Newest papers

Rank Ceiling for Twiddle-Perturbation Faults on the Forward NTT

Chakshu Gupta · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30383 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

NIST está estandarizado por ML-KEM y ML-DSA en 2024 para el establecimiento de claves post cuánticos y las firmas digitales. Ambos computan las transformaciones numéricas teóricas (NTTs) hacia adelante en los mismos polinomios secretos. Los ataques publicados cero cada multiplicador fijo, o twiddle, durante la generación de claves de Kyber con una sola falla, o twiddles individuales en una variante de firma de dilitio; las contramedidas detectan o mascan estas fallas. Los reemplazos no nulos mantienen la invertibilidad, pero la diferencia de transformación correcta-menos-falta no comprimida todavía puede exponer la información de entrada. Este papel caracteriza el mapa lineal de un polinomios secretos correctos a esta diferencia bajo

Machine translation (Meta M2M100); the English original follows.

Abstract

NIST standardised ML-KEM and ML-DSA in 2024 for post-quantum key establishment and digital signatures. Both compute forward number-theoretic transforms (NTTs) on secret polynomials. Published attacks zero every fixed multiplier, or twiddle, during Kyber key generation with a single fault, or individual twiddles in one Dilithium signing variant; countermeasures detect or mask these faults. Nonzero replacements preserve invertibility, but the uncompressed correct-minus-faulted transform difference can still expose input information. This paper characterises the linear map from a secret polynomial to this difference under arbitrary static twiddle replacements, including bit-flips. For one fault, rank equals the number of butterflies sharing its twiddle, halving by layer from 128 to 2 for ML-KEM and to 1 for ML-DSA. Known positions, replacement values and the difference determine that many independent linear combinations of input coefficients. With one fault per layer, all but the constant and linear coefficients for ML-KEM, or the constant for ML-DSA, are determined; Lean 4 certifies this rank-and-kernel result. Those coefficients cancel for every fault set and choice of replacement values. NIST permits seed storage, motivating comparison of a known correct key with a released faulty key from the same seed. If only one ML-KEM secret-polynomial NTT is faulted, the key difference is a known matrix column times the transform difference; an invertible column entry reconstructs the latter. For ML-DSA, neither reconstruction nor the number of secret-polynomial candidates from compressed key differences is established. The per-layer ranks give a closed-form measure of raw exposure for countermeasure design.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Mathematics, Key (lock), NIST, Invertible matrix, Cryptography, Matrix (chemical analysis)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange