Paper 2020/1578 Original: eprint.iacr.org/2020/1578 ↗
An IND-CCA2 Attack Against the 1st- and 2nd-round Versions of NTS-KEM
Abstract
This paper presents an IND-CCA2 attack against the 1st- and 2nd-round versions of NTS-KEM, i.e., the versions before the update in December 2019. Our attack works against the 1st- and 2nd-round specifications, with a number of decapsulation queries upper-bounded by n − k and an advantage lower-bounded by roughly 0.5(n − k)t/n^2 , where n, k, and t stand for the code length, code dimension, and the designed decoding capacity, for all the three parameter sets of NTS-KEM. We found that the non-reference implementations are also vulnerable to our attack, even though there are bugs. There are also bugs in the reference implementations, but in a way invulnerable to our attack.
Metadata
- Available format(s)
PDF- Category
- Public-key cryptography
- Publication info
- Preprint.
- History
- 2020-12-21: last updated
- 2020-12-21: published
- Short URL
- https://ia.cr/2020/1578
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2020/1578,
author = {Tung Chou},
title = {An IND-CCA2 Attack Against the 1st- and 2nd-round Versions of NTS-KEM},
howpublished = {Cryptology {ePrint} Archive, Paper 2020/1578},
year = {2020},
url = {https://eprint.iacr.org/2020/1578}
}