Chosen-Ciphertext Clustering Attack on CRYSTALS-KYBER Using the Side-Channel Leakage of Barrett Reduction

This study proposes a chosen-ciphertext side-channel attack against a lattice-based key encapsulation mechanism (KEM), the third-round candidate of the national institute of standards and technology (NIST) standardization project. Unlike existing attacks that target operations, such as inverse NTT and message encoding/decoding, we target
$\mathsf {Barrett~reduction}$
in the decapsulation phase of
$\mathsf {CRYSTALS{-}KYBER}$
to obtain a secret key. We show that a sensitive variable-dependent leakage of
$\mathsf {Barrett~reduction}$
exposes an entire secret key. The results of experiments conducted on the ARM Cortex-M4 microcontroller accomplish a success rate of 100%. We only need six chosen ciphertexts for
$\mathsf {KYBER512}$
and
$\mathsf {KYBER768}$
and eight chosen ciphertexts for
$\mathsf {KYBER1024}$
. We also show that the
$\mathsf {m4}$
scheme of the
$\mathsf {pqm4}$
library, an implementation with the ARM Cortex-M4 specific optimization (typically in assembly), is vulnerable to the proposed attack. In this scheme, six, nine, and twelve chosen ciphertexts are required for
$\mathsf {KYBER512}$
,
$\mathsf {KYBER768}$
, and
$\mathsf {KYBER1024}$
, respectively.