Falcon Key Recovery from Joint Sampler Leakages

What it is

A power side-channel key-recovery attack on Falcon and the forthcoming FN-DSA standard, posted to the IACR ePrint archive as a preprint (2026/2656, received 27 October 2026) by Youngchang Kim, Yongseong Park, Jaeho Jeon and Young-Sik Kim. It fuses three leakages from each SamplerZ call: the signed-exponent class e(k) of the integer center, the random-sign bit b, and a multi-class proposal magnitude z0.

How it works

Each fused observation narrows the accepted sampler output to a magnitude-preserving interval or ray. The paper uses an exact public linear relation, which holds when there is no modular wraparound, to turn these candidate sets into slab and halfspace constraints on the secret key. The constraints are solved by smooth softplus interval regression, followed by bounded integer reconstruction that is checked against the public key. No LLL or BKZ lattice reduction is used.

Preconditions / Affected

• Power-analysis access to a device running the signer. The evaluation used an ARM Cortex-M4.
• A profiling phase to train the center classifier. The 99.34% accuracy figure is on held-out signatures from the profiling keys.
• Targets tested: PQClean Falcon-512 built with -O3, and c-fn-dsa, where center conversion uses a single constant-time CLZ instruction.

Results

Median post-classification key-recovery runtime on PQClean is 17.54 s per key. This excludes trace acquisition and classification.

What to do

The authors' conclusion is that instruction-level normalization, such as the constant-time CLZ in c-fn-dsa, does not by itself stop key recovery. Countermeasures for FN-DSA implementations must cover all sampler leakage channels together: center exponent, sign and proposal magnitude. Protecting any one of them alone is not enough. The page gives no specific patch or masking recipe.

Caveats

• The evaluation is on one microcontroller and one parameter set, Falcon-512. The page does not report Falcon-1024 results.
• The c-fn-dsa attack is weaker: 12 of the 50 keys were not recovered within 200 signatures.
• The work is a preprint and has not been peer reviewed.