{"id":112780,"date":"2024-01-09T21:10:14","date_gmt":"2024-01-09T19:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber"},"modified":"2024-01-09T21:10:14","modified_gmt":"2024-01-09T19:10:14","slug":"uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-realizacziyah-postkvantovogo-algoritma-shifrovaniya-kyber","title":{"rendered":"Vulnerability in the implementations of the post-quantum encryption algorithm Kyber","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A vulnerability has been discovered in the Kyber encryption algorithm, which won the competition for quantum-resistant cryptographic algorithms. This vulnerability allows for side-channel attacks to reconstruct secret keys based on the timing of operations during the decryption of ciphertext provided by an attacker. The issue affects both the reference implementation of the CRYSTALS-Kyber KEM key encapsulation mechanism and many third-party encryption libraries supporting Kyber, including the pqcrypto library used in the Signal messenger. <\/p>\n

The essence of the vulnerability, codenamed KyberSlash, lies in the use during the decoding of the message in the division operation «t = (((t < 1) + KYBER_Q\/2)\/KYBER_Q) & 1;», where the dividend contains the secret value «t» of type «double», and the divisor is the well-known public value KYBER_Q. The problem is that the division operation time is not constant, and in different environments, the number of CPU cycles executed for division depends on the input data. Thus, based on variations in operation times, one can gain insight into the nature of the data used in the division. <\/p>\n

Daniel Bernstein, a well-known expert in the field of cryptography, has successfully prepared a working demonstration of the possibility of mounting a practical attack. In two out of three experiments conducted on a Raspberry Pi 2 board, he was able to fully reconstruct the Kyber-512 private key based on the timing measurements of the data decoding. The method can also be adapted for Kyber-768 and Kyber-1024 keys. For a successful attack, the ciphertext provided by the attacker must be processed using the same key pair, and the execution time of the operation must be accurately measurable. <\/p>\n

Another leak (KyberSlash2) has been identified in some libraries, which also arises from the use of a secret value during division. The differences from the first variant boil down to the call during the encryption stage (in the poly_compress and polyvec_compress functions), rather than during decryption. The second variant may be useful for an attack only in cases where the procedure is used in re-encryption operations, where the output of the ciphertext is considered confidential. <\/p>\n

The vulnerability has already been fixed in the following libraries: <\/p>\n