Paper 2016/449
Loop-Abort Faults on Lattice-Based Fiat–Shamir and Hash-and-Sign Signatures
Thomas Espitau, Pierre-Alain Fouque, Benoît Gérard, and Mehdi Tibouchi
Abstract
As the advent of general-purpose quantum computers appears to be drawing closer, agencies and advisory bodies have started recommending that we prepare the transition away from factoring and discrete logarithm-based cryptography, and towards postquantum secure constructions, such as lattice- based schemes. Almost all primitives of classical cryptography (and more!) can be realized with lattices, and the efficiency of primitives like encryption and signatures has gradually improved to the point that key sizes are competitive with RSA at similar security levels, and fast performance can be achieved both in soft- ware and hardware. However, little research has been conducted on physical attacks targeting concrete implementations of postquantum cryptography in general and lattice-based schemes in particular, and such research is essential if lattices are going to replace RSA and elliptic curves in our devices and smart cards. In this paper, we look in particular at fault attacks against implementations of lattice-based signature schemes, looking both at Fiat–Shamir type constructions (particularly BLISS, but also GLP, PASSSing and Ring-TESLA) and at hash-and-sign schemes (particularly the GPV-based scheme of Ducas–Prest– Lyubashevsky). These schemes include essentially all practical lattice-based signatures, and achieve the best efficiency to date in both software and hardware. We present several fault attacks against those schemes yielding a full key recovery with only a few or even a single faulty signature, and discuss possible countermeasures to protect against these attacks.
Metadata
- Available format(s)
-
PDF
- Publication info
- Preprint. MINOR revision.
- Keywords
- Fault AttacksDigital SignaturesPostquantum CryptographyLatticesBLISSGPV
- Contact author(s)
- t espitau @ gmail com
- History
- 2016-06-01: last of 2 revisions
- 2016-05-07: received
- See all versions
- Short URL
- https://ia.cr/2016/449
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2016/449,
author = {Thomas Espitau and Pierre-Alain Fouque and Benoît Gérard and Mehdi Tibouchi},
title = {Loop-Abort Faults on Lattice-Based Fiat–Shamir and Hash-and-Sign Signatures},
howpublished = {Cryptology {ePrint} Archive, Paper 2016/449},
year = {2016},
url = {https://eprint.iacr.org/2016/449}
}