Paper 2025/195 Original: eprint.iacr.org/2025/195 ↗
Finding a polytope: A practical fault attack against Dilithium
Abstract
In Dilithium, the rejection sampling step is crucial for the proof of security and correctness of the scheme. However, to our knowledge, there is no attack in the literature that takes advantage of an attacker knowing rejected signatures. The aim of this paper is to create a practical black-box attack against Dilithium with a weakened rejection sampling. We succeed in showing that an adversary with enough rejected signatures can recover Dilithium's secret key in less than half an hour on a desktop computer. There is one possible application for this result: by physically preventing one of the rejection sampling tests from happening, we obtain two fault attacks against Dilithium.
Metadata
- Available format(s)
PDF- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- History
- 2025-02-10: last updated
- 2025-02-10: published
- Short URL
- https://ia.cr/2025/195
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2025/195,
author = {Paco Azevedo-Oliveira and Andersson Calle Viera and Benoît Cogliati and Louis Goubin},
title = {Finding a polytope: A practical fault attack against Dilithium},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/195},
year = {2025},
url = {https://eprint.iacr.org/2025/195}
}