Everything Depends on Your Hammer: A Systematic Rowhammer Attack Exploration on SPHINCS+

Le résumé fourni par la source

Secure implementation of Post-Quantum Cryptosystems (PQC) is becoming critical as the world migrates towards quantum-safe cryptography. Fault attacks (FA) are practical threats affecting cryptographic implementations on both embedded and native, multi-user systems. Although research on FAs targeting PQC algorithms is well-paced for embedded systems (typically with physical adversarial access), exploration of such threats for native systems (typically with remote adversarial access) requires further attention. The type of faults and, consequently, the attack algorithms differ significantly between embedded and native systems.In this paper, we present a systematic approach to evaluate PQC algorithms against Rowhammer – a remote, software-controlled fault injection vector in native and cloud-based systems. Unlike conventional ways in cryptography, where an attack is first developed in theory and then demonstrated on target platform(s), we take a system-specific approach by first characterizing the fault model of a target platform and then exploiting these faults to devise a suitable theoretical attack. This approach helps the attacker quickly converge to an attack optimized for the target system. Also, if exercised successfully for targets with low fault susceptibility, it finds attacks potentially affecting a large number of targets. Our approach is demonstrated for SPHINCS+, the NIST standard for stateless hash-based digital signatures. We discovered a novel Rowhammer-based forgery attack and demonstrated it for DDR3 and DDR4 DRAMs. The attacks were carried out on the standard implementation of SPHINCS+ and for the liboqs library. To the best of our knowledge, this is the first work proposing a forgery attack using Rowhammer on SPHINCS+.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.