KyberSlash: Exploiting secret-dependent division timings in Kyber implementations

Abstract: This paper presents KyberSlash1 and KyberSlash2 – two timing vulnerabilities in several implementations (including the official reference code) of the Kyber Post-Quantum Key Encapsulation Mechanism, recently standardized as ML-KEM. We demonstrate the exploitability of both KyberSlash1 and KyberSlash2 on two popular platforms: the Raspberry Pi 2 (Arm Cortex-A7) and the Arm Cortex-M4 microprocessor. Kyber secret keys are reliably recovered within minutes for KyberSlash2 and a few hours for KyberSlash1. We responsibly disclosed these vulnerabilities to maintainers of various libraries and they have swiftly been patched. We present two approaches for detecting and avoiding similar vulnerabilities. First, we patch the dynamic analysis tool Valgrind to allow detection of variable-time instructions operating on secret data, and apply it to more than 1000 implementations of cryptographic primitives in SUPERCOP. We report multiple findings. Second, we propose a more rigid approach to guaran.... https://tches.iacr.org/index.php/TCHES/article/view/12046

Objekt anzeigen

• Standort: Deutsche Nationalbibliothek Frankfurt am Main
• Umfang: Online-Ressource
• Sprache: Englisch

Verweise und Beziehungen

• Erschienen in: KyberSlash: Exploiting secret-dependent division timings in Kyber implementations ; volume:2025 ; number:2 ; year:2025 ; IACR transactions on cryptographic hardware and embedded systems ; 2025, Heft 2 (2025)

Beteiligte, Orts- und Zeitangaben

• Urheber: Bernstein, Daniel J. ; Bhargavan, Karthikeyan ; Bhasin, Shivam ; Chattopadhyay, Anupam ; Chia, Tee Kiah ; Kannwischer, Matthias J. ; Kiefer, Franziskus ; Paiva, Thales B. ; Ravi, Prasanna ; Tamvada, Goutam

Weitere Informationen

• DOI: 10.46586/tches.v2025.i2.209-234
• URN: urn:nbn:de:101:1-2503121800433.775473703874
• Rechteinformation: Open Access; Der Zugriff auf das Objekt ist unbeschränkt möglich.