LWE Without Modular Reduction and Improved Side-Channel Attacks Against BLISS

Abstract

This paper is devoted to analyzing the variant of Regev's learning with errors (LWE) problem in which modular reduction is omitted: namely, the problem (ILWE) of recovering a vector s ∈ Z n given polynomially many samples of the form (a, a, s + e) ∈ Z n+1 where a and e follow fixed distributions. Unsurprisingly, this problem is much easier than LWE: under mild conditions on the distributions, we show that the problem can be solved efficiently as long as the variance of e is not superpolynomially larger than that of a. We also provide almost tight bounds on the number of samples needed to recover s.Our interest in studying this problem stems from the side-channel attack against the BLISS lattice-based signature scheme described by Espitau et al. at CCS 2017. The attack targets a quadratic function of the secret that leaks in the rejection sampling step of BLISS. The same part of the algorithm also suffers from a linear leakage, but the authors claimed that this leakage could not be exploited due to signature compression: the linear system arising from it turns out to be noisy, and hence key recovery amounts to solving a high-dimensional problem analogous to LWE, which seemed infeasible. However, this noisy linear algebra problem does not involve any modular reduction: it is essentially an instance of ILWE, and can therefore be solved efficiently using our techniques. This allows us to obtain an improved side-channel attack on BLISS, which applies to 100% of secret keys (as opposed to ≈7% in the CCS paper), and is also considerably faster.

LadderLeak: Breaking ECDSA with Less than One Bit of Nonce Leakage

“…As a result we were able to recover the expected number of most significant key bits. The detected peak sizes matched the estimate |B q (K)| 16 with a small relative error of order 2 −5 , and the largest noise floors were about 5 times the estimated average (i.e., 5/ √ 2 m 2 ) in both experiments. Once the top ℓ ′ MSBs of sk have been found, recovering the remaining bits is fairly straightforward in Bleichenbacher's framework; one could just "re-inject" the known part of the secret to the HNP samples as k…”

“…In this appendix, we rely on standard results on subgaussian random variables as introduced for example in [16]. In particular, we use the following result.…”

QuantumHammer

“…Both of these attacks targeted the Bernoulli and CDT sampling. An extension to this work was presented by Bootle et al [6] which manages to recover 100% of the secret key compared to only 7% in the previous work [17]. Another side-channel attack by Ravi et al [37] achieving existential forgery targeted Dilithium, a lattice-based signature scheme.…”

“…It is observed that the number of bit flips increase with the number of hammers. To find the susceptible memory locations in the pre-processing phase we set a value for number of hammers as 10 6 . The other observation is that there is not much difference between the number of 1 − → 0 flips and 0 − → 1 flips.…”

ModFalcon: Compact Signatures Based On Module-NTRU Lattices

“…From the point of view of practical security and side-channel attacks, Gaussian samplers have been known to be a potential weak point (e.g., with respect to timing attacks [9,21,57]). However, the one used in Falcon was provided with a fully constant-time implementation with only minor losses in efficiency [47].…”