Fault-Induced Nonce Repetition in Threshold Lattice Signatures: A Reveal-Structure Criterion, Cross-Scheme Analysis, and Detection Boundaries

What it is

ePrint 2026/2566 (Yulong Meng, received 20 October 2026, approved 21 October 2026) is a preprint on physical fault attacks against threshold ML-DSA. It covers honest participants whose devices are faulted, a threat model that existing threshold analyses mostly skip. The attack is demonstrated end to end on Mithril (ePrint 2026/013, USENIX Security 2026).

How it works

A fault causes one party to replay a sample across sessions, for example through RNG state rollback. That leaks the party's share. Faulting t devices in a t-of-n deployment gives the full signing secret. Every signature still verifies on its own, so the hedged nonce, commitment/session binding and fail-closed final verification are never triggered.

On Mithril the paper reports two implementation versions, six (t,n) configurations and 96/96 scan groups with exact recovery. Residual error is 0 and no lattice reduction is needed. A secret recovered from the coordinator-visible transcript alone was used to forge a signature that passes the implementation's FIPS 204 verifier.

The paper argues exposure depends on reveal structure, meaning whether per-party responses are shown to a party the attacker can see, and not on nonce distribution. Per scheme:

• Quorus is immune because it does not reveal responses, not because of uniformity.
• TALUS can be broken through a double-spend path where the one-time consumption of preprocessing is skipped.
• Trilithium sends the Server's response share to the Client in plaintext. The attack needs only 1 device fault, even though TALUS classifies it as internally uniform (I = 0).

Preconditions / Affected

• A threshold ML-DSA scheme that reveals per-party responses to an attacker-visible party (Mithril, Trilithium, TALUS via its skip path).
• The ability to fault t devices, or 1 for Trilithium.
• For Trilithium, the paper's evidence is the simulator message "(ss, sid, [z']_S)" in the original proof and a verbatim copy of the algorithm in [Jarv26]. Appendix D gives the evidence tier.

What to do

The detection design is transcript-level and has two layers:

• Early warning: alarm on reveal-hash liveness. It scored 305/305 exact hits with zero false positives on the paper's corpus.
• Full coverage: run the same identification computation the attack uses. Within the feasible range of identification, the paper says no window exists where the attack works but goes undetected. Section 6.1 explains how the alarm timing differs between the two layers.

For imperfect faults, full-key recovery needs m* = (ℓ-1)N + ⌈N/K⌉ observations. For ML-DSA-44 this is 768 + ⌈256/K⌉: 896 at K=2 and 787 at K=14. The paper says K is a trade-off, but the abstract does not define it.

Caveats

• Only the abstract was available, so protocol details, the definition of K and the detection thresholds are not covered here.
• The verification claim rests on a tool-assisted workflow with three independent analysis paths, directed by the authors. Section 8.2 describes how it was run and what artifacts are disclosed.
• The paper is an unreviewed preprint. The Trilithium determination is inferred from proof text and a copy of the algorithm, not from a demonstrated attack on an implementation.