论文标题
模糊+硬件性能计数器基于算法颠覆攻击后量子签名方案的检测
Fuzzing+Hardware Performance Counters-Based Detection of Algorithm Subversion Attacks on Post-Quantum Signature Schemes
论文作者
论文摘要
NIST正在标准化量子加密后（PQC）算法，该算法符合量子计算机的计算能力。过去的作品显示了使用加密软件（算法颠覆攻击）的恶意颠覆，从而削弱了实现。我们表明，PQC数字签名代码可以与先前报道的有缺陷的实现相一致，这些有缺陷的实现产生可验证但较少的安全签名，这表明了这种攻击的风险。由于所有处理器都具有内置的硬件性能计数器（HPC），因此存在大量的作品，建议使用HPC指纹对软件进行低成本机器学习（ML）的完整性检查。但是，这种基于HPC的方法可能无法检测到PQC代码的颠覆。当应用于PQC代码时，定性输入的最小百分比提高了该准确性至98％。我们提出灰色盒子的模糊作为获得投入的预处理步骤，以帮助基于HPC的方法。
NIST is standardizing Post Quantum Cryptography (PQC) algorithms that are resilient to the computational capability of quantum computers. Past works show malicious subversion with cryptographic software (algorithm subversion attacks) that weaken the implementations. We show that PQC digital signature codes can be subverted in line with previously reported flawed implementations that generate verifiable, but less-secure signatures, demonstrating the risk of such attacks. Since, all processors have built-in Hardware Performance Counters (HPCs), there exists a body of work proposing a low-cost Machine Learning (ML)-based integrity checking of software using HPC fingerprints. However, such HPC-based approaches may not detect subversion of PQC codes. A miniscule percentage of qualitative inputs when applied to the PQC codes improve this accuracy to 98%. We propose grey-box fuzzing as a pre-processing step to obtain inputs to aid the HPC-based method.
