Masking Kyber: First- and Higher-Order Implementations

Abstract

In the final phase of the post-quantum cryptography standardization effort, the focus has been extended to include the side-channel resistance of the candidates. While some schemes have been already extensively analyzed in this regard, there is no such study yet of the finalist Kyber.In this work, we demonstrate the first completely masked implementation of Kyber which is protected against first- and higher-order attacks. To the best of our knowledge, this results in the first higher-order masked implementation of any post-quantum secure key encapsulation mechanism algorithm. This is realized by introducing two new techniques. First, we propose a higher-order algorithm for the one-bit compression operation. This is based on a masked bit-sliced binary-search that can be applied to prime moduli. Second, we propose a technique which enables one to compare uncompressed masked polynomials with compressed public polynomials. This avoids the costly masking of the ciphertext compression while being able to be instantiated at arbitrary orders.We show performance results for first-, second- and third-order protected implementations on the Arm Cortex-M0+ and Cortex-M4F. Notably, our implementation of first-order masked Kyber decapsulation requires 3.1 million cycles on the Cortex-M4F. This is a factor 3.5 overhead compared to the unprotected optimized implementationin pqm4. We experimentally show that the first-order implementation of our new modules on the Cortex-M0+ is hardened against attacks using 100 000 traces and mechanically verify the security in a fine-grained leakage model using the verification tool scVerif.

Revisiting Higher-Order Masked Comparison for Lattice-Based Cryptography: Algorithms and Bit-Sliced Implementations

“…We will show that bitslicing the A2B conversion gives a significant speedup and is essential to obtain an efficient implementation. Moreover, bitslicing is applied in the comparison implementation by D'Anvers et al [1] but not in the implementations by Bos et al [23] and Coron et al [2]. This makes comparing these results difficult.…”

“…Masked implementations of encryption standardization candidates were presented for Saber by Van Beirendonck et al [22] for first order, and later by Coron et al [2] for higher masking orders. A masked Kyber implementation for generic masking orders was introduced by Bos et al [23]. Fritzmann et al [24] optimized a masked implementation of Saber and Kyber using instruction set extensions.…”

“…A different approach was taken by Bos et al [23], who instead of compressing the masked ciphertext, leave it uncompressed and perform two masked checks to see if it is within the required range, i.e. a high-and low-end check.…”

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

“…KYBER has fast key generation, encapsulation and decapsulation in software [33] (see Section 2.2.2). There have been several works on optimizing implementations of KYBER in both software and hardware, as well as in hybrid hardware/software settings [35,[40][41][42][43][44][45]80]. For high-speed FPGA implementations, [46] shows that in terms of speed and resource realization, KYBER is a leading performer for all operations: key generation, encapsulation and decapsulation (among the finalist lattice KEMs).…”

Chosen-Ciphertext Clustering Attack on CRYSTALS-KYBER Using the Side-Channel Leakage of Barrett Reduction

“…Since the proposed attack constructs an intermediate value t, which is affected by only one coefficient of s j , and exploits it, masking [22], [50] can be secure against the proposed attack. However, substantial time and memory resources are needed because masking would not be appropriate for use in resourceconstrained IoT devices due to its high-performance overhead.…”