The CRYSTALS-Dilithium digital signature scheme, selected by NIST as a post-quantum cryptography (PQC) standard under the name ML-DSA, employs a public key compression technique intended for performance optimization. Specifically, the module learning with error instance (A, t) is compressed by omitting the low-order bits t0 of the vector t. It was recently shown that knowledge of t0 enables more effective side-channel attacks on Dilithium implementations. Another recent work demonstrated a method for reconstructing t0 from multiple signatures. In this paper, we build upon this method by applying profiled deep learning-assisted side-channel analysis to partially recover the least significant bit of t0 from power traces. As a result, the number of signatures required for the reconstruction of t0 can be reduced by roughly half. We demonstrate how the new t0 reconstruction method enhances the efficiency of recovering the secret key component s1, thereby facilitating digital signature forgery, on an ARM Cortex-M4 implementation of Dilithium.

In this paper, we present a side-channel attack on the hardware AES accelerator of a Bluetooth chip used in millions of devices worldwide, ranging from wearables and smart home products to industrial IoT. The attack leverages information about AES computations unintentionally transmitted by the chip together with RF signals to recover the encryption key. Unlike traditional side-channel attacks that rely on power or near-field electromagnetic emissions as sources of information, RF-based attacks leave no evidence of tampering, as they do not require package removal, chip decapsulation, or additional soldered components. However, side-channel emissions extracted from RF signals are considerably weaker and noisier, necessitating more traces for key recovery. The presented profiled machine learning-assisted attack can recover the full encryption key from 45,000 traces captured at a one-meter distance from the target device, with each trace being an average of 10,000 samples per encryption. This is a fourfold improvement over the correlation analysis-based attack on the same AES accelerator.

Traditional public key cryptosystems rely on the hardness of specific mathematical problems, such as integer factorization and discrete logarithm problem. However, these problems can be solved efficiently by Shor's algorithm on a large-scale quantum computer. Although the development of quantum computers has progressed slowly over the past 40 years, it is estimated that a cryptographically relevant quantum computer is likely to be available in 2040, which intensifies the need for quantum-resistant cryptographic algorithms. In response to the quantum threat, in 2016, NIST launched a competition for standardizing post-quantum cryptographic primitives. In August 2024, NIST selected CRYSTALS-Kyber as the public key encryption and key encapsulation standard, and CRYSTALS-Dilithium as the digital signature standard.

However, algorithms which are secure from the perspective of conventional cryptanalysis may still be vulnerable to physical attacks, such as side-channel attacks. This thesis evaluates the resilience of software implementations of three lattice-based post-quantum cryptographic algorithms: Saber, CRYSTALS-Kyber, and CRYSTALS-Dilithium to side-channel attacks.

The presented results are based on seven appended papers. Two of them focus on side-channel attacks on Saber, four target CRYSTALS-Kyber, and one considers CRYSTALS-Dilithium. The main contributions of the thesis are:

1. We evaluate and compare power side-channel and EM side-channel attacks, pointing that amplitude-modulated EM emissions are typically weaker and require a higher sampling rate for secret recovery. We also investigate the difficulty of performing attacks on protected and unprotected implementations.
2. We propose several methods to improve the attack efficiency. For example, a novel neural network model aggregation technique called threshold voting is introduced for deep learning-based attacks. A higher-order attack on CRYSTALS-Kyber is presented by combining the leakages from Barrett reduction and message decoding. Furthermore, an optimal chosen-ciphertext construction strategy is developed to maximize the probability of secret key recovery given a fixed probability of message bit recovery. 
3. We provide a thorough discussion of various attack scenarios, including attacks on encapsulation, decapsulation, and signing procedures. For each scenario, we outline the assumptions and requirements for a successful attack.
4. We present countermeasures to mitigate side-channel attacks at both the algorithmic and hardware levels. We also discuss the limitations of these countermeasures, as well as the challenges associated with deep learning-based attacks.

Most of the methods presented in this thesis are not limited to the specific algorithms described in the papers, and can be extended to other algorithms that are similar to Saber, CRYSTALS-Kyber, and CRYSTALS-Dilithium.

Traditionella kryptosystem med offentlig nyckel bygger på svårigheten i specifika matematiska problem, såsom faktorisering av heltal och problemet med diskreta logaritmer. Dessa problem kan dock lösas effektivt med Shors algoritm på en storskalig kvantdator. Även om utvecklingen av kvantdatorer har gått långsamt under de senaste 40 åren, beräknas det att en kryptografiskt relevant kvantdator sannolikt kommer att finnas tillgänglig år 2040, vilket ökar behovet av kvantresistenta kryptografiska algoritmer. Som svar på hotet från kvantdatorer lanserade NIST 2016 en tävling för standardisering av kvantdatorsäkra primitiver. I augusti 2024 valde NIST CRYSTALS-Kyber som standard för asymmetrisk kryptering och nyckelinkapsling, och CRYSTALS-Dilithium som standard för digitala signaturer.

Algoritmer som är säkra ur konventionell kryptanalytisk synvinkel kan dock fortfarande vara sårbara för fysiska attacker, såsom sidokanalsattacker. Denna avhandling utvärderar motståndskraften hos mjukvaruimplementationer av tre gitterbaserade kvantdatorsäkra algoritmer: Saber, CRYSTALS-Kyber och CRYSTALS-Dilithium mot sidokanalsattacker.

De presenterade resultaten baseras på sju bifogade artiklar. Två av dem fokuserar på sidokanalsattacker mot Saber, fyra riktar sig mot CRYSTALS-Kyber, och en behandlar CRYSTALS-Dilithium. Avhandlingens huvudsakliga bidrag är:

1. Vi utvärderar och jämför effektbaserade och EM-baserade sidokanalsattacker, och påpekar att amplitudmodulerade EM-emissioner typiskt är svagare och kräver högre samplingsfrekvens för att återskapa hemligheter. Vi undersöker även svårigheten med att utföra attacker på skyddade och oskyddade implementationer.
2. Vi föreslår flera metoder för att förbättra attackeffektiviteten. Till exempel introduceras en ny teknik för aggregering av neurala nätverksmodeller, kallad “threshold voting”, för attacker baserade på djupinlärning. En högre ordningens attack mot CRYSTALS-Kyber presenteras genom att kombinera läckage från Barrett-reduktion och meddelandede-kodning. Dessutom utvecklas en optimal strategi för valda chiffertextattacker för att maximera sannolikheten för att återskapa en hemlig nyckel givet en fast sannolikhet att återskapa av meddelandebitar.
3. Vi ger en grundlig diskussion av olika attackscenarier, inklusive attacker mot inkapsling, avkapsling och signering. För varje scenario redogör vi för antaganden och krav för en framgångsrik attack.
4. Vi presenterar motåtgärder för att försvåra sidokanalsattacker både på algoritm- och hårdvarunivå. Vi diskuterar också begränsningarna hos dessa motåtgärder samt utmaningarna med attacker baserade på djupinlärning.

De flesta metoder som presenteras i denna avhandling är inte begränsade till de specifika algoritmer som beskrivs i artiklarna, utan kan även tillämpas på andra algoritmer som liknar Saber, CRYSTALS-Kyber och CRYSTALS-Dilithium.

In July 2022, NIST selected CRYSTALS-Kyber as a new post-quantum secure public key encryption and key encapsulation mechanism to be standardized. To safeguard its shared and secret keys from side-channel attacks (SCA), countermeasures such as masking and shuffling are applied. However, the existing SCA-protected implementations of CRYSTALS-Kyber protect the decapsulation algorithm only. The encapsulation algorithm is not covered because single-trace shared key recovery attacks on encapsulation are not considered feasible. Since the same shared key is never encapsulated more than once, the attacker gets only a single trace per shared key from the execution of the encapsulation algorithm. In this paper, we demonstrate a practical single-trace shared key recovery attack on a first-order masked implementation of the encapsulation algorithm of Kyber-768 in ARM Cortex-M4 based on deep learning-assisted power analysis. Our main contribution is a new aggregation method for ensemble learning that enables enumeration during shared key recovery. Our experimental results show that a full shared key can be recovered with a 91% probability on average from a single trace captured from a different from profiling device.

In response to side-channel attacks on masked implementations of post-quantum cryptographic algorithms, a new bitsliced higher-order masked implementation of CRYSTALS-Kyber has been presented at CHES’2022. The bitsliced implementations are typically more difficult to break by side-channel analysis because they execute a single instruction across multiple bits in parallel. However, in this paper, we reveal new vulnerabilities in the masked Boolean to arithmetic conversion procedure of this implementation that make the shared and secret key recovery possible. We also present a new chosen ciphertext construction method which maximizes secret key recovery probability for a given message bit recovery probability. We demonstrate practical shared and secret key recovery attacks on the first-, second- and third-order masked implementations of Kyber-768 in ARM Cortex-M4 using profiled deep learning-based power analysis.

CRYSTALS-Kyber is a post-quantum secure key encapsulation mechanism which is currently being standardized by the NIST. This makes it important to assess the resistance of CRYSTALS-Kyber implementations to physical attacks. In this paper, we present an attack on a masked and shuffled implementation of CRYSTALS-Kyber in ARM Cortex-M4 that combines side-channel analysis (SCA) with fault injection. First, voltage glitching is performed to bypass the shuffling. We found settings that consistently skip the desired instructions without crashing the device. After the successful fault injection, a deep learning-assisted profiled power analysis based on the Hamming weight leakage model is applied to recover the message (shared key). We use a partial key enumeration method that significantly increases the success rate of message recovery. We also propose countermeasures against the presented attack.

Most of the previous attacks on Dilithium exploit side-channel information which is leaked during the computation of the polynomial multiplication cs1, where s1 is a small-norm secret and c is a verifier's challenge. In this paper, we present a new attack utilizing leakage during secret key unpacking in the signing algorithm. The unpacking is also used in other post-quantum cryptographic algorithms, including Kyber, because inputs and outputs of their API functions are byte arrays. Exploiting leakage during unpacking is more challenging than exploiting leakage during the computation of cs1 since c varies for each signing, while the unpacked secret key remains constant. Therefore, post-processing is required in the latter case to recover a full secret key. We present two variants of post-processing. In the first one, a half of the coefficients of the secret s1 and the error s2 is recovered by profiled deep learning-assisted power analysis and the rest is derived by solving linear equations based on t = As1 + s2, where A and t are parts of the public key. This case assumes knowledge of the least significant bits of t, t0. The second variant uses lattice reduction to derive s1 without the knowledge of t0. However, it needs a larger portion of s1 to be recovered by power analysis. We evaluate both variants on an ARM Cortex-M4 implementation of Dilithium-2. The experiments show that the attack assuming the knowledge of t0 can recover s1 from a single trace captured from a different from profiling device with a non-negligible probability.

Creating a good deep learning model is an art which requires expertise in deep learning and a large set of labeled data for training neural networks. Neither is readily available. In this paper, we introduce a method that enables us to recover messages of LWE/LWR-based PKE/KEMs using simple multilayer perceptron (MLP) models trained on a small dataset. The core idea is to extend the attack dataset so that at least one of its traces has the ground truth label to which the models are biased towards. We demonstrate the effectiveness of the presented method on the examples of CRYSTALS-Kyber and Saber algorithms implemented in ARM Cortex-M4 CPU on nRF52832 system-on-chip supporting Bluetooth 5.2.We use amplitude-modulated EM emanations which are typically weaker and noisier than power or near-field EM side channels, and thus more difficult to exploit.

CRYSTALS-Kyber has been recently selected by the NIST as a new public-key encryption and key-establishment algorithm to be standardized. This makes it important to assess how well CRYSTALS-Kyber implementations withstand side-channel attacks. Software implementations of CRYSTALS-Kyber have already been analyzed and the discovered vulnerabilities were patched in the subsequently released versions. In this paper, we present a profiling side-channel attack on a hardware implementation of CRYSTALS-Kyber. Since hardware implementations carry out computations in parallel, they are typically more difficult to break than their software counterparts. We demonstrate a successful message (session key) recovery attack on a Xilinx Artix-7 FPGA implementation of CRYSTALS-Kyber  by deep learning-based power analysis. Our results indicate that currently available hardware implementations of CRYSTALS-Kyber need better protection against side-channel attacks.

At CHES’2021, a chosen ciphertext attack combined with belief propagation which can recover the long-term secret key of CRYSTALS-Kyber from side-channel information of the number theoretic transform (NTT) computations was presented. The attack requires k traces from the inverse NTT step of decryption, where k is the module rank, for a noise tolerance in the Hamming weight (HW) leakage on simulated data. In this paper, we present an attack which can recover the secret key of CRYSTALS-Kyber from k chosen ciphertexts using side-channel information of the Barret reduction and message decoding steps of decryption, for. The key novel idea is to create a unique mapping between the secret key coefficients and multiple intermediate variables of these procedures. The redundancy in the mapping patterns enables us to detect errors in the secret key coefficients recovered from side-channel information. We demonstrate the attack on the example of a software implementation of Kyber-768 in ARM Cortex-M4 CPU using deep learning-based power analysis.