Newest papers

Rank Ceiling for Twiddle-Perturbation Faults on the Forward NTT

Chakshu Gupta · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30383 · cited by 0 works (OpenAlex) · open-access PDF

Korean

NIST는 2024년에 ML-KEM 및 ML-DSA를 표준화하여 포스트 양자 키 설립 및 디지털 서명에 도달합니다. NIST는 같은 비밀 폴리노미얼에서 원래 번호 이론적 변환 (NTTs)을 계산합니다. 출판 된 공격은 모든 고정 억제자, 또는 키버 키 생성 동안 유일한 오류로 ML-KEM 및 ML-DSA를 표준화합니다. NIST는 모두 비밀 숫자 이론적 변환 (NTTs)을 계산하거나 마스크합니다. Nonzero 대체는 이 오류를 감지하지만, 압축되지 않은 올바른 미만 오류 변환 차이는 여전히 입력 정보를 노출시킬 수 있습니다. Kyber 키 생성 동안이 종이는 비밀 폴리노미얼에서

Machine translation (Meta M2M100); the English original follows.

Abstract

NIST standardised ML-KEM and ML-DSA in 2024 for post-quantum key establishment and digital signatures. Both compute forward number-theoretic transforms (NTTs) on secret polynomials. Published attacks zero every fixed multiplier, or twiddle, during Kyber key generation with a single fault, or individual twiddles in one Dilithium signing variant; countermeasures detect or mask these faults. Nonzero replacements preserve invertibility, but the uncompressed correct-minus-faulted transform difference can still expose input information. This paper characterises the linear map from a secret polynomial to this difference under arbitrary static twiddle replacements, including bit-flips. For one fault, rank equals the number of butterflies sharing its twiddle, halving by layer from 128 to 2 for ML-KEM and to 1 for ML-DSA. Known positions, replacement values and the difference determine that many independent linear combinations of input coefficients. With one fault per layer, all but the constant and linear coefficients for ML-KEM, or the constant for ML-DSA, are determined; Lean 4 certifies this rank-and-kernel result. Those coefficients cancel for every fault set and choice of replacement values. NIST permits seed storage, motivating comparison of a known correct key with a released faulty key from the same seed. If only one ML-KEM secret-polynomial NTT is faulted, the key difference is a known matrix column times the transform difference; an invertible column entry reconstructs the latter. For ML-DSA, neither reconstruction nor the number of secret-polynomial candidates from compressed key differences is established. The per-layer ranks give a closed-form measure of raw exposure for countermeasure design.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Mathematics, Key (lock), NIST, Invertible matrix, Cryptography, Matrix (chemical analysis)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange