SIKE Channels

Abstract

We present new side-channel attacks on SIKE, the isogeny-based candidate in the NIST PQC competition. Previous works had shown that SIKE is vulnerable to differential power analysis, and pointed to coordinate randomization as an effective countermeasure. We show that coordinate randomization alone is not sufficient, because SIKE is vulnerable to a class of attacks similar to refined power analysis in elliptic curve cryptography, named zero-value attacks. We describe and confirm in the lab two such attacks leading to full key recovery, and analyze their countermeasures.

An Efficient Key Recovery Attack on SIDH

“…In particular, it cannot be adjusted in an obvious way to attack primitives that do not reveal this information, such as CRS/CSIDH [10], [39], [7] and SQISign [12], and the general supersingular isogeny path problem remains unaffected [44]. We forward the reader to an online project, initiated by De Feo, which attempts at organizing the most popular isogeny-based cryptographic protocols and their best classical and quantum attacks [14].…”

“…Turning this decision method into a key recovery algorithm works along the lines of Section 6. First, we look for the smallest β ≥ 1 for which there exists an integer α ≥ 0 such that c = 2 a−α − 3 b−β (14) is smooth (this is an optimistic goal!). Then, for each guess for the first degree-3 β -component κ 1 of ϕ, we run our test to see whether or not there exists a degree-3 b−β -isogeny κ 1 (E 0 ) → E mapping 2 α κ 1 (P 0 ) to 2 α P and 2 α κ 1 (Q 0 ) to 2 α Q.…”

“…Once κ 1 is found, we can proceed by steps of degree 3 as in Section 7.3. Since smoothness is such a rare event, it actually makes sense to recycle the expression (14) all along. Then we can also recycle our auxiliary isogeny γ, i.e., it only has to be computed once, including pushing through torsion points.…”

Attribute-Based Encryption Schemes for Next Generation Wireless IoT Networks: A Comprehensive Survey

“…This implementation aims to provide efficient and secure cryptographic operations on resource-constrained devices such as the Cortex-M4. On the other hand, SIKE (supersingular isogeny key encapsulation) can also be implemented on Cortex-M4 [55,56]. It is a post-quantum key exchange scheme based on isogeny-based cryptography.…”