Breaking and Protecting the Crystal: Side-Channel Analysis of Dilithium in Hardware

Steffen, Hauke; Land, Georg; Kogelheide, Lucie Johanna; Güneysu, Tim

doi:10.1007/978-3-031-40003-2_25

Cited by 3 publications

(6 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For FPGA-based implementations, Steffen et al (2022) proposed elector-magnetic analysis targeting polynomial multiplication in Dilithium. They conducted two main attacks.…”

Section: Related Workmentioning

confidence: 99%

“…The results show that attacking the three multiplications parallel implementation uses four times as many power traces as the other one. From Stefffen et al 's work (Steffen et al 2022), it can be seen that FPGA implementation of Dilithium has more parallel operations than the ARM implementation, such as keccak operation and parallel computation of multiple key coefficients, and it takes more time to attack it, so it is difficult to perform a complete analysis. The fast two-stage scheme of Chen et al 's work (Chen et al 2021) reduces the attack time, but the best key recovery can be achieved when the power trace used is 63 times that of the conservative CPA scheme, while the recovery of one key coefficient of the cs 1 in the attack of Steffen et al (2022) has used 1,000,000 electromagnetic traces, and the increase in the dataset of the fast two-stage scheme will be very significant, which is relatively high for the memory requirements of the computer.…”

Section: Related Workmentioning

confidence: 99%

“…Hence, it is not practical to trade more traces for less time. Among the mentioned works, only Steffen et al (2022) conducted attacks on an FPGA-based implementation of Dilithium, but they did not analyse more key coefficients.…”

Section: Related Workmentioning

confidence: 99%

“…For software implementations, it is difficult to analyse the continuous numerical processing on the bus, so the Hamming weight of the targeted variable is often used as a leakage model (Chen et al 2021;Qiao et al 2023). For hardware implementations, it is possible to analyse the previous reference value of the operation by examining registers, hence the Hamming distance model is commonly used to model the power consumption generated by the targeted operation (Steffen et al 2022). The actual power consumption L can be expressed as the Hamming distance between the values before and after (Note: the coefficient index is i) the register is assigned a value, as shown in Eq.…”

Section: Cpa On Polynomial Multiplicationmentioning

confidence: 99%

“…Side-channel leakage from these operations has been investigated using various methods, including Simple Power Analysis (SPA), Correlation Power Analysis (CPA) (Brier et al 2004), and profiled attacks (Chari et al 2002). However, those research mostly focuses on software implementations, having little concern on SCA to hardware implementations of Dilithium due to the hardness (Steffen et al 2022). In the light of this, we study the security of hardware implementations of Dilithium under side channel attacks.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

In-depth Correlation Power Analysis Attacks on a Hardware Implementation of CRYSTALS-Dilithium

Wang,

Gao,

Liu

et al. 2024

Cybersecurity

View full text Add to dashboard Cite

During the standardisation process of post-quantum cryptography, NIST encourages research on side-channel analysis for candidate schemes. As the recommended lattice signature scheme, CRYSTALS-Dilithium, when implemented on hardware, has seen limited research on side-channel analysis, and current attacks are incomplete or requires a substantial quantity of traces. Therefore, we conducted a more complete analysis to investigate the leakage of an FPGA implementation of CRYSTALS-Dilithium using the Correlation Power Analysis (CPA) method, where with a minimum of 70,000 traces partial private key coefficients can be recovered. Furthermore, we optimise the attack by extracting Point-of-Interests using known information due to parallelism (named CPA-PoI) and by iteratively utilising parallel leakages (named CPA-ITR). Our experimental results show that CPA-PoI reduces the number of traces by up to 16.67%, CPA-ITR by up to 25%, and both increase the number of recovered key coefficients by up to 55.17% and 93.10% using the same number of traces. They outperfom the CPA method. As a result, it suggests that the FPGA implementation of CRYSTALS-Dilithium is more vulnerable than thought before to side-channel analysis.

show abstract

“…For FPGA-based implementations, Steffen et al (2022) proposed elector-magnetic analysis targeting polynomial multiplication in Dilithium. They conducted two main attacks.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Cpa On Polynomial Multiplicationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

In-depth Correlation Power Analysis Attacks on a Hardware Implementation of CRYSTALS-Dilithium

Wang,

Gao,

Liu

et al. 2024

Cybersecurity

View full text Add to dashboard Cite

show abstract

Zero-Value Filtering for Accelerating Non-Profiled Side-Channel Attack on Incomplete NTT-Based Implementations of Lattice-Based Cryptography

Tosun,

Savas

2024

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Towards High-Performance Supersingular Isogeny Cryptographic Hardware Accelerator Design

Bai

2023

Electronics

View full text Add to dashboard Cite

Cryptosystems based on supersingular isogeny are a novel tool in post-quantum cryptography. One compelling characteristic is their concise keys and ciphertexts. However, the performance of supersingular isogeny computation is currently worse than that of other schemes. This is primarily due to the following factors. Firstly, the underlying field is a quadratic extension of the finite field, resulting in higher computational complexity. Secondly, the strategy for large-degree isogeny evaluation is complex and dependent on the elementary arithmetic units employed. Thirdly, adapting the same hardware to different parameters is challenging. Considering the evolution of similar curve-based cryptosystems, we believe proper algorithm optimization and hardware acceleration will reduce its speed overhead. This paper describes a high-performance and flexible hardware architecture that accelerates isogeny computation. Specifically, we optimize the design by creating a dedicated quadratic Montgomery multiplier and an efficient scheduling strategy that are suitable for supersingular isogeny. The multiplier operates on Fp2 under projective coordinate formulas, and the scheduling is tailored to it. By exploiting additional parallelism through replicated multipliers and concurrent isogeny subroutines, our 65 nm SMIC technology cryptographic accelerator can generate ephemeral public keys in 2.40 ms for Alice and 2.79 ms for Bob with a 751-bit prime setting. Sharing the secret key costs another 2.04 ms and 2.35 ms, respectively.

show abstract

Breaking and Protecting the Crystal: Side-Channel Analysis of Dilithium in Hardware

Cited by 3 publications

References 20 publications

In-depth Correlation Power Analysis Attacks on a Hardware Implementation of CRYSTALS-Dilithium

In-depth Correlation Power Analysis Attacks on a Hardware Implementation of CRYSTALS-Dilithium

Zero-Value Filtering for Accelerating Non-Profiled Side-Channel Attack on Incomplete NTT-Based Implementations of Lattice-Based Cryptography

Towards High-Performance Supersingular Isogeny Cryptographic Hardware Accelerator Design

Contact Info

Product

Resources

About