SHIFT SNARE: Uncovering Secret Keys in FALCON via Single-Trace Analysis

2025-04-01

IACR Cryptology ePrint Archive

AI Summary

This work uncovers a critical side-channel vulnerability in the discrete Gaussian sampling (DGS) step of FALCON—a NIST-standardized post-quantum signature scheme—during key generation. Specifically, it exploits a sign-bit leakage induced by a 63-bit right shift on 64-bit integers in the reference implementation. We propose the first single-trace power-analysis attack capable of accurately determining the sign (−1 or 0) of polynomial coefficients using only one power trace. Our method integrates side-channel analysis with statistical hypothesis testing. Evaluated on an ARM Cortex-M4 embedded platform for FALCON-512, it achieves a per-coefficient recovery success rate of 99.9999999478% and a full-secret-key recovery rate of 99.99994654%. This is the first attack to fully recover a FALCON secret key under a single-trace setting, breaking the conventional multi-trace paradigm and highlighting practical side-channel risks of lattice-based signatures in resource-constrained deployments.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Adversarial Attacks & Robustness
• Search and Optimization: Sampling/Simulation-based Search

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs

Abstract

This paper presents a novel single-trace side-channel attack on FALCON -- a lattice-based post-quantum digital signature protocol recently approved for standardization by NIST. We target the discrete Gaussian sampling operation within the FALCON key generation scheme and use a single power measurement trace to succeed. Notably, negating the `shift right 63-bit' operation (for 64-bit values) leaks critical information about the `-1' vs. `0' assignments to intermediate coefficients. These leaks enable full recovery of the generated secret keys. The proposed attack is implemented on an ARM Cortex-M4 microcontroller running both reference and optimized software implementations from FALCON's NIST Round 3 package. Statistical analysis with 500k tests reveals a per coefficient success rate of 99.9999999478% and a full key recovery success rate of 99.99994654% for FALCON-512. This work highlights the vulnerability of current software solutions to single-trace attacks and underscores the urgent need to develop single-trace resilient software for embedded systems.

Problem

• Single-trace attack on FALCON key generation
• Exploits leakage in discrete Gaussian sampling
• Recovers secret keys with high success rate

Innovation

• Single-trace attack on FALCON key generation
• Exploits shift right 63-bit operation leak
• ARM Cortex-M4 implementation with high success