scholarly journals Differential Fault Attacks on Deterministic Lattice Signatures

2018 ◽  
pp. 21-43
Author(s):  
Leon Groot Bruinderink ◽  
Peter Pessl
Keyword(s):  
Experimental Verification ◽  
Fault Injection ◽  
Secret Key ◽  
Lattice Basis Reduction ◽  
Key Recovery ◽  
Signature Schemes ◽  
Fault Attacks ◽  
Reduction Techniques ◽  
Basis Reduction ◽  
Lattice Based Cryptography

In this paper, we extend the applicability of differential fault attacks to lattice-based cryptography. We show how two deterministic lattice-based signature schemes, Dilithium and qTESLA, are vulnerable to such attacks. In particular, we demonstrate that single random faults can result in a nonce-reuse scenario which allows key recovery. We also expand this to fault-induced partial nonce-reuse attacks, which do not corrupt the validity of the computed signatures and thus are harder to detect.Using linear algebra and lattice-basis reduction techniques, an attacker can extract one of the secret key elements after a successful fault injection. Some other parts of the key cannot be recovered, but we show that a tweaked signature algorithm can still successfully sign any message. We provide experimental verification of our attacks by performing clock glitching on an ARM Cortex-M4 microcontroller. In particular, we show that up to 65.2% of the execution time of Dilithium is vulnerable to an unprofiled attack, where a random fault is injected anywhere during the signing procedure and still leads to a successful key-recovery.

scholarly journals Practical Multiple Persistent Faults Analysis

2021 ◽  
pp. 367-390
Author(s):  
Hadi Soleimany ◽  
Nasour Bagheri ◽  
Hosein Hadipour ◽  
Prasanna Ravi ◽  
Shivam Bhasin ◽  
...  
Keyword(s):  
Time Complexity ◽  
Fault Injection ◽  
Fault Analysis ◽  
Key Recovery ◽  
Trade Off ◽  
Fault Attacks ◽  
Novel Technique ◽  
Recovery Processes ◽  
Experimental Validations ◽  
Types Of Faults

We focus on the multiple persistent faults analysis in this paper to fill existing gaps in its application in a variety of scenarios. Our major contributions are twofold. First, we propose a novel technique to apply persistent fault apply in the multiple persistent faults setting that decreases the number of survived keys and the required data. We demonstrate that by utilizing 1509 and 1448 ciphertexts, the number of survived keys after performing persistent fault analysis on AES in the presence of eight and sixteen faults can be reduced to only 29 candidates, whereas the best known attacks need 2008 and 1643 ciphertexts, respectively, with a time complexity of 250. Second, we develop generalized frameworks for retrieving the key in the ciphertext-only model. Our methods for both performing persistent fault attacks and key-recovery processes are highly flexible and provide a general trade-off between the number of required ciphertexts and the time complexity. To break AES with 16 persistent faults in the Sbox, our experiments show that the number of required ciphertexts can be decreased to 477 while the attack is still practical with respect to the time complexity. To confirm the accuracy of our methods, we performed several simulations as well as experimental validations on the ARM Cortex-M4 microcontroller with electromagnetic fault injection on AES and LED, which are two well-known block ciphers to validate the types of faults and the distribution of the number of faults in practice.

scholarly journals Side-Channel Attacks on Post-Quantum Signature Schemes based on Multivariate Quadratic Equations

2018 ◽  
pp. 500-523 ◽  
Author(s):  
Aesun Park ◽  
Kyung-Ah Shim ◽  
Namhun Koo ◽  
Dong-Guk Han
Keyword(s):  
Simple Structure ◽  
Single Layer ◽  
Quantum Signature ◽  
Side Channel ◽  
Secret Key ◽  
Key Recovery ◽  
Signature Schemes ◽  
Quadratic Equations ◽  
Affine Maps ◽  
Equivalent Keys

In this paper, we investigate the security of Rainbow and Unbalanced Oil-and-Vinegar (UOV) signature schemes based on multivariate quadratic equations, which is one of the most promising alternatives for post-quantum signature schemes, against side-channel attacks. We describe correlation power analysis (CPA) on the schemes that yield full secret key recoveries. First, we identify a secret leakage of secret affine maps S and T during matrix-vector products in signing when Rainbow is implemented with equivalent keys rather than random affine maps for optimal implementations. In this case, the simple structure of the equivalent keys leads to the retrieval of the entire secret affine map T. Next, we extend the full secret key recovery to the general case using random affine maps via a hybrid attack: after recovering S by performing CPA, we recover T by mounting algebraic key recovery attacks. We demonstrate how this leakage on Rainbow can be practically exploited on an 8-bit AVR microcontroller using CPA. Consequently, our CPA can be applied to Rainbow-like multi-layered schemes regardless of the use of the simple-structured equivalent keys and UOV-like single layer schemes with the implementations using the equivalent keys of the simple structure. This is the first result on the security of multivariate quadratic equations-based signature schemes using only CPA. Our result can be applied to Rainbow-like multi-layered schemes and UOV-like single layer schemes submitted to NIST for Post-Quantum Cryptography Standardization.

scholarly journals New Bleichenbacher Records: Fault Attacks on qDSA Signatures

2018 ◽  
pp. 331-371
Author(s):  
Akira Takahashi ◽  
Mehdi Tibouchi ◽  
Masayuki Abe
Keyword(s):  
Time Frame ◽  
Secret Key ◽  
Key Recovery ◽  
Fault Attacks ◽  
Range Reduction ◽  
Hybrid Parallelization ◽  
Reasonable Time Frame ◽  
Evaluation Board ◽  
Computational Resources ◽  
Avr Microcontroller

In this paper, we optimize Bleichenbacher’s statistical attack technique against (EC)DSA and other Schnorr-like signature schemes with biased or partially exposed nonces. Previous approaches to Bleichenbacher’s attack suffered from very large memory consumption during the so-called “range reduction” phase. Using a carefully analyzed and highly parallelizable approach to this range reduction based on the Schroeppel–Shamir algorithm for knapsacks, we manage to overcome the memory barrier of previous work while maintaining a practical level of efficiency in terms of time complexity.As a separate contribution, we present new fault attacks against the qDSA signature scheme of Renes and Smith (ASIACRYPT 2017) when instantiated over the Curve25519 Montgomery curve, and we validate some of them on the AVR microcontroller implementation of qDSA using actual fault experiments on the ChipWhisperer-Lite evaluation board. These fault attacks enable an adversary to generate signatures with 2 or 3 bits of the nonces known.Combining our two contributions, we are able to achieve a full secret key recovery on qDSA by applying our version of Bleichenbacher’s attack to these faulty signatures. Using a hybrid parallelization model relying on both shared and distributed memory, we achieve a very efficient implementation of our highly scalable range reduction algorithm. This allows us to complete Bleichenbacher’s attack in the 252-bit prime order subgroup of Curve25519 within a reasonable time frame and using relatively modest computational resources both for 3-bit nonce exposure and for the much harder case of 2-bit nonce exposure. Both of these computations, and particularly the latter, set new records in the implementation of Bleichenbacher’s attack.

scholarly journals Security Analysis of HMAC/NMAC by Using Fault Injection

2013 ◽  
Vol 2013 ◽  
pp. 1-6 ◽  
Author(s):  
Kitae Jeong ◽  
Yuseop Lee ◽  
Jaechul Sung ◽  
Seokhie Hong
Keyword(s):  
Computational Complexity ◽  
Fault Injection ◽  
Security Analysis ◽  
Hash Functions ◽  
Main Idea ◽  
Secret Key ◽  
Key Recovery ◽  
Injection Attacks ◽  
Fault Injection Attacks ◽  
Key Recovery Attacks

In Choukri and Tunstall (2005), the authors showed that if they decreased the number of rounds in AES by injecting faults, it is possible to recover the secret key. In this paper, we propose fault injection attacks on HMAC/NMAC by applying the main idea of their attack. These attacks are applicable to HMAC/NMAC based on the MD-family hash functions and can recover the secret key with the negligible computational complexity. Particularly, these results on HMAC/NMAC-SHA-2 are the first known key recovery attacks so far.

Solving the FCSR synthesis problem for multi-sequences by lattice basis reduction

2017 ◽  
Vol 86 (5) ◽  
pp. 1023-1038 ◽  
Author(s):  
Weihua Liu ◽  
Andrew Klapper ◽  
Zhixiong Chen
Keyword(s):  
Synthesis Problem ◽  
Lattice Basis Reduction ◽  
Basis Reduction

scholarly journals Cryptanalysis of Loiss Stream Cipher-Revisited

2014 ◽  
Vol 2014 ◽  
pp. 1-7
Author(s):  
Lin Ding ◽  
Chenhui Jin ◽  
Jie Guan ◽  
Qiuyan Wang
Keyword(s):  
Time Complexity ◽  
Stream Cipher ◽  
Linear Equations ◽  
Data Complexity ◽  
Secret Key ◽  
Key Recovery ◽  
Systems Of Linear Equations ◽  
Key Recovery Attack ◽  
Better Than

Loiss is a novel byte-oriented stream cipher proposed in 2011. In this paper, based on solving systems of linear equations, we propose an improved Guess and Determine attack on Loiss with a time complexity of 2231and a data complexity of 268, which reduces the time complexity of the Guess and Determine attack proposed by the designers by a factor of 216. Furthermore, a related key chosenIVattack on a scaled-down version of Loiss is presented. The attack recovers the 128-bit secret key of the scaled-down Loiss with a time complexity of 280, requiring 264chosenIVs. The related key attack is minimal in the sense that it only requires one related key. The result shows that our key recovery attack on the scaled-down Loiss is much better than an exhaustive key search in the related key setting.

Sign in / Sign up

Export Citation Format

Share Document