Skip to main content

Lund University Publications

LUND UNIVERSITY LIBRARIES

Cache-Timing Attack Against HQC

Huang, Senyang LU ; Sim, Rui Qi ; Chuengsatiansup, Chitchanok ; Guo, Qian LU and Johansson, Thomas LU orcid (2023) In IACR Transactions on Cryptographic Hardware and Embedded Systems 2023(3). p.136-163
Abstract

In this paper, we present the first chosen-ciphertext (CC) cache-timing attacks on the reference implementation of HQC. We build a cache-timing based distinguisher for implementing a plaintext-checking (PC) oracle. The PC oracle uses side-channel information to check if a given ciphertext decrypts to a given message. This is done by identifying a vulnerability during the generating process of two vectors in the reference implementation of HQC. We also propose a new method of using PC oracles for chosen-ciphertext side-channel attacks against HQC, which may have independent interest. We show a general proof-of-concept attack, where we use the Flush+Reload technique and also derive, in more detail, a practical attack on an HQC execution... (More)

In this paper, we present the first chosen-ciphertext (CC) cache-timing attacks on the reference implementation of HQC. We build a cache-timing based distinguisher for implementing a plaintext-checking (PC) oracle. The PC oracle uses side-channel information to check if a given ciphertext decrypts to a given message. This is done by identifying a vulnerability during the generating process of two vectors in the reference implementation of HQC. We also propose a new method of using PC oracles for chosen-ciphertext side-channel attacks against HQC, which may have independent interest. We show a general proof-of-concept attack, where we use the Flush+Reload technique and also derive, in more detail, a practical attack on an HQC execution on Intel SGX, where the Prime+Probe technique is used. We show the exact path to do key recovery by explaining the detailed steps, using the PC oracle. In both scenarios, the new attack requires 53, 857 traces on average with much fewer PC oracle calls than the timing attack of Guo et al. CHES 2022 on an HQC implementation.

(Less)
Please use this url to cite or link to this publication:
author
; ; ; and
organization
publishing date
type
Contribution to journal
publication status
published
subject
keywords
Code-based cryptography, HQC, NIST PQC standardization, Side-channel attacks
in
IACR Transactions on Cryptographic Hardware and Embedded Systems
volume
2023
issue
3
pages
28 pages
publisher
Ruhr-University of Bochum
external identifiers
  • scopus:85163202033
ISSN
2569-2925
DOI
10.46586/tches.v2023.i3.136-163
language
English
LU publication?
yes
id
7dfcf1f5-2941-42eb-83b9-a78d5e6096a2
date added to LUP
2023-09-18 13:22:01
date last changed
2023-11-21 22:51:40
@article{7dfcf1f5-2941-42eb-83b9-a78d5e6096a2,
  abstract     = {{<p>In this paper, we present the first chosen-ciphertext (CC) cache-timing attacks on the reference implementation of HQC. We build a cache-timing based distinguisher for implementing a plaintext-checking (PC) oracle. The PC oracle uses side-channel information to check if a given ciphertext decrypts to a given message. This is done by identifying a vulnerability during the generating process of two vectors in the reference implementation of HQC. We also propose a new method of using PC oracles for chosen-ciphertext side-channel attacks against HQC, which may have independent interest. We show a general proof-of-concept attack, where we use the Flush+Reload technique and also derive, in more detail, a practical attack on an HQC execution on Intel SGX, where the Prime+Probe technique is used. We show the exact path to do key recovery by explaining the detailed steps, using the PC oracle. In both scenarios, the new attack requires 53, 857 traces on average with much fewer PC oracle calls than the timing attack of Guo et al. CHES 2022 on an HQC implementation.</p>}},
  author       = {{Huang, Senyang and Sim, Rui Qi and Chuengsatiansup, Chitchanok and Guo, Qian and Johansson, Thomas}},
  issn         = {{2569-2925}},
  keywords     = {{Code-based cryptography; HQC; NIST PQC standardization; Side-channel attacks}},
  language     = {{eng}},
  number       = {{3}},
  pages        = {{136--163}},
  publisher    = {{Ruhr-University of Bochum}},
  series       = {{IACR Transactions on Cryptographic Hardware and Embedded Systems}},
  title        = {{Cache-Timing Attack Against HQC}},
  url          = {{http://dx.doi.org/10.46586/tches.v2023.i3.136-163}},
  doi          = {{10.46586/tches.v2023.i3.136-163}},
  volume       = {{2023}},
  year         = {{2023}},
}