International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Attacking and Defending Masked Polynomial Comparison for Lattice-Based Cryptography

Authors:
Shivam Bhasin , Temasek Labs, Nanyang Technologival University, Signapore
Jan-Pieter D’Anvers , imec-COSIC KU Leuven, Kasteelpark Arenberg 10 - bus 2452, 3001 Leuven, Belgium
Daniel Heinz , Research Institute CODE, Universität der Bundeswehr München, Germany; Infineon Technologies, Am Campeon 1-15, 85579 Neubiberg, Germany
Thomas Pöppelmann , Infineon Technologies, Am Campeon 1-15, 85579 Neubiberg, Germany
Michiel Van Beirendonck , imec-COSIC KU Leuven, Kasteelpark Arenberg 10 - bus 2452, 3001 Leuven, Belgium
Download:
DOI: 10.46586/tches.v2021.i3.334-359
URL: https://tches.iacr.org/index.php/TCHES/article/view/8977
Search ePrint
Search Google
Abstract: In this work, we are concerned with the hardening of post-quantum key encapsulation mechanisms (KEM) against side-channel attacks, with a focus on the comparison operation required for the Fujisaki-Okamoto (FO) transform. We identify critical vulnerabilities in two proposals for masked comparison and successfully attack the masked comparison algorithms from TCHES 2018 and TCHES 2020. To do so, we use first-order side-channel attacks and show that the advertised security properties do not hold. Additionally, we break the higher-order secured masked comparison from TCHES 2020 using a collision attack, which does not require side-channel information. To enable implementers to spot such flaws in the implementation or underlying algorithms, we propose a framework that is designed to test the re-encryption step of the FO transform for information leakage. Our framework relies on a specifically parametrized t-test and would have identified the previously mentioned flaws in the masked comparison. Our framework can be used to test both the comparison itself and the full decapsulation implementation.
Video from TCHES 2021
BibTeX
@article{tches-2021-31287,
  title={Attacking and Defending Masked Polynomial Comparison for Lattice-Based Cryptography},
  journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
  publisher={Ruhr-Universität Bochum},
  volume={2021, Issue 3},
  pages={334-359},
  url={https://tches.iacr.org/index.php/TCHES/article/view/8977},
  doi={10.46586/tches.v2021.i3.334-359},
  author={Shivam Bhasin and Jan-Pieter D’Anvers and Daniel Heinz and Thomas Pöppelmann and Michiel Van Beirendonck},
  year=2021
}