Newest papers

Rank Ceiling for Twiddle-Perturbation Faults on the Forward NTT

Chakshu Gupta · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30383 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

NIST 是由 ML-KEM 和 ML-DSA 在 2024 年标准化的后量子密钥建立和数字签名。 NIST 均在相同的秘密多元素上计算前进的数字理论转换(NTTs)。 发布的攻击零每个固定倍率或 twiddle,在 Kyber 密钥生成期间使用单个错误或单个 twiddles在一个Dilithium签名变体中运行;反措施检测或掩盖这些错误。 对于一个错误,Nonzero 替代品保留了可逆转性,但未压缩的正确 minus 错误的转换差异仍然可以暴露输入信息。 这种纸张将线性地图从一个秘密正确多元素到这个差异的独特的静态 twiddle替代品,包括

Machine translation (Meta M2M100); the English original follows.

Abstract

NIST standardised ML-KEM and ML-DSA in 2024 for post-quantum key establishment and digital signatures. Both compute forward number-theoretic transforms (NTTs) on secret polynomials. Published attacks zero every fixed multiplier, or twiddle, during Kyber key generation with a single fault, or individual twiddles in one Dilithium signing variant; countermeasures detect or mask these faults. Nonzero replacements preserve invertibility, but the uncompressed correct-minus-faulted transform difference can still expose input information. This paper characterises the linear map from a secret polynomial to this difference under arbitrary static twiddle replacements, including bit-flips. For one fault, rank equals the number of butterflies sharing its twiddle, halving by layer from 128 to 2 for ML-KEM and to 1 for ML-DSA. Known positions, replacement values and the difference determine that many independent linear combinations of input coefficients. With one fault per layer, all but the constant and linear coefficients for ML-KEM, or the constant for ML-DSA, are determined; Lean 4 certifies this rank-and-kernel result. Those coefficients cancel for every fault set and choice of replacement values. NIST permits seed storage, motivating comparison of a known correct key with a released faulty key from the same seed. If only one ML-KEM secret-polynomial NTT is faulted, the key difference is a known matrix column times the transform difference; an invertible column entry reconstructs the latter. For ML-DSA, neither reconstruction nor the number of secret-polynomial candidates from compressed key differences is established. The per-layer ranks give a closed-form measure of raw exposure for countermeasure design.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Mathematics, Key (lock), NIST, Invertible matrix, Cryptography, Matrix (chemical analysis)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange