STMicroelectronics (Belgium)

MAYO is a multivariate signature scheme notable for its efficiency and compact key size. Targeting NIST security level I, MAYO features a public key size of 1168 bytes and a signature size of 321 bytes, making it more compact than leading lattice-based signature schemes like Falcon and Dilithium, thereby easing integration into embedded systems. With the deployment of MAYO in embedded systems, studying the resilience of MAYO implementations against fault injection attacks is of increasing importance. In this paper, we investigate the security of MAYO against fault injection attacks, and present the first end-to-end fault injection attack on the multivariate scheme. The attack introduces a loop-abort fault in the sampling of the vinegar vector. We present two variants: A zero-ing attack, in which the skipped sampling results in an all-zero vinegar vector, and a differential fault attack. In both variants, the faulted signature reveals an oil vector, allowing for full key recovery through techniques borrowed from the reconciliation attack in a few seconds.

Determining bounds on the differential probability of differential trails and the squared correlation contribution of linear trails forms an important part of the security evaluation of a permutation. For Xoodoo, such bounds were proven using the trail core tree search technique, with a dedicated tool (XooTools) that scans the space of all r-round trails with weight below a given threshold Tr. The search space grows exponentially with the value of Tr and XooTools appeared to have reached its limit, requiring huge amounts of CPU time to push the bounds a little further. The bottleneck was the phase called trail extension where short trails are extended to more rounds, especially in the backward direction. In this work, we present a number of techniques that allowed us to make extension much more efficient and as such to increase the bounds significantly. Notably, we prove that the minimum weight of any 4-round trail is 80, the minimum weight of any 6-round trail is at least 132 and the minimum weight of any 12-round trail is at least 264, both for differential and linear trails. As a byproduct we found families of trails that have predictable weight once extended to more rounds and use them to compute upper bounds for the minimum weight of trails for arbitrary numbers of rounds.

At SAC 2016, Espitau et al. presented a loop-abort fault attack against lattice-based signature schemes following the Fiat–Shamir with aborts paradigm. Their attack recovered the signing key by injecting faults in the sampling of the commitment vector (also called masking vector) y, leaving its coefficients at their initial zero value. As possible countermeasures, they proposed to carry out the sampling of the coefficients of y in shuffled order, or to ensure that the masking polynomials in y are not of low degree. In this paper, we show that both of these countermeasures are insufficient. We demonstrate a new loop-abort fault injection attack against Fiat–Shamir with aborts lattice-based signatures that can recover the secret key from faulty signatures even when the proposed countermeasures are implemented. The key idea of our attack is that faulted signatures give rise to a noisy linear system of equations, which can be solved using integer linear programming. We present an integer linear program that recovers the secret key efficiently in practice, and validate the efficacy of our attack by conducting a practical end-to-end attack against a shuffled version of the Dilithium reference implementation, mounted on an ARM Cortex M4. We achieve a full (equivalent) key recovery in under 3 minutes total execution time (including signature generation), using only 5 faulted signatures. In addition, we conduct extensive theoretical simulations of the attack against Dilithium. We find that our method can achieve key recovery in under 5 minutes given a (sufficiently large) set of signatures where just one of the coefficients of y is zeroed out (or left at its initial value of zero). Furthermore, we find that our attack works against all security levels of Dilithium. Our attack shows that protecting Fiat–Shamir with aborts lattice-based signatures against fault injection attacks cannot be achieved using the simple countermeasures proposed by Espitau et al. and likely requires significantly more expensive countermeasures.

In this paper we study what happens to sets when we iteratively apply lossy (round) mappings to them. We describe the information loss as imbalances of parities of intermediate distributions and show that their evolution is governed by the correlation matrices of the mappings. At the macroscopic level we show that iterating lossy mappings results in an increase of a quantity we call total imbalance. We quantify the increase in total imbalance as a function of the number of iterations and of round mapping characteristics. At the microscopic level we show that the imbalance of a parity located in some round, dubbed final, is the sum of distinct terms. Each of these terms consists of the imbalance of a parity located at the output of a round, multiplied by the sum of the correlation contributions of all linear trails between that parity and the final parity. We illustrate our theory with experimental data. The developed theory can be applied whenever lossy mappings are repeatedly applied to a state. This is the case in many modes of block ciphers and permutations for, e.g., iterated hashing or self-synchronizing stream encryption. The main reason why we have developed it however, is for applying it to study the security implications of using non-uniform threshold schemes as countermeasure against differential power and electromagnetic analysis.

We present a practical attack on the Panama hash function that generates a collision in 26 evaluations of the state updating function. Our attack improves that of Rijmen and coworkers that had a complexity 282, too high to produce a collision in practice. This improvement comes mainly from the use of techniques to transfer conditions on the state to message words instead of trying many message pairs and using the ones for which the conditions are satisfied. Our attack works for any arbitrary prefix message, followed by a pair of suffix messages with a given difference. We give an example of a collision and make the collision-generating program available. Our attack does not affect the Panama stream cipher, that is still unbroken to the best of our knowledge.

For the first time, scaled PMOS MUGFET devices with TiCN/HfO <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2 </sub> gate stack is doped with specific pulsed plasma doping processes. This paper first highlights the key benefit brought by conformal source/drain extensions, demonstrates how pulsed plasma doping process can be tuned to conformal dope very dense fin structures and finally shows that high performance (+24% vs. ion implant reference) multi-gate pMOS device (720 μA/μm @ I <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">off</sub> 20nA/μm, at V <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ds </sub> = -1.2V) is achieved with extensions formed by optimized PLAD process

In this section, I wish to put quantum key distribution (QKD) in the wider context of a cryptosystem. I shall discuss informally some aspects that are considered important. The questions I wish to answer here are: “What are the ingredients needed to make a QKD-based cryptosystem work? What services does it bring? What are its limitations?”

In-house data communication is becoming more and more widespread with the increase of the number of 'intelligent' electronic devices in the house. Wideband communication, no longer limited to data transfer between personal computers and their peripherals, is entering the consumer market for high quality video and audio transfer. Powerline LAN communication uses the existing power wiring to convey the data up to tens or even hundreds of megabits. The technology is very well suited for communication between pieces of equipment powered from the electrical outlet.

Abstract We present a new way to construct a MAC function based on a block cipher. We apply this construction to AES resulting in a MAC function that is a factor 2.5 more efficient than CBC-MAC with AES, while providing a comparable claimed security level.KeywordsBlock CipherAdvance Encryption StandardIteration FunctionRound FunctionForgery AttackThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The harmonic distortion introduced by MOS transistors is a property of major importance regarding their analog applications. In recent papers we presented a new integral function method (IFM) to calculate total harmonic distortion (THD) and the third harmonic component (HD3) of MOSFET based on the direct analysis of the non-linearity of the DC I/sub DS/-V/sub DS/ characteristic of the device for a fixed gate voltage. To evaluate this non-linearity, we defined an integral function, which will be called D hereafter, to calculate an integral equation of the I/sub DS/-V/sub DS/ characteristic, and in order to eliminate the even harmonics, a second function, which we call D3 was also defined. In this paper we generalize the IFM to analyze the case where several MOSFET pairs (balanced 2-MOSFET and double balanced 4-MOSFET structures) are used in order to eliminate the even harmonics. Real transistors always show some mismatch in their parameters that become apparent even in these balanced circuits. For the generalized IFM a new function Da is defined and used to analyze the effect of variation of transistor parameters. The efficiency of the new method is demonstrated analyzing the harmonic distortion in a balanced circuit, where typical variations of the threshold voltage if the transistors is taken into account.