NewHope二項式抽樣模板攻擊

A Template Attack on Binomial Sampling in NewHope

彭俊又(CHUN-YU PENG)

指導教授 ： 鄭振牟

國立臺灣大學/電機資訊學院/電子工程學研究所/碩士(2019年)

https://doi.org/10.6342/NTU201903050

摘要

NewHope是一個被看好極有可能成為未來後量子密碼系統的演算法。在分析它抵禦量子電腦攻擊的安全性之餘，密碼系統實作的安全性也是一項重要的議題。本論文中，我們首先分析NewHope演算法中可能成為旁通道分析目標的模組。接著，我們針對其二項式抽樣的實作進行旁通道模板攻擊。實驗的結果顯示出攻擊者可以從單一次的功率消耗波形中，以100\%的成功率分析出二項式抽樣出的秘密參數。

關鍵字

NewHope ； 後量子密碼學 ； 旁通道分析 ； 模板攻擊

並列摘要

The NewHope cryptosystem is a promising candidate for the future post-quantum cryptography standard. Besides its security against the attacks from quantum and classical computers, the side-channel security is also an important issue to the implementation of a cryptosystem. In this thesis, we first evaluate the potential side-channel vulnerabilities in the NewHope cryptosystem. Then, a template attack is presented, which can reveal the secret information generated by the Binomial Sampling Function and compromise the security of the cryptosystem. The result shows a 100% success rate of recovering the secrets by only using a single side-channel power consumption trace.

並列關鍵字

NewHope ； PQC ； Side-Channel Analysis ； Template Attack

參考文獻

[1] G. Alagic, G. Alagic, J. AlperinSheriff, D. Apon, D. Cooper, Q. Dang, Y.K. Liu, C. Miller, D. Moody, R. Peralta, et al. Status Report on the First Round of the NIST PostQuantum Cryptography Standardization Process. US Department of Commerce,National Institute of Standards and Technology, 2019.

[2] E. Alkim, L. Ducas, T. Pöppelmann, and P. Schwabe. Newhope without reconciliation. IACR Cryptology ePrint Archive, 2016:1157, 2016.

[3] E. Alkim, L. Ducas, T. Pöppelmann, and P. Schwabe. Postquantum key exchange—a new hope. In 25th {USENIX} Security Symposium ({USENIX} Security 16), pages 327–343, 2016.

[4] C. Archambeau, E. Peeters, F.X. Standaert, and J.J. Quisquater. Template attacks in principal subspaces. In International Workshop on Cryptographic Hardware and Embedded Systems, pages 1–14. Springer, 2006.

[5] A. Bauer, H. Gilbert, G. Renault, and M. Rossi. Assessment of the keyreuse resilience of newhope. In Cryptographers＇Track at the RSA Conference, pages 272–292. Springer, 2019.