Profiled Side-Channel Attack on Cryptosystems Based on the Binary Syndrome Decoding Problem

Abstract

The NIST standardization process for post-quantum cryptography has been drawing the attention of researchers to the submitted candidates. One direction of research consists in implementing those candidates on embedded systems and that exposes them to physical attacks in return. The Classic McEliece cryptosystem, which is among the four finalists of round 3 in the Key Encapsulation Mechanism category, builds its security on the hardness of the syndrome decoding problem, which is a classic hard problem in code-based cryptography. This cryptosystem was recently targeted by a laser fault injection attack leading to message recovery. Regrettably, the attack setting is very restrictive and it does not tolerate any error in the faulty syndrome. Moreover, it depends on the very strong attacker model of laser fault injection, and does not apply to optimised implementations of the algorithm that make optimal usage of the machine words capacity. In this article, we propose a to change the angle and perform a message-recovery attack that relies on side-channel information only. We improve on the previously published work in several key aspects. First, we show that sidechannel information, obtained with power consumption analysis, is sufficient to obtain an integer syndrome, as required by the attack framework. This is done by leveraging classic machine learning techniques that recover the Hamming weight information very accurately. Second, we put forward a computationallyefficient method, based on a simple dot product and informationset decoding algorithms, to recover the message from the, possibly inaccurate, recovered integer syndrome. Finally, we present a masking countermeasure against the proposed attack.

Defeating Low-Cost Countermeasures against Side-Channel Attacks in Lattice-based Encryption

“…To perform classification of the HW classes, we have decided to Random Forest, the reason being is that it has been shown to be successful in the previous works [CDCG22] and it does not have to deal with a more complex hyperparameter tuning usually encountered in more complex models. Random Forest or RF [Bre01] is an ensemble learning algorithm, based on the construction of multiple decision trees.…”

Key-Recovery by Side-Channel Information on the Matrix-Vector Product in Code-Based Cryptosystems

“…such that Sz T = z * . To get z * in N n−k , we will use the same method of the power analysis attack in [10]. This method is based on side-channel analysis using random forests to recover z * from the Hamming weight information obtained from the matrix-vector product in the first step of Niederreiter decryption.…”

“…) correctly, we can directly find the secret of the cryptosystem. We obtain directly the secret without solving the syndrome decoding problem unlike in [9,10] and this is applicable for most of the code-based cryptosystems.…”

“…Afterwards, Colombier et al [10] proposed to perform a message-recovery attack in Classic McEliece that relies on side-channel information only instead of laser fault injection in the previous work [9]. The latter depends on the very strong attacker model and does not apply to optimized implementations of the algorithm that make optimal usage of the machine words capacity.…”

A Side-Channel Attack Against Classic McEliece When Loading the Goppa Polynomial

“…Common countermeasure fail against our attack We recall that our attack on the loading function of the Goppa polynomial coefficients is performed on the optimized reference implementation of Classic McEliece on ARM-Cortex M4 [CC21]. This reference implementation represents the side-channel attack target of several recent papers [Cay+21;Col+22b;GJJ22]. Shuffling is nowadays one of the most common and effective countermeasure techniques against most side-channel attacks [CMJ22].…”