Abstract:Code-based public-key cryptosystems are promising candidates for standardization as quantum-resistant public-key cryptographic algorithms. Their security is based on the hardness of the syndrome decoding problem. Computing the syndrome in a finite field, usually F2documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {F}_{2}$$end{document}, guarantees the security of the constructions. We show in this article that the problem becomes considerably easier to solve if the syndrome is computed in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} instead. By means of laser fault injection, we illustrate how to compute the matrix-vector product in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} by corrupting specific instructions, and validate it experimentally. To solve the syndrome decoding problem in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document}, we propose a reduction to an integer linear programming problem. We leverage the computational efficiency of linear programming solvers to obtain real-time message recovery attacks against the code-based proposal to the NIST Post-Quantum Cryptography standardization challenge. We perform our attacks in the worst-case scenario, i.e. considering random binary codes, and retrieve the initial message within minutes on a desktop computer.Our attack targets the reference implementation of the Niederreiter cryptosystem in the NIST PQC competition finalist Classic McEliece and is practically feasible for all proposed parameters sets of this submission. For example, for the 256-bit security parameters sets, we successfully recover the message in a couple of seconds on a desktop computer Finally, we highlight the fact that the attack is still possible if only a fraction of the syndrome entries are faulty. This makes the attack feasible even though the fault injection does not have perfect repeatability and reduces the computational complexity of the attack, making it even more practical overall.

A new method for solving polynomial systems with noise over and its applications in cold boot key recovery

Solving Polynomial Systems with Noise over F2: Revisited

On recovering block cipher secret keys in the cold boot attack setting

Recovering AES Keys with a Deep Cold Boot Attack

A Practical Cold Boot Attack on RSA Private Keys

Snowball: Another View on Side-Channel Key Recovery Tools.

Security Through Amnesia: A Software-Based Solution to the Cold Boot Attack on Disk Encryption

Algebraic Fault Analysis on GOST for Key Recovery and Reverse Engineering

Enhanced Side-Channel Cube Attacks on PRESENT.

Automated Search Oriented To Key Recovery On Ciphers With Linear Key Schedule Applications To Boomerangs In Skinny And Forkskinny

Automated Search Oriented to Key Recovery on Ciphers with Linear Key Schedule

Integer syndrome decoding in the presence of noise

Improved deep learning aided key recovery framework: applications to large-state block ciphers

Cryptanalysis of PASS II and MiniPass

Message-Recovery Laser Fault Injection Attack on the Classic McEliece Cryptosystem

Lossy Cryptography from Code-Based Assumptions

Analysis and Improvement of the Components of SNOW 2.0 Based on Statistical Tests

Solving Degree Bounds For Iterated Polynomial Systems

Combining MILP modeling with algebraic bias evaluation for linear mask search: improved fast correlation attacks on SNOW

Parity (XOR) Reasoning for the Index Calculus Attack

Optimizing Rectangle and Boomerang Attacks: A Unified and Generic Framework for Key Recovery