Cryptology ePrint Archive: Report 2019/898

One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips

Mehdi Tibouchi and Alexandre Wallet

Abstract: As one of the most efficient lattice-based signature schemes, and one of the only ones to have seen deployment beyond an academic setting (e.g., as part of the VPN software suite strongSwan), BLISS has attracted a significant amount of attention in terms of its implementation security, and side-channel vulnerabilities of several parts of its signing algorithm have been identified in previous works. In this paper, we present an even simpler timing attack against it. The bimodal Gaussian distribution that BLISS is named after is achieved using a random sign flip during signature generation, and neither the original implementation of BLISS nor strongSwan ensure that this sign flip is carried out in constant time. It is therefore possible to recover the corresponding sign through side-channel leakage (using, e.g., cache attacks or branch tracing). We show that obtaining this single bit of leakage (for a moderate number of signatures) is in fact sufficient for a full key recovery attack. The recovery is carried out using a maximum likelihood estimation on the space of parameters, which can be seen as a statistical manifold. The analysis of the attack thus reduces to the computation of the Fisher information metric.

Category / Keywords: public-key cryptography / Lattice-Based Cryptography, Cryptanalysis, BLISS, Side-Channel Analysis, Maximum Likelihood Estimation, Parametric Inference, Information Geometry

Original Publication (with minor differences): Mathcrypt 2019

Date: received 1 Aug 2019, last revised 28 Aug 2019

Contact author: mehdi tibouchi at normalesup org, wallet alexandre at gmail com

Available format(s): PDF | BibTeX Citation

Note: Updated the description of the distribution for w and (-1)^b*z : made it more accurate and improved the analysis in appendix. Fixed minor editorial stuff.

Version: 20190829:015156 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]