One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips

Journal of mathematical cryptology

article

Mehdi Tibouchi ; Alexandre Wallet

关键词: Lattice-Based Cryptography;    Cryptanalysis;    BLISS;    Side-Channel Analysis;    Maximum Likelihood Estimation;    Parametric Inference;    Information Geometry;   

DOI  :  10.1515/jmc-2020-0079

学科分类：社会科学、人文和艺术（综合）

来源: De Gruyter

【 摘 要 】

As one of the most efficient lattice-based signature schemes, and one of the only ones to have seen deployment beyond an academic setting (e.g., as part of the VPN software suite strongSwan), BLISS has attracted a significant amount of attention in terms of its implementation security, and side-channel vulnerabilities of several parts of its signing algorithm have been identified in previous works. In this paper, we present an even simpler timing attack against it. The bimodal Gaussian distribution that BLISS is named after is achieved using a random sign flip during signature generation, and neither the original implementation of BLISS nor strongSwan ensure that this sign flip is carried out in constant time. It is therefore possible to recover the corresponding sign through side-channel leakage (using, e.g., cache attacks or branch tracing). We show that obtaining this single bit of leakage (for a moderate number of signatures) is in fact sufficient for a full key recovery attack. The recovery is carried out using a maximum likelihood estimation on the space of parameters, which can be seen as a statistical manifold. The analysis of the attack thus reduces to the computation of the Fisher information metric.

【 授权许可】

CC BY|CC BY-NC-ND