Analysis of Error-Correcting Codes for Lattice-Based Key Exchange

Fritzmann, Tim; Pöppelmann, Thomas; Sepúlveda, Johanna

doi:10.1007/978-3-030-10970-7_17

Cited by 25 publications

(50 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…But, designing schemes with negligible decryption failures while also guaranteeing high security could impose a significant penalty over performance. Fritzmann et al [FPS18] performed a systematic study of utilizing forward error correcting codes to artificially reduce decryption failures by correcting errors in the decrypted message. The message m to be encrypted is first input to the ECC's encoding procedure to create a codeword c. This codeword is subsequently encrypted to generate the ciphertext ct.…”

Section: Error Correcting Codes In Lwe/lwr-based Schemesmentioning

confidence: 99%

Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs

Ravi

Roy

Chattopadhyay

et al. 2020

TCHES

View full text Add to dashboard Cite

In this work, we demonstrate generic and practical EM side-channel assisted chosen ciphertext attacks over multiple LWE/LWR-based Public Key Encryption (PKE) and Key Encapsulation Mechanisms (KEM) secure in the chosen ciphertext model (IND-CCA security). We show that the EM side-channel information can be efficiently utilized to instantiate a plaintext checking oracle, which provides binary information about the output of decryption, typically concealed within IND-CCA secure PKE/KEMs, thereby enabling our attacks. Firstly, we identified EM-based side-channel vulnerabilities in the error correcting codes (ECC) enabling us to distinguish based on the value/validity of decrypted codewords. We also identified similar vulnerabilities in the Fujisaki-Okamoto transform which leaks information about decrypted messages applicable to schemes that do not use ECC. We subsequently exploit these vulnerabilities to demonstrate practical attacks applicable to six CCA-secure lattice-based PKE/KEMs competing in the second round of the NIST standardization process. We perform experimental validation of our attacks on implementations taken from the open-source pqm4 library, running on the ARM Cortex-M4 microcontroller. Our attacks lead to complete key-recovery in a matter of minutes on all the targeted schemes, thus showing the effectiveness of our attack.

show abstract

Section: Error Correcting Codes In Lwe/lwr-based Schemesmentioning

confidence: 99%

Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs

Ravi

Roy

Chattopadhyay

et al. 2020

TCHES

View full text Add to dashboard Cite

show abstract

“…random variables following the centered binomial distribution. However, since it is difficult to calculate the multiple convolutions of the above distribution in closed form, the distribution of difference noise is numerically calculated [13].…”

Section: Analysis Of Encoding/modulation and Decoding/demodulation Anmentioning

confidence: 99%

“…where A i = m−1 l=0 α i+256l y m k,l and A i is fully determined by n * t,i , n * t,i+256 , n * t,i+512 , and n * t,i+768 for n = 1024 or by n * t,i and n * t,i+256 for n = 512, and |A i | < mα max where α max = (2nk 2 + k + (q − 1)/r)/q . There are two constraints in (13) such that A i is a finite integer and m−1 l=0 n * t,i+256l and β are congruent modulo q. Thus, E k can be expressed as union of supports satisfying two constraints on n * t,i and α i as follows:…”

Section: Propose Upper Bound On Ber Of Newhopementioning

confidence: 99%

“…We compare the proposed upper bound in (19) [9] for various k. Note that the current upper bound on DFR of NewHope [4], [9] is only provided when k = 8. Additionally, we compare the proposed upper bounds with the DFR derived by assuming no error dependency as in [13]. For convenience of expression, we will use "Proposed upper bound" to denote the the upper bound derived in (19), "CC upper bound" to denote the simplified upper bound using CC bound in (25), "Current upper bound" to denote the current upper bound on DFR of NewHope [4], [9], "No error dependency" to denote the DFR values calculated by assuming no error dependency as in [13], and "Monte Carlo" to denote the DFR values obtained by performing Monte Carlo simulation of NewHope protocol.…”

Section: Verification Of the Proposed Upper Bounds On Dfr Of Newhopementioning

confidence: 99%

See 1 more Smart Citation

Analysis of Error Dependencies on Newhope

et al. 2020

View full text Add to dashboard Cite

Among many submissions to the NIST post-quantum cryptography (PQC) project, NewHope is a promising key encapsulation mechanism (KEM) based on the Ring-Learning with errors (Ring-LWE) problem. Since NewHope is an indistinguishability (IND)-chosen ciphertext attack secure KEM by applying the Fujisaki-Okamoto transform to an IND-chosen plaintext attack secure public key encryption, accurate calculation of decryption failure rate (DFR) is required to guarantee resilience against attacks that exploit decryption failures. However, the current upper bound on DFR of NewHope is rather loose because the compression noise, the effect of encoding/decoding of NewHope, and the approximation effect of centered binomial distribution are not fully considered. Furthermore, since NewHope is a Ring-LWE based cryptosystem, there is a problem of error dependency among error coefficients, which makes accurate DFR calculation difficult. In this paper, we derive much tighter upper bound on DFR than the current upper bound using constraint relaxation and union bound. Especially, the above-mentioned factors are all considered in derivation of new upper bound and the centered binomial distribution is not approximated to subgaussian distribution. In addition, since the error dependency is considered, the new upper bound is much closer to the real DFR than the previous upper bound. Furthermore, the new upper bound is parameterized by using Chernoff-Cramer bound in order to facilitate calculation of new upper bound for the parameters of NewHope. Since the new upper bound is much lower than the DFR requirement of PQC, this DFR margin is used to improve the security and bandwidth efficiency of NewHope. As a result, the security level of NewHope is improved by 7.2 % or bandwidth efficiency is improved by 5.9 %. This improvement in the security and bandwidth efficiency can be easily achieved because there is little change in time/space complexity of NewHope.

show abstract

“…To reduce the failure rate, some schemes utilize error correcting codes (ECC) to make the decryption resilient against a certain number of errors. The NIST candidate LAC [14] relies on extensive error correction, and Fritzmann et al [6] made a study on the positive impact of the usage of ECC's on the security and bandwidth of lattice-based schemes. Another possibility is to eliminate decryption failures altogether and thus eliminate attacks that exploit them, by selecting the parameter of the scheme accordingly.…”

Section: Introductionmentioning

confidence: 99%

The Impact of Error Dependencies on Ring/Mod-LWE/LWR Based Schemes

D’Anvers

Vercauteren

Verbauwhede

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Current estimation techniques for the probability of decryption failures in Ring/Mod-LWE/LWR based schemes assume independence of the failures in individual bits of the transmitted message to calculate the full failure rate of the scheme. In this paper we disprove this assumption both theoretically and practically for schemes based on Ring/Mod-Learning with Errors/Rounding. We provide a method to estimate the decryption failure probability, taking into account the bit failure dependency. We show that the independence assumption is suitable for schemes without error correction, but that it might lead to underestimating the failure probability of algorithms using error correcting codes. In the worst case, for LAC-128, the failure rate is 2 48 times bigger than estimated under the assumption of independence. This higherthan-expected failure rate could lead to more efficient cryptanalysis of the scheme through decryption failure attacks.

show abstract

Analysis of Error-Correcting Codes for Lattice-Based Key Exchange

Cited by 25 publications

References 14 publications

Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs

Generic Side-channel attacks on CCA-secure lattice-based PKE and KEMs

Analysis of Error Dependencies on Newhope

The Impact of Error Dependencies on Ring/Mod-LWE/LWR Based Schemes

Contact Info

Product

Resources

About