Power Analysis on NTRU Prime

Abstract

This paper applies a variety of power analysis techniques to several implementations of NTRU Prime, a Round 2 submission to the NIST PQC Standardization Project. The techniques include vertical correlation power analysis, horizontal indepth correlation power analysis, online template attacks, and chosen-input simple power analysis. The implementations include the reference one, the one optimized using smladx, and three protected ones. Adversaries in this study can fully recover private keys with one single trace of short observation span, with few template traces from a fully controlled device similar to the target and no a priori power model, or sometimes even with the naked eye. The techniques target the constant-time generic polynomial multiplications in the product scanning method. Though in this work they focus on the decapsulation, they also work on the key generation and encapsulation of NTRU Prime. Moreover, they apply to the ideal-lattice-based cryptosystems where each private-key coefficient comes from a small set of possibilities.

Magnifying Side-Channel Leakage of Lattice-Based Cryptosystems With Chosen Ciphertexts: The Case Study of Kyber

“…Other side-channel attacks on lattice-based public-key cryptosystems include template attack by Primas et al [PPM17] and horizontal differential power analysis (DPA) attack by Aysu et al [ATT + 18]. Recently Huang et al [HCY20] applied several power analysis methods to recover the private key from NTRU-Prime [BCLvV17]. Most of these attacks target primitive computations, such as polynomial multiplications, where the long-term secret-key is used as an operand.…”

A Systematic Study of Lattice-based NIST PQC Algorithms: from Reference Implementations to Hardware Accelerators

“…Generally speaking, the last few years have brought a tremendous increase in the literature covering performance evaluations/comparisons of lattice-based cryptography. The algorithms considered in NIST's standardization process have received a fair share of the attention and have been implemented in different platforms [20][21][22][23][24][25][26][27][28][29] (i.e., purely software, SW/HW co-design, FPGA, and ASIC). However, there are several shortcomings to these studies, even before we consider the specific challenges of ASIC implementation.…”

“…Software-based implementations [20,21]. An evaluation study that focuses on the energy efficiency of software implementations is provided in [20].…”

“…An evaluation study that focuses on the energy efficiency of software implementations is provided in [20]. A power analysis on software implementations of NTRU-Prime algorithm is presented in [21]. However, it must be emphasized that drawing power or energy figures from software implementations is not necessarily representative of what an ASIC implementation would eventually consume.…”

Masking Kyber: First- and Higher-Order Implementations

“…Since then, it has been demonstrated that an adversary can utilize the non-constant time behavior of Gaussian samplers [BHLY16,EFGT17] as well as a generic cache-attack behavior [BBK + 17]. Power analysis attacks on lattices have been shown to be able to attack even masked implementations of lattice-based cryptography by targeting the number theoretic transform [PPM17, PP19, XPRO20], message encoding [RBRC20, ACLZ20], polynomial multiplication [HCY19], error correcting codes [DTVV19], decoders [SRSW20] or CCA-transform [GJN20,RRCB20].…”