a key recovery timing attack on post quantum primitives
play

A key-recovery timing attack on post-quantum primitives using the - PowerPoint PPT Presentation

Oct 24, 2023 •184 likes •994 views

A key-recovery timing attack on post-quantum primitives using the Fujisaki-Okamoto transformation and its application on FrodoKEM Qian Guo, Thomas Johansson, Alexander Nilsson August 10, 2020 Preliminaries Implementing Crypto Is Hard

  1. A key-recovery timing attack on post-quantum primitives using the Fujisaki-Okamoto transformation and its application on FrodoKEM Qian Guo, Thomas Johansson, Alexander Nilsson August 10, 2020

  2. Preliminaries

  3. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: 1

  4. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] 1

  5. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . 1

  6. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database 1

  7. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database Post quantum Schemes? 1

  8. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database Post quantum Schemes? • McEliece in 2010 and 2013 [Str10; Str13] 1

  9. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database Post quantum Schemes? • McEliece in 2010 and 2013 [Str10; Str13] • BLISS in 2016 [Bru+16] 1

  10. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database Post quantum Schemes? • McEliece in 2010 and 2013 [Str10; Str13] • BLISS in 2016 [Bru+16] • LAC & Ramstake in 2019 [D’A+19] 1

  11. Implementing Crypto Is Hard WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM As shown by attacks on: • DH / RSA / DSS in 1996 [Koc96] • Openssl in 2002 and 2016 [BB03; YGH16] . . . • 212 CVEs currently in NIST’s Vulnerability Database Post quantum Schemes? • McEliece in 2010 and 2013 [Str10; Str13] • BLISS in 2016 [Bru+16] • LAC & Ramstake in 2019 [D’A+19] This presentation: A general attack against the Fujisaki-Okamoto transformation. 1

  12. Our contribution WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The Fujisaki-Okamoto (FO) transform does not directly handle secret data, yet must be implemented in constant time. 2

  13. Our contribution WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The Fujisaki-Okamoto (FO) transform does not directly handle secret data, yet must be implemented in constant time. Potentially vulnerable NIST PQC candidates: FrodoKEM, LAC, BIKE (early version), HQC, ROLLO and RQC. Maybe others? 2

  14. Our contribution WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The Fujisaki-Okamoto (FO) transform does not directly handle secret data, yet must be implemented in constant time. Potentially vulnerable NIST PQC candidates: FrodoKEM, LAC, BIKE (early version), HQC, ROLLO and RQC. Maybe others? We show the attack for FrodoKEM (Lattice/LWE based). 2

  15. A quick, lightweight, background

  16. PKE’s and KEM’s WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM Publik Key Encryption Schemes sk , pk ← KeyGen ( · ) ( sk , pk ) ⇔ (secret key, public key) c ← PKE.CPA.Encrypt ( pk,m ) ( m , c ) ⇔ (plaintext, ciphertext) m ← PKE.CPA.Decrypt ( sk,c ) 3

  17. PKE’s and KEM’s WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM Publik Key Encryption Schemes sk , pk ← KeyGen ( · ) ( sk , pk ) ⇔ (secret key, public key) c ← PKE.CPA.Encrypt ( pk,m ) ( m , c ) ⇔ (plaintext, ciphertext) m ← PKE.CPA.Decrypt ( sk,c ) Key Encapsulation Mechanisms sk , pk ← KeyGen ( · ) c , ss ← KEM.CCA.Encaps ( pk ) ss ⇔ (shared secret) ss ← KEM.CCA.Decaps ( sk,c ) 3

  18. Security Models WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM PKE-schemes are often proven under the IND-CPA model 4

  19. Security Models WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM PKE-schemes are often proven under the IND-CPA model INDistinguishability under Chosen Plaintext Attack: Security game with no access to a decryption oracle. 4

  20. Security Models WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM PKE-schemes are often proven under the IND-CPA model INDistinguishability under Chosen Plaintext Attack: Security game with no access to a decryption oracle. Often, IND-CCA is desirable. 4

  21. Security Models WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM PKE-schemes are often proven under the IND-CPA model INDistinguishability under Chosen Plaintext Attack: Security game with no access to a decryption oracle. Often, IND-CCA is desirable. INDistinguishability under Chosen Ciphertext Attack: Security game with access to a decryption oracle. 4

  22. Security Models WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM PKE-schemes are often proven under the IND-CPA model INDistinguishability under Chosen Plaintext Attack: Security game with no access to a decryption oracle. Often, IND-CCA is desirable. INDistinguishability under Chosen Ciphertext Attack: Security game with access to a decryption oracle. The Fujisaki-Okamoto (FO) transform can be used to transform a CPA secure PKE-cipher into a CCA secure cipher. 4

  23. LWE and Code-based schemes WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM A common property: 5

  24. LWE and Code-based schemes WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM A common property: LWE encoding c = g ( pk , m ; r ) + e ( r ) Code-based encoding c = mG ⊕ e 5

  25. LWE and Code-based schemes WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM A common property: LWE encoding c = g ( pk , m ; r ) + e ( r ) Code-based encoding c = mG ⊕ e e can vary by a small degree without affecting decryption. 5

  26. LWE and Code-based schemes WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM A common property: LWE encoding c = g ( pk , m ; r ) + e ( r ) Code-based encoding c = mG ⊕ e e can vary by a small degree without affecting decryption. Decryption fails if e varies by a larger degree. 5

  27. Fujisaki-Okamoto I WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The FO-transform can be used to transform a CPA secure PK-cipher into a CCA secure non-malleable KEM: 6

  28. Fujisaki-Okamoto I WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The FO-transform can be used to transform a CPA secure PK-cipher into a CCA secure non-malleable KEM: Algorithm 1: KEM.CCA.Encaps Input: pk Output: ( c , ss ) 1 pick a random m 2 ( r , k ) ← H ( m , pk ) 3 c ← PKE.CPA.Encrypt ( pk,m;r ) 4 ss ← H ( c , k ) 5 return ( c , ss ) 6

  29. Fujisaki-Okamoto I WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The FO-transform can be used to transform a CPA secure PK-cipher into a CCA secure non-malleable KEM: Algorithm 1: KEM.CCA.Encaps Input: pk Output: ( c , ss ) 1 pick a random m 2 ( r , k ) ← H ( m , pk ) 3 c ← PKE.CPA.Encrypt ( pk,m;r ) /* IND-CPA secure */ 4 ss ← H ( c , k ) 5 return ( c , ss ) 6

  30. Fujisaki-Okamoto II WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The decapsulation function decodes and compare the re-encoding with the received ciphertext. 7

  31. Fujisaki-Okamoto II WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The decapsulation function decodes and compare the re-encoding with the received ciphertext. Algorithm 2: KEM.CCA.Decaps Input: ( sk , pk , c ) Output: ( ss ) 1 m ′ ← PKE.CPA.Decrypt ( sk,c ) 2 ( r ′ , k ′ ) ← H ( m ′ , pk ) 3 c ′ ← PKE.CPA.Encrypt ( pk,m’;r ) 4 if ( c ′ = c ) then return ss ′ ← H ( c , k ) 5 else return ss ′ ← H ( c , k ′ ) 6 end if 7 return ( c , ss ) 7

  32. Fujisaki-Okamoto II WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The decapsulation function decodes and compare the re-encoding with the received ciphertext. Algorithm 2: KEM.CCA.Decaps Input: ( sk , pk , c ) Output: ( ss ) 1 m ′ ← PKE.CPA.Decrypt ( sk,c ) 2 ( r ′ , k ′ ) ← H ( m ′ , pk ) 3 c ′ ← PKE.CPA.Encrypt ( pk,m’;r ) 4 if ( c ′ = c ) then return ss ′ ← H ( c , k ) 5 else return ss ′ ← H ( c , k ′ ) 6 end if 7 return ( c , ss ) 7

  33. Fujisaki-Okamoto II WALLENBERG AI, AUTONOMOUS SYSTEMS AND SOFTWARE PROGRAM The decapsulation function decodes and compare the re-encoding with the received ciphertext. Algorithm 2: KEM.CCA.Decaps Input: ( sk , pk , c ) Output: ( ss ) 1 m ′ ← PKE.CPA.Decrypt ( sk,c ) 2 ( r ′ , k ′ ) ← H ( m ′ , pk ) 3 c ′ ← PKE.CPA.Encrypt ( pk,m’;r ) 4 if ( c ′ = c ) then return ss ′ ← H ( c , k ) 5 else return ss ′ ← H ( c , k ′ ) 6 end if 7 return ( c , ss ) 7

Recommend

Open-Source FPGA Implementation of Post-Quantum Cryptographic Hardware Primitives Rashmi Agrawal

Open-Source FPGA Implementation of Post-Quantum Cryptographic Hardware Primitives Rashmi Agrawal

Open-Source FPGA Implementation of Post-Quantum Cryptographic Hardware Primitives Rashmi Agrawal , Bu Lake, Alan Ehret, and Michel Kinsy Adaptive & Secure Computing Systems Lab Department of Electrical & Computer Engineering Boston

964 views • 48 slides
1 11/05/2016 18:35 Strong recovery in Q4 post cyber attack Lowest ever churn Flat net

1 11/05/2016 18:35 Strong recovery in Q4 post cyber attack Lowest ever churn Flat net

1 11/05/2016 18:35 Strong recovery in Q4 post cyber attack Lowest ever churn Flat net adds Strongest quarter of RGU growth +148k FY EBITDA 260m in line with guidance; material step up in H2 margin to 18.4% Reiterating FY17

651 views • 43 slides
Post-Quantum EPID Signatures from Symmetric Primitives Dan Boneh Saba Eskandarian Ben Fisch

Post-Quantum EPID Signatures from Symmetric Primitives Dan Boneh Saba Eskandarian Ben Fisch

Post-Quantum EPID Signatures from Symmetric Primitives Dan Boneh Saba Eskandarian Ben Fisch Hardware Enclaves A trusted component in an untrusted system Protected memory isolates enclave from compromised OS Untrusted System Enclave

505 views • 34 slides
The Quantum Risk & Post-Quantum Crypto JP Aumasson The Quantum Risk & Post-Quantum

The Quantum Risk & Post-Quantum Crypto JP Aumasson The Quantum Risk & Post-Quantum

The Quantum Risk & Post-Quantum Crypto JP Aumasson The Quantum Risk & Post-Quantum Crypto JP Aumasson uantum /me 15 years experience in applied cryptography (PhD, industry, consulting) Designed widely used algorithms Author of the

816 views • 52 slides
Implementing post-quantum cryptography Peter Schwabe Radboud University, Nijmegen, The

Implementing post-quantum cryptography Peter Schwabe Radboud University, Nijmegen, The

Implementing post-quantum cryptography Peter Schwabe Radboud University, Nijmegen, The Netherlands June 28, 2018 PQCRYPTO Mini-School 2018, Taipei, Taiwan Part I: How to make software secure Implementing post-quantum cryptography 2 Timing

1.44k views • 116 slides
The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences:

The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences:

1 2 The post-quantum Internet Risk management Daniel J. Bernstein Combining congruences: state-of-the-art pre-quantum University of Illinois at Chicago & attack against original DH, Technische Universiteit Eindhoven RSA, and some

2.34k views • 171 slides
Timing Recovery at Low SNR Cramer-Rao bound, and outperforming the PLL Aravind R. Nayak John R.

Timing Recovery at Low SNR Cramer-Rao bound, and outperforming the PLL Aravind R. Nayak John R.

I N S T A I T I G U R T O E E G O F E H T T E C F H P R O G R E S S S E R V I C E O N A N D O L L A O E G S Y 1 8 8 5 Timing Recovery at Low SNR

820 views • 38 slides
Post-Quantum Zero-Knowledge Proofs for Accumulators with Applications to Ring Signatures from

Post-Quantum Zero-Knowledge Proofs for Accumulators with Applications to Ring Signatures from

Post-Quantum Zero-Knowledge Proofs for Accumulators with Applications to Ring Signatures from Symmetric-Key Primitives David Derler , Sebastian Ramacher , Daniel Slamanig PQC rypto 18, April 9, 2018 1 Ring Signatures P

612 views • 27 slides
Quantum Algorithms Tutorial Ronald de Wolf 1/ 37 Post-quantum cryptography I Quantum computers

Quantum Algorithms Tutorial Ronald de Wolf 1/ 37 Post-quantum cryptography I Quantum computers

Quantum Algorithms Tutorial Ronald de Wolf 1/ 37 Post-quantum cryptography I Quantum computers can break public-key cryptography that is based on assuming hardness of factoring, discrete logs, and a few other problems I Post-quantum

2.98k views • 37 slides
A Side-Channel Assisted Cryptanalytic Attack Against QcBits Mlissa Rossi Mike Hamburg

A Side-Channel Assisted Cryptanalytic Attack Against QcBits Mlissa Rossi Mike Hamburg

A Side-Channel Assisted Cryptanalytic Attack Against QcBits Mlissa Rossi Mike Hamburg Michael Hutter Mark E. Marson Possible path for post-quantum security Error-correcting codes Quantum computers may threaten the mathematical

892 views • 66 slides
Computing World Dan Boneh and Mark Zhandry Stanford University Classical Chosen Message Attack

Computing World Dan Boneh and Mark Zhandry Stanford University Classical Chosen Message Attack

Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World Dan Boneh and Mark Zhandry Stanford University Classical Chosen Message Attack (CMA) m = S(sk, m) signing key sk Classical CMA + Quantum Computer (post-quantum

341 views • 21 slides
SW/HW Codesign of the Post-Quantum Cryptography Algorithm NTRUEncrypt Using HLS and RTL Design

SW/HW Codesign of the Post-Quantum Cryptography Algorithm NTRUEncrypt Using HLS and RTL Design

SW/HW Codesign of the Post-Quantum Cryptography Algorithm NTRUEncrypt Using HLS and RTL Design Methodologies Farnoud Farahmand, Duc Tri Nguyen, Viet B. Dang*, Ahmed Ferozpuri and Kris Gaj George Mason University Post st-Quantum Quantum

441 views • 14 slides
Standardization of post-quantum cryptography Tanja Lange 08 May 2016 A Workshop About

Standardization of post-quantum cryptography Tanja Lange 08 May 2016 A Workshop About

Standardization of post-quantum cryptography Tanja Lange 08 May 2016 A Workshop About Cryptographic Standards History of post-quantum cryptography 2003 Daniel J. Bernstein introduces term Post-quantum cryptography. PQCrypto 2006:

623 views • 23 slides
Iterative Timing Recovery John R. Barry School of Electrical and Computer Engineering, Georgia

Iterative Timing Recovery John R. Barry School of Electrical and Computer Engineering, Georgia

Iterative Timing Recovery John R. Barry School of Electrical and Computer Engineering, Georgia Tech Atlanta, Georgia U.S.A. barry@ece.gatech.edu 0 Outline Timing Recovery Tutorial Problem statement TED: M&M, LMS, S-curves

859 views • 56 slides
Post-Synthesis Simulation VITAL Models, SDF Files, Timing Simulation Post-synthesis simulation

Post-Synthesis Simulation VITAL Models, SDF Files, Timing Simulation Post-synthesis simulation

Post-Synthesis Simulation VITAL Models, SDF Files, Timing Simulation Post-synthesis simulation Purpose: Verify correctness of synthesized circuit Verify synthesis tool delay/timing estimates Synthesis tool generates: Gate-level

363 views • 18 slides
Incorporating Post-Quantum Cryptography in a microservice architecture Research Project 2 Why

Incorporating Post-Quantum Cryptography in a microservice architecture Research Project 2 Why

R. van der Gaag, D. Weller Incorporating Post-Quantum Cryptography in a microservice architecture Research Project 2 Why think about post-quantum cryptography W. Buchanan et. al concluded Gate-based quantum computers pose a significant

349 views • 18 slides
Again Guideline of IPA Again Guideline of IPA We respect the IPAs policy so that we reported

Again Guideline of IPA Again Guideline of IPA We respect the IPAs policy so that we reported

Extended APOP Password Extended APOP Password Recovery Attack Recovery Attack Yu Sasaki, Lei Wang, Kazuo Ohta and Noboru Kunihiro (The University of Electro-Communications) 31 characters can be recovered. Remark: This research was done only

117 views • 7 slides
Post-Quantum Cryptography Dr. Ruben Niederhagen, February 8, 2016 Introduction Quantum Computers

Post-Quantum Cryptography Dr. Ruben Niederhagen, February 8, 2016 Introduction Quantum Computers

Post-Quantum Cryptography Dr. Ruben Niederhagen, February 8, 2016 Introduction Quantum Computers Using quantum states for computation: Introduced in 1985 by David Deutsch [3]. Operate on qubits using gates that perform reversible

1.69k views • 157 slides
Post-Conflict Recovery: Post-Conflict Recovery: Best-case National Organizations Best-case

Post-Conflict Recovery: Post-Conflict Recovery: Best-case National Organizations Best-case

Post-Conflict Recovery: Post-Conflict Recovery: Best-case National Organizations Best-case National Organizations B. Knauft Emory University Carnegie CPRP Program 2013-2015 States in Transition Priorities States in Transition Priorities n

295 views • 15 slides
CS412 Software Security Software Bugs Mathias Payer EPFL, Spring 2019 Mathias Payer CS412

CS412 Software Security Software Bugs Mathias Payer EPFL, Spring 2019 Mathias Payer CS412

CS412 Software Security Software Bugs Mathias Payer EPFL, Spring 2019 Mathias Payer CS412 Software Security From Software Bugs to Attack Primitives Attack primitives are exploit building blocks Software bugs map to attack primitives , i.e.,

512 views • 23 slides
A Timing Attack on Hyperelliptic Curve Cryptosystems Asiacrypt 2003 rump session on Dec. 2 nd ,

A Timing Attack on Hyperelliptic Curve Cryptosystems Asiacrypt 2003 rump session on Dec. 2 nd ,

A Timing Attack on Hyperelliptic Curve Cryptosystems Asiacrypt 2003 rump session on Dec. 2 nd , 2003 M.Katagi, I.Kitamura, T.Akishita, and T. Takagi(*) Sony Corporation (*)Technische Universitaet Darmstadt Introduction Optimization of

229 views • 5 slides
The Picnic Post-Quantum Signature Scheme and its Security Analysis Itai Dinur Ben-Gurion

The Picnic Post-Quantum Signature Scheme and its Security Analysis Itai Dinur Ben-Gurion

The Picnic Post-Quantum Signature Scheme and its Security Analysis Itai Dinur Ben-Gurion University Credit for some slides: Melissa Chase and Picnic team Post-Quantum Cryptography Large-scale quantum computer could efficiently factor large

533 views • 34 slides
17-654: Analysis of Software Systems Spring 2005 4/21/2005 Topics Timing attack

17-654: Analysis of Software Systems Spring 2005 4/21/2005 Topics Timing attack

17-654: Analysis of Software Systems Spring 2005 4/21/2005 Topics Timing attack Algorithms leak information Nice example of practice trumping theoretical security Hardening algorithms: randomization Privilege separation

1.11k views • 69 slides
A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. Gpfert, C. van Vredendaal,

A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. Gpfert, C. van Vredendaal,

A Hybrid Lattice Reduction and Quantum Search Attack on LWE F. Gpfert, C. van Vredendaal, Thomas Wunderer 29.06.2017 | 1 Motivation Primal BKW Embedding LWE Hybrid Dual Embedding Make it quantum! Faster More versatile

553 views • 28 slides

More recommend