Abstract
We study masking countermeasures for side-channel attacks against signature schemes constructed from the MPC-in-the-head paradigm, specifically when the MPC protocol uses preprocessing. This class of signature schemes includes Picnic, an alternate candidate in the third round of the NIST post-quantum standardization project. The only previously known approach to masking MPC-in-the-head signatures suffers from interoperability issues and increased signature sizes. Further, we present a new attack to demonstrate that known countermeasures are not sufficient when the MPC protocol uses a preprocessing phase, as in Picnic3.We overcome these challenges by showing how to mask the underlying zero-knowledge proof system due to Katz–Kolesnikov–Wang (CCS 2018) for any masking order, and by formally proving that our approach meets the standard security notions of non-interference for masking countermeasures. As a case study, we apply our masking technique to Picnic. We then implement different masked versions of Picnic signing providing first order protection for the ARM Cortex M4 platform, and quantify the overhead of these different masking approaches. We carefully analyze the side-channel risk of hashing operations, and give optimizations that reduce the CPU cost of protecting hashing in Picnic by a factor of five. The performance penalties of the masking countermeasures ranged from 1.8 to 5.5, depending on the degree of masking applied to hash function invocations.
Highlights
As the possible advent of a quantum computer threatens the security of widely deployed cryptographic schemes, the design of new quantum-resilient alternatives is a pressing task
As described in [SBWE20] and in [GSE20], the values revealed by the prover to allow the verifier to check the consistency of the MPC protocol can be employed by an adversary in a side-channel attack
We show that masking the signing operations is a practical countermeasure for side-channel attacks, and prove our masked KKW and Picnic[3] meet the standard security notion (NIo), with a mix of both manual proofs and formal verification with the maskVerif tool
Summary
As the possible advent of a quantum computer threatens the security of widely deployed cryptographic schemes, the design of new quantum-resilient alternatives is a pressing task. Instead of opening N − 1 parties as a typical MPCitH prover would, an SNIitH prover only reveals N − t − 1 parties as a response, where the parameter t serves as the “buffer” for probing security This way, the prover makes sure that at least one party’s internal state remains completely hidden, even if the side-channel adversary observes up to t variables during the execution of MPC protocol Πf. We are motivated to design an alternative countermeasure addressing the following question: Can we mask signature generation in signature schemes constructed with the MPC-in-the-head-with-preprocessing paradigm in a provably secure manner, without modifying the verification algorithm?
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
