Single-Trace Attack on NIST Round 3 Candidate Dilithium Using Machine Learning-Based Profiling

Abstract

In this paper, we propose single-trace side-channel attacks against CRYSTALS-DILITHIUM. CRYSTALS-DILITHIUM is a lattice-based digital signature algorithm, one of the third round finalists of the national institute of standards and technology (NIST) standardization project. We attack number-theoretic transform (NTT) in the signing procedure and key generation of CRYSTALS-DILITHIUM to obtain a secret key. When targeting the signing procedure, we can recover both secret key vectors s 1 and s 2 . This enables forgery of signatures. However, only the secret key vector s 1 can be recovered when targeting the key generation. Thus, we additionally attack four operations, sampling, addition, rounding, and packing, to find s 2 . We applied a machine learning-based profiling attack method to find the secret key vectors s 1 and s 2 with a single trace.INDEX TERMS Digital signature, lattice-based cryptography, number-theoretic transform, side-channel attack, machine learning-based profiling attack.

In-depth Correlation Power Analysis Attacks on a Hardware Implementation of CRYSTALS-Dilithium

“…Primas et al (2017) proposed a generic method targeting NTT operations that requires establishing templates for all possible multiplications in butterfly operations, which is costly. Han et al (2021) employed a machine learning-based method to attack NTT operations, recovering keys using 60,000 power traces. Berzati et al (2023) reconstructed a given coefficient in a predicted vector to determine if it is zero, thus recovering the private key using linear algebra methods, with 700,000 power traces.…”

Implementation attacks on post-quantum lattice-based cryptography

“…Han et al [162] targeted the NTT instance over s 1 using a simple template attack, which could recover the complete secret polynomial s 1 in a single trace. They showed that an attacker can target leakage from the product of the secret coe cients with the twiddle factors in the first round of the NTT (i.e.)…”

“…Moreover, the attack is aided by the fact that there are only 5 possible candidates for coe cients of the secret s 1 . Han et al [162] targeted the reference implementation of Dilithium through the power side-channel on the ARM Cortex-M4 microcontroller to recover the entire secret s 1 in a single trace. We refer to this attack as the Simple_NTT_Template attack.…”