Exploiting ROLLO’s constant-time implementations with a single-trace analysis - Archive ouverte HAL
Article Dans Une Revue Designs, Codes and Cryptography Année : 2023

Exploiting ROLLO’s constant-time implementations with a single-trace analysis

Résumé

ROLLO, for Rank-Ouroboros, LAKE and LOCKER, was a candidate to the second round of the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) standardization process. In the lastest update in April 2020, there was a key-encapsulation mechanism (ROLLO-I) and a public-key encryption scheme (ROLLO-II). In this paper, we propose a side-channel attack to recover the syndrome during the decapsulation process of ROLLO-I. From this syndrome, we explain how to recover the private key. We target two constant-time implementations: the C reference implementation and a C implementation available on GitHub. By capturing power measurements during the execution of the Gaussian elimination function, we are able to extract from a single trace each element of the syndrome. This attack can also be applied to the decryption process of ROLLO-II. Finally, we give countermeasures based on masking and randomization to protect future implementations. We also provide their impact regarding the execution time.
Fichier principal
Vignette du fichier
ROLLO_DCC_2023.pdf (2.06 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04166638 , version 1 (01-03-2024)

Licence

Identifiants

Citer

Agathe Cheriere, Lina Mortajine, Tania Richmond, Nadia El Mrabet. Exploiting ROLLO’s constant-time implementations with a single-trace analysis. Designs, Codes and Cryptography, 2023, Coding and Cryptography 2022, pp.1-26. ⟨10.1007/s10623-023-01227-3⟩. ⟨hal-04166638⟩
122 Consultations
50 Téléchargements

Altmetric

Partager

More