kth.sePublications KTH
Operational message
There are currently operational disruptions. Troubleshooting is in progress.
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
A side-channel attack on a masked hardware implementation of CRYSTALS-Kyber
KTH, School of Electrical Engineering and Computer Science (EECS), Electrical Engineering, Electronics and Embedded systems.
KTH, School of Electrical Engineering and Computer Science (EECS), Electrical Engineering, Electronics and Embedded systems.ORCID iD: 0000-0001-7382-9408
2025 (English)In: JOURNAL OF CRYPTOGRAPHIC ENGINEERING, ISSN 2190-8508, Vol. 15, no 1, article id 7Article in journal (Refereed) Published
Abstract [en]

NIST has recently selected CRYSTALS-Kyber as a new public key encryption and key establishment algorithm to be standardized. This makes it important to evaluate the resistance of CRYSTALS-Kyber implementations to side-channel attacks. Software implementations of CRYSTALS-Kyber have already been thoroughly analysed. The discovered vulnerabilities have helped improve subsequently released versions and promoted stronger countermeasures against side-channel attacks. In this paper, we present the first attack on a protected hardware implementation of CRYSTALS-Kyber. We demonstrate a practical message (shared key) recovery attack on the first-order masked FPGA implementation of Kyber-512 by Kamucheka et al. (2022) using power analysis based on the Hamming distance leakage model. The presented attack exploits a vulnerability located in the masked message decoding function executed during the decryption step of decapsulation. The message recovery is performed using a profiled deep learning-assisted method which extracts the message directly, without explicitly retrieving each share. By repeating the same decapsulation multiple times, it is possible to increase the success rate of full shared key recovery to 99%. We also analyse the feasibility of recovering shared keys during encapsulation and propose a countermeasure against the presented attack that is also applicable to FPGA implementations of other cryptographic algorithms.

Place, publisher, year, edition, pages
Springer Nature , 2025. Vol. 15, no 1, article id 7
Keywords [en]
Public key cryptography, Post-quantum cryptography, CRYSTALS-Kyber, LWE/LWR-based KEM, Side-channel attack, Deep learning
National Category
Computer Engineering
Identifiers
URN: urn:nbn:se:kth:diva-362930DOI: 10.1007/s13389-025-00375-7ISI: 001458493000002Scopus ID: 2-s2.0-105001686111OAI: oai:DiVA.org:kth-362930DiVA, id: diva2:1955427
Note

QC 20250430

Available from: 2025-04-30 Created: 2025-04-30 Last updated: 2025-04-30Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Ji, YanningDubrova, Elena

Search in DiVA

By author/editor
Ji, YanningDubrova, Elena
By organisation
Electronics and Embedded systems
Computer Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 240 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf