<p>We study the hardness of the Syndrome Decoding problem, the base of most code-based cryptographic schemes, such as Classic McEliece, in the presence of side-channel information. We use ChipWhisperer equipment to perform a template attack on Classic McEliece running on an ARM Cortex-M4, and accurately classify the Hamming weights of consecutive 32-bit blocks of the secret error vector <InlineEquation ID="IEq1"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1603_Article_IEq1.gif" Format="GIF" Height="18" Rendition="HTML" Resolution="72" Type="Linedraw" Width="49" /> </InlineMediaObject> <EquationSource Format="TEX">\(\textbf{e}\in {{\mathbb {F}}}_2^n\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi mathvariant="bold">e</mi> <mo>∈</mo> <msubsup> <mi mathvariant="double-struck">F</mi> <mn>2</mn> <mi>n</mi> </msubsup> </mrow> </math></EquationSource> </InlineEquation>. With these weights at hand, we optimize Information Set Decoding algorithms. Technically, we demonstrate how to speed up information set decoding via a dimension reduction, additional parity-check equations, and an improved information set search, all derived from the Hamming-weight information. Consequently, using our template attack, we can practically recover an error vector <InlineEquation ID="IEq2"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1603_Article_IEq1.gif" Format="GIF" Height="18" Rendition="HTML" Resolution="72" Type="Linedraw" Width="49" /> </InlineMediaObject> <EquationSource Format="TEX">\(\textbf{e}\in {{\mathbb {F}}}_2^n\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi mathvariant="bold">e</mi> <mo>∈</mo> <msubsup> <mi mathvariant="double-struck">F</mi> <mn>2</mn> <mi>n</mi> </msubsup> </mrow> </math></EquationSource> </InlineEquation> in dimension <InlineEquation ID="IEq3"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1603_Article_IEq3.gif" Format="GIF" Height="14" Rendition="HTML" Resolution="72" Type="Linedraw" Width="65" /> </InlineMediaObject> <EquationSource Format="TEX">\(n=2197\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>n</mi> <mo>=</mo> <mn>2197</mn> </mrow> </math></EquationSource> </InlineEquation> in a matter of seconds. Without side-channel information, such an instance has a complexity of around 88 bit. We also estimate how our template attack affects the security of the proposed McEliece parameter sets. Roughly speaking, even an error-prone leak of our Hamming weight information leads for <InlineEquation ID="IEq4"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10623_2025_1603_Article_IEq4.gif" Format="GIF" Height="14" Rendition="HTML" Resolution="72" Type="Linedraw" Width="65" /> </InlineMediaObject> <EquationSource Format="TEX">\(n=3488\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mi>n</mi> <mo>=</mo> <mn>3488</mn> </mrow> </math></EquationSource> </InlineEquation> to a security drop of 89 bits.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

How to lose some weight: a practical template syndrome decoding attack

  • Sebastian Bitzer,
  • Jeroen Delvaux,
  • Elena Kirshanova,
  • Sebastian Maaßen,
  • Alexander May,
  • Antonia Wachter-Zeh

摘要

We study the hardness of the Syndrome Decoding problem, the base of most code-based cryptographic schemes, such as Classic McEliece, in the presence of side-channel information. We use ChipWhisperer equipment to perform a template attack on Classic McEliece running on an ARM Cortex-M4, and accurately classify the Hamming weights of consecutive 32-bit blocks of the secret error vector \(\textbf{e}\in {{\mathbb {F}}}_2^n\) e F 2 n . With these weights at hand, we optimize Information Set Decoding algorithms. Technically, we demonstrate how to speed up information set decoding via a dimension reduction, additional parity-check equations, and an improved information set search, all derived from the Hamming-weight information. Consequently, using our template attack, we can practically recover an error vector \(\textbf{e}\in {{\mathbb {F}}}_2^n\) e F 2 n in dimension \(n=2197\) n = 2197 in a matter of seconds. Without side-channel information, such an instance has a complexity of around 88 bit. We also estimate how our template attack affects the security of the proposed McEliece parameter sets. Roughly speaking, even an error-prone leak of our Hamming weight information leads for \(n=3488\) n = 3488 to a security drop of 89 bits.