Newest papers

Rank Ceiling for Twiddle-Perturbation Faults on the Forward NTT

Chakshu Gupta · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30383 · cited by 0 works (OpenAlex) · open-access PDF

Arabic

ويستخدم ML-KEM و ML-DSA المحدودة في النسخة النهائية من NIST في عام 2024 لإنشاء المفتاح القصير والعلامات الرقمية. كلا التقديرات تبدأ في التخفيف عن التغيرات الرقمية التقليدية (NTTs) على نفس الترتيبات الصلبة. التخفيضات المفروضة على كل الترتيب القصير، أو التخفيف، أثناء إنشاء المفتاح القصير مع خطأ واحد، أو التخفيضات الفردية في إطار التخفيضات القصيرة في إطار التخفيضات القصيرة في إطار التخفيضات القصيرة في إطار التخفيضات القصيرة، بما في ذلك التخفيضات القصيرة القصيرة المفروضة، بما في ذلك التخفيض

Machine translation (Meta M2M100); the English original follows.

Abstract

NIST standardised ML-KEM and ML-DSA in 2024 for post-quantum key establishment and digital signatures. Both compute forward number-theoretic transforms (NTTs) on secret polynomials. Published attacks zero every fixed multiplier, or twiddle, during Kyber key generation with a single fault, or individual twiddles in one Dilithium signing variant; countermeasures detect or mask these faults. Nonzero replacements preserve invertibility, but the uncompressed correct-minus-faulted transform difference can still expose input information. This paper characterises the linear map from a secret polynomial to this difference under arbitrary static twiddle replacements, including bit-flips. For one fault, rank equals the number of butterflies sharing its twiddle, halving by layer from 128 to 2 for ML-KEM and to 1 for ML-DSA. Known positions, replacement values and the difference determine that many independent linear combinations of input coefficients. With one fault per layer, all but the constant and linear coefficients for ML-KEM, or the constant for ML-DSA, are determined; Lean 4 certifies this rank-and-kernel result. Those coefficients cancel for every fault set and choice of replacement values. NIST permits seed storage, motivating comparison of a known correct key with a released faulty key from the same seed. If only one ML-KEM secret-polynomial NTT is faulted, the key difference is a known matrix column times the transform difference; an invertible column entry reconstructs the latter. For ML-DSA, neither reconstruction nor the number of secret-polynomial candidates from compressed key differences is established. The per-layer ranks give a closed-form measure of raw exposure for countermeasure design.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Mathematics, Key (lock), NIST, Invertible matrix, Cryptography, Matrix (chemical analysis)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange