Algebraic Key-Recovery Side-Channel Attack on Classic McEliece
Résumé
The ongoing standardization of post-quantum cryptography (PQC) by NIST has renewed attention to code-based cryptosystems, notably \textit{Classic McEliece}, due to their long-standing resistance to cryptanalysis and strong security against quantum adversaries. However, implementation-level vulnerabilities such as side-channel leakage remain a critical threat. In this work, we present a novel algebraic side-channel attack targeting the decapsulation phase of \textit{Classic McEliece}, specifically when implemented using the reference decoding algorithm based on Berlekamp–Massey and matrix-vector multiplications. Our approach exploits Hamming weight leakage observed during syndrome computations and combines linear algebra techniques over finite fields with bit-level side-channel information. The proposed method significantly improves over previous attacks in terms of computational efficiency and robustness to noise, remaining effective even under realistic leakage inaccuracies. We provide both a theoretical analysis and a probabilistic model characterizing the success rate in noisy conditions. Our results also contribute to the theoretical understanding of algebraic distinguishability of field elements from side-channel leakage, partially validating previously stated conjectures. Experimental simulations confirm the practicality of the attack, including for large parameter sets associated with high security levels. Importantly, the attack specifically exploits leakage arising during the matrix--vector multiplication used to compute the double syndrome in the \textit{Classic McEliece} reference implementation. The attack does not apply if the double syndrome is computed by other means (for example, using transposed additive FFTs), or if a different decoding algorithm is used that does not require computing the double syndrome at all. This highlights that informed algorithmic choices can serve as effective countermeasures and underscores the urgent need for rigorous side-channel evaluations and secure-by-design implementations of code-based cryptosystems.
| Origine | Fichiers produits par l'(les) auteur(s) |
|---|---|
| licence |

