International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Belief Propagation Meets Lattice Reduction: Security Estimates for Error-Tolerant Key Recovery from Decryption Errors

Authors:
Julius Hermelink , Max Planck Institute for Security and Privacy, Bochum, Germany
Erik Mårtensson , Selmer Center, Department of Informatics, University of Bergen, Bergen, Norway; Department of Electrical and Information Technology, Lund University, Lund, Sweden
Simona Samardjiska , Digital Security Group, Radboud University, Nijmegen, The Netherlands
Peter Pessl , Infineon Technologies AG, Munich, Germany
Gabi Dreo Rodosek , Universität der Bundeswehr München, Munich, Germany
Download:
DOI: 10.46586/tches.v2023.i4.287-317
URL: https://tches.iacr.org/index.php/TCHES/article/view/11167
Search ePrint
Search Google
Abstract: In LWE-based KEMs, observed decryption errors leak information about the secret key in the form of equations or inequalities. Several practical fault attacks have already exploited such leakage by either directly applying a fault or enabling a chosen-ciphertext attack using a fault. When the leaked information is in the form of inequalities, the recovery of the secret key is not trivial. Recent methods use either statistical or algebraic methods (but not both), with some being able to handle incorrect information. Having in mind that integration of the side-channel information is a crucial part of several classes of implementation attacks on LWEbased schemes, it is an important question whether statistically processed information can be successfully integrated in lattice reduction algorithms.We answer this question positively by proposing an error-tolerant combination of statistical and algebraic methods that make use of the advantages of both approaches. The combination enables us to improve upon existing methods – we use both fewer inequalities and are more resistant to errors. We further provide precise security estimates based on the number of available inequalities.Our recovery method applies to several types of implementation attacks in which decryption errors are used in a chosen-ciphertext attack. We practically demonstrate the improved performance of our approach in a key-recovery attack against Kyber with fault-induced decryption errors.
BibTeX
@article{tches-2023-33349,
  title={Belief Propagation Meets Lattice Reduction: Security Estimates for Error-Tolerant Key Recovery from Decryption Errors},
  journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
  publisher={Ruhr-Universität Bochum},
  volume={2023, Issue 4},
  pages={287-317},
  url={https://tches.iacr.org/index.php/TCHES/article/view/11167},
  doi={10.46586/tches.v2023.i4.287-317},
  author={Julius Hermelink and Erik Mårtensson and Simona Samardjiska and Peter Pessl and Gabi Dreo Rodosek},
  year=2023
}