Fault attack recovers deterministic CSIDH and OSIDH-LD keys
Original title: From if to Oops: Turning a conditional into a key-recovery oracle
A binary search over faulted lane masks needs at most 297 queries for OSIDH-LD and 222 for CSIDH-512-sized keys.
Researchers show that deterministic CSIDH variants place secret-dependent steps at fixed public points, so the same instruction can be faulted on every run. Zeroing the mask that chooses which lane computes the next isogeny turns output changes into a threshold oracle on secret exponents. Full OSIDH-LD keys were recovered in a software fault simulation of the reference implementation, and a ChipWhisperer-Lite skipped the targeted instruction with probability at least 0.94. They argue fault resistance requires giving up determinism and propose randomization.
Unconfirmed: The hardware result is limited to an isolated fault position on ChipWhisperer-Lite, not a deployed product.
- One fault per execution feeds a binary search that recovers the full key.
- OSIDH-LD needs at most 297 oracle queries; deterministic CSIDH needs at most 222.
- The CSIDH figure is for CSIDH-512-sized keys.
- On ChipWhisperer-Lite the instruction skip probability is at least 0.94 at one isolated position.
From the original article
1 min read at arxiv.orgDeterministic variants of CSIDH remove randomness from the group action, either through implementation techniques or, as in Houben's deterministic CSIDH and OSIDH-LD, by design. Since earlier fault attacks on CSIDH mostly target random point sampling, determinism seems to close that avenue.
By Gustavo Banegas · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.