arXiv 2203.006372022-03-01cs.CR

对双锂签名方案的签名更正攻击

Signature Correction Attack on Dilithium Signature Scheme

Saad Islam, Koksal Mus, Richa Singh, Patrick Schaumont, Berk Sunar

摘要：

受量子计算机兴起的推动，现有的公钥密码系统预计将在未来十年内在数十亿台设备中被后量子方案取代。为了促进过渡，NIST正在运行一个标准化过程，该过程目前处于最后一轮。目前，只有三个数字签名方案在竞争中留下，其中Dilithium和Falcon是基于格的方案。经典的签名方案的错误攻击是利用错误签名对和正确签名对来恢复秘密密钥的，但只适用于确定性签名方案。为了对抗这种攻击，Dilithium提供了一个随机版本，使每个签名都是唯一的，即使在签署相同的消息时也是如此。在这项工作中，我们介绍了一种新的签名校正攻击，它不仅适用于确定性版本，但也Dilithium的随机版本，即使在使用AVX2指令的恒定时间实现是有效的。签名纠正攻击利用二锂的数学结构，通过使用错误的签名和公钥来恢复秘密密钥位。它可以工作的任何故障机制，可以引起单位翻转。为了演示，我们使用Rowhammer诱导故障。因此，我们的攻击不需要任何物理访问或特殊权限，因此也可以在共享云服务器上实现。我们对Dilithium进行了彻底的经典和量子安全分析，并成功恢复了安全级别2的3，072秘密密钥$s_1$中的1，851位。针对量子攻击者的格强度从$2^{128}$降低到$2^{81}$，而针对经典攻击者的格强度从$2^{141}$降低到$2^{89}$ .因此，可以采用签名校正攻击来实现对Dilithium（安全级别2）的实际攻击，如NIST后量子标准化过程的第3轮中所提出的。

英文摘要：

Motivated by the rise of quantum computers, existing public-key cryptosystems are expected to be replaced by post-quantum schemes in the next decade in billions of devices. To facilitate the transition, NIST is running a standardization process which is currently in its final Round. Only three digital signature schemes are left in the competition, among which Dilithium and Falcon are the ones based on lattices. Classical fault attacks on signature schemes make use of pairs of faulty and correct signatures to recover the secret key which only works on deterministic schemes. To counter such attacks, Dilithium offers a randomized version which makes each signature unique, even when signing identical messages. In this work, we introduce a novel Signature Correction Attack which not only applies to the deterministic version but also to the randomized version of Dilithium and is effective even on constant-time implementations using AVX2 instructions. The Signature Correction Attack exploits the mathematical structure of Dilithium to recover the secret key bits by using faulty signatures and the public-key. It can work for any fault mechanism which can induce single bit-flips. For demonstration, we are using Rowhammer induced faults. Thus, our attack does not require any physical access or special privileges, and hence could be also implemented on shared cloud servers. We perform a thorough classical and quantum security analysis of Dilithium and successfully recover 1,851 bits out of 3,072 bits of secret key $s_1$ for security level 2. The lattice strength against quantum attackers is reduced from $2^{128}$ to $2^{81}$ while the strength against classical attackers is reduced from $2^{141}$ to $2^{89}$. Hence, the Signature Correction Attack may be employed to achieve a practical attack on Dilithium (security level 2) as proposed in Round 3 of the NIST post-quantum standardization process.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

摘要：

英文摘要：

相关论文