since it takes 512 · 5r times the runtime of the 6 For α ∈ {0, −2, −1, 1, 2}: i+r hash query for every fault attack. 7 If H(baz1 + z2 − bc − aαced,q , µ) = c : 2) Application to BLISS: As described in Sec. II-B3, 8 For j ∈ {i, ..., i + r}: the secret keys of the instantiations BLISS-I and 9 If α = 2 : 4 j BLISS-II are two polynomials s1, s2 with ternary-like 10 secret[j] = −1, determined[j] = 2 instantiation. Therefore, the attack on the 128-bit instanti- 11 If α = −2: j ations of BLISS can be described in a similar manner as 12 secret[j] = 1, determined[j] = 2 it was done for the GLP scheme. 13 If αj = −1 : 14 If determined[j] = 1: As before, assume r coefficients are changed during 15 secret[j] = 0, determined[j] = 2 a fault attack. We assume that the coefficients of the 16 Else: faulty secret polynomial(s) are in the set {−3, ..., 3}, 17 determined[j] = −1 since it can be assumed that each coefficient is saved 18 If αj = 1 : Pn−1 i in three bits. Let α = i=0 αix . Given a faulty sig- 19 If determined[j] = −1 : nature σ = (z , z?, c) of the message µ, the attacker 20 secret[j] = 0, determined[j] = 2 1 2 runs an algorithm similar to GeneralBao(·), Fig.1. The 21 Else: 22 determined[j] = 1 only difference is that the values of α lie in different 23 Return determined, secret intervals: in case the fault was induced on s1, the at- ? tacker checks H bξa1z1 + ξqc − ξαced,2q + z2, µ = c
for αi1 , ..., αir ∈ {−4, ..., 4} for i1, ..., ir ∈ {0, ..., n − 1}. Fig. 1. Algorithm to compute coefficients of the secret given a In case the fault was induced on s2, the attacker signature computed with a faulty secret where maximal r of the coefficients are changed by a randomization fault 4For the higher-security instantiations BLISS-III and BLISS-IV, d2 ∈ {0.03, 0.06}, i.e., there are a very few coefficients outside As described in Sec. II-C, at most k = 118 coefficients {−1, 0, 1}. Hence, extending our attack to those instantiations will of s have to be determined via fault attacks to compute increase the run time, but the attack still weakens the security.
6 ? checks H bξa1z1 + ξqc − αced,2q + z2, µ = c for because the value of the faulty modulus would remain 5 unknown. Furthermore, key and signature generation of αi1 , ..., αir ∈ {−5, ..., 5} for i1, ..., ir ∈ {0, ..., n−1} . As in the attack against the GLP scheme, sometimes the secret lattice-based signature schemes are randomized at several coefficients can be determined uniquely. The probability points by construction. Hence, tools like the Chinese that a coefficient of s1 (resp., s2) is determined uniquely remainder theorem do not give access to the secret. is 2/21 (resp., 4/21). We assume again that the indices of D. Randomization of the Randomness the changed coefficients are distributed uniformly random over the original coefficients. Hence, we roughly estimate As expected, also the randomization of the random the expected number of needed fault attacks by values, e.g., the product ay (or similar) or the hash output m c, does not reveal information that the attacker can use X r 1024 − ij−1 · ≥ k, to forge signatures, because such values look like (or are) 7 1024 j=1 random values by default. with i0 = 0 and notations as in Sec. III-A1. Hence, with IV. SKIPPING FAULTS r = 1 an expected number of m = 2934 faults is needed Skipping faults consist in skipping, i.e., ignoring, se- to determine k = 344 (see Sec. II-C) coefficients of the lected lines of the program code. This can, for example, secret (with r = 4 an expected number of m = 733 is be achieved via CPU clock glitching [7]. By showing needed). We conclude that the attack is less efficient on that even higher-order skipping faults against a real-word BLISS than on the GLP scheme, but it is still applicable. cryptographic implementation are practical, the relevance 3) Application to ring-TESLA: The coefficients of the of this kind of fault attacks has recently been strength- Pn−1 i secret s = i=0 six of ring-TESLA are chosen with ened [7]. Gaussian distributed. Hence, the possible values of α We analyze different ways to exploit skipping faults would be in a very large range. Even if we assume that during the key generation (Section IV-A), the signature the coefficients are with high probability bounded by generation (Section IV-B), and the verification algorithm |si| ≤ σ (with σ = 52 for instantiation ring-TESLA-I), (Section IV-C). In the majority of cases, we explain the the number of needed fault attacks would be huge. Hence, fault attacks using the implementations of the signature this attack does not seem to be a threat for ring-TESLA in schemes. Therefore, we use the publicly available soft- particular and for instantiations with Gaussian distribution ware, i.e., we use the C++-implementation of BLISS [13], in general. the C-implementation of the GLP scheme [18], and the C- B. Randomization of the Error Polynomial implementation of ring-TESLA [1]. Since the implementa- tion of ring-TESLA and the GLP scheme use the benefits A similar attack as described in Sec. III-A could be of the AVX instructions, we sometimes also consider the used to compute the (secret) error polynomial e. Leaking X86 assembly code of respective code lines. e is as bad as leaking s, since s can be computed easily once e is known. Moreover, the success probability of A. During Key Generation most of the mathematical lattice analyses would increase In this section we describe two possible skipping attacks since those algorithms also benefit from reducing the key during the key generation. space from {−1, 0, 1} to {−1, 0} or {0, 1}. However, the 1) Skipping the Modulus Reduction: Let A ← n×m, GLP scheme is not vulnerable to this variant because of $ Zq and s, e are chosen with some distribution over n and its compression and rounding functions, since then the Z m, respectively. Afterwards compute b = As+e without equation H(az + z − bc − aαxic , µ) = c holds for Z 1 2 d,q reducing modulo q. Solving SVP or CVP in the lattice several values of α. Hence, α can not be determined. Λ = {v ∈ n | Aw = v for some w ∈ m} is most often Nevertheless, we mention this attack to raise awareness Z Z much easier than solving the same problem in Λ (A), during the construction and instantiation of schemes. For q since det(Λ) ≥ det(Λ (A)), especially in case A is example, instantiating ring-TESLA (which does not come q invertible. Hence, skipping the modulo operation during with such a compression function) over ternary LWE the key generation algorithm seems to be a security flaw. should be considered very carefully. However, this fault attack is already prevented in the three C. Randomization of the Modulus considered signature schemes. We use the implementation of the GLP scheme to explain the prevention. The randomization of the modulus does not seem to As indicated by Listing1, the value t (corresponding reveal any information that helps to forge signatures, to b in our notation) is computed without the reduction 5 To be exact, in case the fault was induced on s2, the attacker checks step. The modulo operation is performed in the subroutine the hash values for α0 ∈ {−4, ..., 6} and α1, ..., αn−1 ∈ {−5, ..., 5}. poly_pack. Skipping Line 78 of Listing1 thwarts the
7 modulo reduction. Afterwards, only the least 32 bits of compute s, the error vector e will remain unknown. In (the faulty) t are saved in r. Hence, skipping Line 78 the GLP scheme, however, e is used to compute z2. Next leads to a randomization fault on b which does not reveal we describe how an attacker can forge signatures anyway: secret information. the attacker chooses randomness y1, y2, computes the hash 48 poly_mul_a(t, s1); value c for a message µ, z1 = y1 + sc, and z2 = y2 49 poly_add_nored(t, t, s2); (instead of z2 = y2 + ec). The attacker applies rejection 51 poly_pack(pk, t); ? [...] sampling and compresses z2 to z2 as usual and returns 71 void poly_pack(unsigned char r[3 POLY_DEG], ? * the signature σ = (z1, z2, c). The verify algorithm accepts const poly f) 72 { this signature σ as we show in the following. Due to 73 int i; ? the rejection sampling, z1, z2 ∈ Rq,[k−32]. Furthermore, 74 signed long long t; ? 75 for(i=0;i
8 [...] 1) Skipping the Correctness Check: An adversary 107 poly_mul(z1,c,s1); 108 poly_add_nored(z1,z1,y1); chooses c uniformly at random and chooses z (reps., z1 ? 109 poly_coeffreduce(z1); and z2) small enough and of the expected form (e.g., [...] 119 poly_mul(z2,c,s2); correct number of zero-coefficients), such that the size 120 poly_add_nored(z2,z2,y2); check goes through. Afterwards, the attacker computes the 121 poly_coeffreduce(z2); hash value c0. Hence, skipping the correctness check yields Listing 3. C code of the GLP implementation for the computation of an acceptance of the (invalid) signature of any message. the signature values z1 and z2. In the software of ring-TESLA, the correctness check is As before, the assembly code of the respective code implemented as the following single if-condition: lines corresponds to jumping to another operation. Hence, this attack gives the same result as zeroing the whole 378 if(memcmp(c,c_sig,32)) return -1; randomness as described in Sec. V-B, i.e., by skipping where c_sig corresponds to c0 in our notation and one line an attacker knows the secret key. returning -1 corresponds to not accepting a signature. A similar attack is not possible in case of the BLISS or In case of BLISS and the GLP scheme, the correctness the ring-TESLA implementation. We explain the reason checks are implemented as if-conditions for each entry on the example of ring-TESLA. Explanations for BLISS of c, see as an example the respective lines of the GLP can be found in Appendix D2. implementation in Listing5. In the implementation of ring-TESLA the value sc is added to the value y as can be seen in Listing4. Hence, 184 for(i=0;i<20;i++) 185 if(sm[i] != h[i]) skipping Line 323 in Listing4 yields z = y (the value 186 goto fail; vec_y is the output value in the implementation). Since the Listing 5. C Code of the correctness check in the GLP scheme; randomness changes for every run of the sign algorithm, sm[0],...,sm[19] corresponds to c and h corresponds to c0 in the attacker does not learn anything about the secret. our notation; goto fail corresponds to not accepting a signature. 323 poly_add(vec_y, vec_y, Sc); Therefore, the skip has to be realized as a jump out of the for-loop after the first iteration. Hence, the invalid Listing 4. C Code of ring-TESLA for the addition of sc and y. ? signature is accepted as long as c, z1, and z2 are chosen 3) Skipping the Modulus Reduction: Skipping the re- such that c[0] = c0[0]. duction modulo q during the signature generation does 2) Skipping the Size Check: We explain this attack by not reveal information about the secret since during the the example of the GLP scheme. It can similarly be ap- computation of z = y + sc (the only value that is returned plied to BLISS, while ring-TESLA is resistant to this kind and depending on the secret) no modulo reduction is of fault attack. The attack works as follows: the attacker computed in all of the signature schemes. Moreover, the chooses y1, y2 ←$ Rq,[k] and computes the hash value modulo operation is computed very often during the sign c for some self-chosen message. Afterwards, the attacker algorithm, i.e., it is rather difficult to skip all the modulo −1 computes z1 = a (ay1 + bc) (recall that the polynomial operations during the computation via fault attacks. a is invertible) and z2 = y2. Easy computation shows C. During Verification that as long as the size check is skipped, the signature σ = (z , z?, c) To prevent the installation of malicious malware it is 1 2 is accepted. In case of GLP the size check if not enough to use cryptographic signatures for software is again implemented as a simple -condition. This is updates. It is also necessary to ensure that the verification also the case for BLISS, but by construction of the verify if z of these signatures is computed correctly [29]. Hence, we algorithm, two -conditions have to be checked for 1 as analyze fault attacks during the verification algorithm in indicated by Fig.5. However, the attack does not work for this section. We identify two ways to force the acceptance ring-TESLA for the following reason: to accept the signa- 0 0 of an invalid signature for any message µ via skipping ture (z, c) the equation c = H w1 d,q , w2 d,q , µ has 0 attacks. In all three signature schemes that are considered to hold. Therefore wi d,q = baiz − biced,q = baiyed,q in this paper, the verify algorithm consists essentially has be fulfilled for i = 1, 2, i.e., the signature value z of computing a hash value c0, checking whether this is has to fulfill two equations during the verification. During the same as the input value c (called the correctness the attack the value z would be uniquely computed via ? check), and checking whether z (resp., z1 and z2) are a1 or a2. Hence, the probability that z would fulfill both small enough (called the size check). Note that we do equations is very small. not consider skipping the computation of the encoding function of the hash value c, since this would lead to V. ZEROING FAULTS an unallocated value. However, we consider zeroing c in Zeroing fault attacks assume that the attacker can set Sec. V-D. a whole variable or a part thereof to zero. We present
9 zeroing attacks during the key generation, the sign, and the attack. We assume that the coefficients are changed block- (i) (i) verify algorithm. Although it has often been questioned if wise, i.e., the coefficients yj , ..., yj+r are changed for this is a realistic attack scenario, zeroing faults have been i ∈ {1, ..., m} and j ∈ {0, ..., n − 1}, and the attacker realized in practice [23]. In certain cases, zeroing attacks cannot control which block of r coefficients is set to zero. can be realized with skipping attacks, which is why we The idea of the attack is as follows: first the at- refer to SectionIV in the respective cases. tacker induces a zeroing fault on the randomness and checks which of the coefficients were changed to zero A. Zeroing the Secret or Error During Key Generation (we explain later in this section how this is done). (i) Zeroing the error polynomial can be implemented as The attacker collects equations with yj = 0, i.e., skipping addition operations during the key generation. (i) (i) T (i) (sj, ..., s0, −sn−1, ..., −sj+1)(c0 , ..., cn−1) = zj . The Hence, we refer to Sec. IV-A for more information. attacker repeats those steps until the set of n0 ≥ n Similarly, one can zero the secret polynomial. Assume collected equations is sufficient, i.e., every coefficient of that during the key generation a zeroing fault is induced s0, ..., sn−1 is at least once multiplied with a non-zero such that s = 0, hence the value b = e (mod q) is c(ik). Hence, the attacker receives the following system of jk returned and the attacker knows the error polynomial equations, which can be solved uniquely: e. In case of the GLP scheme this is enough to forge T (i1) (in0 ) T C · (s0, ..., sn−1) = (z , ..., z ) , (5) signatures: in case of the GLP scheme, the attacker, know- j1 jn0 ing e, can compute a (valid) signature for any message µ y , y ← R c ← c(i1) ... c(i1) −c(i1) ... −c(i1) by choosing 1 2 $ q,[k] and computing j1 0 n−1 j1+1 ? H(bay1 + y2ed,q , µ), z2 = y2 +ec, and its compression z2 with C = ...... . (i 0 ) (i 0 ) (i 0 ) (i 0 ) as usual. Then z1 = y1 with y1 ←$ Rq,[k−32] (instead of c n ... c n −c n ... −c n jn0 0 n−1 jn0 +1 z1 = y1 + sc). As in Sec. IV-A, easy computation shows ? Next we describe how an attacker can find out which that (z1, z2, c) will be accepted by the verify algorithm. coefficients of the randomness were changed to zero In case of ring-TESLA, signatures cannot be forged in a during the i-th fault attack. The equation z(i) = sc(i) +y(i) similar manner, because a signature (c, z) has to fulfill two is equivalent to z(i) = Rot(s)c(i) + y(i). To simplify the equations in order to be verified correctly: ba1z − b1ced,q (i) (i) explanation we assume w.l.o.g. that c0 = ... = cω−1 = 1 and ba2z − b2ced,q. This only occurs if and only if e1c = (i) (i) and cω = ... = cn−1 = 0. Hence, we can write e2c, which is very unlikely. The attack is not applicable to BLISS since the public value aq = 0 if one of the secret (i) (i) z0 =s0 − sn−1 + ... − sn−ω + y0 polynomials f, g is set to zero. Hence, the attacker gains (i) (i) not additional information. z1 =s1 + s0 − sn−2 + ... − sn−ω+1 + y1 In the publicly available software implementation of ... (6) GLP and ring-TESLA, the key generation and the sign (i) (i) z =sn−1 + sn−2 + ... + sn−ω−1 + y . algorithm do not test whether the keys are of the correct n−1 n−1 form. Thus, the respective attacks would not be detected (i) (i) (i) We define zj = ςj +yj for j = 0, ..., n−1. Since sj ← in the currently available implementations. D√σ, the expectation value of |sj| is given by E[|sj|] = σ 2/π for j = 0, ..., n − 1. Furthermore, since kck = ω, B. Zeroing the Randomness During the Signature Gener- (i) √ ςj is Gaussian distributed with standard deviation ωσ ation (i) p and E[|ςj |] = 2ω/πσ. Via the triangle inequality it In the following, we describe a zeroing attack on the holds that randomness of the signature generation. First, we describe p (i) (i) p the attack on ring-TESLA. Afterwards, we describe sim- B/2 − 2ω/πσ ≤ E[|ςj + yj |] ≤ 2ω/πσ + B/2. ilar attacks on BLISS and the GLP scheme. For the parameter set ring-TESLA-II, i.e., with B = 222 − 1) Description of the Attack Against ring-TESLA: (i) 1, ω = 19, and σ = 52,E[|z |] is given by Throughout this section we use the following notation: j let the secret polynomial be s = Pn−1 s xj. Let j=0 j 102, if y(i) = 0, (z(1), c(1)), ..., (z(m), c(m)) E[|z(i)|] ≈ j be signatures for any mes- j 21 (i) (i) Pn−1 (i) j (i) Pn−1 (i) j 2 , if yj 6= 0. sages with z = j=0 zj x and c = j=0 cj x (i) where cj ∈ {0, 1} for i = 1, ..., m. Furthermore, let Since the difference between the expectation values is y(1), ..., y(m) be the faulty randomnesses with y(i) = very large, we assume that the attacker can unambiguously Pn−1 (i) j (i) j=0 yj x . Finally, let r ∈ {1, ..., n} be the number determine whether or not yj was changed to zero. of coefficients that are changed to zero during the fault The efficiency of the attack depends also on when the
10 zeroing attack was induced on the randomness. If the standard lattices instead of ideal lattices. zeroing is applied before v1 = a1y and v2 = a2y in Fig.4 Let r = n, i.e., the randomness is equal to the zero are computed, rejection sampling is disabled, since then vector. Let the notation and assumptions be as described coefficients of the polynomials z, w1, w2 are very small above. Then the following system of equations gives n·m and will pass the if-condition in Line 17. If the zeroing equations and n2 unknowns and can be solved uniquely: attack is induced after v1 and v2 are (but before z is) T T computed, the rejection condition on z is disabled, but the z(1), ...., z(m) = Rot(s) c(1), ..., c(m) . condition on w and w are the same as in the case without 1 2 Still it is less efficient than in the ring setting, since the zeroing. Hence, the probability of rejection is given by attacker needs to induce at least 3n zeroing faults (again (1 − 2L/2d)2n. For the instantiation ring-TESLA-II, i.e., the factor 3 comes from the rejection probability). In n = 512, d = 23, and L = 2766, the fault attack has to the ring setting with the same assumption r = n, the be repeated with probability roughly 0.508. attacker needs to induce (on average) three zeroing faults The number of needed zeroing faults strongly depends successfully. on the value r. Let m be the number of necessary In case r < n, the attack is in general not applicable successful fault inductions to reveal the secret and let S be to signature schemes over standard lattices, since the the set of equations which will be part of Equation (5). We multiplication of matrices is not commutative, a condition assume that every successful fault induction adds r new that we need in Equation (5). equations to the set S, since the hash value c changes for every sign query. Hence, solving the following equation C. Zeroing the Hash Value During the Signature Gener- for m gives the number of necessary faults: ation m 1 X 1 1 · r − (k − 1) − ≥ n. (7) Zeroing the hash value c during the sign algorithm does 3 2n 2r k=1 not lead to more information about the secret key since only the product sc occurs in the final signature. Hence, m ≥ 3n 3 Thus, r−1/2r , where the factor comes from the the attacker only gets access to the randomness, which rejection probability of 0.34 stated in [1]. Assume the changes for every run of the sign algorithm in BLISS, attacker can set 12 bytes to zero, i.e., r = 4 since each ring-TESLA, and the GLP scheme. Hence, knowledge of coefficient of y can be saved in three bytes, then m = 384. one specific random value does not reveal information to For r = 1, we get m = 1536. successfully forge signatures. However, Alkim et al. [4] In case r = n, i.e., the complete randomness can define the standard-lattice-based signature scheme TESLA be set to zero, only a single successful fault attack is to be deterministic. They use a standard technique to necessary, since then the linear system of equations in transform a probabilistic scheme into a deterministic one Equation (6) can be solved uniquely with high probability. by using a secret seed sec, a pseudo random function The reason is that the rows of a rotation matrix are Z- (PRF), and a pseudo random generator (PRG), i.e., let linearly independent and ±s0, ..., ±sn−1 are independent µ be a message then y ← PRG(PRF (sec|µ)). Zeroing random variables with high probability. the hash value yields information as described below. Let 2) Application to BLISS or the GLP Scheme: The σµ = (zµ = Scµ +yµ, cµ) be the signature of µ. Querying attack can also be applied on BLISS and the GLP scheme. a signature for µ again while inducing a zeroing fault on Assume that the zeroing fault was induced on y1 of the cµ yields the faulty signature σ0 = (z0 = yµ, 0). Thus, GLP scheme. As explained above, we can recover s. the attacker can compute zµ − z0 = Scµ. As described in Afterwards, we can compute e by e = t − as. Because of Sec. V-B3, to determine S uniquely n zeroing faults of this the compression function the attack is not effective if y2 is kind have to be performed. We note that we are aware that faulty. Due to the compression algorithm, a maximum of the success of this attack is highly dependent on concrete six coefficients are in the final signature for the proposed implementations of standardizations and on whether and instantiation. Similarly, we can assume that the zeroing how countermeasures like timestamps are implemented. fault was induced on y1 during the sign algorithm of This issue does not exclusively apply to lattice-based BLISS. As explained above, we can then recover s1 and signatures, but since first steps of standardizing lattice- 7 we can recover s2 by s2 = a1s1. For similar reasons as based crypto are made , we nevertheless like to emphasize for the GLP scheme, the attack does not work effectively to take care about this here. in case y2 instead of y1 is faulty. 7 3) Application to Signature Schemes over Standard- The National Institute of Standards and Technology (NIST) an- nounced the call for quantum-resistant cryptographic algorithms for Lattices: The attack is far less efficient and only appli- new public-key crypto standards at PQCrypto 2016. See https:// cable for r = n when applied to schemes defined over pqcrypto2016.jp for more information.
11 D. Zeroing Fault During the Verification Algorithm Most probably this would lead to a serious efficiency In this subsection, we describe a zeroing attack on the penalty. polynomial computed from the hash value c using the B. Countermeasures Against Skipping Faults pseudo code of ring-TESLA. This attack works similarly We describe countermeasures to prevent the skipping on the GLP scheme and BLISS since they use the same attacks presented in Sec.IV. mechanism as it is used in ring-TESLA, although this is One way to prevent skipping faults addressing the not made explicit in their pseudo code. addition in general is to define a new variable to save The goal of the attacker is to force the verify algorithm the resulting sum, e.g., Listing6. Skipping Line 49 of to accept a (unvalid) signature for a message µ. To this the countermeasure in Listing6 does not lead to a suc- end, the attacker chooses z ← R , computes c0 ← $ q,[B−U] cessful attack since the value b2 would not be allocated H(ba ze , ba ze , µ), and returns (c, z) as signature 1 d,q 2 d,q and a segmentation fault would be triggered. Hence, no of µ. During the verify algorithm, first the value c ← information about the secret is revealed. F (c0) is computed. Assume c was set to zero during a 00 // original // countermeasure fault attacks. Hence, w1 = a1z and w2 = a2z, and c ← 48 poly_mul_a(b, s); poly_mul_a(b1, s); 0 00 49 poly_add_nored(b,b,e); poly_add_nored(b2,b1,e); H(ba1zed,q , ba2zed,q , µ). Thus, c = c and the signature is accepted. Listing 6. Comparison of the original code of the GLP scheme and an example of a countermeasure against skipping the addition during VI.COUNTERMEASURESAND GUIDELINES key generation. We describe countermeasures to prevent fault attacks for A different approach which prevents skipping attacks each kind of attack described in this paper. Additionally to in certain cases is to add secret information to random our guidelines, we refer to the intensive literature about information and not the other way around, e.g., use the countermeasures in general [30]. Note that it is crucial code shown on the bottom of Listing7 instead of the that a countermeasure can not be easily circumvented by original GLP code. Hence, skipping Line 108b in Listing7 another fault attack. Hence, implementations of counter- results in z1 = y1 instead of z1 = y1 + as. Since y1 measures should always consider preventions against all changes for every sign query, the attacker does not gain three kinds of attacks. information about the secret. This is already realized in the implementations of BLISS and ring-TESLA. A. Countermeasures Against Randomization Faults // original One way to prevent the randomization attack described 95a poly_setrandom_maxk(y1); [...] in Sec. III is to check the correctness of the secret key. 107a poly_mul(z1,c,s1); As long as the randomization fault is not implemented as 108a poly_add_nored(z1,z1,y1); 109a poly_coeffreduce(z1); a skipping attack, it can be prevented by simple correct- ness checks or comparisons. Our approach is somewhat //countermeasure −1 95b poly_setrandom_maxk(z1); different: let a be the inverse polynomial of a in Rq, [...] s0 be the faulty secret, s be the original secret, and 107b poly_mul(v1,c,s1); 0 0 108b poly_add_nored(z1,z1,v1); let b = as + e (mod q). Instead of Line8 of the 109b poly_coeffreduce(z1); −1 0 GLP scheme (see Fig.3), we compute z1 = a (b − Listing 7. Comparison of the original code of the GLP scheme and 0 b)c + s c + y1 = sc + y1. Hence, we always return a an example of a countermeasure against skipping the addition of the signature generated with the correct secret key even if randomness during signature generation. the fault attack described in Sec. III occurred. As long as Since our analysis focuses on (and our countermeasures implemented with respect to the guidelines mentioned in protect against) first order fault attacks we assume that an the next section, this countermeasure should not induce attack can not know the content of the cache and induce a vulnerabilities against the described skipping or zeroing skipping fault at the same time. Hence, the countermeasure attacks. A disadvantage of this countermeasure is that described above should prevent first order fault attacks. the public key b has to be given as input, i.e., the key However, a stronger adversary might know the content of sizes are increased. Furthermore, the inverse of a has to the cache, skip Line 95b, and hence can compute s1. We be computed. Similarly to the protection of the secret leave the analysis of this scenario for future work. polynomial, the error term could be protected if necessary. Besides the countermeasures mentioned above, it should Our analysis in Sec. III indicates that aggressive instan- be ensured that only correctly formed or totally random tiations such as DCK or NTRU are more vulnerable to keys are returned. In the following, we describe a method randomization attacks. Hence, instantiating BLISS or the to prevent the skipping attack presented in Sec. IV-A2. GLP scheme over ring-LWE or ring-SIS would strengthen The goal of this attack is to skip operations during the key the security of those schemes with respect to fault attacks. generation algorithm such that the public key is not of the
12 correct form. A faulty b can either be b = as+e ( mod q), Assuming that the zeroing fault is not caused by skip- b = as (mod q), b = e (mod q), or b = 0. To prevent ping or randomizing faults, we can prevent a zeroing returning a faulty b, the additional computations shown in attack by simply checking whether the values of the secret Fig.2 should be implemented for the GLP scheme (and or error polynomial (Sec. V-A), the randomness during similarly for ring-TESLA and BLISS). In case b is not signing (Sec. V-B), the hash value (Sec. V-C), or the encoding polynomial (Sec. V-D) are zero, since we only consider first-order faults in this paper. 1 b = as + e (mod q) ONCLUSION 2 u ←$ Zq VII.C kt−ask+u 3 ν = kek+u In this paper, we analyzed the lattice-based signa- 4 If s = νs ∧ e = νe: ture schemes BLISS, ring-TESLA, and the GLP scheme 5 Return sk = (νs, νe) and their implementations with respect to fault attacks. 6 Else: Furthermore, we presented countermeasures against the 7 Restart key generation described attacks. Hereby, we considered three types of Fig. 2. Pseudo code of a countermeasure to check whether the key faults: randomization, skipping, and zeroing faults. pair is generated correctly: the returned key pair is either of the correct For nine of the 15 considered attacks at least one of form or the secret and the public key do not correspond to each other. the three schemes was vulnerable. We summarize our results in TableI. All three schemes are vulnerable against faulty, ν = 1 and the correct elements s, e are returned. zeroing faults during the sign algorithm, against zeroing In case b is faulty, no security flaw occurs because even faults during the verification, against skipping faults dur- if Line4 is skipped, the secret and the public key do not ing the key generation, against two kinds of skipping faults correspond to each other. Hence, at worst the signer uses during the verification algorithm, and (to a variable extent) the invalid keys to sign messages which can not be verified against skipping faults during the signature generation with the corresponding faulty b. algorithm. Moreover, the GLP scheme is vulnerable to an Due to (Gaussian) sampling of elements, it is rather additional skipping attack during the sign algorithm and difficult to induce a skipping fault to skip the rejection an additional zeroing attack during the key generation. sampling at the right time. Nevertheless, it is advisable to In Table III, we recall the (expected) minimal number of make sure that rejection sampling is applied correctly. In successful faults needed for the respective fault attacks. case of ring-TESLA and the GLP scheme the rejection sampling is implemented as an if-condition such that TABLE III the signature is returned if the if-condition is true. In COMPARISON OF THE GLP SCHEME,BLISS, ANDRING-TESLA WITHRESPECTTOTHEEXPECTEDNUMBEROFSUCCESSFUL assembly code this means, that the signature is returned FAULTS SUCH THAT THE FAULT ATTACK SUCCEEDS.THE TABLE if the zero flag is equal to 1. Hence, when the if- SHOWS THE ALGORITHMS WHICH THE FAULT ATTACKS TARGET, condition is skipped by fault, a signature is returned if I.E., KEY GENERATION (KG), SIGNATURE GENERATION (S), AND and only if the zero flag was set equal to 1 in an earlier VERIFY (V).IFTHESCHEMEISVULNERABLETOTHERESPECTIVE ATTACK, THE NUMBER OF NECESSARY SUCCESSFUL FAULTS IS computation. It is reasonable to assume that this happens GIVEN, OTHERWISEWEWRITE -. with probability 0.5. Hence, formulating the if-condition as it is done for ring-TESLA and the GLP scheme does not Fault Attack Algorithm GLP BLISS ring- prevent the skipping attack completely, but it doubles the TESLA (expected) number of necessary fault injections. In case Rand. of secret, r = 4 S 151 733 - of the BLISS implementation, the rejection sampling is Skip of addition KG 1 1 1 Skip of rejection S ? ? ? implemented as if-condition(s) such that a signature is Skip of addition S 1 - - rejected if the if-condition holds true. Hence, skipping Skip of correct-check V 1 1 1 this if-condition means to skip the rejection sampling. Skip of size-check V 1 1 - Reformulating the if-condition as it is done for ring- Zero. of secret KG 1 - - 8 TESLA and the GLP scheme would make this skipping Zero. of randomness, r = 1 S 1 2 1 Zero. of hash polynomial V 1 1 1 attack much more complicated.
C. Countermeasures Against Zeroing Faults We state that the three signature schemes and their implementations behave rather similar under fault attacks. Zeroing faults can often be categorized as randomiza- However, the different instantiations of the schemes lead tion or skipping faults. Hence, zeroing faults can often be prevented by the countermeasures described in Sec. VI-A 8Since the rejection sampling is applied independently from the and VI-B. randomness.
13 to different vulnerabilities. BLISS and the GLP scheme [9] J. Buchmann, F. Göpfert, T. Güneysu, T. Oder, and T. Pöppel- are more vulnerable to a randomization attack during the mann, “High-performance and lightweight lattice-based public- key generation because of their aggressive instantiation key encryption,” in To appear in IoTPTS 2016.5 [10] J. Buchmann, F. Göpfert, R. Player, and T. Wunderer, “On with ternary secret and error. Moreover, our analysis the hardness of lwe with binary error: Revisiting the hybrid shows that ideal-lattice-based schemes are in general more lattice-reduction and meet-in-the-middle attack,” in International vulnerable to zeroing attacks during the sign algorithm Conference on Cryptology AFRICACRYPT 2016. Springer, 2016, pp. 24–43.5 than standard-lattice-based schemes. We propose effective [11] V. Chandrasekaran, B. Recht, P. A. Parrilo, and A. S. Willsky, countermeasures for each of the analyzed attacks. Most “The convex geometry of linear inverse problems,” Foundations of them are very efficient, since they do not require time- of Computational Mathematics, vol. 12, no. 6, pp. 805–849, 2012. consuming computations. 16 [12] L. Ducas, A. Durmus, T. Lepoint, and V. Lyubashevsky, “Lattice Future Work. This work is a starting point for fault signatures and bimodal gaussians,” in Advances in Cryptology - analysis of lattice-based cryptography. It is not compre- CRYPTO 2013, 2013, pp. 40–56.1,3,4, 17 hensive, e.g., we did not analyze underlying algebraic [13] L. Ducas and T. Lepoint, “Bliss: Bimodal lattice signature computations such as polynomial multiplications and we schemes,” http://bliss.di.ens.fr/.7 [14] L. Ducas and P. Q. Nguyen, “Learning a zonotope and more: did not consider fault attacks targeting these underlying Cryptanalysis of ntrusign countermeasures,” in Advances in computations, e.g., we did not analyze the effects of Cryptology - ASIACRYPT 2012 - 18th International Conference zeroing attacks on the most (or least) significant bits of on the Theory and Application of Cryptology and Information polynomial coefficients or the modulus. Security, Beijing, China, December 2-6, 2012. Proceedings, 2012, pp. 433–450.8 In addition to these ideas for deeper fault analysis, we [15] N. Gama and P. Q. Nguyen, “Predicting lattice reduction,” in leave for future work to compare the original implementa- Advances in Cryptology - EUROCRYPT 2008, 27th Annual tions with implementations that take our countermeasures International Conference on the Theory and Applications of Cryptographic Techniques, Istanbul, Turkey, April 13-17, 2008. into account and to verify the effectiveness of the proposed Proceedings, 2008, pp. 31–51.4 measures by a software simulation. Moreover, since this [16] C. Giraud and E. W. Knudsen, “Fault attacks on signature work focuses on theoretical fault analysis, the practical schemes,” in Information Security and Privacy: 9th Australasian realization of the proposed attacks remains to be done. Conference, ACISP, 2004, pp. 478–491.1,5, 16 [17] T. Güneysu, V. Lyubashevsky, and T. Pöppelmann, “Practical lattice-based cryptography: A signature scheme for embedded REFERENCES systems,” in Cryptographic Hardware and Embedded Systems - CHES 2012, 2012, pp. 530–547.1,3, 16 [1] S. Akleylek, N. Bindel, J. Buchmann, J. Krämer, and G. A. Mar- [18] G. Güneysu, T. Oder, T. Pöppelmann, and P. Schwabe, “Software son, “An efficient lattice-based signature scheme with provably speed records for lattice-based signatures,” https://cryptojedi.org/ secure instantiation,” in International Conference on Cryptology – crypto/index.shtml#lattisigns.7 AFRICACRYPT 2016, D. Pointcheval, T. Rachidi, and A. Nitaj, [19] A. A. Kamal and A. M. Youssef, “Fault analysis of the ntruen- Eds. Springer, 2016, pp. 44–60.1,3,7, 11, 16 crypt cryptosystem,” IEICE Transactions, vol. 94-A, no. 4, pp. [2] M. R. Albrecht, C. Cid, J. Faugère, R. Fitzpatrick, and L. Perret, 1156–1158, 2011.1 “Algebraic algorithms for LWE problems,” Cryptology ePrint [20] R. Lindner and C. Peikert, “Better key sizes (and attacks) for Archive, Report 2014/1018, 2014.5 lwe-based encryption,” in Topics in Cryptology - CT-RSA 2011, [3] M. R. Albrecht, R. Fitzpatrick, and F. Göpfert, “On the efficacy of 2011, pp. 319–339.4 solving LWE by reduction to unique-svp,” in Information Security [21] V. Lyubashevsky, “Lattice signatures without trapdoors,” in and Cryptology - ICISC 2013, 2013, pp. 293–310.4 Advances in Cryptology - EUROCRYPT 2012, 2012, pp. 738– [4] E. Alkim, N. Bindel, J. Buchmann, and O. Dagdelen, “Tesla: 755.3 Tightly-secure efficient signatures from standard lattices,” Cryp- [22] D. Micciancio and C. Peikert, “Hardness of SIS and LWE with tology ePrint Archive, Report 2015/755, 2015.3, 11 small parameters,” in Advances in Cryptology - CRYPTO 2013, [5] S. Bai and S. D. Galbraith, “An improved compression technique 2013, pp. 21–39.5 for signatures based on learning with errors,” in Topics in [23] D. Naccache, P. Q. Nguyen, M. Tunstall, and C. Whelan, “Ex- Cryptology - CT-RSA 2014, 2014, pp. 28–47.4 perimenting with faults, lattices and the DSA,” in Public Key [6] F. Bao, R. H. Deng, Y. Han, A. Jeng, A. D. Narasimhalu, Cryptography - PKC 2005, 2005, pp. 16–28. 10 and T. Ngair, “Breaking public key cryptosystems on tamper [24] O. Nguyen, Phong Q.and Regev, “Learning a parallelepiped: resistant devices in the presence of transient faults,” in Security Cryptanalysis of ggh and ntru signatures,” pp. 271–288, 2006. Protocols: 5th International Workshop Paris, France, B. Christian- 8 son, B. Crispo, M. Lomas, and M. Roe, Eds. Springer, 1998, [25] N. S. A. (NSA), “Cryptography today,” https://www.nsa.gov/ia/ pp. 115–124.5, 16 programs/suiteb_cryptography/, Aug 19, 2015.1 [7] J. Blömer, R. G. da Silva, P. Günther, J. Krämer, and J. Seifert, [26] N. I. of Standards and T. (NIST), “Post-quantum cryptography: “A practical second-order fault attack against a real-world pairing Nist’s plan for the future,” https://pqcrypto2016.jp/data/pqc2016_ implementation,” in 2014 Workshop on Fault Diagnosis and nist_announcement.pdf, Aug 19, 2015.1 Tolerance in Cryptography, FDTC 2014, 2014, pp. 123–136.7 [27] C. Peikert, “How (not) to instantiate ring-lwe,” Cryptology ePrint [8] L. G. Bruinderink, A. Hülsing, T. Lange, and Y. Yarom, “Flush, Archive, Report 2016/351, 2016.2 gauss, and reload – a cache attack on the bliss lattice-based [28] M.-J. O. Saarinen, “Arithmetic coding and blinding countermea- signature scheme,” Cryptology ePrint Archive, Report 2016/300, sures for ring-lwe,” Cryptology ePrint Archive, Report 2016/276, 2016.1 2016.1
14 [29] J. Seifert, “On authenticated computing and rsa-based authentica- outputs (a, ha, si + e) ∈ Rq × Rq, where a ←$ Rq and tion,” in Proceedings of the 12th ACM Conference on Computer e ← χ. and Communications Security, CCS 2005, 2005, pp. 122–127.9 [30] I. Verbauwhede, D. Karaklajic, and J. Schmidt, “The fault attack We state the search and the decisional learning with jungle - A classification model to guide you,” in 2011 Workshop errors problem. on Fault Diagnosis and Tolerance in Cryptography, FDTC 2011, Definition 2 (Ring Learning with Errors Problem): Let 2011, pp. 3–8.5, 12 k [31] J. von Neumann, “Various techniques used in connection with n, q > 0 be integers and n = 2 for some k ∈ N>0 and random digits,” in Monte Carlo Method, ser. National Bureau of χ be a distribution over R. Standards Applied Mathematics Series, A. S. Householder, G. E. Given n, q, and m LWE-samples, the (search) ring Forsythe, and H. H. Germond, Eds., 1951, vol. 12, pp. 36–38.8 [32] Özgür Dagdelen, R. E. Bansarkhani, F. Göpfert, T. Güneysu, learning with errors problem R − LW En,m,q,χ is to T. Oder, T. Pöppelmann, A. H. Sánchez, and P. Schwabe, find the polynomial s. Given n, q, and samples “High-speed signatures from standard lattices,” in Progress in (a1, b1), ..., (am, bm), the (decisional) ring learning with Cryptology – LATINCRYPT 2014, D. F. Aranha and A. Menezes, errors problem is to decide whether b1, ..., bm are chosen Eds., vol. 8895. Springer, 2015, pp. 84–103.4 with the LWE-distribution or whether they are chosen n APPENDIX uniformly random over Zq[x]/(x + 1). A. Extended Definitions and Security Notions Since in this paper we only use the decisional ring In this section, we recall security notions of signature learning with errors problem, we denote this problem schemes. Furthermore, we depict the signature schemes always by LWE. GLP, ring-TESLA, and BLISS in detail in respective figures3,4, and5. The decisional compact knapsack problem is essentially 1) Syntax, Functionality, and Security of Signature the LWE problem with ternary instantiation. Schemes: A signature scheme with key space K, mes- Definition 3 (Decisional Compact Knapsack Problem): k sage space M, and signature space S, is a tuple Σ = Let n, q > 0 be integers with n = 2 for some k ∈ N>0, ψ (KeyGen, Sign, Verify) of algorithms defined as follows. be the uniform distribution Rq,[1], and s ← ψ. We define D (a, ha, si + e) ∈ • The (probabilistic) key generation algorithm on input by s,ψ the distribution which outputs the security parameter 1λ returns a key pair (vk, sk) ∈ Rq × Rq, where a ←$ Rq and e ← ψ. K. We write (sk, vk) ← KeyGen(1λ) and call sk the Given n, q, and samples (a1, b1), ..., (am, bm) the DCK signing key and vk the verification key. problem is to decide whether b1, ..., bm are chosen uni- n • The (probabilistic) signing algorithm takes as input formly random over Zq[x]/(x + 1) or whether they are a signing key sk, a message µ ∈ M, and outputs a sampled with Ds,ψ. signature σ ∈ S. We write σ ← Sign(sk, µ). The R-SIS (also abbreviated by SIS) is defined as • The verification algorithm, on input a verification follows. key vk, a message µ ∈ M, and a signature σ ∈ S, Definition 4 (Short Integer Solution Problem): Let k returns a bit b: If b = 1 we say that the algorithm n, q > 0 be integers and n = 2 for some k ∈ N>0 and χ accepts, otherwise we say that it rejects. We write be a distribution over R. Given a1, ..., am ←$ Rq,[q] the b ← Verify(vk, µ, σ). R-SIS problem is to find a polynomial s ∈ Rq,[q] such We require (perfect) correctness of the signature that a1s + ... + ams = 0 (mod q) and ksk ≤ β ∈ R. scheme: For every security parameter λ, every choice of the randomness of the probabilistic algorithms, every key B. The Analyzed Signature Schemes pair (vk, sk) ← KeyGen(1λ), every message µ ∈ M, and every signature σ ← Sign(sk, µ), Verify(vk, m, σ) = 1 In this section we depict the signature schemes GLP, holds. ring-TESLA, and BLISS in Fig.3,4, and5, respectively. 2) Definition of Lattice-Based Problems: In this sec- tion, we recall definitions and notations of the used lattice- C. Detailed Analysis of the Hybrid Approach based problems, namely the (decisional) ring learning with errors problem (R-LWE), the ring short integer solution In this section, we give a detailed analysis of the hybrid problem (R-SIS), and the decisional compact knapsack approach. problem (DCK). 1) Hybrid Approach Applied to the GLP Scheme: In We start by defining the learning with errors distribution the following, we explain how to find the smallest k and the ring learning with errors problem in the following. possible, such that we can apply the hybrid approach Definition 1 (Learning with Errors Distribution): Let on the GLP scheme. As described in Sec. II-B1, the n, q > 0 be integers, s ∈ Rq, and χ be a distribution error is ternary. Hence, the expected norm of the error is p over R. We define by Ds,χ the R-LWE distribution which ||e|| = 2/3 · n. Furthermore, only a single LWE-tuple
15 KeyGen(1λ) : KeyGen(1λ) :
1 s, e ←$ Rq,[1] 1 a1, a2 ←$ Rq n 2 a ←$ Rq 2 s, e1, e2 ← Dσ 3 b ← as + e (mod q) 3 If checkE(e1) = 0 ∨ checkE(e2) = 0 4 sk ← (s, e), vk ← (a, b) 4 Restart 5 Return (sk, vk) 5 b1 ← a1s + e1 (mod q) 6 b2 ← a2s + e2 (mod q) Sign(µ; a, s, e) : 7 sk ← (s, e1, e2), vk ← (b1, b2) 8 Return (sk, vk) 6 y1, y2 ←$ Rq,[k] 7 c ← H bay + y e , µ 1 2 d,q Sign(µ; a , a , s, e , e ) : 8 z ← y + sc 1 2 1 2 1 1 9 y ← R 9 z ← y + ec $ q,[B] 2 2 10 v ← a y (mod q) 10 If z , z ∈/ R : 1 1 1 2 k−32 11 v ← a y (mod q) 11 2 2 Restart 0 ? 12 c ← H bv1ed,q , bv2ed,q , µ 12 Else: z2 ← compress(az1 − tc, z2, p, k − 32) ? 13 c ← F (c0) 13 Return (z1, z2 , c) ? Verify(µ; z1, z2 , c; a, b) 14 z ← y + sc 0 ? 15 w1 ← v1 − e1c (mod q) 14 c ← H baz1 + z2 − bced,q , µ 0 ? 16 w2 ← v2 − e2c (mod q) 15 If c = c ∧ z1, z2 ∈ Rk−32: 17 If |[w ] d |, |[w ] d | ∈/ R d ∨z 6∈ R : 16 Return 1 1 2 2 2 2 −L B−U 18 Restart 17 Else: Return 0 19 Return (z, c0)
Fig. 3. Specification of the GLP scheme by Güneysu et al. [17]. The 0 rounding operator b·e corresponds to the function used in the original Verify(µ; z, c ; a1, a2, b1, b2) d,q 0 paper with d = log (k), where k is the parameter used in [17]. For 20 c ← F (c ) 2 0 detailed information about the system parameters and the procedure 21 w1 ← a1z − b1c (mod q) compress, we refer to the original work. 22 w0 ← a z − b c (mod q) 2 2 2 23 00 0 0 c ← H w1 d,q , w2 d,q , µ 0 00 24 If c = c ∧ z ∈ RB−U : is given, i.e., m = n. Substituting this in Equation (3) for 25 Return 1 the standard embedding approach, we get the inequality 26 Else: Return 0
n+1 1/(n+1) Fig. 4. Specification of the scheme ring-TESLA by Akleylek et al. [1]. n+1 Γ(1 + 2 ) k−n−1) δ ≤ p · q . (8) For detailed information about the system parameters and the procedure π2/3n · τ checkE, we refer to the original work. Equation (4) for the dual embedding approach corresponds to two, i.e., m = 2n. 2n−k+1 1 Γ(1 + ) 2n−k+1 δ2n−k+1 ≤ 2 · qk−n−1. (9) Next, we explain how to find the smallest k possible, τ · p2/3nπ such that the uSVP can be solved. Equation (3) for the Finally, we can compute that the minimal k such that standard embedding approach gives the inequality for the standard embedding approach above Γ(1 + 2n+1 )1/(2n+1) δ2n+1 ≤ √ 2 · qk−n−1. (10) is fulfilled is 173 and the minimal value such that the π||e|| · τ equation holds for the dual embedding is 118. This is Equation (4) corresponds to roughly the same amount of necessary faults as stated by others [6], [16], who use 160 faulty signatures. Γ(1 + 3n−k+1 )1/(3n−k+1) δ3n−k+1 ≤ √ 2 · qk−n−1. (11) 2) Hybrid Approach Applied to the Signature Scheme π||e|| · τ ring-TESLA: The hybrid-approach applied to the scheme Hence, the minimal values are k = 405 and k = 442 for ring-TESLA is very similar to the one of GLP. The only the standard and the dual embedding approach, respec- difference is the distribution of the error and the number tively. of given LWE-samples. The polynomial e is chosen to be 3) Hybrid Approach Applied to the Signature Scheme Gaussian distributed with standard deviation σ. Hence, the BLISS: Since the signature scheme BLISS is based on the expected length of the corresponding coefficient vector e security of SIS and SIS can be seen as an SVP problem, Γ( n+1 ) √ 2 of dimension n is given by kek = Γ( n ) 2σ. We refer we can apply the hybrid-approach also on BLISS in a 2 to [11] for more details. The number of LWE-samples is slightly different manner. Following the notation in Fig-
16 KeyGen(1λ) A2s2 = −b, where −b = −A1s1. Define the set L = {w ∈ 2n−k | A w = −b (mod q)} = Λ⊥(A ) + u, 1 f, g ←$ Fd1,d2 Z 2 q 2 2 2n−k 2 If Nλ(S) ≥ 5C (dδ1ne + 4d4δ2ne)κ where u ∈ Z such that A2u = −b. Finding s2 ∈ L 3 Restart is equivalent to solving the closest vector problem (CVP): 4 a = (2g + 1)/f (mod q) ⊥ ⊥ q CVP(Λq (A2), u)) = v ∈ Λq (A2), since the vector 5 If f not invertible u − v corresponds to s2. Instead of solving CVP in the 6 Restart ⊥ T T kernel lattice Λq (A2), we can equivalently solve CVP 7 (s1, s2) ← (f, 2g + 1) 2n−k×n−k 8 (a1, a2) = (2aq, q − 2)(mod 2q) in the image lattice Λq A2 , with A2 ∈ Zq 9 sk ← (s , s )T , vk ← (a , a ) ⊥ 1 2 1 2 such that hKer(A2)i = hIm(A2)i. Hence, Λq (A2) = 10 Return (sk, vk) Λq A2 . We solve the CVP by embedding the vector u T Sign(µ; A = (a1, q − 2); S = (s1, s2) ) : in the standard embedding lattice. As before, we define 2n−k+1 11 y1, y2 ← Dσ Λ = Λq(Ast) = {w ∈ Zq | Astx = w (mod 12 u = ξa y + y (mod 2q) ! 1 1 2 n−k+1 A2 u q) for some x ∈ Zq }, with Ast = ∈ 13 c ← H bued,2q , µ 0 1 14 b ←$ {0, 1} 2n−k+1×n−k+1 b Zq , and dim(Λq(Ast) = 2n − k + 1 and 15 z1 ← y1 + (−1) s1c n b det(Λq(Ast) = q . The secret vector s2 is a short 16 z2 ← y2 + (−1) s2c 17 Continue with probability 1/ν vector in this lattice. We can compute the norm as q ? ks k ≤ 2n−k · 5d and d = 154. With these values, 18 z2 ← bued,2q − bu − z2ed,2q mod p 2 2n 1 1 ? k 19 Return (z1, z2 , c) the minimal value for such that Equation (4) is fulfilled is k = 344 if the attack should not run longer than a day. ? Verify(µ; A = (a1, q − 2); z1, z , c) The dual embedding approach is not efficiently applicable 2 20 0 ? for BLISS. c ← H ξa1z1 + ξqc(mod 2q) d,2q + z2 (mod p), µ 21 0 d ? d ? If c = c ∧ ||(z1|2 z2 )||2 ≤ B2 ∧ ||(z1|2 z2 )||∞ ≤ B∞: D. More Details on Some Fault Attacks 22 Return 1 23 Else: Return 0 In this section, we extend our explanations given in the respective sections. Fig. 5. Specification of the scheme BLISS by Ducas et al. [12]. For 1) Skipping Faults During the Key Generation: A detailed information about the system parameters and the definition similar attack as described in Sec. IV-A2 can be applied of Nλ(·), we refer to the original work. The set Fd1,d2 is defined Pn−1 i to ring-TESLA and BLISS. as Fd1,d2 = {h = i=0 hix |hi ∈ {−2, −1, 0, 1, 2}, |{hi ∈ {−1, 1}}| = d1, |{hi ∈ {−2, 2}}| = d2} and ν = a) Explanation for ring-TESLA: Listing8 shows M exp −||Sc||2/(2σ2)cosh(hz, Sci/σ2) . the implementation of the computation of the public key b1, b2. Similarly to the description of the GLP scheme, skipping Line 230 or 232 yields bi = ais. Hence, we can easily compute s. n×2n ure5, let A ∈ Zq be the matrix defined by the rotation 229 poly_mul_fixed(poly_T1,poly_S,poly_a1); matrices of 2aq and q − 2, i.e., A = (Rot(2aq), Rot(a2)) 230 poly_add(poly_T1,poly_T1,poly_E1); 2n 231 poly_mul_fixed(poly_T2,poly_S,poly_a2); and let s ∈ Zq be the coefficient vector of the secret 232 poly_add(poly_T2,poly_T2,poly_E2); polynomials f and 2g + 1, i.e., s0 = f0, ..., sn−1 = fn−1, s=2g0 + 1, sn+1 = 2g1, ..., s2n−1 = 2gn−1. For the Listing 8. C code of the signature scheme ring-TESLA for the instantiation BLISS-I the coefficients are as follows: computation of the public values b1 and b2; the values poly_T1 and poly_T2 correspond to b1 and b2, respectively {−1, 0, 1} if i ∈ {0, ..., n − 1}, By definition of the signature generation of ring-TESLA, si ∈ {−1, 1, 3} if i = n, this is enough to forge signatures. The error polynomials {−2, 0, 2} if i ∈ {n + 1, ..., 2n − 1}, e1 and e2 are not necessary during the sign algorithms since Lines 15 and 16 in Fig.4 can be substituted by with |{s = ±1}| = |{s = ±2}| = d (excluding s ). i i 1 n testing whether the equation baiz − biced,q = baiyed,q Hence,√ the expected norm of s can be approximated by holds for i = 1, 2. ksk = 5d1. b) Explanation for BLISS: The public key of BLISS Assume that we revealed k coefficients of s by fault consists of a polynomial a1 = 2aq = 2(2g + 1)/f, where attacks. Write the equation As = 0 (mod q) as A1s1 + f, g are polynomials with small coefficients. In the C++ n×k 2n−k A2s2 = 0 (mod q) with A1 ∈ Zq , A2 ∈ Zq , implementation of BLISS the public key is computed via k 2n−k s1 ∈ Zq , and s2 ∈ Zq . This can be written as the commands depicted in Listing9.
17 161 conv(pX, sk.s1);} \\ pX=f 162 NTL::conv(aq, pX);} \\ aq=f 163 NTL::inv(aq, aq);} \\ aq=1/f 164 NTL::ZZ\_pE tmp;} 165 conv(pX, -(sk.s2));} \\ pX=-(2g+1) 166 NTL::conv(tmp, pX);} \\ tmp=-(2g+1) 167 NTL::mul(aq, aq, tmp);} \\ aq=-(2g+1)/f Listing 9. C++ code of the signature scheme BLISS for the computation of the public value a1.
Skipping Line 167 in Listing9 yields aq = 1/f. Since a1 = 2aq is part of the public key, f can be recovered easily. Similar to the GLP scheme, skipping an operation in the key generation does not reveal the polynomial g or 2g + 1. However, given f an attacker can forge signatures for any message µ. A general secret-public-key pair of BLISS fulfills the equation a1s1 +(q−1)s2 = q (mod 2q) 2s2s1 for s1 = f and s2 = 2g+1. This can be written as s + q 1 (q − 1)s2 = q (mod 2q). Hence, s2 = q−1 (mod 2q). As long as in the signature generation of BLISS it is not checked whether s2 is of the correct form, signatures computed with the secret key (f, q/q − 1 (mod 2q) will be verified with the public key (2/f, q − 2). 2) Skipping Faults During the Signature Generation: We shortly describe the reason why the attack described in Sec. IV-B2 does not gain any information when it is applied to BLISS. As Listing 10 indicates, the values of y1 and y2 are written in z1 and z2, respectively. Hence, skipping the addition in Lines 148-159 of Listing 10 yields z1 = y1 and z2 = y2. Since the randomness y1, y2 changes for every run of the sign algorithm, this does not reveal information about the secret. Skipping Lines 127- 131 yields z1, z2 with unknown values to the attacker. 126 // Gaussian Sampling 127 for (i=0; i 18