PQC 표준화 알고리즘 CRYSTALS-KYBER에 대한 비프로파일링 분석 공격 및 대응 방안
Non-Profiling Analysis Attacks on PQC Standardization Algorithm CRYSTALS-KYBER and Countermeasures
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 양자 내성 암호 표준화 사업을 진행 중인 미국의 국립표준기술연구소는 표준화가 확정된 4개의 알고리즘을 발표하였다. 본 논문에서는 PKE/KEM 분야에서 표준화가 확정된 CRYSTALS-KYBER 알고리즘의 복호화 과정 중 비프로파일링 기반 전력 분석 공격인 CPA(Correlation Power Analysis)와 DDLA(Differential Deep Learning Analysis)에 의해 개인 키가 노출될 수 있음을 보이고자 한다. 실험 결과 개인 키의 일차 다항식 계수 복구에 성공하였으며, 특히 DDLA에서는 중간 값의 해밍 웨이트(Hamming Weight)를 라벨로 사용하는 모델에서 평가 기법인 NMM(Normalized Maximum Margin)의 값이 13.0으로 가장 높은 값을 가져 개인 키를 복구할 수 있는 것을 확인하였다. 또한, 복호화 과정 중 암호문을 랜덤하게 분할하고 계수별 곱셈 연산의 시작 지점을 랜덤화하는 방어 기법을 적용하면 상기한 공격을 방어하는 것을 확인하였다.
Abstract
Recently, the National Institute of Standards and Technology (NIST) announced four cryptographic algorithms as a standard candidates of Post-Quantum Cryptography (PQC). In this paper, we show that private key can be exposed by a non-profiling-based power analysis attack such as Correlation Power Analysis (CPA) and Differential Deep Learning Analysis (DDLA) on CRYSTALS-KYBER algorithm, which is decided as a standard in the PKE/KEM field. As a result of experiments, it was successful in recovering the linear polynomial coefficient of the private key. Furthermore, the private key can be sufficiently recovered with a 13.0 Normalized Maximum Margin (NMM) value when Hamming Weight of intermediate values is used as a label in DDLA. In addition, these non-profiling attacks can be prevented by applying countermeasures that randomly divides the ciphertext during the decryption process and randomizes the starting point of the coefficient-wise multiplication operation.
참고문헌 (18)
- P. Shor, "Polynomial time algorithms for discrete logarithms and factoring on a quantum computer", SIAM Journal on Computing, 26(5), pp.1484~1509 (1997)
- Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process, "D. Moody", National Institute of Standards and Technology, ~ (2022)
- P. Kocher, "Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems, in CRYPTO’96", LNCS, 1109, pp.104~113 (1996)
- T. S. Messerges, "Using second-order power analysis to attack DPA resistant software", International Workshop on Cryptographic Hardware and Embedded Systems, pp.238~251 (2000)
- L. Goubin, "A refined power-analysis attack on elliptic curve cryptosystems", International Workshop on Public Key Cryptography, pp.199~211 (2003)
- S. Chari, "Template attacks", CHES’02, pp.13~28 (2002)
- P. Kocher, "Differential power analysis, in Advances in Cryptology, CRYPTO’ 99", LNCS, 1666, pp.388~397 (1999)
- E. Brier, "Correlation power analysis with a leakage model", CHES'04, pp.16~29 (2004)
- B. Timon, "Non-profiled deep learning-based side-channel attacks with sensitivity analysis", IACR Transactions on Cryptographic Hardware and Embedded Systems, pp.107~131 (2019)
- D. Heinz, "First-Order Masked Kyber on ARM Cortex-M4", National Institute of Standards and Technology, ~ (2021)
- A. Karlov, "Power analysis attack on Kyber", Cryptology ePrint Archive (2021)
- J. Bos, "CRYSTALS-Kyber : a CCA-secure module-lattice-based KEM", IEEE European Symposium on Security and Privacy, pp.353~367 (2018)
- R. Avanzi, "CRYSTALS-KYBER Algorithm Specifications And Supporting Documentation(version 3. 02)", NIST PQC Round, 3, pp.1~43 (2021)
- D. Bae, "Non-profiling deep learing side-channel attack with Hamming weight-based binary labels", CISC-W’20 (2020)
- 한재승, "효과적인 딥러닝 기반 비프로파일링 부채널 분석 모델 설계방안", 정보보호학회논문지, 30(6), pp.1291~1300 (2020), 한국정보보호학회[DOI]
- S. Kim, "Correlation Power Analysis of NTT Multiplication of NIST PQC Round 3 Finalist Candidate KYBER", CISC-S’21, pp.510~514 (2021)
- Y. Won, "Non-Profiled Side-Channel Attack Based on Deep Learning Using Picture Trace", IEEE Access, 9, pp.22480~22492 (2021)
- D. Bae, and J. Ha, "Performance Metric for Differential Deep Learning Analysis", Journal of Internet Services and Information Security(JISIS), 11(2), pp.22~33 (2021)