Timing Attacks on Error Correcting Codes in Post-Quantum Schemes

Abstract

While error correcting codes (ECC) have the potential to significantly reduce the failure probability of post-quantum schemes, they add an extra ECC decoding step to the algorithm. Even though this additional step does not compute directly on the secret key, it is susceptible to side-channel attacks. We show that if no precaution is taken, it is possible to use timing information to distinguish between ciphertexts that result in an error before decoding and ciphertexts that do not contain errors, due to the variable execution time of the ECC decoding algorithm. We demonstrate that this information can be used to break the IND-CCA security of post-quantum secure schemes by presenting an attack on two round 1 candidates to the NIST Post-Quantum Standardization Process: the Ring-LWE scheme LAC and the Mersenne prime scheme Ramstake. This attack recovers the full secret key using a limited number of timed decryption queries and is implemented on the reference and the optimized implementations of both submissions. It is able to retrieve LAC's secret key for all security levels in under 2 minutes using less than 2 16 decryption queries and Ramstake's secret key in under 2 minutes using approximately 2400 decryption queries. The attack generalizes to other lattice-based schemes with ECC in which any side-channel information about the presence of errors is leaked during decoding.

Status report on the second round of the NIST post-quantum cryptography standardization process

“…However, care is needed to ensure that this design does not lead to security vulnerabilities. During the first round of the NIST standardization process, several authors published attacks on LAC that reduced its security to below the required levels [34,35,36,37]. These included chosen-ciphertext attacks that worked by artificially increasing the decryption failure rate and side-channel attacks that exploit non-constant-time implementations of the error-correction procedures in LAC.…”

Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs

“…While the aforementioned attacks primarily targeted IND-CPA secure schemes, Bauer et al [BGRR19] also suggested utilizing side-channel information to instantiate plaintext checking oracles and also performed preliminary experiments using EM side-channel information to argue their case. More concretely, D'Anvers et al [DTVV19] demonstrated use of timing leakage information to perform chosen ciphertext attacks over the IND-CCA secure LAC KEM and also stated the possibility of using other side-channels to perform chosen ciphertext attacks. In this work, we extend and generalize the idea of side-channels being used as efficient plaintext checking oracles by demonstrating practical EM-side channel assisted key recovery attacks applicable to six IND-CCA secure LWE/LWR based PKE/KEMs.…”

“…However, this is only true in a classical black box setting since any cryptographic algorithm implemented on a real-device leaks information about intermediate values through side-channels such as timing, power consumption or Electromagnetic (EM) emanation. In fact, D'Anvers in [DTVV19] showed that difference in the execution times of variable-time error correcting procedures can be used to distinguish validity of decrypted output codewords with very high probability. They utilized this timing vulnerability as a plaintext checking oracle to demonstrate practical chosen ciphertext attacks over IND-CCA secure KEMs LAC [LLZ + 18] and RAMSTAKE [Sze17].…”

Single-Trace Attacks on Message Encoding in Lattice-Based KEMs

“…Silverman and Whyte [49] presented a timing attack against NTRUEncrypt, which was based on a variation in the number of hash calls in decryption. Timing leakage information about error-correcting codes in a decoding algorithm allows extracting an entire secret key of LAC [16]. Park and Han [38] reported an SPA attack against the decryption of the ring-LWE encryption scheme performed on an AVR processor.…”