Polynomial-Time Key-Recovery Attack on the NIST Specification of PROV - Archive ouverte HAL Accéder directement au contenu
Pré-Publication, Document De Travail Année : 2024

Polynomial-Time Key-Recovery Attack on the NIST Specification of PROV

Ludovic Perret
  • Fonction : Auteur
  • PersonId : 935330
  • IdRef : 123278864

Résumé

In this paper, we present an efficient attack against PROV, a recent variant of the popular Unbalanced Oil and Vinegar (UOV) multivariate signature scheme, that has been submitted to the ongoing NIST standardization process for additional post-quantum signature schemes. A notable feature of PROV is its proof of security, namely, existential unforgeability under a chosen-message attack (EUF-CMA), assuming the hardness of solving the system formed by the public-key non-linear equations. We present a polynomial-time key-recovery attack against the first specification of PROV (v1.0). To do so, we remark that a small fraction of the PROV secret-key is leaked during the signature process. Adapting and extending previous works on basic UOV, we show that the entire secret-key can be then recovered from such a small fraction in polynomial-time. This leads to an efficient attack against PROV that we validated in practice. For all the security parameters suggested in by the authors of PROV, our attack recovers the secret-key in at most 8 seconds. We conclude the paper by discussing the apparent mismatch between such a practical attack and the theoretical security claimed by PROV designers. Our attack is not structural but exploits that the current specification of PROV differs from the required security model. A simple countermeasure makes PROV immune against the attack presented here and led the designers to update the specification of PROV (v1.1).
Fichier principal
Vignette du fichier
Notes_PROV.pdf (439.17 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04466417 , version 1 (19-02-2024)

Identifiants

  • HAL Id : hal-04466417 , version 1

Citer

Ludovic Perret, River Moreira Ferreira. Polynomial-Time Key-Recovery Attack on the NIST Specification of PROV. 2024. ⟨hal-04466417⟩
31 Consultations
26 Téléchargements

Partager

Gmail Facebook X LinkedIn More