1. Faulting original McEliece's implementations is possible: How to mitigate this risk?
- Author
-
Giraud, Vincent, Bouffard, Guillaume, Département d'informatique - ENS Paris (DI-ENS), École normale supérieure - Paris (ENS-PSL), Université Paris sciences et lettres (PSL)-Université Paris sciences et lettres (PSL)-Institut National de Recherche en Informatique et en Automatique (Inria)-Centre National de la Recherche Scientifique (CNRS), Ingenico Group S.A., Agence nationale de la sécurité des systèmes d'information (ANSSI), Guillaume Hiet, and Jan Tobias Mühlberg
- Subjects
[INFO.INFO-CR]Computer Science [cs]/Cryptography and Security [cs.CR] ,Binary Instrumentation ,McEliece ,White-box attack model ,Post-quantum cryptography - Abstract
International audience; Private and public actors increasingly encounter use cases where they need to implement sensitive operations on mass-market peripherals for which they have little or no control. They are sometimes inclined to attempt this without using hardware-assisted equipment, such as secure elements. In this case, the white-box attack model is particularly relevant and includes access to every asset, retro-engineering, and binary instrumentation by attackers. At the same time, quantum attacks are becoming more and more of a threat and challenge traditional asymmetrical ciphers, which are treasured by private and public actors.The McEliece cryptosystem is a code-based public key algorithm introduced in 1978 that is not subject to wellknown quantum attacks and that could be implemented in an uncontrolled environment. During the NIST post-quantum cryptography standardization process [17], a derived candidate commonly refer to as classic McEliece was selected. This algorithm is however vulnerable to some fault injection attacks while a priori, this does not apply to the original McEliece. In this article, we thus focus on the original McEliece cryptosystem and we study its resilience against fault injection attacks on an ARM reference implementation [18]. We disclose the first fault injection based attack and we discuss on how to modify the original McEliece cryptosystem to make it resilient to fault injection attacks.
- Published
- 2023