Abstract:Leakages during the signing process, including partial key exposure and partial (or complete) randomness exposure, may be devastating for the security of digital signatures. In this work, we investigate the security of lattice-based Fiat-Shamir signatures in the presence of randomness leakage. To this end, we present a generic key recovery attack that relies on minimum leakage of randomness, and then theoretically connect it to a variant of Integer-LWE (ILWE) problem. The ILWE problem, introduced by Bootle et al. at Asiacrypt 2018, is to recover the secret vector s given polynomially many samples of the form $({text{a}}, langle {text{a}}, {text{s}} rangle + text {e}) in mathbb {Z}^{text {n}+1}$ , and it is solvable if the error $text {e} in mathbb {Z}$ is not superpolynomially larger than the inner product $langle {text{a}}, {text{s}} rangle $ . However, in our variant (we call the variant FS-ILWE problem in this paper), ${text{a}}in mathbb {Z}^{text {n}}$ is a sparse vector whose coefficients are NOT independent any more, and e is related to a and s as well. We prove that the FS-ILWE problem can be solved in polynomial time, and present an efficient algorithm to solve it. Our generic key recovery method directly implies that many lattice-based Fiat-Shamir signatures will be totally broken with one (deterministic or probabilistic) bit of randomness leakage per signature. Our attack has been validated by experiments on two NIST PQC signatures Dilithium and qTESLA. For example, as to Dilithium-III of 125-bit quantum security, the secret key will be recovered within 10 seconds over an ordinary PC desktop, with about one million signatures. Similar-y, key recovery attacks on Dilithium under other parameters and qTESLA will be completed within 20 seconds and 31 minutes respectively. In addition, we also present a non-profiled attack to show how to obtain the required randomness bit in practice through power analysis attacks on a proof-of-concept implementation of polynomial addition. The experimental results confirm the practical feasibility of our method.

Leakage of Signal Function with Reused Keys in RLWE Key Exchange

Complete Attack On Rlwe Key Exchange With Reused Keys, Without Signal Leakage

Practical Randomized RLWE-Based Key Exchange Against Signal Leakage Attack.

How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys

Light the Signal: Optimization of Signal Leakage Attacks Against LWE-Based Key Exchange

How to Validate the Secret of a Ring Learning with Errors (RLWE) Key

Key Exchange and Authenticated Key Exchange with Reusable Keys Based on RLWE Assumption

One Sample Ring-LWE with Rounding and Its Application to Key Exchange.

Cryptanalysis of RLWE-Based One-Pass Authenticated Key Exchange

Provably Secure Password Authenticated Key Exchange Based On Rlwe For The Post-Quantum World

Comparison Analysis and Efficient Implementation of Reconciliation-Based RLWE Key Exchange Protocol.

A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem.

Identity-Concealed Authenticated Encryption from Ring Learning with Errors

On Security Analysis of an After-the-fact Leakage Resilient Key Exchange Protocol

Algebraic Side-Channel Attacks on KLEIN

On the Security of Lattice-Based Fiat-Shamir Signatures in the Presence of Randomness Leakage

Leakage-Resilient Anonymous Heterogeneous Multi-Receiver Hybrid Encryption in Heterogeneous Public-Key System Settings

A Simple and Practical Key Reuse Attack on NTRU Cryptosystem

Exploiting Redundant Randomness for Resisting Key Exposure in Encrypted Communication Systems

Finite-key security analysis for quantum key distribution with leaky sources

Provably Secure Three-Party Password-Based Authenticated Key Exchange From Rlwe