@inproceedings{c89e9006ce9b435fb9d5cfb774a8f86b,
title = "Assessment of the Key-Reuse Resilience of NewHope",
abstract = "NewHope{\^A} is a suite of two efficient Ring-Learning-With-Error based key encapsulation mechanisms (KEMs) that has been proposed to the NIST call for proposals for post-quantum standardization. In this paper, we study the security of NewHope{\^A} when an active adversary takes part in a key establishment protocol and is given access to an oracle, called key mismatch oracle, which indicates whether her guess of the shared key value derived by the party targeted by the attack is correct or not. This attack model turns out to be relevant in private key reuse situations since an attacker may then be able to access such an oracle repeatedly – either directly or using faults or side channels, depending on the considered instance of NewHope. Following this model we show that, by using NewHope{\^A} recommended parameters, several thousands of queries are sufficient to recover the full private key with high probability. This result has been experimentally confirmed using Magma CAS{\^A} implementation. While the presented key mismatch oracle{\^A} attacks do not break any of the designers{\textquoteright} security claims for the NewHope{\^A} KEMs, they provide better insight into the resilience of these KEMs against key reuse. In the case of the CPA-KEM instance of NewHope, they confirm that key reuse (e.g. key caching at server side) should be strictly avoided, even for an extremely short duration. In the case of the CCA-KEM instance of NewHope, they allow to point out critical steps inside the CCA transform that should be carefully protected against faults or side channels in case of potential key reuse.",
keywords = "Active attack, Lattice based cryptography, PQ-crypto, Side channels",
author = "Aur{\'e}lie Bauer and Henri Gilbert and Gu{\'e}na{\"e}l Renault and M{\'e}lissa Rossi",
note = "Publisher Copyright: {\textcopyright} 2019, Springer Nature Switzerland AG.; Cryptographers Track at the RSA Conference 2019, CT-RSA 2019 ; Conference date: 04-03-2019 Through 08-03-2019",
year = "2019",
month = jan,
day = "1",
doi = "10.1007/978-3-030-12612-4\_14",
language = "English",
isbn = "9783030126117",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "272--292",
editor = "Mitsuru Matsui",
booktitle = "Topics in Cryptology – CT-RSA 2019 - The Cryptographers{\textquoteright} Track at the RSA Conference 2019, Proceedings",
}