Poly2MsgLeaks: Certified Key Recovery from Polynomial-to-Message Leakage

What it is

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on SMAUG-T in its TiMER parameter set. It targets the polynomial-to-message (P2M) step and recovers the full 512-coefficient PKE secret. The preprint (ePrint 2026/2657, received 27 October 2026) is by Yongseong Park, YoungChang Kim, Jeongdo Kim and Young-Sik Kim. The listed contact addresses are at dgist.ac.kr.

How it works

Each P2M decision depends on four ternary secret coefficients, so it reveals one of 81 local states. The authors characterize all admissible P2M predicates. Their six-query schedule maps the 81 states onto 57 binary transcripts. Even with both exact polynomial weights, noiseless transcripts leave a mean residual ambiguity of 27.2 bits, so a plain transcript decoder is not enough.

The attack closes that gap with waveform information:

• It keeps waveform scores for all 81 states instead of hard-deciding each block.
• It couples the 128 local blocks through the exact polynomial weights.
• It enumerates a calibrated cost region and checks candidates against the public-key relation.

The public-key check is what makes the recovery "certified". Under a uniform-matrix model, the authors prove that an incorrect key is released with probability at most 2^-2095.6. For exchangeable calibration and evaluation keys, the probability that the true key lies outside the searched region is bounded without a channel model.

Results

• Hardware: an STM32F415, using six physical P2M traces.
• First cohort: 999 of 1,000 previously unseen secrets recovered.
• Second cohort: a verifier-driven policy recovered all 1,000 secrets at a mean cost of 7.021 traces, with no false acceptances.
• Ablation: with the same decoder and limits, equalizing the scores within each transcript class cut recovery from 998 to 112 keys. The within-class waveform scores therefore carry most of the recovery power.

Preconditions / Affected

• The target is SMAUG-T with the TiMER parameter set. The page names no other parameter sets.
• The attacker needs chosen-ciphertext query access and physical power measurement of the device.
• The attack is profiled, so the attacker needs a device to build templates on. The page does not describe the profiling setup in detail.

What to do

For implementers of SMAUG-T, the page reports two designs that held up. Single-write message assembly and a two-share masked P2M each left the evaluated six-execution attack with no complete secret. The abstract gives no implementation detail for either countermeasure.

Caveats

• Only the six-execution attack was evaluated against the two countermeasures. The abstract does not claim they resist attacks with more traces or other methods.
• The 2^-2095.6 bound depends on a uniform-matrix model. The bound on the true key falling outside the search region depends on exchangeable calibration and evaluation keys.
• Results come from one microcontroller, the STM32F415. This is a preprint, not peer reviewed.
• The one-key miss in the first cohort (999 of 1,000) shows the six-trace attack is not always complete. Extra traces fixed this in the second cohort.