On Exploiting Message Leakage in (Few) NIST PQC Candidates for Practical Message Recovery Attacks

In this work, we propose generic and practical side-channel attacks for message recovery in post-quantum lattice-based public key encryption (PKE) and key encapsulation mechanisms (KEM). The targeted schemes are based on the well known Learning With Errors (LWE) and Learning With Rounding (LWR) prob...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on information forensics and security 2022, Vol.17, p.684-699
Main Authors: Ravi, Prasanna, Bhasin, Shivam, Roy, Sujoy Sinha, Chattopadhyay, Anupam
Format: Article
Language:English
Subjects:
Algorithms
ciphertext malleability
Encryption
Feature extraction
key encapsulation mechanism (KEM)
key recovery attack
Lattice-based cryptography
Learning
message recovery attack
NIST
Quantum cryptography
Recovery
Resistance
Rounding
Side-channel attacks
Standardization
Transforms
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In this work, we propose generic and practical side-channel attacks for message recovery in post-quantum lattice-based public key encryption (PKE) and key encapsulation mechanisms (KEM). The targeted schemes are based on the well known Learning With Errors (LWE) and Learning With Rounding (LWR) problem and include three finalists and six semi-finalist candidates of the ongoing NIST's standardization process for post-quantum cryptography. Notably, we propose to exploit inherent ciphertext malleability properties of LWE/LWR-based PKEs as a powerful tool for side-channel assisted message recovery attacks. The use of ciphertext malleability widens the scope of previous attacks with the ability to target multiple operations for message recovery. Moreover, our attacks are adaptable to different implementation variants and are also applicable to implementations protected with concrete shuffling and masking side-channel countermeasures. Our work mainly highlights the presence of inherent algorithmic properties in LWE/LWR-based schemes that can aid side-channel attacks for message recovery, thereby stressing on the need for strong side-channel countermeasures against message recovery for LWE/LWR-based schemes.
ISSN:1556-6013
1556-6021
DOI:10.1109/TIFS.2021.3139268