# Cold Boot Attacks on the Supersingular Isogeny Key Encapsulation (SIKE) Mechanism
###### Abstract  
This research paper evaluates the feasibility of cold boot attacks on the Supersingular Isogeny Key Encapsulation (SIKE) mechanism. This key encapsulation mechanism has been included in the list of alternate candidates of the third round of the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography Standardization Process. To the best of our knowledge, this is the first time this scheme is assessed in the cold boot attacks setting. In particular, our evaluation is focused on the reference implementation of this scheme. Furthermore, we present a dedicated key-recovery algorithm for SIKE in this setting and show that the key recovery algorithm works for all the parameter sets recommended for this scheme. Moreover, we compute the success rates of our key recovery algorithm through simulations and show the key recovery algorithm may reconstruct the SIKE secret key for any SIKE parameters for a fixed and small \(\alpha=0.001\) (the probability of a 0 to 1 bit-flipping) and varying values for \(\beta\) (the probability of a 1 to 0 bit-flipping) in the set \(\{0.001,0.01,\ldots,0.1\}\). Additionally, we show how to integrate a quantum key enumeration algorithm with our key-recovery algorithm to improve its overall performance. cold boot attacks; key enumeration; key-recovery algorithm; post-quantum cryptography; Supersingular Isogeny Key Encapsulation (SIKE) Mechanism; Side-channel Attacks +
Footnote †: : 2020: 2020  
main memory, the retrieved content is altered [10]. This means that on the condition that an attacker gets possession of a chunk of memory content, this content might be noisy, which means that some 0 bits may have flipped to 1 bits and vice-versa. The next attacker's task is to try to recover secret information stored in the procured memory content, based on what this attacker may learn from the error distribution that occurs during the data acquisition process. In order to evaluate a public key scheme in this setting, we assume that the attacker procures memory content from a memory region in which the scheme's secret key was stored, and thus such adversary obtains a noisy version of it. On possession of this noisy memory content, the adversary's main task is to try to recover the original secret key from its bit-flipped version. More specifically, the evaluation of a public key encryption scheme in this setting entails three main tasks: (1) the attacker is required to learn the in-memory representations of the scheme's secret key, i.e., the data structures that are used to store the scheme's secret key, (2) the attacker is required to estimate error probability distributions for the bit-flipping, and (3) finally, the attacker is required to devise and develop a key-recovery algorithm for the scheme's secret key. To deal with the first task, the attacker may either study natural in-memory representations for the scheme's secret key or review scheme's actual implementations to further learn the scheme's secret key memory formats. We follow the latter approach, since it is more realistic, and hence we make a deep review of the SIKE reference implementation (Version v3.3) [9]. Regarding the second task, we assume the attacker estimate \(\alpha\), the probability for a 0 bit of original content to turn to a 1 bit, and \(\beta\), the probability for a 1 bit of original content to turn to a 0 bit, as per the cold boot model described in Section 2. Lastly, we develop our key-recovery algorithm based on a general key-recovery strategy introduced in [11]. Basically, by exploiting and combining the optimal key enumeration algorithm [12], and a non-optimal key enumeration algorithm, as in [11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27], we are able to get a suitable algorithm for the key-recovery task. In particular, this algorithm takes advantage of the SIKE secret key in-memory representation and the estimations for both \(\alpha\) and \(\beta\) to generate suitable key candidates for the secret key.