Single Trace Analysis on Constant Time CDT Sampler and Its Countermeasure

Abstract

The Gaussian sampler is an integral part in lattice-based cryptography as it has a direct connection to security and efficiency. Although it is theoretically secure to use the Gaussian sampler, the security of its implementation is an open issue. Therefore, researchers have started to investigate the security of the Gaussian sampler against side-channel attacks. Since the performance of the Gaussian sampler directly affects the performance of the overall cryptosystem, countermeasures considering only timing attacks are applied in the literature. In this paper, we propose the first single trace power analysis attack on a constant-time cumulative distribution table (CDT) sampler used in lattice-based cryptosystems. From our analysis, we were able to recover every sampled value in the key generation stage, so that the secret key is recovered by the Gaussian elimination. By applying our attack to the candidates submitted to the National Institute of Standards and Technology (NIST), we were able to recover over 99% of the secret keys. Additionally, we propose a countermeasure based on a look-up table. To validate the efficiency of our countermeasure, we implemented it in Lizard and measure its performance. We demonstrated that the proposed countermeasure does not degrade the performance.

Machine-Learning Side-Channel Attacks on the GALACTICS Constant-Time Implementation of BLISS

“…Kim et al [KH18] found that high-precision Gaussian samples based on CDT are not only inefficient in terms of required storage space, but also showed their insecurity by demonstrating a single trace power analysis attack. By recovering the Gaussian samples, they also break the security of the lattice-based scheme employing the sampler.…”

“…The deviation of the resulting values from a Gaussian distribution is compensated by an additional rejection condition based on a Bernoulli sample. Due to the blending with uniform values, even if the CDT sample values are obtained by an attack such as the one by Kim et al [KH18], the values of the final Gaussian sample cannot be derived. Thus, the secret key cannot be recovered as the solution to a system of linear equations.…”

Single-Trace Side-Channel Attacks on the Toom-Cook: The Case Study of Saber

“…There has been a lot of work focus on the risks of lattice-based cryptographic systems to side-channel attacks. Several works exploit vulnerabilities of different operations, including but not limited to polynomial multiplication [PPM17,HCY19,XPSR + 21,AKJ + 18], message encoding/decoding [ACLZ20, RBRC22, NDGJ21], Gaussian sampler [Pes16,KH18], or the Fujisaki-Okamoto (FO) transform [RSRCB20, BDH + 21]. In particular, the polynomial multiplication has attracted more attention for the vulnerability of long-term secret key.…”

Special Issue on “Side Channel Attacks”

“…Recently, PQCs, cryptographic algorithms executed on a classical computer which are expected to be secure against adversaries with quantum computers, have been actively studied. This special issue contains two papers about power analysis attacks on PQCs: The well-known NTRU algorithm, and a cumulative distribution table (CDT) sampler used in the lattice-based PQCs [64,65].Cache-based timing attacks: This special issue contains two research papers with regard to cache-based timing attacks, utilizing the timing difference between cache hits and cache misses. One paper proposes a new constant-time method for RSA modular exponentiation, which is resistant against fine-grained cache attacks [66].…”

“…Recently, PQCs, cryptographic algorithms executed on a classical computer which are expected to be secure against adversaries with quantum computers, have been actively studied. This special issue contains two papers about power analysis attacks on PQCs: The well-known NTRU algorithm, and a cumulative distribution table (CDT) sampler used in the lattice-based PQCs [64,65].…”