Chosen-Ciphertext Clustering Attack on CRYSTALS-KYBER Using the Side-Channel Leakage of Barrett Reduction
Bo-Yeon Sim, Aesun Park, Dong‐Guk Han · IEEE Internet of Things Journal · 2022
This study proposes a chosen-ciphertext side-channel attack against a lattice-based key encapsulation mechanism (KEM), the third-round candidate of the national institute of standards and technology (NIST) standardization project. Unlike existing attacks that target operations, such as inverse NTT and message encoding/decoding, we target$\mathsf {Barrett~reduction}$in the decapsulation phase of$\mathsf {CRYSTALS{-}KYBER}$to obtain a secret key. We show that a sensitive variable-dependent leakage of$\mathsf {Barrett~reduction}$exposes an entire secret key. The results of experiments conducted on the ARM Cortex-M4 microcontroller accomplish a success rate of 100%. We only need six chosen ciphertexts for$\mathsf {KYBER512}$and$\mathsf {KYBER768}$and eight chosen ciphertexts for$\mathsf {KYBER1024}$. We also show that the$\mathsf {m4}$scheme of the$\mathsf {pqm4}$library, an implementation with the ARM Cortex-M4 specific optimization (typically in assembly), is vulnerable to the proposed attack. In this scheme, six, nine, and twelve chosen ciphertexts are required for$\mathsf {KYBER512}$,$\mathsf {KYBER768}$, and$\mathsf {KYBER1024}$, respectively.