On configurable SCA countermeasures against single trace attacks for the NTT
The Number Theoretic Transform (NTT) is a critical subblock used in several structured lattice-based schemes, including Kyber and Dilithium, which are finalist candidates in the NIST’s standardization process for post-quantum cryptography. The NTT was shown to be susceptible to single trace side-c...
Saved in:
Main Authors: | , , , |
---|---|
Other Authors: | |
Format: | Conference or Workshop Item |
Language: | English |
Published: |
2021
|
Subjects: | |
Online Access: | https://hdl.handle.net/10356/147131 |
Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Institution: | Nanyang Technological University |
Language: | English |
Summary: | The Number Theoretic Transform (NTT) is a critical subblock used in several structured lattice-based schemes, including Kyber
and Dilithium, which are finalist candidates in the NIST’s standardization process for post-quantum cryptography. The NTT was shown to be
susceptible to single trace side-channel attacks by Primas et al. in CHES
2017 and Pessl et al. in Latincrypt 2019 who demonstrated full key recovery from single traces on the ARM Cortex-M4 microcontroller. However,
the cost of deploying suitable countermeasures to protect the NTT from
these attacks on the same target platform has not yet been studied. In
this work, we propose novel shuffling and masking countermeasures to
protect the NTT from such single trace attacks. Firstly, we exploit arithmetic properties of twiddle constants used within the NTT computation
to propose efficient and generic masking strategies for the NTT with
configurable SCA resistance. Secondly, we also propose new variants of
the shuffling countermeasure with varying granularity for the NTT. We
perform a detailed comparative evaluation of the runtime performances
for our proposed countermeasures within open source implementations
of Kyber and Dilithium from the pqm4 library on the ARM Cortex-M4
microcontroller. Our proposed countermeasures yield a reasonable runtime overhead in the range of 7%–78% across all procedures of Kyber,
while the runtime overheads are much more pronounced for Dilithium,
ranging from 12%–197% for the key generation procedure and 32%–
490% for the signing procedure. |
---|