Skip to content

Back to the catalog

From if to Oops: Turning a conditional into a key-recovery oracle
eprint.iacr.orgpaper

From if to Oops: Turning a conditional into a key-recovery oracle

The paper presents a fault attack on deterministic CSIDH and OSIDH-LD. Forcing the lane-selection mask to zero (for example by skipping one instruction) makes output changes reveal whether a secret exponent reaches a threshold. Binary search then recovers the full key in at most 297 queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. Full OSIDH-LD keys were recovered in software fault simulation, and a ChipWhisperer-Lite skipped the target instruction with probability at least 0.94. The authors argue fault resistance requires giving up determinism and propose randomization countermeasures.

TL;DR Shows that deterministic CSIDH and OSIDH-LD leak full keys through repeated single instruction-skip faults, and proposes randomization-based countermeasures.
Open original ↗

Organisations named here

  • binary search oracle
  • CSIDH-512
  • deterministic CSIDH
  • Gustavo Banegas
  • Houben
  • instruction skip
  • Monika Trimoska
  • Nia Dimitrova
  • OSIDH-LD

Technologies named here

  • Houben's deterministic CSIDH
  • OSIDH-LD
  • ChipWhisperer-Lite
  • CSIDH

Techniques named here

  • Fault attack on deterministic CSIDH and OSIDH-LD
  • Key-recovery oracle
  • Instruction-skip fault injection
  • Fault injection

Related in Hardware & RF