Chosen-Ciphertext Clustering Attack on CRYSTALS-KYBER Using the Side-Channel Leakage of Barrett Reduction

Abstract

This study proposes a chosen-ciphertext sidechannel attack against a lattice-based key encapsulation mechanism (KEM), the third-round candidate of the national institute of standards and technology (NIST) standardization project. Unlike existing attacks that target operations, such as inverse NTT and message encoding/decoding, we target Barrett reduction in the decapsulation phase of CRYSTALS-KYBER to obtain a secret key. We show that a sensitive variable-dependent leakage of Barrett reduction exposes an entire secret key. The results of experiments conducted on the ARM Cortex-M4 microcontroller accomplish a success rate of 100%. We only need six chosen ciphertexts for KYBER512 and KYBER768 and eight chosen ciphertexts for KYBER1024. We also show that the m4 scheme of the pqm4 library, an implementation with the ARM Cortex-M4 specific optimization (typically in assembly), is vulnerable to the proposed attack. In this scheme, six, nine, and twelve chosen ciphertexts are required for KYBER512, KYBER768, and KYBER1024, respectively.

A Message Recovery Attack on LWE/LWR-Based PKE/KEMs Using Amplitude-Modulated EM Emanations

“…Several vulnerabilities have been discovered in the implementations of LWE/ LWR-based PKE/KEMs, including incremental storage vulnerability [21], weakness of re-encryption operation in Fujisaki-Okamoto transform [27] and weakness of polynomial multiplication [16]. For CRYSTALS-Kyber, secret key information has also been extracted through Barrentt reduction procedure [15,26].…”

Improving Single-Trace Attacks on the Number-Theoretic Transform for Cortex-M4

“…However, lattice-based schemes remain vulnerable to sidechannel attacks [5], [6], [7], in particular when they are combined with chosen-ciphertext attacks [8], [9]. Among these, single-trace attacks are especially troubling, since they allow an attacker to determine secret information by observing a single cryptographic operation, and are often difficult to protect against.…”