As post-quantum cryptography (PQC) nears standardization and eventual deployment, it is increasingly important to understand the security of the implementations of selected schemes. In this paper, we conduct such an investigation, uncovering concerning findings about many of the finalists of the NIST PQC standardization competition. Specifically, we show Rowhammer-based attacks on the Kyber and BIKE Key Exchange Mechanisms and the Dilithium Digital Signature scheme that enable complete recovery of the secret key with only a moderate amount of effort - no supercomputers, or months of precomputation. Moreover, we experimentally carry out our attacks using a combination of Rowhammer, performance degradation, and memory massaging techniques, showing that our attacks are practically feasible. Our results show that such side-channel based attacks are a critical concern and need to be considered when new cryptographic schemes are standardized, when standard implementations are developed, and when instances are deployed. We conclude with recommendations on implementation techniques that harden cryptographic schemes against Rowhammer attacks.

Abstract We introduce new types of formula for isogenies between elliptic curves in the Weierstrass model. Elliptic curves and isogenies (morphisms between elliptic curves) are important mathematical concepts that have attracted interest of both mathematicians and cryptographers. Given a Weierstrass equation defining an elliptic curve and a finite subgroup on the curve, the well-known Vélu’s formula shows how to explicitly write down an isogeny between two Weierstrass elliptic curves with the given subgroup as its kernel. The Vélu’s formula is described by equations involving summations of the coordinates of points. Several prior works have developed a different type of isogeny formula described by products of the coordinates of points on various alternative models of elliptic curves. In this work, we give a family of new types of formula for isogenies between elliptic curves, subsuming the sum type and product type as special cases.

In this work, we recover the private key material of the FrodoKEM key exchange mechanism as submitted to the NIST Post Quantum Cryptography (PQC) standardization process.