Although postquantum cryptography is of growing practical concern, not many works have been devoted to implementation security issues related to postquantum schemes. In this paper, we look in particular at fault attacks against implementations of lattice-based signatures and key exchange protocols. For signature schemes, we are interested both in Fiat-Shamir type constructions (particularly BLISS, but also GLP, PASSSign, and Ring-TESLA) and in hash-and-sign schemes (particularly the GPV-based scheme of Ducas-Prest-Lyubashevsky). For key exchange protocols, we study the implementations of NewHope, Frodo, and Kyber. These schemes form a representative sample of modern, practical lattice-based signatures and key exchange protocols, and achieve a high level of efficiency in both software and hardware. We present several fault attacks against those schemes that recover the entire key recovery with only a few faulty executions (sometimes only one), show that those attacks can be mounted in practice based on concrete experiments in hardware, and discuss possible countermeasures against them.

In this paper, we investigate the security of the BLISS lattice-based signature scheme, one of the most promising candidates for postquantum-secure signatures, against side-channel attacks. Several works have been devoted to its efficient implementation on various platforms, from desktop CPUs to microcontrollers and FPGAs, and more recent papers have also considered its security against certain types of physical attacks, notably fault injection and cache attacks. We turn to more traditional side-channel analysis, and describe several attacks that can yield a full key recovery.

Residue Number System (RNS) is nowadays considered as a real alternative to other hardware architectures for handling large-number computations. In this paper we propose algorithmic answers to some of the questions that may face a designer when implementing such solution. More precisely, we investigated the following three problems. First, we propose an efficient method for constructing maximal bases noticing that this problem can be seen as a max-clique problem. Second we consider the logical gates count reduction when two different bases share the same hardware modules. Again it is linked to graph theory since it corresponds to finding a maximum weighted matching. Eventually we detail how the presence of DSP blocks in FPGAs can be leveraged to reach higher design frequencies by implementing full computation units inside.