Loop abort Faults on LatticeBased FiatShamir & Hashn Sign signatures As the advent of generalpurpose quantum computers appears to be drawing closer, agencies and advisory bodies have started recommending that we prepare the transition away from factoring and discrete logarithmbased cryptography, and towards postquantum secure constructions, such as latticebased schemes. Almost all primitives of classical cryptography (and more!) can be realized with lattices, and the efficiency of primitives like encryption and signatures has gradually improved to the point that key sizes are competitive with RSA at similar security levels, and fast performance can be achieved both in software and hardware. However, little research has been conducted on physical attacks targeting concrete implementations of postquantum cryptography in general and latticebased schemes in particular , and such research is essential if lattices are going to replace RSA and elliptic curves in our devices and smart cards. In this paper, we look in particular at fault attacks against some instances of the FiatShamir family of signature scheme on lattices (BLISS, GLP, TESLA and PASSSign) and on the GPV scheme, member of the Hashu0027n Sign family. Some of these schemes have achieved recordsetting efficiency in software and hardware. We present several possible fault attacks, one of which allows a full key recovery with as little as a single faulty signature, and discuss possible countermeasures to mitigate these attacks.

Implementing and Benchmarking Three LatticeBased PostQuantum Cryptography Algorithms Using SoftwareHardware Codesign It has been predicted that within the next tenfifteen years, quantum computers will have computational power sufficient to break current publickey cryptography schemes. When that happens, all traditional methods of dealing with the growing computational capabilities of potential attackers, such as increasing key sizes, will be futile. The only viable solution is to develop new standards based on algorithms that are resistant to quantum computer attacks and capable of being executed on traditional computing platforms, such as microprocessors and FPGAs. Leading candidates for new standards include latticebased postquantum cryptography (PQC) algorithms. In this paper, we present the results of implementing and benchmarking three latticebased key encapsulation mechanisms (KEMs) that have progressed to Round 2 of the NIST standardization process. Our implementations are based on a softwarehardware codesign approach, which is particularly applicable to the current stage of the NIST PQC standardization process, where the large number and high complexity of the candidates make traditional hardware benchmarking extremely challenging. We propose and justify the choice of a suitable systemonchip platform and design methodology. The obtained results indicate the potential for very substantial speedups vs. purely software implementations, reaching 28x for encapsulation and 20x for decapsulation.