Paper 2026/580
Exploiting noisy single-bit leakage in ML-DSA
, Bundesamt für Sicherheit in der Informationstechnik (BSI)Abstract
ML-DSA implementations face a serious risk from partial leakage of the mask vector $\boldsymbol{y}$. Recent research has shown that this threat is practical. Even highly noisy, single-bit leakage accumulated over many signatures can suffice to recover the secret key. We carefully analyze the number of signatures with bit leakage required for successful key recovery using a stochastic model, rather than relying on a concrete attack method. On the practical side, we develop new attack methods capable of recovering the key using almost the minimal number of signatures required in theory. Our attacks work for bit-error probabilities as high as 0.49 and for leakage at every bit position of index at least four or five (depending on the ML-DSA parameter set), making them more widely applicable than prior attacks, which were not reported to succeed for bit positions below six. In the most favorable scenario, leakage at bit index four keeps our attack practical for leaked bits with an error probability of 0.499, and in the absence of noise reduces the signature requirement to below 1000.
Metadata
- Available format(s)
-
PDF
- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- Keywords
- ML-DSADilithiumkey recoveryinteger linear programmingnonlinear programming
- Contact author(s)
-
kaveh bashiri @ bsi bund de
jan geuenich @ bsi bund de
johannes mittmann @ bsi bund de - History
- 2026-03-24: approved
- 2026-03-23: received
- See all versions
- Short URL
- https://ia.cr/2026/580
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2026/580,
author = {Kaveh Bashiri and Jan Geuenich and Johannes Mittmann},
title = {Exploiting noisy single-bit leakage in {ML}-{DSA}},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/580},
year = {2026},
url = {https://eprint.iacr.org/2026/580}
}
