Assessing the Feasibility of Single Trace Power Analysis of Frodo

Abstract

Lattice-based schemes are among the most promising postquantum schemes, yet the effect of both parameter and implementation choices on their side-channel resilience is still poorly understood. Aysu et al. (HOST'18) recently investigated single-trace attacks against the core lattice operation, namely multiplication between a public matrix and a "small" secret vector, in the context of a hardware implementation. We complement this work by considering single-trace attacks against software implementations of "ring-less" LWE-based constructions. Specifically, we target Frodo, one of the submissions to the standardisation process of NIST, when implemented on an (emulated) ARM Cortex M0 processor. We confirm Aysu et al.'s observation that a standard divide-and-conquer attack is insufficient and instead we resort to a sequential, extend-and-prune approach. In contrast to Aysu et al. we find that, in our setting where the power model is far from being as clear as theirs, both profiling and less aggressive pruning are needed to obtain reasonable key recovery rates for SNRs of practical relevance. Our work drives home the message that parameter selection for LWE schemes is a double-edged sword: the schemes that are deemed most secure against (black-box) lattice attacks can provide the least security when considering side-channels. Finally, we suggest some easy countermeasures that thwart standard extend-and-prune attacks.

LWE with Side Information: Attacks and Concrete Security Estimation

“…The ongoing standardization process and anticipated deployment of lattice-based cryptography raises an important question: How resilient are lattices to side-channel attacks or other forms of side information? While there are numerous works addressing this question for specific cryptosystems (See [2,9,17,18,32,33] for side channel attacks targeting lattice-based NIST candidates), these works use rather ad-hoc methods to reconstruct the secret key, requiring new techniques and algorithms to be developed for each setting. For example, the work of [9] uses brute-force methods for a portion of the attack, while [7] exploits linear regression techniques.…”

“…While there are numerous works addressing this question for specific cryptosystems (See [2,9,17,18,32,33] for side channel attacks targeting lattice-based NIST candidates), these works use rather ad-hoc methods to reconstruct the secret key, requiring new techniques and algorithms to be developed for each setting. For example, the work of [9] uses brute-force methods for a portion of the attack, while [7] exploits linear regression techniques. Moreover, ad-hoc methods do not allow (1) to take advantage of decades worth of research and (2) optimization of standard lattice attacks.…”

“…Our main example (Sect. 6.1) revisits the side channel information obtained from the first side-channel attack of [9] against Frodo. In that article, it was concluded that a divide-and-conquer side-channel template attack would not lead to a meaningful attack using standard combinatorial search for reconstruction of the secret.…”

Single-Trace Attacks on Message Encoding in Lattice-Based KEMs

“…Aysu et al [5] mounted horizontal DPA attacks on the hardware implementations of NewHope and FrodoKEM, extracting secret keys with a success rate of over 99% using a single trace. Bos et al [11] extended this attack considering ring-less LWE-based constructions by utilizing a single-trace template attack and reported the experimental results for a Frodo key-exchange protocol, which was later updated to FrodoKEM. More DPA attacks targeting the multiplications of the decryption phase in lattice-based PKE can be found in [37], [44], [45].…”

“…While attacking the encapsulation phase of KEM, it is only possible to use a single trace, as it encrypts a random secret message every time. Several research works were aimed at recovering random secret messages using a single trace [2], [5], [11]; however, the studies based on vulnerabilities of the message encoding operation in the encapsulation phase presented limitedly [2].…”