A Holistic Approach Towards Side-Channel Secure Fixed-Weight Polynomial Sampling

Krausz, Markus; Land, Georg; Richter-Brockmann, Jan; Güneysu, Tim

doi:10.1007/978-3-031-31371-4_4

Cited by 4 publications

(1 citation statement)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From a side-channel point of view, multiplying the public challenge polynomial c with the secret key vector s 1 , followed by an addition to the nonce y, is the most critical operation for signature generation in Dilithium [SLKG23]. We highlight that the challenge polynomial c is also public for rejected signature candidates [KLRBG23] and is sparse and ternary. The coefficients of the secret key polynomial vector s 1 are uniformly random with a small bound (i.e., there are only five or nine possible values).…”

Section: Applicability To Dilithiummentioning

confidence: 99%

Gadget-based Masking of Streamlined NTRU Prime Decapsulation in Hardware

Land,

Marotzke,

Richter-Brockmann

et al. 2023

TCHES

View full text Add to dashboard Cite

Streamlined NTRU Prime is a lattice-based Key Encapsulation Mechanism (KEM) that is, together with X25519, the default algorithm in OpenSSH 9. Based on lattice assumptions, it is assumed to be secure also against attackers with access to< large-scale quantum computers. While Post-Quantum Cryptography (PQC) schemes have been subject to extensive research in recent years, challenges remain with respect to protection mechanisms against attackers that have additional side-channel information, such as the power consumption of a device processing secret data. As a countermeasure to such attacks, masking has been shown to be a promising and effective approach. For public-key schemes, including any recent PQC schemes, usually, a mixture of Boolean and arithmetic techniques is applied on an algorithmic level. Our generic hardware implementation of Streamlined NTRU Prime decapsulation, however, follows an idea that until now was assumed to be solely applicable efficiently to symmetric cryptography: gadget-based masking. The hardware design is transformed into a secure implementation by replacing each gate with a composable secure gadget that operates on uniform random shares of secret values. In our work, we show the feasibility of applying this approach also to PQC schemes and present the first Public-Key Cryptography (PKC) – pre- and post-quantum – implementation masked with the gadget-based approach considering several trade-offs and design choices. By the nature of gadget-based masking, the implementation can be instantiated at arbitrary masking order. We synthesize our implementation both for Artix-7 Field-Programmable Gate Arrays (FPGAs) and 45nm Application-Specific Integrated Circuits (ASICs), yielding practically feasible results regarding the area, randomness requirement, and latency. We verify the side-channel security of our implementation using formal verification on the one hand, and practically using Test Vector Leakage Assessment (TVLA) on the other. Finally, we also analyze the applicability of our concept to Kyber and Dilithium, which will be standardized by the National Institute of Standards and Technology (NIST).

show abstract

Section: Applicability To Dilithiummentioning

confidence: 99%