Misuse Attacks on Post-quantum Cryptosystems

Abstract

Many post-quantum cryptosystems which have been proposed in the National Institute of Standards and Technology (NIST) standardization process follow the same meta-algorithm, but in different algebras or different encoding methods. They usually propose two constructions, one being weaker and the other requiring a random oracle. We focus on the weak version of nine submissions to NIST. Submitters claim no security when the secret key is used several times. In this paper, we analyze how easy it is to run a key recovery under multiple key reuse. We mount a classical key recovery under plaintext checking attacks (i.e., with a plaintext checking oracle saying if a given ciphertext decrypts well to a given plaintext) and a quantum key recovery under chosen ciphertext attacks. In the latter case, we assume quantum access to the decryption oracle.

Attack on LAC Key Exchange in Misuse Situation

“…Some lattice-based KEM of the NIST competition were analysed in the key reused context using a key mismatch oracle. In [3], Baetu et al proposed a generic attack for several algorithms using the same structure called meta-algorithm. However, most of the algorithms attacked in [3] did not pass the rst round of the submission, except Frodo-640 and NewHope512.…”

“…In [3], Baetu et al proposed a generic attack for several algorithms using the same structure called meta-algorithm. However, most of the algorithms attacked in [3] did not pass the rst round of the submission, except Frodo-640 and NewHope512. However in [10], Huguenin-Dumittan et al pursue the work of generic attack for round 2 candidates.…”

Quantum Misuse Attack on Frodo

“…By computing the expectation and variance of the error term, we can recover the full key with fewer oracle queries. Compared with the work of B etu et al [ 22 ], our algorithm can reduce the number of oracle calls to 1 and meanwhile keep the same success probability as the AJOP-based quantum KR-CCA algorithm; see Table 1 .…”

“…In 2019, Alagic et al gave a quantum algorithm for learning rounding function and showed that this algorithm can recover the key of an IND-CPA-secure LWE-based encryption scheme with constant success probability [ 21 ]. At EUROCRYPT 2019, B etu et al analyzed the security of meta-cryptosystems under key reuse by mounting a quantum key recovery under the chosen-ciphertext attacks [ 22 ].…”

(One) Failure Is Not an Option: Bootstrapping the Search for Failures in Lattice-Based Encryption Schemes

“…A similar attack on Ring-LWE based schemes was later presented by Fluhrer [22] and extended by Bȃetu et. al [5].…”