When Frodo Flips: End-to-End Key Recovery on FrodoKEM via Rowhammer

National Security Agency. 2021. Frequently Asked Questions: Quantum Computing and Post-Quantum Cryptography. https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF

Gorjan Alagic, Daniel Apon, David Cooper, Quynh Dang, Thinh Dang, John Kelsey, Jacob Lichtinger, Carl Miller, Dustin Moody, Rene Peralta, Ray Perlner, Angela Robinson, Daniel Smith-Tone, and Yi-Kai Liu. 2022. Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process. Technical Report : NIST Internal Report (NISTIR) 8413. U.S. Department of Commerce, Washington, D.C. https://doi.org/10.6028/NIST.IR.8413

Erdem Alkim, Joppe W. Bos, Léo Ducas, Patrick Longa, Ilya Mironov, Michael Naehrig, Valeria Nikolaenko, Chris Peikert, Ananth Raghunathan, Douglas Stebila, Karen Easterbrook, and LaMacchia Brian. 2022. FrodoKEM: Practical quantum-secure key encapsulation from generic lattices. https://frodokem.org/

Thomas Allan, Billy Bob Brumley, Katrina Falkner, Joop van de Pol, and Yuval Yarom. 2016. Amplifying Side Channels through Performance Degradation. In Proceedings of the 32nd Annual Conference on Computer Security Applications (Los Angeles, California, USA) (ACSAC '16). Association for Computing Machinery, New York, NY, USA, 422--435. https://doi.org/10.1145/2991079.2991084

Frank Arute, Kunal Arya, Ryan Babbush, Dave Bacon, Joseph C. Bardin, Rami Barends, Rupak Biswas, Sergio Boixo, Fernando G. S. L. Brandao, David A. Buell, Brian Burkett, Yu Chen, Zijun Chen, Ben Chiaro, Roberto Collins, William Courtney, Andrew Dunsworth, Edward Farhi, Brooks Foxen, Austin Fowler, Craig Gidney, Marissa Giustina, Rob Graff, Keith Guerin, Steve Habegger, Matthew P. Harrigan, Michael J. Hartmann, Alan Ho, Markus Hoffmann, Trent Huang, Travis S. Humble, Sergei V. Isakov, Evan Jeffrey, Zhang Jiang, Dvir Kafri, Kostyantyn Kechedzhi, Julian Kelly, Paul V. Klimov, Sergey Knysh, Alexander Korotkov, Fedor Kostritsa, David Landhuis, Mike Lindmark, Erik Lucero, Dmitry Lyakh, Salvatore Mandrà, Jarrod R. McClean, Matthew McEwen, Anthony Megrant, Xiao Mi, Kristel Michielsen, Masoud Mohseni, Josh Mutus, Ofer Naaman, Matthew Neeley, Charles Neill, Murphy Yuezhen Niu, Eric Ostby, Andre Petukhov, John C. Platt, Chris Quintana, Eleanor G. Rieffel, Pedram Roushan, Nicholas C. Rubin, Daniel Sank, Kevin J. Satzinger, Vadim Smelyanskiy, Kevin J. Sung, Matthew D. Trevithick, Amit Vainsencher, Benjamin Villalonga, Theodore White, Z. Jamie Yao, Ping Yeh, Adam Zalcman, Hartmut Neven, and John M. Martinis. 2019. Quantum supremacy using a programmable superconducting processor. Nature, Vol. 574, 7779 (2019), 505--510. https://doi.org/10.1038/s41586-019--1666--5

Zelalem Birhanu Aweke, Salessawi Ferede Yitbarek, Rui Qiao, Reetuparna Das, Matthew Hicks, Yossi Oren, and Todd Austin. 2016. ANVIL: Software-based protection against next-generation rowhammer attacks. ACM SIGPLAN Notices, Vol. 51, 4 (2016), 743--755.

Aurélie Bauer, Henri Gilbert, Guénaël Renault, and Mélissa Rossi. 2019. Assessment of the Key-Reuse Resilience of NewHope. In Topics in Cryptology -- CT-RSA 2019 (Lecture Notes in Computer Science, Vol. 11405), Mitsuru Matsui (Ed.). Springer, Heidelberg, Germany, San Francisco, CA, USA, 272--292. https://doi.org/10.1007/978--3-030--12612--4_14

Nina Bindel and John M. Schanck. 2020. Decryption Failure Is More Likely After Success. In Post-Quantum Cryptography - 11th International Conference, PQCrypto 2020, Jintai Ding and Jean-Pierre Tillich (Eds.). Springer, Heidelberg, Germany, Paris, France, 206--225. https://doi.org/10.1007/978--3-030--44223--1_12

Jonathan Bootle, Claire Delaplace, Thomas Espitau, Pierre-Alain Fouque, and Mehdi Tibouchi. 2018. LWE without modular reduction and improved side-channel attacks against BLISS. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 494--524.

Erik Bosman, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2016. Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector. In IEEE SP.

Ferdinand Brasser, Lucas Davi, David Gens, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2017. $$CAn't$$ Touch This: Software-only Mitigation against Rowhammer Attacks targeting Kernel Memory. In 26th USENIX Security Symposium (USENIX Security 17). 117--130.

Shawn T Brown, Paola Buitrago, Edward Hanna, Sergiu Sanielevici, Robin Scibek, and Nicholas A Nystrom. 2021. Bridges-2: A Platform for Rapidly-Evolving and Data Intensive Research. In Practice and Experience in Advanced Research Computing. 1--4.

Claudio Canella, Michael Schwarz, Martin Haubenwallner, Martin Schwarzl, and Daniel Gruss. 2020. KASLR: Break it, fix it, repeat. In Proceedings of the 15th ACM Asia Conference on Computer and Communications Security. 481--493.

Lucian Cojocar, Kaveh Razavi, Cristiano Giuffrida, and Herbert Bos. 2019. Exploiting correcting codes: On the effectiveness of ECC memory against Rowhammer attacks. In IEEE SP.

Dana Dachman-Soled, Léo Ducas, Huijing Gong, and Mélissa Rossi. 2020. LWE with Side Information: Attacks and Concrete Security Estimation. In Advances in Cryptology -- CRYPTO 2020, Part II (Lecture Notes in Computer Science, Vol. 12171), Daniele Micciancio and Thomas Ristenpart (Eds.). Springer, Heidelberg, Germany, Santa Barbara, CA, USA, 329--358. https://doi.org/10.1007/978--3-030--56880--1_12

Jan-Pieter D'Anvers, Qian Guo, Thomas Johansson, Alexander Nilsson, Frederik Vercauteren, and Ingrid Verbauwhede. 2019. Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes. In PKC 2019: 22nd International Conference on Theory and Practice of Public Key Cryptography, Part II (Lecture Notes in Computer Science, Vol. 11443), Dongdai Lin and Kazue Sako (Eds.). Springer, Heidelberg, Germany, Beijing, China, 565--598. https://doi.org/10.1007/978--3-030--17259--6_19

Jan-Pieter D'Anvers, Mélissa Rossi, and Fernando Virdia. 2020. (One) Failure Is Not an Option: Bootstrapping the Search for Failures in Lattice-Based Encryption Schemes. In Advances in Cryptology -- EUROCRYPT 2020, Part III (Lecture Notes in Computer Science, Vol. 12107), Anne Canteaut and Yuval Ishai (Eds.). Springer, Heidelberg, Germany, Zagreb, Croatia, 3--33. https://doi.org/10.1007/978--3-030--45727--3_1

Finn de Ridder, Pietro Frigo, Emanuele Vannacci, Herbert Bos, Cristiano Giuffrida, and Kaveh Razavi. 2021. SMASH: Synchronized Many-sided Rowhammer Attacks from JavaScript. In USENIX Security. Paper=https://comsec.ethz.ch/wp-content/files/smash_sec21.pdf URL=https://comsec.ethz.ch/research/dram/smash Pwnie Nomination for the Most Underhyped Research.

Jintai Ding, Saed Alsayigh, R V Saraswathy, Scott Fluhrer, and Xiaodong Lin. 2017. Leakage of signal function with reused keys in RLWE key exchange. In 2017 IEEE International Conference on Communications (ICC). 1--6. https://doi.org/10.1109/ICC.2017.7996806

Jintai Ding, Scott R. Fluhrer, and Saraswathy RV. 2018. Complete Attack on RLWE Key Exchange with Reused Keys, Without Signal Leakage. In ACISP 18: 23rd Australasian Conference on Information Security and Privacy (Lecture Notes in Computer Science, Vol. 10946), Willy Susilo and Guomin Yang (Eds.). Springer, Heidelberg, Germany, Wollongong, NSW, Australia, 467--486. https://doi.org/10.1007/978--3--319--93638--3_27

Scott Fluhrer. 2016. Cryptanalysis of ring-LWE based key exchange with key share reuse. Cryptology ePrint Archive, Report 2016/085. https://eprint.iacr.org/2016/085.

Pietro Frigo, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2018. Grand pwning unit: Accelerating microarchitectural attacks with the GPU. In IEEE SP. 195--210.

Pietro Frigo, Emanuele Vannacci, Hasan Hassan, Victor van der Veen, Onur Mutlu, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2020. TRRespass: Exploiting the Many Sides of Target Row Refresh. In S&P. https://comsec.ethz.ch/wp-content/files/trrespass_sp20.pdf Best Paper Award, Pwnie Award for the Most Innovative Research, Honorable Mention in IEEE MICRO Top Picks.

Eiichiro Fujisaki and Tatsuaki Okamoto. 1999. Secure Integration of Asymmetric and Symmetric Encryption Schemes. In Advances in Cryptology -- CRYPTO'99 (Lecture Notes in Computer Science, Vol. 1666), Michael J. Wiener (Ed.). Springer, Heidelberg, Germany, Santa Barbara, CA, USA, 537--554. https://doi.org/10.1007/3--540--48405--1_34

Bundesamt für Sicherheit in der Informationstechnik. 2022. BSI TR-02102--1: “Cryptographic Mechanisms: Recommendations and Key Lengths” Version: 2022--1. https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102--1.pdf

Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, and Cristiano Giuffrida. 2017. ASLR on the Line: Practical Cache Attacks on the MMU. In NDSS, Vol. 17. 26.

Daniel Gruss, Moritz Lipp, Michael Schwarz, Daniel Genkin, Jonas Juffinger, Sioli O'Connell, Wolfgang Schoechl, and Yuval Yarom. 2018. Another flip in the wall of Rowhammer defenses. In IEEE SP. 245--261.

Daniel Gruss, Clémentine Maurice, Anders Fogh, Moritz Lipp, and Stefan Mangard. 2016b. Prefetch side-channel attacks: Bypassing SMAP and kernel ASLR. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 368--379.

Daniel Gruss, Clémentine Maurice, and Stefan Mangard. 2016a. Rowhammer.js: A remote software-induced fault attack in JavaScript. In DIMVA. 300--321.

Dennis Hofheinz, Kathrin Hövelmanns, and Eike Kiltz. 2017. A Modular Analysis of the Fujisaki-Okamoto Transformation. In TCC 2017: 15th Theory of Cryptography Conference, Part I (Lecture Notes in Computer Science, Vol. 10677), Yael Kalai and Leonid Reyzin (Eds.). Springer, Heidelberg, Germany, Baltimore, MD, USA, 341--371. https://doi.org/10.1007/978--3--319--70500--2_12

James Howe, Ayesha Khalid, Marco Martinoli, Francesco Regazzoni, and Elisabeth Oswald. 2019. Fault attack countermeasures for error samplers in lattice-based cryptography. In 2019 IEEE International Symposium on Circuits and Systems (ISCAS). IEEE, 1--5.

Saad Islam, Koksal Mus, Richa Singh, Patrick Schaumont, and Berk Sunar. 2022. Signature Correction Attack on Dilithium Signature Scheme. CoRR, Vol. abs/2203.00637 (2022). https://doi.org/10.48550/arXiv.2203.00637 showeprint[arXiv]2203.00637

Patrick Jattke, Victor van der Veen, Pietro Frigo, Stijn Gunter, and Kaveh Razavi. 2022. Blacksmith: Scalable Rowhammering in the Frequency Domain. In S&P. Paper=https://comsec.ethz.ch/wp-content/files/blacksmith_sp22.pdf URL=https://comsec.ethz.ch/research/dram/blacksmith

Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. 2014. Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors. In 2014 ACM/IEEE 41st International Symposium on Computer Architecture (ISCA). 361--372. https://doi.org/10.1109/ISCA.2014.6853210

Daniel Kirkwood, Bradley C. Lackey, John McVey, Mark Motley, Jerome A. Solinas, and David Tuller. 2015. Failure is not an Option: Standardization Issues for Post-Quantum Key Agreement. https://csrc.nist.gov/csrc/media/events/workshop-on-cybersecurity-in-a-post-quantum-world/documents/presentations/session7-motley-mark.pdf.

Radhesh Krishnan Konoth, Marco Oliverio, Andrei Tatar, Dennis Andriesse, Herbert Bos, Cristiano Giuffrida, and Kaveh Razavi. 2018. $$ZebRAM$$: Comprehensive and Compatible Software Protection Against Rowhammer Attacks. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18). 697--710.

Andrew Kwong, Daniel Genkin, Daniel Gruss, and Yuval Yarom. 2020. RAMBleed: Reading Bits in Memory Without Accessing Them. In 41st IEEE Symposium on Security and Privacy (S&P).

Richard Lindner and Chris Peikert. 2011. Better Key Sizes (and Attacks) for LWE-Based Encryption. In Topics in Cryptology -- CT-RSA 2011 (Lecture Notes in Computer Science, Vol. 6558), Aggelos Kiayias (Ed.). Springer, Heidelberg, Germany, San Francisco, CA, USA, 319--339. https://doi.org/10.1007/978--3--642--19074--2_21

Moritz Lipp, Michael Schwarz, Lukas Raab, Lukas Lamster, Misiker Tadesse Aga, Clémentine Maurice, and Daniel Gruss. 2020. Nethammer: Inducing rowhammer faults through network requests. In 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 710--719.

Michele Marazzi, Patrick Jattke, Flavien Solt, and Kaveh Razavi. 2022. ProTRR: Principled yet Optimal In-DRAM Target Row Refresh. In S&P. Paper=https://comsec.ethz.ch/wp-content/files/protrr_sp22.pdf URL=https://comsec.ethz.ch/research/dram/protrr Patent pending, ETH Spark Award Nomination.

Daniele Micciancio and Oded Regev. 2009. Lattice-based cryptography. In Post-quantum cryptography. Springer, 147--191.

Koksal Mus, Saad Islam, and Berk Sunar. 2020. QuantumHammer: A Practical Hybrid Attack on the LUOV Signature Scheme. In ACM CCS 2020: 27th Conference on Computer and Communications Security, Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna (Eds.). ACM Press, Virtual Event, USA, 1071--1084. https://doi.org/10.1145/3372297.3417272

Onur Mutlu and Jeremie S. Kim. 2020. RowHammer: A Retrospective. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, Vol. 39, 8 (2020), 1555--1571. https://doi.org/10.1109/TCAD.2019.2915318

NIST. 2016. Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process. https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/call-for-proposals-final-dec-2016.pdf

National Institute of Standards and Technology (NIST). 2022a. Post-quantum cryptography - Round 3 submissions. https://csrc.nist.gov/Projects/post-quantum-cryptography/round-3-submissions

National Institute of Standards and Technology (NIST). 2022b. Post-quantum cryptography standardization. https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization

Chris Peikert. 2016. A Decade of Lattice Cryptography. Foundations and Trends in Theoretical Computer Science, Vol. 10, 4 (2016), 283--424. https://doi.org/10.1561/0400000074

Peter Pessl, Leon Groot Bruinderink, and Yuval Yarom. 2017. To BLISS-B or not to be: Attacking strongSwan's Implementation of Post-Quantum Signatures. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1843--1855.

Ruth Pordes, Don Petravick, Bill Kramer, Doug Olson, Miron Livny, Alain Roy, Paul Avery, Kent Blackburn, Torre Wenaus, Frank Würthwein, et al. 2007 a. The open science grid. In Journal of Physics: Conference Series, Vol. 78. IOP Publishing, 012057.

Ruth Pordes, Don Petravick, Bill Kramer, Doug Olson, Miron Livny, Alain Roy, Paul Avery, Kent Blackburn, Torre Wenaus, Frank Würthwein, Ian Foster, Rob Gardner, Mike Wilde, Alan Blatecky, John McGee, and Rob Quick. 2007 b. The open science grid. In J. Phys. Conf. Ser. (78, Vol. 78). 012057. https://doi.org/10.1088/1742--6596/78/1/012057

Yue Qin, Chi Cheng, Xiaohan Zhang, Yanbin Pan, Lei Hu, and Jintai Ding. 2021. A Systematic Approach and Analysis of Key Mismatch Attacks on Lattice-Based NIST Candidate KEMs. In ASIACRYPT 2021, Tibouchi and H. Wang (Eds.). 92--121. https://doi.org/10.1007/978--3-030--92068--5_4

Prasanna Ravi, Mahabir Prasad Jhanwar, James Howe, Anupam Chattopadhyay, and Shivam Bhasin. 2018. Side-channel assisted existential forgery attack on Dilithium-a NIST PQC candidate. Cryptology ePrint Archive (2018).

Prasanna Ravi, Mahabir Prasad Jhanwar, James Howe, Anupam Chattopadhyay, and Shivam Bhasin. 2019. Exploiting determinism in lattice-based signatures: practical fault attacks on pqm4 implementations of NIST candidates. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security. 427--440.

Kaveh Razavi, Ben Gras, Erik Bosman, Bart Preneel, Cristiano Giuffrida, and Herbert Bos. 2016. Flip Feng Shui: Hammering a Needle in the Software Stack. In USENIX Security. 1--18.

Oded Regev. 2005. On lattices, learning with errors, random linear codes, and cryptography. In 37th Annual ACM Symposium on Theory of Computing, Harold N. Gabow and Ronald Fagin (Eds.). ACM Press, Baltimore, MA, USA, 84--93. https://doi.org/10.1145/1060590.1060603

Google Research. 2021. Half-Double: Next-Row-Over Assisted Rowhammer. https://github.com/google/hammer-kit/blob/main/20210525_half_double.pdf

Tsunekazu Saito, Keita Xagawa, and Takashi Yamakawa. 2018. Tightly-Secure Key-Encapsulation Mechanism in the Quantum Random Oracle Model. In Advances in Cryptology -- EUROCRYPT 2018, Part III (Lecture Notes in Computer Science, Vol. 10822), Jesper Buus Nielsen and Vincent Rijmen (Eds.). Springer, Heidelberg, Germany, Tel Aviv, Israel, 520--551. https://doi.org/10.1007/978--3--319--78372--7_17

Mark Seaborn and Thomas Dullien. 2015. Exploiting the DRAM Rowhammer bug to gain kernel privileges. https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html.

Johanna Sepulveda, Andreas Zankl, and Oliver Mischke. 2017. Cache attacks and countermeasures for NTRUEncrypt on MPSoCs: post-quantum resistance for the IoT. In 2017 30th IEEE International System-on-Chip Conference (SOCC). IEEE, 120--125.

Igor Sfiligoi, Daniel C Bradley, Burt Holzman, Parag Mhashilkar, Sanjay Padhi, and Frank Wurthwein. 2009a. The pilot way to grid resources using glideinWMS. In 2009 WRI World congress on computer science and information engineering, Vol. 2. IEEE, 428--432.

Igor Sfiligoi, Daniel C Bradley, Burt Holzman, Parag Mhashilkar, Sanjay Padhi, and Frank Wurthwein. 2009b. The pilot way to grid resources using glideinWMS. In 2009 WRI World Congress on Computer Science and Information Engineering (2, Vol. 2). 428--432. https://doi.org/10.1109/CSIE.2009.950

Kevin Z Snow, Fabian Monrose, Lucas Davi, Alexandra Dmitrienko, Christopher Liebchen, and Ahmad-Reza Sadeghi. 2013. Just-in-time code reuse: On the effectiveness of fine-grained address space layout randomization. In 2013 IEEE Symposium on Security and Privacy. IEEE, 574--588.

Andrei Tatar, Radhesh Krishnan Konoth, Elias Athanasopoulos, Cristiano Giuffrida, Herbert Bos, and Kaveh Razavi. 2018. Throwhammer: Rowhammer Attacks over the Network and Defenses. In USENIX ATC. https://comsec.ethz.ch/wp-content/files/throwhammer_atc18.pdf Pwnie Award Nomination for the Most Innovative Research.

Mehdi Tibouchi and Alexandre Wallet. 2021. One bit is all it takes: a devastating timing attack on BLISS's non-constant time sign flips. Journal of Mathematical Cryptology, Vol. 15, 1 (2021), 131--142.

Youssef Tobah, Andrew Kwong, Ingab Kang, Daniel Genkin, and Kang G Shin. 2022. SpecHammer: Combining Spectre and Rowhammer for New Speculative Attacks. In 43rd IEEE Symposium on Security and Privacy (S&P).

Victor Van Der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clementine Maurice, Giovanni Vigna, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida. 2016. Drammer: Deterministic Rowhammer attacks on mobile platforms. In CCS. 1675--1689.

Ricardo Villanueva-Polanco. 2019. Cold Boot Attacks on Bliss. In International Conference on Cryptology and Information Security in Latin America. Springer, 40--61.

Yuan Xiao, Xiaokuan Zhang, Yinqian Zhang, and Radu Teodorescu. 2016. One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation. In USENIX Security.

Yuval Yarom and Katrina Falkner. 2014. $$FLUSH RELOAD$$: A High Resolution, Low Noise, L3 Cache $$Side-Channel$$ Attack. In 23rd USENIX security symposium (USENIX security 14). 719--732. io