领域：学术论文 · 应用学科

1. Introduction
Post-quantum cryptography (PQC) has been actively studied in recent years. To construct PQC, a public key encryption scheme (PKE) with chosen-plaintext attack (CPA) security is first developed, and then a key encapsulation mechanism (KEM) with chosen-ciphertext attack (CCA) security is obtained by combining the PKE with either the Fujisaki–Okamoto (FO) transform [FO99] or its variants. Thus, the re-encryption of the FO(-like) transform plays an essential role in the decapsulation of PQC.
In practical uses of PQC, security evaluation against implementation attacks, such as side-channel attacks, in addition to mathematical cryptanalysis attacks is inevitable. Side-channel attacks on PQC have been first studied on the PKE decryption part that exploits the secret key directly, similar to those on the modular exponentiation/scalar multiplication in RSA/elliptic curve cryptography (ECC). In recent years, another attack aspect has been studied [GTN20,RRCB20,UXT+21], in which the attacker focuses on the leakage of re-encryption to implement a decryption oracle, which enables one to mount a chosen-ciphertext attack (CCA) on the underlying CPA-secure PKE. Note that the decryption oracle is not necessarily a full decryption oracle but it can be, for example, plaintext-checking (PC) and decryption-failure (DF) oracles. These attacks suggest that we should protect not only the PKE decryption but also the whole KEM decapsulation, including re-encryption and the equality/validity checks of the re-encrypted ciphertext, against side-channel attacks. Ueno et al. [UXT+21] showed that such an attack was generally applicable to many post-quantum KEMs equipped with an FO-like transforms, and demonstrated that their attack could recover eight of the nine KEM candidates in the third round of the NIST PQC standardization.
These studies suggest that the potential and limitation of such attacks (i.e., the least number of side-channel traces for a successful key recovery) should be investigated to develop secure KEM implementations, including the design of countermeasures and/or cryptographic protocols. The number of side-channel traces required for a successful attack is commonly determined by two factors: (1) the number of decryption oracle accesses required for key recovery and (2) the number of traces required to realize the reliable decryption oracle. Therefore, a tight evaluation of the factors, that is, an efficient keyrecovery algorithm with a decryption oracle that can be realized from side-channel traces, would contribute to understanding the least number of traces (i.e., the optimal attack cost) for a successful key recovery.
2.Related works
A KEM is a public-key cryptographic primitive used to transmit a secret key securely. A KEM consists of three probabilistic polynomial-time algorithms: key generation (KeyGen), encapsulation (Encaps), and decapsulation (Decaps). Most post-quantum KEMs are proven to be CCA secure since they adopt an FO-like transform. Here, we refer to FO transforms and their variants [HHK17, SXY18, BHH+19] as FO-like transforms. Algorithm 1 illustrates a typical post-quantum KEM equipped with an underlying PKE scheme and an FO-like transform, assuming that the PKE is CPA secure and is given as three probabilistic polynomial-time algorithms: key generation Gen, encryption Enc and decryption Dec. Such KEMs employ random oracles (ROs) denoted by G, H, and Hprf in Algorithm 1, which are frequently realized using a cryptographic hash function (or other symmetric primitive), and are frequently instantiated with SHA-3 or SHAKE. The attacks considered herein focus on the decapsulation KEM.Decaps, which computes the shared secret as a result of H at Line 6 from an input ciphertext c, a private key sk and a public key pk (if the input ciphertext is valid). KEM.Decaps first applies the PKE decryption PKE.Dec to compute the corresponding plaintext m′ from the ciphertext and then performs a re-encryption to validate the computed m′, that is, computes PKE.Enc in the same manner as KEM.Encaps to check whether the re-encrypted ciphertext c′ equals to the input ciphertext c. If c = c′, the input ciphertext is considered valid, and the shared secret H(m′, c) is then calculated and output. Otherwise (i.e., c ̸= c′), the ciphertext is invalid, and a pseudorandom value computed using Hprf (or a rejection symbol) is output at Line 8. The FO-like transform performs the ciphertext verification to detect any invalid ciphertexts and prevent any CCA that queries invalid ciphertexts and exploits their decryption results.
Side-channel attacks on the FO-like transforms were initially presented in the pioneering works by Guo et al. [GTN20] and Ravi et al. [RRCB20]. Guo et al. presented a timing attack exploiting the equality check (as at Line 5 in Algorithm 1). Ciphertexts of postquantum KEMs are treated as a long vector in CPUs/microcontrollers. A comparison using an usual operation (e.g., memcmp) takes a (relatively) long time if two ciphertexts are very similar to each other; otherwise, the comparison terminates shortly. They exploited this timing difference to implement a PC oracle for lattice- and code-based KEMs, and presented key-recovery attacks for lattice-based and code-based KEMs where the equality check was not implemented in constant time. Ravi et al. reported the first power/EM attack on an FO-like transform. The attack implemented a PC oracle or decryption failure oracle by exploiting the side-channel leakage during computation of RO (i.e., hash function) in re-encryption with a t-test-based template. Their attack achieved key recovery of six lattice-based KEMs: Kyber, Saber, FrodoKEM, Round5, NewHope and LAC.  Bhasin et al. [BDH+21] presented an attack on masked polynomial comparison schemes for Kyber, Saber, and FrodoKEM [OSPG18, BPO+20] by exploiting ciphertext equality checks in lattice-based KEMs and demonstrated its application to Kyber. They implemented a PC oracle using a distinguisher based on the t-test. More recently, Ueno et al. demonstrated a generalization of power/EM attacks on FO-like transforms [UXT+21]. They illustrated that the side-channel leakage during re-encryption can be generally exploited if a KR-PCA on the underlying PKE is known. They demonstrated that their attack could achieve key recovery of eight out of nine KEMs of NIST PQC third-round candidates. One major research direction of attacks of this kind is to improve the attack efficiency (i.e., reduce the number of required traces) for a precise evaluation of the cost of an optimal attack. Other side-channel-assisted CCAs have also been extensively studied in this way [XPR+22, RBRC22, SKL+20, REB+21, NDGJ21], especially for lattice-based KEMs. More recently, in [QCZ+21], Qin et al. showed an improvement of CCAs on lattice-based KEMs using a binary key-mismatch oracle with adaptive queries, which reduced the number of oracle accesses/queries compared to that of the CCA used in [UXT+21]. In [SCZ+23], Shen et al. presented a side-channel-assisted CCA using a binary PC oracle with an error correction of the PC oracle outputs, implemented by side-channel information. They showed that the error tolerance reduced the number of traces required to implement a PC oracle, which reduced the total number of traces required for key recovery. They also applied their attack to Kyber, and achieved up to 55.4% reduction of the total number of traces required for key recovery compared to that in [UXT+21].
3.Proposed Attack
The major drawback of CCAs with the PC oracle outlined in Section 2.3 is that the attacker obtains no more than one-bit information per oracle access4, which results in a large number of traces being required for key recovery. In this study, we propose an oracle named the multiple-valued plaintext-checking (MV-PC) oracle to extract more bits of information per oracle access. Let μ be a positive integer. Consider an attacker who knows that a ciphertext c ̃ is necessarily decrypted to either of the μ plaintexts m0, m1, . . . , mμ−1. The attacker can recover the secret key of the KEM with repeated and adaptive queries if the attacker knows to which plaintext c ̃ is decrypted. Such an oracle is a generalization of the (binary) PC oracle with μ = 2. Note that, without side-channels, the FO-like transform theoretically does not provide any information about which plaintext c ̃ corresponds to (although the attacker knows the reference plaintext for valid ciphertext). We name this oracle the MV-PC oracle, and formally define it as  Oμ(c ̃; m0, m1, . . . , mμ−1) = v s.t. PKE.Decsk(c ̃) = mv.  Intuitively, the MV-PC oracle for μ values (called μV-PC) provides up-to log2 μ information to the attacker; therefore, a CCA using the MV-PC oracle would achieve key recovery with fewer oracle accesses roughly by a factor of 1/ log2 μ than that of the conventional KR-PCA with the binary PC oracle.
3.2 General attack description
The proposed attack exploits an MV-PC oracle through a side-channel leakage and recovers the secret key by side-channel-assisted CCA on the underlying CPA-secure PKE. As well as the previous attack in [UXT+21], the proposed attack focuses on the side-channel leakage during the RO evaluation (i.e., computation of symmetric primitive like hash function) of re-encryption in PKE.Decaps. Using the side-channel leakage, the attacker accesses to an MV-PC oracle; that is, estimates which an invalid ciphertext c ̃ is decrypted to plaintext m0, m1, . . . , mμ−1 by PKE.Dec. If the attacker can correctly estimate the plaintext from the side-channel leakage, the attacker can perform a key recovery CCA. The proposed attack achieves a key recovery with fewer side-channel traces, if the MV-PC oracle is efficiently implemented. As in [UXT+21], the proposed SCA consists of profiling and attack phases. In the profiling phase, the attacker trains a μ-classification NN to estimate the plaintext (i.e., implement an μV-PC oracle) from side-channel traces during the RO evaluation. In the attack phase, the attacker queries invalid ciphertexts and performs a CCA using the μVPC oracle implemented by the trained NN. Although the attack requires a profiling, we do not require any profiling device which the attacker can know/control the secret key, in contrast to major DL-based side-channel attacks on symmetric primitive. This is because the profiling can be carried out without secret key, as in previous SCAs on latticebased KEMs [RRCB20, XPR+22, RBRC20, SKL+20, NDGJ21, UXT+21]. The usage of NN makes the proposed attack general and efficient, because it has been shown that
DL-based side-channel attacks are applicable to various implementations (including ones with countermeasures such as masking and random delay) without detailed knowledge of implementation nor a specific condition/assumption about leakage. Moreover, the proposed attack can be carried out by the neural distinguisher from side-channel leakage during the RO evaluation, and the key recovery capability depends solely on the quality of the neural distinguisher.


翻译考点：
考点1：“plaintext-checking oracle” 推荐翻译为 明文检查谕言机 或 明文检查预言机
考点2：“full decryptyion oracle” 推荐翻译为 全解密谕言机 或 全解密预言机
考点3： ”decryption failure oracle“ 推荐翻译为 解密失败谕言机 或 解密失败预言机
考点4：“exploit" 应跟据后接宾语调整翻译语义，如”exploit the secret key“推荐翻译为”非法获取私钥“，”exploit the decryption results“则推荐翻译为”利用解密后的结果“
考点5：”invalid“ 在密码学选择密文攻击场景下推荐翻译为 ”非法的“
考点6：”trace“ 在侧信道密码分析领域推荐翻译为 ”波形“
考点7：”profiling phase“ 在侧信道密码分析领域推荐必须译为 ”建模阶段“
考点8：”cryptographic primitive“ 推荐翻译为 ”密码学原语” 或 “密码学基础组件”
考点9：“secret key” 在公钥密码学场景下必须译为 “私钥”