Curse of Re-encryption: A Generic Power/EM Analysis on Post-Quantum KEMs

Abstract

This paper presents a side-channel analysis (SCA) on key encapsulation mechanism (KEM) based on the Fujisaki–Okamoto (FO) transformation and its variants. The FO transformation has been widely used in actively securing KEMs from passively secure public key encryption (PKE), as it is employed in most of NIST post-quantum cryptography (PQC) candidates for KEM. The proposed attack exploits side-channel leakage during execution of a pseudorandom function (PRF) or pseudorandom number generator (PRG) in the re-encryption of KEM decapsulation as a plaintext-checking oracle that tells whether the PKE decryption result is equivalent to the reference plaintext. The generality and practicality of the plaintext-checking oracle allow the proposed attack to attain a full-key recovery of various KEMs when an active attack on the underlying PKE is known. This paper demonstrates that the proposed attack can be applied to most NIST PQC third-round KEM candidates, namely, Kyber, Saber, FrodoKEM, NTRU, NTRU Prime, HQC, BIKE, and SIKE (for BIKE, the proposed attack achieves a partial key recovery). The applicability to Classic McEliece is unclear because there is no known active attack on this cryptosystem. This paper also presents a side-channel distinguisher design based on deep learning (DL) for mounting the proposed attack on practical implementation without the use of a profiling device. The feasibility of the proposed attack is evaluated through experimental attacks on various PRF implementations (a SHAKE software, an AES software, an AES hardware, a bit-sliced masked AES software, and a masked AES hardware based on threshold implementation). Although it is difficult to implement the oracle using the leakage from the TI-based masked hardware, the success of the proposed attack against these implementations (even except for the masked hardware), which include masked software, confirms its practicality.

Faulty isogenies: a new kind of leakage

“…Implications to SIKE. Recently, Ueno et al [26] analyze a plaintext-checking Oracle-based attack; they focus on the encryption computation from the SIKE decapsulation procedure. However, our attack targets SIDH derive procedure,…”

“…Oracle calls [26] Countermeasures. A pairing test could work as a countermeasure, but the attacker can manipulate the points to bypass this test.…”

“…Generic fault injection and side-channel attacks against the Fujisaki-Okamotobased key encapsulation mechanism were presented in [29,26]. In [26, §4.3], the authors applied the attack of [11] to SIKE.…”

“…The attacker compares the side-channel leakage output by the SIKE decapsulation block when processing a valid ciphertext with a modified one. The combination of the active attack of [11] with the plaintext-checking oracle, allows to have a full SIKE key recovery by invoking less than 500 oracle accesses (see [26,Table 2]).…”

“…Our Contributions. We present a new fault-injection adaptive attack on SIDH, which could apply to SIKE under the same plaintext-checking oracle as in [26]. Our analysis centers on Bob's 3-isogeny chain computation and relies on the following:…”