A Look Into (Few) SCA & Fault attack vulnerabilities in lattice based PQC schemes & Countermeasures

### Overview This talk explores practical implementation security in post-quantum cryptography (PQC), with a particular focus on lattice-based schemes. As classical public-key cryptography faces threats from quantum algorithms, NIST initiated a standardization process for quantum-resistant alternatives, many of which rely on lattice problems such as Learning With Errors (LWE) and Module-LWE. While these mathematical constructions offer theoretical security against quantum computers, their physical implementations on embedded devices and microcontrollers remain susceptible to physical attacks, specifically fault injection attacks and side-channel analysis (SCA).

### Key Topics - **Post-Quantum Cryptography & Lattices:** Background on NIST PQC standardization and underlying hardness problems such as LWE, where public matrix operations and noise terms are used to protect secret keys. - **Fault Injection Attacks:** Examination of physical attack techniques—ranging from low-cost clock or voltage glitching to high-cost localized laser or electromagnetic pulse injections—aimed at disrupting computations. - **Side-Channel Analysis (SCA):** Exploiting incidental physical leakage (power consumption, electromagnetic emissions, or timing) during sensitive operations such as polynomial multiplication, NTT (Number Theoretic Transform), and message decoding. - **Countermeasures:** Implementation defenses including algorithmic verification steps, masking techniques, and constant-time execution.

### Technical Details - **Fault Attacks on Lattice Schemes:** The speaker illustrates how injecting faults into intermediate variables can drastically reduce scheme security. For instance, altering a single bit or skipping a specific loop condition allows attackers to establish a simplified system of linear equations, enabling key recovery through mathematical solvers without needing to solve the full underlying lattice problem. Faults during signature generation (such as bypassing rejection sampling or corrupting polynomial addition operations) can similarly leak sensitive secret key information. - **Side-Channel Leakage in Decryption and NTT:** Side-channel leakage is evaluated across critical components such as the Number Theoretic Transform (NTT) and decryption routines. When implementations perform secret-dependent operations without constant-time behavior or proper masking, power and EM traces (even down to single-trace template attacks) can reveal intermediate values. - **Combined Threats & Verification:** The talk notes that verifying ciphertext integrity or public-key validity before completing decryption can mitigate certain oracle-style chosen-ciphertext side-channel attacks, though verification itself must be implemented securely to prevent timing or fault-based bypasses.

### Takeaways - Mathematical quantum resistance does not automatically guarantee implementation security; physical microcontrollers running PQC schemes require dedicated hardening. - Even single-bit faults or slight timing/power leakages during polynomial operations can completely compromise secret keys. - Designers and developers must apply comprehensive protections—combining masking, constant-time primitives, and fault detection/redundancy—rather than relying solely on the theoretical hardness of lattice problems.