Single-Trace Side-Channel Attacks on ω-Small Polynomial Sampling: With Applications to NTRU, NTRU Prime, and CRYSTALS-DILITHIUM

Karabulut, Emre; Alkım, Erdem; Aysu, Aydın

doi:10.1109/host49136.2021.9702284

Cited by 17 publications

(8 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Fig. 8a shows the leakage distribution as the Bias increases (from 3 the maximum and average leakages shows similar distributions the top to the bottom plot), whereas Fig. 8b is showing the corresponding SNR levels of the different designs.…”

Section: Simulated Asic-model Correspondencementioning

confidence: 93%

“…In Fig. 6b the leakage distribution of the minimum current (in each clockcycle) is shown per each of these settings 3 . The important and interesting aspect which we can observe is that as more and more bits are utilized by the randomizer, the leakage distributes more and is becoming more and more uniform as discussed above.…”

Section: Simulated Asic-model Correspondencementioning

confidence: 99%

“…To date, various successful single leakage-trace SCA attacks were shown possible for public-key encryption/ digital signatures schemes, both on hardware and software implementations (see e.g., [1]- [3]).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Fully-Digital Randomization Based Side-Channel Security—Toward Ultra-Low Cost-per-Security

2022

View full text Add to dashboard Cite

In this paper we formulate and re-evaluate a recently proposed randomization-based sidechannel protection mechanism. The strength of the construction lies with its ability to comply with standard digital design flows and that it provides a security parameter which directly links side-channel security metrics. A detailed leakage model is provided and investigated for the first time, and it is linked to electronic parameters of the randomization mechanism. We develop guidelines and optimization for concrete ASIC constructions, and sheds light on this ultra low-cost leakage-randomization mechanism. The proposed circuit is natural to be utilized without or on top of the popular masking countermeasures. It is demonstrated to be considerably more efficient in terms of attack data-complexity as compared to low-order masking (i.e., number of shares d = 2). In addition, seemingly it is a nice and necessary fit to increase the noise when a too low-noise environment is expected, which impedes masking's theoretical security. Finally, it is discussed that the proposed mechanism is natural to be embedded with masked designs for higher security-levels (d > 2) while lowering significantly their asymptotically quadratic area price-tag as d increase. Robustness results are provided along with post & route cost estimations for both AES encryption and a more recently proposed permutation such as ISAP. Our design efficiently provides unprecedented three orders-of-magnitude signal-to-noise reduction with a total area-overhead of 21% and 46% for AES and Ascon-ρ, respectively. These factors are more cost-efficient than low-orders masked designs and such mechanisms are sometimes necessary when the inherent noise is not sufficient. However, the joint embedding of the proposed mechanism with masked designs potentially exponentially improve the security level they provide, all whilst enabling electronic-design friendly security mechanism.

show abstract

Section: Simulated Asic-model Correspondencementioning

confidence: 93%

Section: Simulated Asic-model Correspondencementioning

confidence: 99%

See 1 more Smart Citation

Fully-Digital Randomization Based Side-Channel Security—Toward Ultra-Low Cost-per-Security

2022

View full text Add to dashboard Cite

show abstract

“…More precisely, it may be possible to perform a template attack against the permutations, so that using a single trace, the adversary could recover all n permutations and eventually the secret-key. We refer to [KAA21] for an example of such attack.…”

Section: Complexity the Time Complexity Of The Algorithm Ismentioning

confidence: 99%

High-order masking of NTRU

Coron

Gérard²,

Trannoy³

et al. 2023

TCHES

View full text Add to dashboard Cite

The main protection against side-channel attacks consists in computing every function with multiple shares via the masking countermeasure. While the masking countermeasure was originally developed for securing block-ciphers such as AES, the protection of lattice-based cryptosystems is often more challenging, because of the diversity of the underlying algorithms. In this paper, we introduce new gadgets for the high-order masking of the NTRU cryptosystem, with security proofs in the classical ISW probing model. We then describe the first fully masked implementation of the NTRU Key Encapsulation Mechanism submitted to NIST, including the key generation. To assess the practicality of our countermeasures, we provide a concrete implementation on ARM Cortex-M3 architecture, and eventually a t-test leakage evaluation.

show abstract

“…Multiple algorithmic approaches have been proposed [5,9,10,15,18] for this. Karabulut et al presented the first power side-channel attack on fixed weight sampling [14], targeting NTRU, Streamlined NTRU Prime, and Dilithium. Recently, Guo et al [12] introduced an attack on HQC and BIKE utilizing the fixed weight polynomial sampling with variable timing depending on the seed.…”

Section: Introductionmentioning

confidence: 99%

A Holistic Approach Towards Side-Channel Secure Fixed-Weight Polynomial Sampling

Krausz

Land

Richter-Brockmann

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The sampling of polynomials with fixed weight is a procedure required by round-4 Key Encapsulation Mechanisms (KEMs) for Post-Quantum Cryptography (PQC) standardization (BIKE, HQC, McEliece) as well as NTRU, Streamlined NTRU Prime, and NTRU LPRrime. Recent attacks have shown in this context that side-channel leakage of sampling methods can be exploited for key recoveries. While countermeasures regarding such timing attacks have already been presented, still, there is no comprehensive work covering solutions that are also secure against power side channels.To close this gap, the contribution of this work is threefold: First, we analyze requirements for the different use cases of fixed weight sampling. Second, we demonstrate how all known sampling methods can be implemented securely against timing and power/EM side channels and propose performance-enhancing modifications. Furthermore, we propose a new, comparison-based methodology that outperforms existing methods in the masked setting for the three round-4 KEMs BIKE, HQC, and McEliece. Third, we present bitsliced and arbitrary-order masked software implementations and benchmarked them for all relevant cryptographic schemes to be able to infer recommendations for each use case. Additionally, we provide a hardware implementation of our new method as a case study and analyze the feasibility of implementing the other approaches in hardware.

show abstract

Single-Trace Side-Channel Attacks on ω-Small Polynomial Sampling: With Applications to NTRU, NTRU Prime, and CRYSTALS-DILITHIUM

Cited by 17 publications

References 23 publications

Fully-Digital Randomization Based Side-Channel Security—Toward Ultra-Low Cost-per-Security

Fully-Digital Randomization Based Side-Channel Security—Toward Ultra-Low Cost-per-Security

High-order masking of NTRU

A Holistic Approach Towards Side-Channel Secure Fixed-Weight Polynomial Sampling

Contact Info

Product

Resources

About