Classical Misuse Attacks on NIST Round 2 PQC: The Power of Rank-Based Schemes

The US National Institute of Standards and Technology (NIST) recently announced the public-key cryptosystems (PKC) that have passed to the second round of the post-quantum standardization process. Most of these PKC come in two flavours: a weak IND-CPA version and a strongly secure IND-CCA construction. For the weaker scheme, no level of security is claimed in the plaintext-checking attack (PCA) model. However, previous works showed that, for several NIST candidates, only a few PCA queries are sufficient to recover the secret key. In order to create a more complete picture, we design new key-recovery PCA against several round 2 candidates. Our attacks against CRYSTALS-Kyber, HQC, LAC and SABER are all practical and require only a few thousand queries to recover the full secret key. In addition, we present another KR-PCA attack against the rank-based scheme RQC, which needs roughly O(238) queries. Hence, this type of scheme seems to resist better than others to key recovery. Motivated by this observation, we prove an interesting result on the rank metric. Namely, that the learning problem with the rank distance is hard for some parameters, thus invalidating a common strategy for reaction attacks.


Published in:
Applied Cryptography and Network Security, 208-227
Presented at:
18th International Conference ACNS 2020 International Conference on Applied Cryptography and Network Security, Rome, Italie, Octobre 19-22, 2020
Year:
2020
Publisher:
Springer, Cham
ISBN:
978-3-030-57807-7
Laboratories:




 Record created 2020-08-28, last modified 2020-08-31


Rate this document:

Rate this document:
1
2
3
 
(Not yet reviewed)