Chosen Ciphertext SPA Attack on Ring-LWE Encryption Scheme : Private Key

PQC 부채널 분석

2019년 07월 17일 (금) 국민대학교 발표자 : 심보연

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 1 / 47 1. 개요

▣ PKC (Public Key Cryptosystem)

RSA, ECC

Smart Car

Factoring and Discrete Logarithms Certificate e-Passport

Key Exchange

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 2 / 47 1. 개요

▣ PKC (Public Key Cryptosystem)

1994 Shor’s algorithm (for quantum computation) Quantum estimated to arrive in the next 10 to 15 years Computer RSA, ECC

Factoring and Discrete Logarithms

49-qubit chip 72-qubit chip 53-qubit quantum computer “Tangle-Lake” “Bristlecone” “Q System One” January 2018 March 2018 January 2019

[1] Peter Williston Shor, “Algorithms for Quantum Computation: Discrete Logarithms and Factoring”, SFCS 1994, pp. 124-134, 1994.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 3 / 47 1. 개요

▣ PKC (Public Key Cryptosystem)

1994 Shor’s algorithm (for quantum computation) Quantum Computer RSA, ECC

Factoring and Discrete Logarithms Lattice-based Code-based

Post-Quantum Cryptography KEM/Encryption Multivariate Hash-based

Signature Isogeny

etc.

[1] Peter Williston Shor, “Algorithms for Quantum Computation: Discrete Logarithms and Factoring”, SFCS 1994, pp. 124-134, 1994.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 4 / 47 1. 개요

▣ PKC (Public Key Cryptosystem) • 2020/2021 : Select algorithms or start a 3rd Round • 2022-2024 : Draft standards available Dec 20, 2016 Formal Call for Proposals

February 24-26, 2016 April 11-13, 2018 August 22-24, 2019

PQCrypto 2016 NIST First PQC NIST Second PQC Standardization Standardization Conference Conference

co-located with co-located with

PQCrypto 2018

January 30, 2019 Second Round Candidates announced (26 algorithms)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 5 / 47 1. 개요

▣ NIST Round 2 Candidates

KEM/Encryption Signature

(9) Lattice-based (7) Code-based (3) Lattice-based FrodoKEM LWE Classic McEliece Goppa qTESLA Fiat-Shamir LAC RLWE NTS-KEM Goppa Crystals-Dilithium Fiat-Shamir NewHope RLWE BIKE Short Hamming FALCON Hash then sign

Round5 LWR/RLWR HQC Short Hamming (4) Multivariate Crystals-Kyber MLWE LEDAcrypt Short Hamming GeMMS HFE Saber MLWR RQC Low rank LUOV UOV Three Bears IMLWE ROLLO Low rank Rainbow UOV NTRU NTRU (1) Isogeny MQDSS Fiat-Shamir

NTRU Prime NTRU SIKE Isogeny (2) Symmetric-based SPHINCS+ Hash Picnic ZKP

https://csrc.nist.gov/CSRC/media/Presentations/Round-2-of-the-NIST-PQC-Competition-What-was-NIST/images-media/pqcrypto-may2019-moody.pdf

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 6 / 47 1. 개요

▣ NIST PQC Standardization

 The selection criteria

 Security

 against both classical and quantum attacks

 Performance

 measured on various “classical” platforms

 Other properties

 Drop-in replacements – Compatibility with existing protocols and networks

 Perfect forward secrecy

 Resistance to side-channel attacks

 Simplicity and flexibility

 Misuse resistance

https://csrc.nist.gov/CSRC/media/Presentations/Round-2-of-the-NIST-PQC-Competition-What-was-NIST/images-media/pqcrypto-may2019-moody.pdf

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 7 / 47 2. Lattice-Based

▣ NIST Round 2 Candidates : Lattice-based

[LP11] [NTRU96]

LWE LWR NTRU

NTRU Prime

FrodoKEM Plain FALCON Round5 NewHope LAC qTESLA Ring

Kyber Dilithium Saber Module

ThreeBears

: Digital Signature : KEM/PKE

[LP11] Richard Lindner and Chris Peikert, “Better Key Sizes (and Attacks) for LWE-Based Encryption”, CT-RSA 2011, pp. 319-339. [NTRU96] Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman, “NTRU: A Ring-Based Public Key Cryptosystem”, ANTS 1998, pp.267-288.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 8 / 47 2. Lattice-Based

※ Convolution product = Polynomial multiplication ▣ SCA on KEM/PKE 공격 대상 공격 연산 공격 유형 대응 기법

Decryption NTRU TA Fixed hash calls [CT-RSA 2007] (Difference in #hash calls)

Decryption [RFID Security 2008] NTRU DPA (Polynomial multiplication) [IEICE 2010] Decryption NTRU SPA, CPA SOCPA Masking, Blinding (Polynomial multiplication) FA [IEICE 2011] Protected Decryption [IEICE 2011] NTRU CA (Polynomial multiplication) FA [Cryptography and Communications 2012] Protected Decryption [IEICE 2011] Random delay, Masking, NTRU Chosen Ciphertext DPA [Microprocessors and Microsystems 2013] (Polynomial multiplication) Insert dummy

[TIIS 2013] Knuth-Yao Sampler Bit scanning SPA Shuffling

Decryption Ring-LWE scheme CPA Masking [ePrint 2014] (Multiplication, addition)

Decryption [CHES 2015] Ring-LWE scheme Chosen Ciphertext SPA (Addition)

[AsianHOST 2016] Decryption Ring-LWE scheme CPA Masking (Multiplication, addition) [J. Cryptographic Engineering 2016] Decryption Ring-LWE scheme CPA Additively Homomorphic Masking (Multiplication, addition) [PQCrypto 2016] Protected Decryption (masking) Ring-LWE scheme TAP Shuffling [CHES 2017] (NTT)

Decryption NTRU SPA, CPA, SOCPA, CA Random Key Rotation [Computers and Electrical Engineering 2017] (Polynomial multiplication)

[Applied Science 2018] FrodoKEM, Lizard Constant-time CDT sampler SPA Look-up table based

Decryption Constant-time, NTRU (NIST Round 1) CA [Applied Science 2018] (Polynomial multiplication) Initialization with a random

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 9 / 47 2. Lattice-Based

※ Convolution product = Polynomial multiplication ▣ SCA on KEM/PKE 공격 대상 공격 연산 공격 유형 대응 기법

Decryption Dummy and memory update, Binary Ring-LWE scheme SPA, DPA [DATE 2018] (Polynomial multiplication) Masking survey [GLSVLS 2018]

FA [IEEE Trans. on Computer 2018]

Encryption FrodoKEM, NewHope Horizontal CPA Shuffling, Insert dummy [HOST 2018] (Multiplication)

Encryption Shuffling, FrodoKEM TAP [SAC 2018] (Multiplication) reduce algorithmic variance

CBA [TCHES 2018]

FA [TCHES 2018]

Decryption NewHope Key reuse based SPA, FA [CT-RSA 2019] (Key mismatch oracle)

Protected Decryption (masking) Ring-LWE scheme TAP Masking [Latincrypt 2019] (NTT)

Decryption LAC, Ramstake Chosen Ciphertext TA [TIS 2019] (Decoding of error correcting code)

Frodo, LAC, Round5, TAP(SAC 2018) + Algebraic [ePrint 2020] NTRU-HPS

Encryption NewHope SPA, TAP Masking + Shuffling [PQCrypto 2020] (Message Encoding)

SPA, Chosen-input SPA, Decryption [TCHES 2020] NTRU Prime Online TAP, Vertical CPA, (Masking, Blinding) + Shuffling (Polynomial Multiplication) Horizontal In-Depth CPA

[TCHES 2020] Round5, LAC, Kyber, Decryption Chosen Ciphertext SPA NewHope, Saber, FrodoKEM (FO transform, decoding ECC)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 10 / 47 2. Lattice-Based

▣ [HOST 2018], [SAC 2018]

 Attack Scenario Alice Bob

Generate 푠푒푒푑

푎 ← 퐺푒푛퐴(푠푒푒푑) ′ ′ 푠, 푒 ← 푠푎푚푝푙푒() 푠 , 푒 , 푒′′ ← 푠푎푚푝푙푒() Single-Trace Attack 푎 ← 퐺푒푛퐴(푠푒푒푑) 푏 = 푎푠 + 푒 (푏, 푠푒푒푑) ′ ′ Public 푏, 푠푒푒푑 , private (푠) 푏 = 푎푠 + 푒′ 푣 = 푏푠′ + 푒′′ (푏′, 푟) 푣′ = 푏′푠 푟 = 푠푎푚푝푙푒′(푣)

푉 = 푅푒푐(푣′, 푟) 푉 = 푅푒푐(푣, 푟)

푠푠푘푒푦 = 푆퐻퐴256(푉) 푠푠푘푒푦 : shared secret key 푠푠푘푒푦 = 푆퐻퐴256(푉)

[1] Aydin Aysu, Youssef Tobah, Mohit Tiwari, Andreas Gerstlauer, and Michael Orshansky, “Horizontal Side-Channel Vulnerabilities of Post-Quantum Key Exchange Protocols”, HOST 2018, pp. 81-88, April, 2018.

[2] Joppe W. Bos, Simon Friedberger, Marco Martinoli, Elisabeth Oswald, and Martijn Stam, “Assessing the Feasibility of Single Trace Power Analysis of Frodo”, SAC 2018, pp. 261-234, August, 2018.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 11 / 47 2. Lattice-Based

▣ [HOST 2018], [SAC 2018]

[HOST 2018] Horizontal Side-Channel Vulnerabilities of Post-Quantum Key Exchange Protocols

[SAC 2018] Assessing the feasibility of single trace power analysis of Frodo

[HOST 2018] [SAC 2018]

Target Scheme FrodoKEM, NewHope FrodoKEM

Matrix Multiplication (퐴푆) Target Operation Matrix-vector Multiplication (퐴푠) Schoolbook Multiplication with Barret reduction (푎푠)

Implementation Hardware (SAKURA-G) Software (ELMO simulation – ARM Cortex M0)

Power Model Hamming Distance Hamming Weight

Divide-and-Conquer Template Attack Attack Type Horizontal Correlation Power Analysis Extend-and-Prune Template Attack

# Traces Single-Trace Single-Trace

Countermeasure Shuffling, Insert dummy Shuffling / reduce algorithmic variance

[ePrint 2020] LWE with Side Information; Attacks and Concrete Security Estimation

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 12 / 47 2. Lattice-Based

※ Convolution product = Polynomial multiplication ▣ SCA on KEM/PKE 공격 대상 공격 연산 공격 유형 대응 기법

Decryption Dummy and memory update, Binary Ring-LWE scheme SPA, DPA [DATE 2018] (Polynomial multiplication) Masking survey [GLSVLS 2018]

FA [IEEE Trans. on Computer 2018]

Encryption FrodoKEM, NewHope Horizontal CPA Shuffling, Insert dummy [HOST 2018] (Multiplication)

Encryption Shuffling, FrodoKEM TAP [SAC 2018] (Multiplication) reduce algorithmic variance

CBA [TCHES 2018]

FA [TCHES 2018]

Decryption NewHope Key reuse based SPA, FA [CT-RSA 2019] (Key mismatch oracle)

Protected Decryption (masking) Ring-LWE scheme TAP Masking [Latincrypt 2019] (NTT)

Decryption LAC, Ramstake Chosen Ciphertext TA [TIS 2019] (Decoding of error correcting code)

Frodo, LAC, Round5, TAP(SAC 2018) + Algebraic [ePrint 2020] NTRU-HPS

Encryption NewHope SPA, TAP Masking + Shuffling [PQCrypto 2020] (Message Encoding)

SPA, Chosen-input SPA, Decryption [TCHES 2020] NTRU Prime Online TAP, Vertical CPA, (Masking, Blinding) + Shuffling (Polynomial Multiplication) Horizontal In-Depth CPA

[TCHES 2020] Round5, LAC, Kyber, Decryption Chosen Ciphertext SPA NewHope, Saber, FrodoKEM (FO transform, decoding ECC)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 13 / 47 2. Lattice-Based

▣ [PQCrypto 2020] Defeating NewHope with a Single-Trace

 Attack Scenario

Alice Bob NewHope : Key Generation Input Output Public key 푏, 푠푒푒푑 , private key (푠) 휇 : secret message 1. Generate 푠푒푒푑 푎 ← 퐺푒푛퐴(푠푒푒푑) 2. 푎 ← 퐺푒푛퐴 (푠푒푒푑) 푠′, 푒′, 푒′′ ← 푠푎푚푝푙푒() 3. 푠, 푒 ← 푠푎푚푝푙푒() 4. 푏 = 푎푠 + 푒 푢 ← 푎푠′ + 푒′ 5. Return (푏, 푠푒푒푑), (푠) 푣 ← 푏푠′ + 푒′′ + 퐸푛푐표푑푒(휇) (푢, ℎ) ℎ ← 퐶표푚푝푟푒푠푠(푣) Single-Trace Attack 푣 ← 퐷푒푐표푚푝푟푒푠푠(ℎ) 휇 ← 퐷푒푐표푑푒(푣 − 푢푠)

푠푠푘푒푦 = 푆퐻퐴퐾퐸256(휇) 푠푠푘푒푦 : shared secret key 푠푠푘푒푦 = 푆퐻퐴퐾퐸256(휇)

[3] Dorian Amiet, Andreas Curiger, Lukas Leuenberger, and Paul Zbinden, “Defeating NewHope with a Single Trace”, PQCrypto 2020, pp. 189-205, April, 2020.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 14 / 47 2. Lattice-Based

▣ [PQCrypto 2020] Defeating NewHope with a Single-Trace 펄스 없으면 공격 성공률 100% Optimization Level 0 Optimization Level 3

Averaged Trace (100) Averaged Trace (1000)

band-pass filter at 1.5 ~ 10 MHz (encoding of a single message bit takes 9 clock cycles, 59 MHz / 9 = 6.56 MHz) reference trace : average 1000 traces for all 256 possible values 256 Reference Traces Single-Trace = Template 47% 펄스  후처리 없어도 99.5% 4% 펄스  2-byte 전수조사  > 99%

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 15 / 47 2. Lattice-Based

▣ SCA on Signature 공격 대상 공격 연산 공격 유형 대응 기법

[Cryptography and Communications 2012] NTRUSign Sign Generation FA

Gaussian Sampling, [CHES 2016] BLISS CA Rejection Sampling

Key Generation, Sign Generation, [FDTC 2016] BLISS, ring-TESLA, GLP FA Verification

[SAC 2016] BLISS, TESLA, GLP, GPV Gaussian Sampling CA

Polynomial multiplication, [ICAR 2016] BLISS Blinding Gaussian Sampling

[ePrint 2017] BLISS Gaussian Sampling SPA, TAP

Rejection Sampling, Gaussian [SAC 2017] BLISS SPA, SEMA, BTA Sampling, Polynomial multiplication

[SAC 2017] BLISS Gaussian Sampling CA

[IACR 2018] Dilithium, qTESLA Sign Generation FA

[EUROCRYPT 2018] GLP Masking

[ICAR 2019] BLISS Rejection Sampling TA

[ePrint 2019] Dilithium Masking

[CARDIS 2019] qTESLA Masking

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 16 / 47 2. Lattice-Based

▣ NIST Round 2 Lattice

[LP11] [NTRU96]

LWE LWR NTRU

NTRU Prime

FrodoKEM Plain FALCON Round5

AsianHOST 2016 NewHope LAC qTESLA Ring (Modular Addition)

Asiacrypt 2020 (Message Encoding) Kyber Dilithium Saber Module KIISC S 2020 (Message Encoding)

ThreeBears KIISC S 2020 (Message Decoding)

KIISC S 2020 (Signature Generation) : Digital Signature : KEM, PKE

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 17 / 47 2. Lattice-Based

▣ Our results

Conference Title / Description

AsianHOST 2016 Chosen ciphertext Simple Power Analysis on software 8-bit implementation of ring-LWE encryption

Single-Trace Attacks on the Message Encoding of Lattice-Based KEMs Asiacrypt 2020 Crystals-Kyber, Saber, FrodoKEM + (LAC, NewHope, NTRU, NTRU Prime) / Message Encoding

NIST Round 2 후보 LAC Key Encapsulation Mechanism에 대한 신규 단일 파형 공격

LAC / Message Encoding

NIST Round 2 후보 격자 기반 KEM NTRU LPRime에 대한 신규 단일 파형 공격 KIISC S2020 NTRU LPRime / Message Decoding

NIST Round 2 후보 마스킹된 qTESLA 전자서명 알고리즘에 대한 단일 파형 공격

qTESLA / Signature Generation

Novel Single-Trace Attack on Countermeasures against Instruction-related Timing Attack - NIST Round 2 LAC and HQC - WISA 2020 LAC, HQC / constant-time BCH decoding

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 18 / 47 2. Lattice-Based

Our results 1 : AsianHOST 2016 ▣ Chosen ciphertext SPA attack on ring-LWE encryption scheme : Private key

 Attack Scenario : Public key

Algorithm. Pseudo-code of Decryption  The adversary can select different ciphertexts (= chosen ciphertexts)

Input 푐෥1, 푐෥2 , (푟෥2) fixed Output Message 푚 푐෥1, 푐෥2, 푟෥2

1. for 푖 = 0 to 푛 − 1 do Chosen 2. 푇퐶 푖 ← 푐෥ 푖 × 푟෥ 푖 1 1 2 푐෥ , 푐෥ 퐷퐸퐶(푐෥1, 푐෥2, 푟෥2) 1 2 3. if 푇퐶1 푖 ≥ 푞 then 4. 푇퐶 푖 ← 푇퐶 푖 푚표푑 푞 1 1 풜 ∶ Adversary 5. end if 푚

6. 푀′[푖] ← 푇퐶1 푖 + 푐෥2[푖] 7. if 푀′ 푖 ≥ 푞 then  The adversary can measure their power consumption during 8. 푚′ i ← 푀′ 푖 푚표푑 푞 decryption operation on 8-bit processor 9. else distinguishable . Modular reduction has occurred Power consumption trace 10. 푚′ i ← 푀′ 푖 11. end if

12. 푚′ ← 푰푵푻푻(푚′) . Modular reduction has not occurred 13. 푚 ← Decode(푚′) 14. end for

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 19 / 47 2. Lattice-Based

Our results 1 : AsianHOST 2016 ▣ Is it possible to distinguish whether a modular operation occurs or not?

O X X O X O X O

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 20 / 47 2. Lattice-Based

Our results 1 : AsianHOST 2016 ▣ Is it possible to distinguish whether a modular operation occurs or not?

 PCDC 푿, 풀 = 흈(푿)/흈(푿 − 풀)

O X X O X O XO

Reference Trace (O)

• 박애선, 원유승, 한동국, “8 비트 구현 Ring-LWE 암호시스템의 SPA 취약점 연구”, 한국정보보호학회 논문지, 2017. • Countermeasure : 박애선, 원유승, 한동국, “Ring-LWE 기반 공개키 암호시스템의 선택 암호문 단순전력분석 공격 대응법”, 한국정보보호학회 논문지, 2017.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 21 / 47 2. Lattice-Based

Our results 2 : KIISC S2020 ▣ LAC

 Attack Scenario

Alice Bob LAC : Key Generation Input Output Public key 푏, 푠푒푒푑 , private key (푠) 휇 : secret message 1. Generate 푠푒푒푑 푎 ← 퐺푒푛퐴(푠푒푒푑) 2. 푎 ← 퐺푒푛퐴 (푠푒푒푑) ′ 휇 ← 퐸퐶퐶퐵퐶퐻(휇) 3. 푠, 푒 ← 푠푎푚푝푙푒() 4. 푏 = 푎푠 + 푒 푠′, 푒′, 푒′′ ← 푠푎푚푝푙푒() 5. Return (푏, 푠푒푒푑), (푠) 푢 ← 푎푠′ + 푒′ (푢, 푣) 푣 ← 푏푠′ + 푒′′ + 퐸푛푐표푑푒(휇′) 휇′ ← 퐷푒푐표푑푒(푣 − 푢푠) 휇 ← 퐸퐶퐶−1 (휇′) Single-Trace Attack 퐵퐶퐻

푠푠푘푒푦 = 퐻퐴푆퐻(휇, 푢, 푣) 푠푠푘푒푦 : shared secret key 푠푠푘푒푦 = 퐻퐴푆퐻(휇, 푢, 푣)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 22 / 47 2. Lattice-Based

Our results 2 : KIISC S2020 ▣ LAC : Message Encoding

Encapsulation

Single-Trace Attack

p_code = 휇′ = 휇 ∥ 푒푐푐 Secret Message 휇 ∈ 0,1 퐼, 퐼 = 256 Error Correcting Code 푒푐푐 ∈ 0,1 푙, 푙 = 144

0푥00 , 푖푓 푝_푐표푑푒 푖 ≫ 푗 ∧ 1 = 0 푚푒푠푠푎푔푒 = ቊ 0푥7푑 , 푖푓 푝_푐표푑푒 푖 ≫ 푗 ∧ 1 = 1

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 23 / 47 2. Lattice-Based

Our results 2 : KIISC S2020 ▣ LAC : Distributions of the PoIs

-O0 -O1 -O2 -O3 -Os

Optimization Level 퐸(퐺1) 퐸(퐺2) 퐸 퐺1 − 퐸(퐺2) 퐸 퐺 > 퐸(퐺 ) -O0 7.7773e-02 6.7497e-02 1.0276e-02 1 2

-O1 1.1788e-02 3.4290e-03 8.3590e-03

-O2 1.0367e-02 1.9882e-03 8.3788e-03 100% 푃푡표푡푎푙 -O3 1.8690e-02 9.5977e-03 9.0923e-03

-Os 3.5680e-03 -6.4983e-03 1.0066e-04 set 0 set 1 k-means clustering algorithm 푖

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 24 / 47 2. Lattice-Based

Our results 3 : KIISC S2020 ▣ NTRU Prime / LPRime

 Attack Scenario Alice Bob

Public key (푝푘), private key (푠푘) Generate a uniform random 풓 퐶 = (푐, 훾) 퐶, 풓 = 퐻푖푑푒(풓, 푝푘, 퐻푎푠ℎ 4 ∥ 푝푘 ) 푎 = 푆푚푎푙푙퐷푒푐표푑푒(푠푘)

퐵 = 푅표푢푛푑푒푑퐷푒푐표푑푒(푐)

푇 = 푇표푝퐷푒푐표푑푒(푐)

푟′ = (푅푖푔ℎ푡 푇 − 푎퐵 + 4푤 + 1 푚표푑 푞)

Single-Trace Attack 풓 = 퐷푒푐표푑푒(푟′)

퐶′, 풓 = 퐻푖푑푒(풓, 푝푘, 퐻푎푠ℎ 4 ∥ 푝푘 )

푠푠푘푒푦 = 푆퐻퐴512(1 ∥ 푟 ∥ 퐶) 푠푠푘푒푦 : shared secret key 푠푠푘푒푦 = 푆퐻퐴512(1 ∥ 푟 ∥ 퐶)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 25 / 47 2. Lattice-Based

Our results 3 : KIISC S2020 ▣ NTRU Prime / LPRime : Message Decoding

 Decrypt Decapsulation

Secret Message 푟 ∈ 0,1 퐼, 퐼 = 256

푟 = 푟0, ⋯ , 푟퐼−1 2, 푟푖 = 푟[푖]

0푥0000 , 푖푓 퐹푞푓푟푒푒푧푒() ≥ 0 푖푛푡16_푛푒푔푎푡푖푣푒_푚푎푠푘() = ቊ 0푥푓푓푓푓 , 푖푓 퐹푞푓푟푒푒푧푒() < 0

0 , 푖푓 푖푛푡16_푛푒푔푎푡푖푣푒_푚푎푠푘() = 0푥0000 푟[푖] = ቊ 1 , 푖푓 푖푛푡16_푛푒푔푎푡푖푣푒_푚푎푠푘() = 0푥푓푓푓푓

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 26 / 47 2. Lattice-Based

Our results 3 : KIISC S2020 ▣ NTRU Prime / LPRime : Distributions of the PoIs

-O0 -O1 -O2 -O3 -Os

Optimization Level 퐸(퐺1) 퐸(퐺2) 퐸 퐺1 − 퐸(퐺2) 퐸 퐺 > 퐸(퐺 ) -O0 7.6411e-02 3.0403e-02 4.6008e-02 1 2

-O1 -4.2961e-02 -7.8910e-02 3.5949e-02

-O2 -6.6894e-02 4.0483e-02 2.6411e-02 100% 푃푡표푡푎푙 -O3 4.9231e-02 2.8530e-02 2.0701e-02

-Os -4.6974e-02 -8.8565e-02 4.1591e-02 set 0 set 1 k-means clustering algorithm 푖

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 27 / 47 2. Lattice-Based

Our results 4 : KIISC S2020 ▣ qTESLA

 Attack Scenario 푁 + 1 Share. 푥 = 푥0 ⊕ ⋯ ⊕ 푥푁, 푥푖 0≤푖≤푁

Public key (푝푘), Secret key (푠푘)

Message 푚, Signature (푆푖푔푛) Alice Bob

푆푖푔푛 푦푖 0≤푖≤푁 ← 푆푎푚푝푙푒() 퐺푒푛푒푟푎푡푖표푛

푣푖 0≤푖≤푁 ← 푎 ∙ 푦푖 0≤푖≤푁 푚, (푧, 푐) 푐 ← 퐸푛푐(퐻 푣푖 0≤푖≤푁 푀, 푚 )

푧푖 0≤푖≤푁 ← 푦푖 0≤푖≤푁 + 푠푖 0≤푖≤푁 ∙ 푐 Single-Trace Attack

푤푖 0≤푖≤푁 ← 푣푖 0≤푖≤푁 − 푒푖 0≤푖≤푁 ∙ 푐

푧 ← 푧푖 0≤푖≤푁

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 28 / 47 2. Lattice-Based

Our results 4 : KIISC S2020 ▣ qTESLA : ML-based TA (Machine Learning based Template Attack)

푠푖[11] START

공격 파형, 서명 값 획득

 학습 파형 생성

학 습 단 계

 학습 파형 ( 곱셈 연산 4개 )

 Label : 풔풊[풋] value 풔 풋 : 16bit 공 격 단 계 풊  Model : MLP 상위 8bit 하위 8bit

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 29 / 47 2. Lattice-Based

Our results 4 : KIISC S2020 ▣ qTESLA : ML-based TA (Machine Learning based Template Attack)

Layer Node (in, out) Kernel initializer START Input Layer (푥, 푥) - Batch Normalization (푥, 푥) - Dense (푥, 64) he_uniform Relu (64,64) - 공격 파형, 서명 값 획득 공격 파형, 서명 값 획득 Batch Normalization (64, 64) - Dense (64,64) he_uniform Relu (64,64) - Batch Normalization (64, 64) - 학습 파형 생성 학습 파형 생성 Dense (64, 256) he_uniform Softmax (256, 256) -

• Input Normalization: all values are within the range of -1 and 1 • Loss function: categorical_crossentropy 학 습 단 계 • Optimizer: Nadam (lr=0.002, epsilon=1e-08) 학 습 단 계 • Label encoding: one-hot encoding • Batch size and epochs: 32 and maximum 100, respectively • #Trace: (training 푇, validation 푉) 100%

공 격 단 계

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 30 / 47 3. Code-Based

▣ NIST Round 2 Code

 QC code based cryptosystem

Algorithm Purpose Code

BIKE KEM QC-MDPC Code HQC KEM-DEM QC & BCH QC code RQC KEM-DEM QC & Gabidulin Goppa code

LEDAkem KEM QC-LDPC QC-LDPC code LEDAcrypt Reed-Solomon codes LEDApkc KEM QC-LDPC QC-MDPC code MDPC codes  other code based cryptosystem LDPC codes

Algorithm Purpose Code • Quasi-Cyclic code Classic McEliece KEM Goppa for saving memory (small key sizes) NTS-KEM KEM Goppa

ROLLO(LAKE, LOCKER, Ouroboros-R) KEM-DEM LRPC

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 31 / 47 3. Code-Based

▣ SCA on KEM/PKE 공격 대상 공격 연산 공격 유형 대응 기법

Decryption [PQCrypto 2008] (Patterson algorithm / TA Raise degree Error locator polynomial)

McEliece Key Generation PA Masking (Generation of parity-check matrix)

Decryption Constant-time operation, MA (Permutation) only public input dependent access

Decryption [ICISC 2009] McEliece (Patterson algorithm / TA Regular operation Error locator polynomial)

Decryption [PQCrypto 2010] McEliece (Patterson algorithm / TA Regular operation Secret permutation)

Decryption [PQCrypto 2010] McEliece (Permutation, syndrome computation, SPA Shuffling, insert dummy, masking syndrome inversion)

FA [FutureTech 2010]

Decryption [J. Cryptographic Engineering 2011] McEliece (Patterson algorithm / SPA Regular operation Error locator polynomial)

Decryption Regular operation, blinding, McEliece TA / FA [J. Cryptographic Engineering 2011] (Root finding) masking

Decryption [J. Cryptographic Engineering 2011] McEliece / Niederreiter (Patterson algorithm / TA Error locator polynomial)

Decryption McEliece TAC [PQCrypto 2013] (Syndrome inversion)

Decryption McEliece SPA Regular operation [RadioElektronika 2015] (Syndrome computation)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 32 / 47 3. Code-Based

▣ SCA on KEM/PKE 공격 대상 공격 연산 공격 유형 대응 기법

Decryption McEliece DPA Masking [RadioElektronika 2016] (Permutation)

Decryption [J. Computers, Communications & Control 2017] McEliece (Patterson algorithm / TA Regular operation Error locator polynomial) survey [ICCCC 2018]

Encryption (Matrix multiplication) / QC-MDPC McEliece TA, SPA Regular operation [PQCrypto 2014] Decryption (Key rotation)

Decryption QC-MDPC McEliece DPA + Algebraic Masking [ACNS 2015] (Syndrome computation / key rotation)

Decryption QC-MDPC McEliece DPA + Algebraic Masking [IEEE Transactions 2016] (Syndrome computation / key rotation)

Decryption QC-MDPC McEliece Masking [SAC 2016] (Syndrome computation, decoder)

Decryption QC-MDPC Regular operation [CHES 2016] (Syndrome computation)

Decryption QC-MDPC DPA + Algebraic Masking [CHES 2017] (Syndrome computation)

Decryption QC-MDPC Masking [TIIS 2019] (Syndrome computation)

Decryption QC DPA, SPA Masking, hiding(mentioned) [TCHES 2019] (Syndrome computation)

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 33 / 47 3. Code-Based

▣ [CHES 2017] A side-channel assisted cryptanalytic attack against QcBits

Syndrome computation 푯 ⋅ 풄⊺

2014 Timing Attack (Simple Power Analysis)

2016 Constant-Time Implementation

2017 Differential Power Analysis on Constant-Time Implementation

Limitation: It could not completely recover accurate secret indices, requiring further solving linear equations to obtain entire secret information

8-bit 16-bit 32-bit 64-bit 80-bit security 0.4 seconds 15 seconds 16 hours ≈ 530 years 128-bit security 2 seconds 4 minutes ≈ 7 days ≈ 790,000 years

It is not feasible on 64-bit processor

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 34 / 47 3. Code-Based

Our results 5 : TCHES 2019 ▣ Multiple-Trace Attack on Constant-Time Multiplication

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ 8-bit word

Correlation Correlation Occurring Power Position Analysis

Word unit rotation 풖풏풓풐풕풂풕풆풅 , 풊풇 풅 = ퟎ 풓풆풔풖풍풕 = ቊ 풊 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ

풓풐풕풂풕풆풅 & ퟎ풙ퟎퟎ ⊕ 풖풏풓풐풕풂풕풆풅 & ퟎ풙풇풇 = 풖풏풓풐풕풂풕풆풅 , 풊풇 풅 = ퟎ 풓풆풔풖풍풕 = ቊ 풊 풓풐풕풂풕풆풅 & ퟎ풙풇풇 ⊕ 풖풏풓풐풕풂풕풆풅 & ퟎ풙ퟎퟎ = 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ

Bit rotation 풓풆풔풖풍풕 = (≪ퟖ−푳)|(≫푳)

0 ≤ 푳 = 풅ퟐ풅ퟏ풅ퟎ ퟐ < 8

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 35 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Multiple-Trace Attack on the Word Unit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ} 풖풏풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟎ Property 1. 풓풆풔풖풍풕 = ቊ 푹 ∈ ퟎ, ퟏ ퟖ 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ 푹풂풏풅풐풎 8-bit word

L S L L L S

푹 푹

16-byte rotate << 푹 16-byte rotate << 푹

푹 is loaded and saved 푹 is only loaded Absolute Correlation Coefficient Correlation Absolute Absolute Correlation Coefficient Correlation Absolute 풅 = (ퟎퟏퟏퟎퟏퟎퟏퟎ)ퟐ 풅 = (ퟏퟏퟏퟎퟏퟎퟏퟎ)ퟐ

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 36 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Multiple-Trace Attack on the Word Unit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ} 풖풏풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟎ Property 2. 풓풆풔풖풍풕 = ቊ 푹 ∈ ퟎ, ퟏ ퟖ 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ 푹풂풏풅풐풎 8-bit word

L L S L L S

푹 푹

4-byte rotate << 푹 2-byte rotate << 푹

same

푑푖+1 푑푖 Absolute Correlation Coefficient Correlation Absolute Absolute Correlation Coefficient Correlation Absolute 풅 = (ퟏퟏퟏퟎퟏퟎퟏퟎ)ퟐ 풅 = (ퟏퟏퟏퟎퟏퟎퟏퟎ)ퟐ

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 37 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Multiple-Trace Attack on the Bit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ} 풓풆풔풖풍풕 = (≪(ퟖ−푳))|(≫푳) 8-bit word 0 ≤ 푳 = 풅ퟐ풅ퟏ풅ퟎ ퟐ < 8

 Guess the 푳 value from 0 to 7 and calculate Pearson’s correlation coefficient between traces and 풓풆풔풖풍풕 values

50 traces are sufficient

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 38 / 47 3. Code-Based

Our results 5 : TCHES 2019 ▣ Single-Trace Attack on Constant-Time Multiplication

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ 8-bit word

Key Simple Bit-dependent Power Attack Analysis

Word unit rotation 풖풏풓풐풕풂풕풆풅 , 풊풇 풅 = ퟎ 풓풆풔풖풍풕 = ቊ 풊 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ

Bit rotation 풓풆풔풖풍풕 = (≪ퟖ−푳)|(≫푳)

0 ≤ 푳 = 풅ퟐ풅ퟏ풅ퟎ ퟐ < 8

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 39 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Single-Trace Attack on the Word Unit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ}  풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ} 8-bit word 풓풐풕풂풕풆풅 & ퟎ풙ퟎퟎ ⊕ 풖풏풓풐풕풂풕풆풅 & ퟎ풙풇풇 = 풖풏풓풐풕풂풕풆풅 , 풊풇 풅 = ퟎ 풓풆풔풖풍풕 = ቊ 풊 풓풐풕풂풕풆풅 & ퟎ풙풇풇 ⊕ 풖풏풓풐풕풂풕풆풅 & ퟎ풙ퟎퟎ = 풓풐풕풂풕풆풅 , 풊풇 풅풊 = ퟏ

169 = 10101001 2 201 = 11001001 2 233 = 11101001 2

 푾 = ퟖ • K-means clustering Key Bit-dependent Property ퟎ풙ퟎퟎ , 풊풇 풅 = ퟎ 풎풂풔풌 = ቊ 풊 • Fuzzy k-means clustering ퟎ풙풇풇 , 풊풇 풅풊 = ퟏ • EM (Expectation-maximization)

• 심보연, 권지훈, 최규영, 조지훈, 한동국, “마스킹된 상수 시간 곱셈을 사용하는 QC 코드 기반 암호 알고리즘에 대한 단일 파형 분석”, 한국정보보호학회 하계학술대회, 2019.

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 40 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Single-Trace Attack on the Bit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ}

8-bit word 풓풆풔풖풍풕 = (≪ퟖ−푳)|(≫푳)

0 ≤ 푳 = 풅ퟐ풅ퟏ풅ퟎ ퟐ < 8

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 41 / 47 3. Code-Based

Our results 5 : TCHES 2019

▣ Single-Trace Attack on the Bit Rotation target

풅 = 풅ퟕ풅ퟔ풅ퟓ풅ퟒ풅ퟑ풅ퟐ풅ퟏ풅ퟎ ퟐ, 풅풊 ∈ {ퟎ, ퟏ}

8-bit word 풓풆풔풖풍풕 = (≪ퟖ−푳)|(≫푳)

0 ≤ 푳 = 풅ퟐ풅ퟏ풅ퟎ ퟐ < 8

Bit rotate Left shift Right shift SPA

(8 − 퐿) times 퐿 times 8-bit word Single bit shift instructions O ((8 − 퐿) clock cycles) (퐿 clock cycles) (8 − 퐿) times 퐿 times 16-bit word Single bit shift instructions O ((8 − 퐿) clock cycles) (퐿 clock cycles) Multiple bit shift instructions 32-bit word One clock One clock X (ex. barrel shifter) Multiple bit shift instructions 64-bit word One clock One clock X (ex. barrel shifter)

 In the cases of 32-bit and 64-bit, we need to solve linear equations to find accurate indices

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 42 / 47 Our results 6 : ePrint 2019 ▣ Vulnerable operations

Loops whose bound is Branches whose condition is input-dependent input-dependent input-dependent memory access

 Constant-time BCH Error-Correcting Code, ePrint 2019-155  Timing Attack on HQC and Countermeasure, ePrint 2019-909

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 43 / 47 4. Multivariate

▣ NIST Round 2 Multivariate

Algorithm Purpose

GeMMS Signature HFE

LUOV Signature UOV

Rainbow Signature UOV

MQDSS Signature Fiat-Shamir

▣ SCA on Signature

[ITTC 2004] On the importance of protecting delta; in SFLASH against side channel attacks

FA [The Computer Journal 2017] On the importance of checking multivariate public key cryptography for side-channel attacks: The case of enTTS scheme

FA [Future Generation Computer System 2018] Side-channel security analysis of UOV signature for cloud-based Internet of Things

[TCHES 2018] Side-Channel Attacks on Post-Quantum Signature Schemes based on Multivariate Quadratic Equations

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 44 / 47 4. Multivariate

Our results 7 : TCHES 2018 ▣ CPA against Rainbow Signature

 Non-invasive attack on MQ-based signature schemes

공격 가정 완화

분석 대상 기존 연구 제안 방법

[The Computer Journal 2017]

Rainbow Signature generation CPA + Fault injection CPA

 (Goal) Recovery the secret maps 푆, ℱ, 푇  (Goal) Recovery the secret maps 푆, ℱ, 푇

enTTS implementation Rainbow and UOV implementation with random linear maps with equivalent keys

Rainbow UOV

CPA + Algebraic

 (Goal) forged signature

Rainbow implementation with random linear maps

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 45 / 47 5. 결론

▣ Conclusion

부채널 분석에 대한 안전성 검증 필요

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 46 / 47 Q & A Q & A

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 47 / 47 PA Power Analysis EMA Electromagnetic Analysis MA Microarchitectural Attack SPA Simple Power Analysis SPAP Simple Power Analysis with Profiling SEMA Simple Electromagnetic Analysis TA Timing Attack TAC Cache Timing Attack (∈ MA) TAP Template Attack (∈ SPAP) CA Collision Attack DPA Differential Power Analysis CPA Correlation Power Analysis CEMA Correlation Electromagnetic Analysis FA Fault Attack DFA Differential Fault Attack CBA Cold Boot Attack

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 48 / 47 2. Lattice-Based

▣ SCA on KEM/PKE

[CT-RSA 2007] Timing attacks on NTRUEncrypt via variation in the number of hash calls

[RFID Security 2008] Power analysis on NTRU implementations for RFIDs: First results

[IEICE 2010] Countermeasures against Power Analysis Attacks for NTRU Public Key Cryptosystem

[IEICE 2011] Fault analysis of the NTRUEncrypt cryptosystem

[Cryptography and Communications 2012] Fault analysis of the NTRUSign digital signature scheme

[Microprocessors and Microsystems 2013] First-order collision attack on protected NTRU cryptosystem

[TIIS 2013] Power analysis attacks and countermeasures on NTRU-based wireless body area networks

[ePrint 2014] Compact and Side Channel Secure Discrete Gaussian Sampling

[CHES 2015] A masked Ring-LWE implementation

[AsianHOST 2016] Chosen ciphertext Simple Power Analysis on software 8-bit implementation of ring-LWE encryption

[J. Cryptographic Engineering 2016] Masking ring-LWE

[PQCrypto 2016] Additively Homomorphic Ring-LWE Masking

[CHES 2017] Single-Trace Side-Channel Attacks on Masked Lattice-Based Encryption

[Computers and Electrical Engineering 2017] Random key rotation: Side-channel countermeasure of NTRU cryptosystem for resource-limited devices

[Applied Science 2018] Single Trace Analysis on Constant Time CDT Sampler and Its Countermeasure

[Applied Science 2018] Single Trace Side Channel Analysis on NTRU Implementation

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 49 / 47 2. Lattice-Based

▣ SCA on KEM/PKE

[DATE 2018] Binary Ring-LWE hardware with power side-channel countermeasures

[GLSVLS 2018] Physical Protection of Lattice-Based Cryptography: Challenges and Solutions

[IEEE Trans. on Computer 2018] Loop-Abort Faults on Lattice-Based Signature Schemes and Key Exchange Protocols

[HOST 2018] Horizontal Side-Channel Vulnerabilities of Post-Quantum Key Exchange Protocols

[SAC 2018] Assessing the feasibility of single trace power analysis of Frodo

[TCHES 2018] Cold Boot Attacks on Ring & Module-LWE Under the NTT

[TCHES 2018] Differential fault attacks on deterministic lattice signatures

[CT-RSA 2019] Assessment of the Key-Reuse Resilience of NewHope

[ePrint 2019] Correlation Power Analysis on NTRU Prime and Related Countermeasures = [TCHES 2020] Power Analysis of NTRU Prime

[Latincrypt 2019] More Practical Single-Trace Attacks on the Number Theoretic Transform

[TIS 2019] Timing Attacks on Error Correcting Codes in Post-Quantum Schemes

[ePrint 2020] LWE with Side Information; Attacks and Concrete Security Estimation

[PQCrypto 2020] Defeating NewHope with a Single Trace

[TCHES 2020] Power Analysis of NTRU Prime

[TCHES 2020] Generic Side-channel attacks on CCA-secure lattice-based PKE and KEM schemes

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 50 / 47 2. Lattice-Based

▣ SCA on Signature countermeasure / qTESLA, Dilithium 공격

[Cryptography and Communications 2012] Fault analysis of the NTRUSign digital signature scheme

[CHES 2016] Flush, Gauss, and Reload - A Cache Attack on the BLISS Lattice-Based Signature Scheme

[[FDTC 2016] Lattice-Based Signature Schemes and Their Sensitivity to Fault Attacks

[SAC 2016] Loop-Abort Faults on Lattice-Based Fiat-Shamir and Hash-and-Sign Signatures

[ICAR 2016] Arithmetic Coding and Blinding Countermeasures for Lattice Signatures

[ePrint 2017] Analyzing the Shuffling Side-Channel Countermeasure for Lattice-Based Signatures

[SAC 2017] Side-Channel Attacks on BLISS Lattice-Based Signatures

[SAC 2017] To BLISS-B or not to be - Attacking strong Swan's Implementation of Post-Quantum Signatures

[IACR 2018] Differential Fault Attacks on Deterministic Lattice Signatures

[EUROCRYPT 2018] Masking the GLP Lattice-Based Signature Scheme at Any Order

[ICAR 2019] One Bit It Takes A Devastating Timing Attack on BLISS's Non-Constant Time Sign Flips

[ePrint 2019] Masking Dilithium : Efficient Implementation and Side-Channel Evaluation

[CARDIS 2019] An Efficient and Provable Masked Implementation of qTESLA

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 51 / 47 3. Code-Based

▣ SCA on KEM/PKE

[PQCrypto 2008] Side channels in the McEliece PKC

[ICISC 2009] A timing attack against patterson algorithm in the McEliece PKC

[PQCrypto 2010] A timing attack against the Secret Permutation in the McEliece PKC

[PQCrypto 2010] Practical power analysis attacks on software implementations of McEliece

[FutureTech 2010] MecEliece/Niederreiter PKC: sensitivity to fault injection

[J. Cryptographic Engineering 2011] A simple power analysis attack on a McEliece cryptoprocessor

[J. Cryptographic Engineering 2011] Message-aimed side channel and fault attacks against a public-key cryptosystems with homomorphic properties

[J. Cryptographic Engineering 2011] Side-channel attacks on the McEliece and Niedereiter public-key cryptosystems

[PQCrypto 2013] Timing attacks against the syndrome inversion in code-based cryptosystems

[RadioElektronika 2015] Countermeasure against the SPA Attack on an Embedded McEliece Cryptosystem

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 52 / 47 3. Code-Based

▣ SCA on KEM/PKE

[RadioElektronika 2016] Differential power analysis attacks on the secure bit permutation in the McEliece cryptosystem

[J. Computers, Communications & Control 2017] Improved Timing Attacks against the Secret Permutation in the McEliece PKC

survey [ICCCC 2018] Survey on cryptanalysis of code-based cryptography: From theoretical to physical attacks

[PQCrypto 2014] Towards side-channel resistant implementations of QC-MDPC McEliece encryption on constrained devices

[ACNS 2015] Differential Power Analysis of a McEliece Cryptosystem

[IEEE Transactions 2016] Horizontal and Vertical Side Channel Analysis of a McEliece Cryptosystem

[SAC 2016] Masking Large Keys in Hardware: A Masked Implementation of McEliece

[CHES 2016] QcBits: Constant-Time Small-Key Code-Based Cryptography

[CHES 2017] A side-channel assisted cryptanalytic attack against QcBits

[TIIS 2019] Higher-Order Masking Scheme against DPA Attack in Practice: McEliece Cryptosystem Based on QD-MDPC Code

[TCHES 2019] Novel Side-Channel Attacks on Quasi-Cyclic Code-Based Cryptography

Side Channel Analysis Design Academy 2020. 07. 17 PQC 부채널 분석 53 / 47