Bypassing PQC Signature Verification with Fault Injection

## Overview

In this talk, Fikret Garipay (Security Engineer at Keysight Device Security Testing, formerly Riscure) analyzes the physical security and fault-injection vulnerability of Post-Quantum Cryptography (PQC) digital signature schemes. As quantum computing drives the transition away from RSA and ECC toward PQC for secure boot and firmware signing, implementations are increasingly deployed on embedded microcontrollers and hardware roots of trust (such as OpenTitan and Caliptra).

Garipay evaluates the primary signature schemes undergoing standardization or deployment—including Dilithium (required by the CNSA framework and standardized by NIST), SPHINCS+, LMS, and XMSS. He highlights that while PQC schemes offer theoretical algorithmic security against quantum cryptanalysis, practical implementations running on bare-metal embedded targets introduce novel, hardware-level fault-injection attack surfaces.

---

## Target Architecture and Experimental Setup

The research focuses strictly on exploiting underlying cryptographic logic rather than generic fault injection targets such as `memcmp` skips or forced return values.

* **Target Device**: STM32F4 microcontroller featuring an ARM Cortex-M4 core running bare-metal firmware. * **Target Libraries**: * PQM4 (an optimized PQC library targeting ARM Cortex-M4) used for Dilithium. * Upstream reference libraries used for XMSS and SPHINCS+ (due to lack of PQM4 support stemming from performance constraints). * **Fault Injection Apparatus**: * **Voltage Fault Injection (VFI)**: Lowering core supply voltage at precise time offsets. The parameters require balancing glitch length and glitch voltage between unperturbed execution (normal reject) and device mute/reset conditions to yield computational faults. * **FPGA**: Handles trigger detection, high-precision timing, and drives a programmable power source. * **Oscilloscope**: Monitors power traces, glitch profiles, and operational signals. * **Serial Interface**: Connects the PC host to the target device to issue commands and signatures.

---

## Attack Methodology: Dilithium Verification Bypass

The attacks build upon previous literature regarding the fault-injection sensitivity of public parameters in Dilithium (covering security levels 2, 3, and 5; targeting standard randomized signing using the Number Theoretic Transform (NTT)).

During standard verification, the device verifies $A z - c \cdot t_1 \cdot 2^d$, adjusts via a hint vector, recomputes $w_1$, and matches challenge $c$. By neutralizing or constraining the secret-dependent product term $c \cdot t_1 \cdot 2^d$, an attacker can sign an arbitrary message using **only the public key**:

* **Attack 1**: Force $c \cdot t_1 \cdot 2^d = 0$ during verification. * **Attack 2**: Force $c \cdot t_1 \cdot 2^d < \gamma_2$ during verification (where normally $d = 13$).

The speaker identified and experimentally validated multiple targeting scenarios within the PQM4 implementation:

1. **Unpacking Public Key**: Skipping the unpacking of $t_1$ causes $c \cdot t_1 \cdot 2^d = 0$ (enabling Attack 1). 2. **Challenge Sampling (`poly_challenge`)**: Skipping the second `for` loop in `poly_challenge` prevents coefficients from being overwritten after zero-initialization, keeping $c = 0$ and resulting in $c \cdot t_1 \cdot 2^d = 0$ (enabling Attack 1). 3. **Bit-Shift by $d$ (`poly_shift` / `polyveck_shift`)**: Skipping the loop that invokes `poly_shift` avoids the 13-bit shift (or reduces the shift below 4), ensuring $c \cdot t_1 \cdot 2^d < \gamma_2$ (enabling Attack 2). 4. **Polynomial Subtraction (`poly_sub` / `polyveck_sub`)**: Skipping the loop calling `poly_sub` prevents subtracting $c \cdot t_1 \cdot 2^d$ from $A z$, executing the check purely on $A z$ (enabling Attack 1).

Experimental parameter scans (plotting glitch duration vs. glitch voltage) demonstrated repeatable, successful verification bypasses across these scenarios.

---

## Findings and Takeaways

* **Public-Key-Only Forgery**: Corrupting intermediate polynomial arithmetic allows an adversary possessing only the public key to craft validly accepted signatures for arbitrary payloads. * **Broad and Fragmented Attack Surface**: Unlike classical schemes where hardening focused heavily on modular exponentiation or scalar multiplication, Dilithium verification spans initialization, challenge generation, shifting, and vector subtraction. A vulnerability in any of these subroutines compromises the entire verification chain. * **Hardness of Generic Hardening**: Securing PQC digital signature verifications against fault injection requires extensive, fine-grained control-flow and computational integrity checks at multiple stages, making generalized fault resistance significantly harder to implement than in classical primitives.