Abstract:Code-based public-key cryptosystems are promising candidates for standardization as quantum-resistant public-key cryptographic algorithms. Their security is based on the hardness of the syndrome decoding problem. Computing the syndrome in a finite field, usually F2documentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {F}_{2}$$end{document}, guarantees the security of the constructions. We show in this article that the problem becomes considerably easier to solve if the syndrome is computed in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} instead. By means of laser fault injection, we illustrate how to compute the matrix-vector product in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document} by corrupting specific instructions, and validate it experimentally. To solve the syndrome decoding problem in Ndocumentclass[12pt]{minimal}usepackage{amsmath}usepackage{wasysym}usepackage{amsfonts}usepackage{amssymb}usepackage{amsbsy}usepackage{mathrsfs}usepackage{upgreek}setlength{oddsidemargin}{-69pt}egin{document}$$mathbb {N}$$end{document}, we propose a reduction to an integer linear programming problem. We leverage the computational efficiency of linear programming solvers to obtain real-time message recovery attacks against the code-based proposal to the NIST Post-Quantum Cryptography standardization challenge. We perform our attacks in the worst-case scenario, i.e. considering random binary codes, and retrieve the initial message within minutes on a desktop computer.Our attack targets the reference implementation of the Niederreiter cryptosystem in the NIST PQC competition finalist Classic McEliece and is practically feasible for all proposed parameters sets of this submission. For example, for the 256-bit security parameters sets, we successfully recover the message in a couple of seconds on a desktop computer Finally, we highlight the fact that the attack is still possible if only a fraction of the syndrome entries are faulty. This makes the attack feasible even though the fault injection does not have perfect repeatability and reduces the computational complexity of the attack, making it even more practical overall.

Algebraic Attacks on Round-Reduced RAIN and Full AIM-III.

Algebraic, Aida/Cube And Side Channel Analysis Of Katan Family Of Block Ciphers

An Algebraic Attack on Ciphers with Low-Degree Round Functions: Application to Full MiMC

Theoretical Round Modification Fault Analysis on AEGIS-128 with Algebraic Techniques

Differential Fault Attacks on Privacy Protocols Friendly Symmetric-Key Primitives: RAIN and HERA

Enhanced Side-Channel Cube Attacks on PRESENT.

Algebraic Side-Channel Attacks on KLEIN

New Differential-Algebraic Attacks and Reparametrization of Rainbow

Integral Attacks on Pyjamask-96 and Round-Reduced Pyjamask-128

Quantum Attacks on 1K-AES and PRINCE

Classical and Quantum Meet-in-the-Middle Nostradamus Attacks on AES-like Hashing

A Complete Cryptanalysis of the Post-Quantum Multivariate Signature Scheme Himq-3

Improved Meet-In-The-Middle Attacks On Round-Reduced Aria

Cube Cryptanalysis Of Round-Reduced Acorn

New Complexity Estimation on the Rainbow-Band-Separation Attack

Analysis of partial key recovery attack on multivariate cryptographic transformations using rank systems

Combined Fault and DPA Protection for Lattice-Based Cryptography

Message-Recovery Laser Fault Injection Attack on the Classic McEliece Cryptosystem

A closer look at the belief propagation algorithm in side-channel attack on CCA-secure PQC KEM

Quantum Security Analysis of the Key-Alternating Ciphers

The Singularity Attack to the Multivariate Signature Scheme Himq-3.