2

This question may be a basic question but it is not clear to me at the moment.

I have an Error Correcting Code (ECC) in a key-encapsulation scheme designed for post-quantum cryptography which operates on secret data.

The ECC I am using is constant time as long as the number of errors which need to be corrected is constant, and as long as those errors occur at the same positions in the message. The runtime does not depend on the secret data itself, only on the #errors and their positions in the secret data.

Does this leak any useful information? The # of errors which occur is not always constant in a real scenario...

kelalaka
  • 48,443
  • 11
  • 116
  • 196
jonnyx
  • 123
  • 3

1 Answers1

1

This may indeed leak information. If we can induce data dependent errors. If an attacker can induce a bit flip it won't help him, but it is actually more likely he could induce bits to be set by generating relevant interference.

If a bit was 1 to begin with the extra interference won't make it any more 1, but if it was 0 to begin with? setting it to 1 would be an error which needs correcting and you may be able to time this. Just in general trying to create more set bits seems like a practical attack and with the timing of the ECC would allow at least (over repeated attempts) to assess the number of set bits.

A more complicated attack on which bit is set would require a great degree of control on the errors. Need much more information on the complete setup in order to confidently rule this out, but it seems more far fetched.

Meir Maor
  • 11,835
  • 1
  • 23
  • 54
  • thanks for sharing your thoughts. What I can do, is change the code such that it always calls the routine which corrects all designed errors, instead of shortcutting if eg. only 1 error is detected. I would still get different runtimes depending on the location, which is better than before I guess, but still not perfect right? – jonnyx Nov 11 '18 at 13:20
  • This indeed seems like an improvement, and if all attacker can do is induce some bits to be set to 1 randomly that would prevent the simple attack I proposed for recovering number of set bits in the data. Not sure what the attacker can actually reasonably do without more information on the complete setup. – Meir Maor Nov 11 '18 at 16:27