Sonia Belaïd

Ange Martinelli

Thomas Prest Pqshield

Je Remercie Aussi

Michel F Abdalla

Martin Albrecht

Pierre- Alain Fouque

Helena Handschuh

Ensuite Vers Henri

Thomas Ange

Prest

Jean-René Ricosset

Renaud Dupin

David Dubois

Olivier Lefranc

Philippe Bernard

Olivier Painchault

Matthieu Orcière

Julien Giraud

Sylvain Prat

Zoé Lachartre

Amblard Que J'ai

Louiza Khati

Aurélien Dupin

Brice Minaud

David Naccache

Hoeteck Wee

Céline Chevalier

Phong Nguyen

Duong-Hieu Phan

Azam Soleima- Nian

Balthazar Bauer

Léo Colisson

Luka Music

Théo Ryffel

Ainsi Qu'aux Nouveaux

Baptiste Cottier

Lénaick Gouriou

Hugo Senet Merci

Georg Fuchs- Bauer

Damien Vergnaud

Ehsan Ebrahimi

Pooya Farshim

Junqing Gong

Julia Hesse

Fabrice X Benhamouda

Florian Bourse

Jérémy Chotard

Aisling Connolly

Geoffroy Couteau

Del Rafaël

Pierre-Alain Pino

Dahmun Dupont

Thierry Goudarzi

Michele Mefenza

Michele Minelli

Alain Orrù

Razvan Passelègue

Léonard Rosie

Thibaut Assouline

Hugo Bagory

Edouard Dufour Marival

Bogdan Sans

Marie Ursu

Euler

Merci

Stéphane Émery

Lise-Marie Bivard

Sophie Jaudon

Valérie Mongiat

Aurélie Bauer

Jérôme Plût

Jérémy Jean

Jean-René Reinhard

Hugues Randriam

Yannick Seurin

Thomas Fuhr

Thomas Trouchkine

David El-Baze

Guillaume Bouffard

Emmanuel Prouff

Adrian Tillard

Ryad Benadjila

Karim Khalfallah

Boris Simunovic

Yoan Chergui

Eliane Jaulmes

J'ai Finalement

José Beaucoup À Henri

Laura Araujo

Isabelle Coman

Pastor D'

Alain Fouque

Gilles Barthe

So- Nia Belaïd

Benjamin Grégoire

Je Ensuite

Aurélie Remercie

Guénaël Bauer

Renault

Pierrick Méaux

Rotella Yann

Je Remercie François

Léo Ducas

Huijing Gong

Dana Dachman-Soled

Pieter D ' Anvers

Fernando Virdia

Mark E Marson

Mike Hamburg

Mike Hutter

Merci Beaucoup À Sonia

Matthieu Rivain

Invité•e•s ayant participé à l'encadrement

Lattice-based cryptography is considered as a quantum-safe alternative for the replacement of currently deployed schemes based on RSA and discrete logarithm on prime fields or elliptic curves. It offers strong theoretical security guarantees, a large array of achievable primitives, and a competitive level of efficiency. Nowadays, in the context of the NIST post-quantum standardization process, future standards may ultimately be chosen and several new latticebased schemes are high-profile candidates. The cryptographic research has been encouraged to analyze lattice-based cryptosystems, with a particular focus on practical aspects. This thesis is rooted in this effort.

In addition to black-box cryptanalysis with classical computing resources, we investigate the extended security of these new lattice-based cryptosystems, employing a broad spectrum of attack models, e.g. quantum, misuse, timing or physical attacks. Accounting that these models have already been applied to a large variety of pre-quantum asymmetric and symmetric schemes before, we concentrate our efforts on leveraging and addressing the new features introduced by lattice structures. Our contribution is twofold: defensive, i.e. countermeasures for implementations of lattice-based schemes and offensive, i.e. cryptanalysis.

On the defensive side, in view of the numerous recent timing and physical attacks, we wear our designer's hat and investigate algorithmic protections. We introduce some new algorithmic and mathematical tools to construct provable algorithmic countermeasures in order to systematically prevent all timing and physical attacks. We thus participate in the actual provable protection of the GLP, BLISS, qTesla and Falcon lattice-based signatures schemes.

On the offensive side, we estimate the applicability and complexity of novel attacks leveraging the lack of perfect correctness introduced in certain lattice-based encryption schemes to improve their performance. We show that such a compromise may enable decryption failures attacks in a misuse or quantum model. We finally introduce an algorithmic cryptanalysis tool that assesses the security of the mathematical problem underlying lattice-based schemes when partial knowledge of the secret is available. The usefulness of this new framework is demonstrated with the improvement and automation of several known classical, decryption-failure, and side-channel attacks.

En arrivant de San Francisco, je ne pensais pas que cette expérience serait aussi riche en émotions. Je m'imaginais encore moins qu'elle se terminerait par une pandémie mondiale et une soutenance en comité restreint. Mais cela n'enlève rien à mon enthousiasme pour ce domaine passionnant et ma fierté au regard du chemin parcouru. Voici quelques mots-clés qui, à mon avis, ont participé au bon déroulement et à l'authenticité de cette thèse. viii Lignes 1 Super allié et boosteur de moral. Je ne peux pas en dire plus, par crainte de la mafia corse.

2 Activité de détente fréquemment pratiquée avec Louiza et Chloé qui consistait à se mettre de la terre dans les cheveux pour devenir plus ou moins rousse.

3 Quizz quotidien de culture générale dont les réponses sont principalement détenues par Jérôme ou Hugues.

4 Nombre anormalement élevé d'affiliations pour une doctorante. Je ne regrette pas ce format original de thèse multipartite qui m'a permis d'être entourée de collègues brillants issus de milieux académiques, industriels et étatiques.

5 "Parce que tu le vaux bien", et parce que le prix Jeune Talents a été une incroyable expérience. Je remercie toute son équipe chaleureusement.

6 Passion très contagieuse partagée avec plusieurs membres du laboratoire de l'ENS. Victimes de selection naturelle pendant le confinement.

7 Dira qu'il n'a pas assez dirigé ma thèse alors que son soutien a été sans faille quelle que soit l'heure du jour et de la nuit. Merci infiniment ! 8 Groupe de recherche presque totalement féminin relié au projet RISQ. 9 Ornithophile arachnophobe toujours disponible pour m'aider malgré son emploi du temps chargé, source perpétuelle des bonnes idées de recherche.

10 A l'origine de mon projet de thèse, elle m'a guidée et conseillée avec beaucoup de bienveillance. J'ai beaucoup apprécié travailler avec elle, merci ! 11 Mon premier jour de thèse a consité à distribuer des badges et goodies pendant cette conférence.

12 Quoi qu'en disent les rageux, c'est définitivement un sport.

13 Japonophile qui m'a aidée à comprendre les algorithmes de bases de Gröbner. Merci pour ton soutien et tes conseils pendant ma thèse ! 14 Structure académique prestigieuse dans laquelle j'ai été ravie de pouvoir faire ma thèse. Je n'oublierai pas les nombreuses pauses café à refaire le monde avec les membres de l'équipe.

Colonnes

a Un des nombreux acronymes douteux générés pendant cette thèse.

b Great Californian company where I had the chance to make a pre-doc internship.

c Contrairement au cryptnic, je n'ai jamais pu en organiser par manque de volontaires.

d La raison pour laquelle il faut se faire discret en automne et au printemps.

e Seul projet de recherche qui n'avait rien à voir avec mon pourtant très large sujet de thèse, mais qui m'a permis de travailler avec des amis dans une super ambiance.

f Ce n'est pas une startup mais une PME : environnement très stimulant avec une équipe de choc que j'ai été ravie de venir voir régulièrement.

g Boss final à convaincre pour pouvoir soutenir. Ses remarques ont grandement amélioré la qualité de ce manuscrit.

h Principe du chapitre 3 et aussi une des solutions à l'épidémie de Covid19.

i Environnement industriel dynamique aux mille avantages dans lequel j'ai passé de très belles années.

Résumé

La cryptographie fondée sur les réseaux euclidiens représente une alternative prometteuse à la cryptographie asymétrique utilisée actuellement, en raison de sa résistance présumée à un ordinateur quantique universel. Cette nouvelle famille de schémas asymétriques dispose de plusieurs atouts parmi lesquels de fortes garanties théoriques de sécurité, un large choix de primitives et, pour certains de ses représentants, des performances comparables aux standards actuels. Une campagne de standardisation post-quantique organisée par le NIST est en cours et plusieurs schémas utilisant des réseaux euclidiens font partie des favoris. La communauté scientifique a été encouragée à les analyser car ils pourraient à l'avenir être implantés dans tous nos systèmes. L'objectif de cette thèse est de contribuer à cet effort.

Nous étudions la sécurité de ces nouveaux cryptosystèmes non seulement au sens de leur résistance à la cryptanalyse en "boîte noire" à l'aide de moyens de calcul classiques, mais aussi selon un spectre plus large de modèles de sécurité, comme les attaques quantiques, les attaques supposant des failles d'utilisation, ou encore les attaques par canaux auxiliaires. Ces différents types d'attaques ont déjà été largement formalisés et étudiés par le passé pour des schémas asymétriques et symétriques pré-quantiques. Dans ce mémoire, nous analysons leur application aux nouvelles structures induites par les réseaux euclidiens. Notre travail est divisé en deux parties complémentaires : les contremesures et les attaques.

La première partie regroupe nos contributions à l'effort actuel de conception de nouvelles protections algorithmiques afin de répondre aux nombreuses publications récentes d'attaques par canaux auxiliaires. Les travaux réalisés en équipe auxquels nous avons pris part on abouti à l'introduction de nouveaux outils mathématiques pour construire des contre-mesures algorithmiques, appuyées sur des preuves formelles, qui permettent de prévenir systématiquement les attaques physiques et par analyse de temps d'exécution. Nous avons ainsi participé à la protection de plusieurs schémas de signature fondés sur les réseaux euclidiens comme GLP, BLISS, qTesla ou encore Falcon.

Dans une seconde partie consacrée à la cryptanalyse, nous étudions dans un premier temps de nouvelles attaques qui tirent parti du fait que certains schémas de chiffrement à clé publique ou d'établissement de clé peuvent échouer avec une faible probabilité. Ces échecs sont effectivement faiblement corrélés au secret. Notre travail a permis d'exhiber des attaques dites « par échec de déchiffrement » dans des modèles de failles d'utilisation ou des modèles quantiques. Nous avons d'autre part introduit un outil algorithmique de cryptanalyse permettant d'estimer la sécurité du problème mathématique sous-jacent lorsqu'une information partielle sur le secret est donnée. Cet outil s'est avéré utile pour automatiser et améliorer plusieurs attaques connues comme des attaques par échec de déchiffrement, des attaques classiques ou encore des attaques par canaux auxiliaires. To improve social distancing, all lattices must guarantee that they contain no non-zero vector shorter than 2 meters to be considered safe. SVP-COVID.

@FakeIACR

Chapter content Cryptography, the science dedicated to protecting data and communications, has become prevalent within a few decades. It can now be found at an industrial scale in smart cards, mobile phones, all over the internet, etc. Cryptography can rely on a secret key, which is shared between the sender and the receiver and nobody else. Such protocols belong in the symmetric cryptography family, and require the sender and the receiver to agree on a common secret key, before being able to communicate safely. Deriving a common secret key can be achieved thanks to another category denoted asymmetric cryptography, also called public-key cryptography. The concept has been introduced by Diffie and Hellman in 1976 [START_REF] Diffie | New directions in cryptography[END_REF]. The principle is that each user now has a publicly available key, called public key related to its own private key. The latter enables anyone to encrypt a message using the public key and, only the decryption is only possible with the corresponding private key. In today's cryptographic protocols, for performance reasons, a public-key scheme is typically used to derive a shared secret symmetric key between two users. Then, symmetric cryptography, usually more efficient, is typically used for the rest of the protocol. This thesis exclusively focuses on asymmetric cryptography.

The asymmetric cryptographic security guarantees are based on the conjectured hardness of mathematical problems. Hard problems -which concretely means that even putting together a lot of computing power will not allow solving them -can be used to build communication protocols that are guaranteed to be secure. Almost all implemented cryptographic protocols base their security on the hardness of two mathematical problems: the integer factorization and the discrete logarithm. Unfortunately, both problems are threatened by the potential advent of large scale quantum computers 1 .

Quantum computers are a new type of computers whose instructions are not based on classical physical principles, but rather on quantum physics. The lowest-level brick of a quantum computer is a quantum bit or qubit. In contrast to a classical bit, a qubit can take infinitely many other values (called quantum superpositions) than 0 and 1. This feature allows quantum computers to be much faster than classical computers over some classes of problems, among which the factorization and discrete logarithm [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF]. As a result, all protocols based on these problems would be rendered insecure by a large-scale quantum computer. Progress in quantum computing is slow but steady: the current quantum computers can manipulate about a hundred physical qubits [START_REF] Arute | Quantum supremacy using a programmable superconducting processor[END_REF] while more than several thousands logical 2 qubits are necessary for breaking the factorization. Some specialists expect that practical large scale universal 3 quantum computers might become a reality within the next decades [START_REF] Chen | Report on Post-Quantum Cryptography[END_REF].

To prevent a collapse of cryptographic protocols, and to avoid a mono-culture of hardness assumptions, researchers have worked on building secure cryptographic protocols which do not rely on the factorization and discrete logarithm, and that can be expected to be impervious to attacks performed by quantum computers. These schemes are usually labeled under the umbrella terms "quantum-safe cryptography" or "post-quantum cryptography". Post-quantum cryptography has gained momentum these last few years, driven both by advances in quantum computing and by the fact that information that needs to be protected nowadays may still be sensitive by the time quantum computers become available. Indeed, long-term sensitive encrypted data can be stored today and they can potentially be decrypted later, if a quantum computer is built. Another illustration is the emerging standardization initiatives around the world. More precisely, the NIST (National Institute of Standards and Technology, USA) is currently running a standardization campaign for post-quantum protocols that started in fall 2017 [START_REF] Chen | Report on Post-Quantum Cryptography[END_REF]. Future standards are expected in a few years.

Several promising pathways exist towards robust asymmetric post-quantum schemes, in particular those relying on the hardness of problems over lattices, error-correcting codes, multivariate polynomial systems, isogenies of elliptic curves or on the security of hash functions. All these problems are expected to remain hard even in the presence of a quantum computer. Lattice-based cryptography has been widely recognized as a foremost candidate for practical, post-quantum security and significant efforts have been devoted to develop and analyze latticebased cryptosystems. In particular, it offers strong theoretical security guarantees, a large array of achievable primitives, and a level of efficiency that can compete, at least for the so-called structured instances, with pre-quantum constructions. This thesis is rooted in this context and focuses on analyzing lattice-based cryptosystems.

Cryptanalysis

The cryptanalysis is a subdomain of cryptology which consists in attacking existing cryptographic constructions in order to challenge their claimed security properties. Its purpose is to improve the cryptosystems' security by understanding their weaknesses. In the context of an attack against a given cryptosystem, an "attack model" should be defined containing two important parts:

1. The target of the attack must be clearly stated. Its purpose can be to recover a private key, the content of an encrypted message or to forge a signature for instance. In all this thesis, the focus is on recovering the private key on lattice-based cryptosystems.

2. The attack resources must be also specified. They represent the means that are available to the attacker. There exists a multitude of resources based on different use cases. The less means are available to the attacker, the more powerful the attack is. First, the computational resources available for the attacker should be quantified. These resources include time and memory. Second, the attack model should also specify what information is available to the attacker, the minimum being the public parameters (like the public key).

As shown in the next subsections, depending on the context, some additional information and ressources may be available to the attacker.

Classical attacks

An attacker always knows at least the public parameters of a given cryptosystem and thus its public key. She may want to recover the associated private key. A classical cryptanalysis only uses this information to estimate the amount of computing ressources required to recover the private key. Sometimes, depending on the model, the attack can have access to decryption or signature oracles. The classical attacks often rely on breaking the underlying hard problem. Such classical attack models have been studied since the beginning of cryptography and it is now an important part of the design of new cryptosystems.

Quantum attacks

Quantum attacks started to be studied after Shor's quantum algorithm for period finding in 1994 [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF]. In quantum attacks, we assume that the attacker has access to quantum algorithms. The latter are faster for certain determined tasks and they are likely to be implemented in the future on large quantum circuits. Quantum computing falls outside the scope of this thesis but some quantum algorithms are used in attacks as a "black-box".

Grover's algorithm. We will use for example Grover's algorithm [START_REF] Lov | A Fast Quantum Mechanical Algorithm for Database Search[END_REF] in Section 4.3. It is assumed to be able to find with high probability the unique input of a function that produces a particular output value using just O( √ N ) evaluations of the function, where N is the cardinal of the function's domain.

Side-channel attacks

Timing attacks. In timing attacks, we assume that the attacker is able to measure the time taken to execute cryptographic algorithms. Indeed, every algorithm in a computer takes time to execute, and the duration can differ based on the input and the private key. For example, the execution time of a square-and-multiply algorithm used in modular exponentiation depends linearly on the number of bits "1" in the private key. With several measurements and statistical techniques, an attacker is able to recover the private key. In the context of cryptanalysis, this model of attacks was formalized by Kocher in 1996 [START_REF] Paul | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems[END_REF]. In his work, he showed that these attacks were practical against a number of encryption algorithms, including RSA, ElGamal, and the Digital Signature Algorithm. Nowadays, timing attacks are an important part of cryptanalysis [START_REF] Lipp | Meltdown: Reading Kernel Memory from User Space[END_REF][START_REF] Brumley | Remote Timing Attacks Are Practical[END_REF][START_REF] Pornin | Why Constant-Time Crypto?[END_REF][START_REF] Daniel | Cache-timing attacks on AES[END_REF]. Along with the physical attacks presented in the next subsection, they are in the side-channel attacks family.

Physical attacks. Physical attacks are a family of powerful attacks that target an algorithm practical implementation on physical chips. They were introduced and formalized in 1999 [KJJ99; GP99; Cha+99]. In this setting, the corresponding attackers can observe the device's emanations (electromagnetic waves, acoustic waves, temperature or power consumption) to recover the private key. These physical attacks can be categorized in many different ways, depending on the adversary's capabilities, the available equipments or their complexity. We refer to [START_REF] Mangard | Power Analysis Attacks: Revealing the Secrets of Smart Cards[END_REF] for a complete description.

We outline hereafter two types of non-invasive4 physical attacks which can extract the secret key from the device. Both exploit traces of leakage of the device, which are the graphs representing a measured physical leakage (e.g. power consumption) during the execution of an algorithm as a function of the time. The physical leakage is generally correlated to changes in the state of the registers and then to the calculation processed. These two types of physical attacks are the following.

• A single-trace analysis consists in extracting information from the visual interpretation of one or very few traces. This type of attack often targets algorithms that are executed only once like key generations. We mention this type of attack in Section 5.6.1.

• In a differential analysis an attacker computes intermediate values computed in the algorithm and uses statistical analysis of multiple traces.

Misuse attacks

One may also assume that, for example for reasons related to some practical constraints, the implementation of a cryptosystem slightly differs from the theoretical specifications. In other words, some modifications like the reuse of randomness or private key may be implemented in order to increase the efficiency while outside from the recommandations. This scenario has been called misuse in [START_REF] Rogaway | A Provable-Security Treatment of the Key-Wrap Problem[END_REF]. We investigate a misuse case in Section 4.2.

Lattice-based cryptography

In this thesis, we denote by Z q the ring Z/qZ. We write := for a deterministic assignation and ← for a probabilistic assignation either from a probability distribution or from a function with probabilitic output. For S a finite set, we also note $ ← -S for drawing uniformly at random an element in S. For m ∈ N, we define the 2 -norm on R m as x 2 := i x 2 i . We use row notations for vectors, and start indexing from 0. The notation I n denotes the identity matrix of dimension n.

Lattices

A lattice is essentially a set of points in the space arranged periodically. This structure has been commonly used in many disciplines, from art5 to crystallography6 . Fig. 1.1 presents a twodimensional lattice. This structure has received considerable attention from mathematicians starting with the early works of Gauss around the beginning of the XIX century, Hermite and Minkowski around the end of the XIX century and Lenstra, Lenstra and Lovasz in the 80's to quote a few names. Lattices started to be used as a tool for analyzing the security of a variety of cryptographic problems. Later, they have been shown to possess some unique properties in computational complexity leading to the current cryptographic constructions studied nowadays.

, • • • , b n-1 ) in R m .
More precisely, a lattice is generated as the set of all linear integer combinations of n (n ≤ m) linearly independent basis vectors {b j } ⊂ R m , namely,

L := j z j b j : z j ∈ Z .
We say that m is the dimension of Λ and n is its rank. A lattice is full rank if n = m. The volume of a lattice is defined as Vol(L) := det(BB T ) where B is defined as a matrix in R n×m whose rows are the vectors of the basis.

For simplicity, we will depict lattices here in two dimensions but in cryptography, one must think of a high-dimensional structure.

Geometric lattice-based hard problems

As previously stated, public-key cryptography bases its security guarantees on the conjectured hardness of mathematical problems like the discrete logarithm or the factorization problem. Equivalently, several recently-defined hard problems are the building bricks for lattice-based cryptography. In this thesis, we formulate hard problems as challenges using the key words "given" and "find" for search problems or "given" and "distinguish" for decisional problems. The lattice-based hard problems have interesting, actively-studied properties (strong computational hardness, worst-case to average-case reductions) [LLL82; GG98; AR04; Kho04] that place latticebased cryptography as a high-profile direction for post-quantum cryptography.

Let us first introduce a notation for the closed zero-centered Euclidean hyperball: for any m ∈ N, c ∈ R m and r > 0,

B m (c, r) := {x ∈ R m | x -c 2 ≤ r}.
(1.1)

This ball is used to define the successive minima of a lattice. These are the sizes of linearly independent vectors in L ordered by increasing norm. Given a lattice L, we denote by λ i (L) the i-th minimum of L, as follows.

λ i (L) := inf {r > 0 : dim (Span (L ∩ B m (0, r))) ≥ i} .

For a better intuition, two of them are graphically represented in Fig. 1.2. Let us now introduce two important geometric problems on lattices.

Hard Problem 1 -Unique Shortest Vector Problem (uSVP) Let n and m be positive integers and ρ ≥ 1 a parameter.

Given a basis (b 0 , • • • , b n-1 ) of a lattice L ⊂ R m that verifies λ 2 (L) > ρ • λ 1 (L) Find a vector v ∈ L such that v 2 = λ 1 (L)
When ρ = 1, the problem is called Shortest Vector Problem (SVP).

We introduce another hard problem, that, instead of searching for the shortest vector, searches for the closest to a given point from R m . For any point t ∈ R m and any lattice L, the distance of t to the lattice is denoted dist(t, L) := min{ tx 2 : x ∈ L}.

Hard Problem 2 -Bounded Distance Decoding (BDD) Let n and m be positive integers and η > 0 be a parameter. The Bounded Distance Decoding problem is the following problem:

Given a basis (b 0 , • • • , b n-1 ) of a lattice L ⊂ R m , and an element t ∈ R m that verifies dist(t, L) ≤ η • λ 1 (L) Find a vector x ∈ L closest to t.

For high-dimensional lattices, the aforementioned uSVP and BDD problems are assumed hard even with the use of quantum computers. Contrary to the factorization and discrete logarithm problems, these lattice problems are supported by strong computational hardness properties. For example, on randomized instances, in certain ranges of parameters, the uSVP and BDD problems are NP-hard [START_REF] Ajtai | The Shortest Vector Problem in L2 is NP-hard for Randomized Reductions (Extended Abstract)[END_REF][START_REF] Ajtai | Generating Hard Instances of Lattice Problems (Extended Abstract)[END_REF][START_REF] Arora | The Hardness of Approximate Optimia in Lattices, Codes, and Systems of Linear Equations[END_REF]. Besides, the security analysis and complexity estimation of both problems, in classical and quantum computation models, have been an active line of research during the past 20 years. In this thesis, we briefly present two algorithmic tools for the security analysis that will be used in the next chapters.

Babai rounding. Given a lattice L and a point t, Babai's rounding algorithm is used to find a point x ∈ L "reasonably close" to t [Bab85; Len81; LLL82]. It is presented in Algorithm 1. The

• represents a rounding to the nearest integer in Z applied coefficient-wise. Babai's algorithm is applied using the Moore-Penrose pseudoinverse B ∼ := B T (BB T ) -1 that verifies BB ∼ = I n .

Algorithm 1 -Babai RoundOff algorithm

Data: a basis (b 0 , • • • , b n-1 ) ⊂ R m written as a matrix in B ∈ R n×m , t ∈ R m Result: x ∈ L close to t 1 x := tB ∼ B 2 return x
Intuitively, the purpose of this rounding is to solve Hard Problem 2 by outputting a vector x ∈ L close to t.

Proposition 1. Let t ∈ R m , Algorithm 1 returns a vector x ∈ L such that t -

x 2 ≤ √ n 2 • B sub where B sub := sup x∈R m \{0} xB 2 x 2 .
and Lovasz (LLL) [START_REF] Arjen Lenstra | Factoring Polynomials with Rational Coefficients[END_REF] in 1982. It can output non-zero lattice vectors whose norms are greater than that of the shortest non-zero lattice vector by at most a factor 2 O(n) . Even if this approximation seems bad for breaking any hard problem, LLL algorithm is still widely used in cryptanalysis.

A more recent lattice reduction algorithm called Block-Korkine-Zolotarev (BKZ) [Kan83; FP85; SE94] consists in applying LLL as a subroutine in projected sub-lattices with a fixed dimension β, called blocksize. BKZ offers trade-offs between the quality of the output and the complexity: higher blocksizes lead to better reduction quality (i.e. shorter vectors), at the expense of increasing the runtime. More exactly, the runtime increases exponentially in β. As discussed in [GN08; CN11; Alk+16b; Alb+17], predicting the quality of BKZ's output on a concrete lattice instance L is far from immediate and still under investigation. The current mostly used estimation makes the experimentally verified Geometric Series Assumption (GSA). We refer to [START_REF] Chen | BKZ 2.0: Better Lattice Security Estimates[END_REF] for the description and validity of this assumption. The estimation considers that, after applying BKZ with blocksize β (denoted BKZ-β for short) the lattice basis is expected to contain a vector b that verifies b 2 = δ n β • Vol(L) 1/n . The factor δ β is called the root-Hermite factor and for β > 50, it is predicted to follow

δ β ∼ (πβ) 1 β • β 2πe 1/(2β-2)
.

(1.2)

Still assuming GSA, BKZ-β is able to solve uSVP (Hard Problem 1) instances whenever ρ ≥ τ •δ n β where τ < 1 is a constant depending on the lattice family. The BDD instances can also be transformed into uSVP ones and be solved with BKZ. We detail such a transformation in more details in Section 5.3.3. BKZ is currently the most utilized lattice reduction method [AKS01; HPS11b; HPS11a; MW15].

Other hard lattice-based problems

A second class of lattice problems arose from cryptographic constructions : Learning with Errors [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF] and Short Integer Solution [START_REF] Ajtai | Generating Hard Instances of Lattice Problems (Extended Abstract)[END_REF]. They are somehow ad-hoc and thus cannot directly be seen as geometrically as the ones presented in Section 1.2.2.

Hard Problem 3 -Search learning with error (LWE) Let n, m and q be positive integers, and let χ be a distribution over Z.

Given the pair A ∈ Z n×m q , b := zA + e ∈ Z m q where: 1. A is sampled uniformly at random in Z n×m q , 2. z is sampled uniformly at random in Z n q , 3. e ← χ m .

Find z (or equivalently e).

The hardness of Hard Problem 3 highly depends on the distribution χ. In fact, most of the hardness results consider that χ is a centered discrete Gaussian distribution with a small standard deviation (we refer to Section 2.2.2 for precisions on this distribution).

To relate LWE with uSVP, the authors of [START_REF] Brakerski | Classical hardness of learning with errors[END_REF] prove that an LWE instance is as hard as standard geometric lattice problems.

Hard Problem 4 -Short Integer Solution (SIS) Let n, m and q be positive integers and γ > 0 be a parameter.

Given a matrix A ∈ Z n×m q sampled uniformly at random, Find a non-zero vector z ∈ Z n q such that 1. zA = 0

2. z 2 ≤ γ
Similarly, the hardness of Hard Problem 4 highly depends on how small γ is and the underlying uSVP is simply the following: the solution z is a short vector in the lattice {x|xA = 0 mod q}. The authors of [START_REF] Micciancio | Worst-case to average-case reductions based on Gaussian measures[END_REF] proved that Hard Problem 4 can be as hard as Section 1.2.2's problems.

Ring variants

For designing more efficient systems, ring variants of the previous problems were introduced. Although they were initially introduced for arbitrary polynomial rings, we instantiate a ring which will be used in the majority of the thesis. For n, q integer parameters such that X n + 1 is irreducible in Z q , we define

R q := Z q [X] X n + 1 . (1.3)
Note that the parameter n does not appear in the notation as it is always a fixed parameter of the scheme. Throughout, we abuse notation and identify elements in Z q with their representatives in [-q/2, q/2), and elements in R q with their representatives of degree < n. This allows us to define the 2 -norm x 2 of a polynomial x ∈ R q , so that x 2 := i x 2 i where x i ∈ [-q/2, q/2) are the coefficients of x, and extend this to vectors of polynomials y ∈ R l q as y 2 := i y i 2 2 . Identically, we define and extend the ∞ -norm.

The Module-LWE (or Mod-LWE) problem [START_REF] Langlois | Worst-Case to Average-Case Reductions for Module Lattices[END_REF] is a generalization of Hard Problem 3. It also includes the Ring-LWE problem introduced in [Ste+09; LPR10] as a particular case.

Hard Problem 5 -Search Module LWE (Mod-LWE)

Let n, m, q be parameters that define R q as in Eq. (1.3), k be a positive integer and χ be a probability distribution over R q Given (a i , b i ) := (a i , a i , z + e i ) ∈ R k q × R q for i ∈ [0, m -1] where:

1. the a i ∈ R k q are sampled uniformly at random for i ∈ [0, m -1], 2. z ∈ R k q is sampled uniformly at random, 3. e i ← χ for i ∈ [0, m -1].

Find z (or equivalently e).

Ring-LWE is a particular case where k = 1.

Similarly, we present the module/ring variant of Hard Problem 4.

Hard Problem 6 -Module Short Integer Solution (Mod-SIS) Let n, q be parameters that define R q as in Eq. (1.3), k be a positive integer and γ > 0 be a parameter.

Given a ∈ R k q sampled uniformly at random, Find a non-zero z ∈ R k q such that 1. z, a = 0

2. for all coefficients z[i] of z, ∀i ∈ [0, k -1], z[i] ∞ ≤ γ
Ring-SIS is a particular case where k = 1.

Under certain conditions, these ring variants can be as hard as the problems defined in Section 1.2.3 [LM06; PR06; Ste+09; LPR10; LPR13]. However, in practice their security is conjectured and it is somehow questioned because of the high structure of the underlying lattices. Some of the designs choose to avoid this ring structure [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF].

Let us present another problem that was introduced before LWE and SIS [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF]. It is only defined with a cyclotomic ring and has been assumed hard since its introduction.

Hard Problem 7 -NTRU Let n, q be two prime numbers that define R q as in Eq. (1.3), and χ be a probability distribution over R q .

Given h = g/f mod q where f and g are sampled from χ.

Find g (or equivalently f ).

Lattice constructions

In lattice-based cryptography, one advantage lies in the fact that the cryptosystems themselves have a remarkably simple description. The underlying elementary operations are often simple linear additions. Most of the work is in establishing and proving their security.

Public key encryption. Hoffstein, Pipher and Silverman developed one of the first constructions in 1998 [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], they propose an efficient public key encryption based on Hard Problem 7, still assumed hard. This construction has inspired recent candidates for post-quantum standardization. Later, Regev suggested constructions using Hard Problem 3 in [START_REF] Regev | New lattice based cryptographic constructions[END_REF][START_REF] Regev | Lattice-Based Cryptography (Invited Talk)[END_REF] and the first design has been introduced in [START_REF] Lindner | Better Key Sizes (and Attacks) for LWE-Based Encryption[END_REF]. The latter has also inspired very efficient recent candidates. We present in Table 1.1 lattice-based public key encryption schemes which may be standardized for post-quantum use.

Signatures. The first lattice-based signature scheme has been introduced in [GGH97] and the NTRU company followed by proposing NTRUSign [START_REF] Hoffstein | NTRUSIGN: Digital Signatures Using the NTRU Lattice[END_REF][START_REF] Hoffstein | NSS: An NTRU Lattice-Based Signature Scheme[END_REF] based on Hard Problem 7. Both constructions were later broken because of a partial key leak in the distribution of the signatures [START_REF] Phong | Learning a Parallelepiped: Cryptanalysis of GGH and NTRU Signatures[END_REF]. Perturbation countermeasures were proposed by the authors of [START_REF] Hoffstein | NTRUSIGN: Digital Signatures Using the NTRU Lattice[END_REF] but their security was subsequently broken in [START_REF] Ducas | Learning a Zonotope and More: Cryptanalysis of NTRUSign Countermeasures[END_REF]. Following this line of research, [START_REF] Gentry | Trapdoors for hard lattices and new cryptographic constructions[END_REF] introduced a framework impervious to the latter statistical attacks. The distribution of its outputted signatures does not depend on the private key. This framework is at the origin of a family of lattice-based signatures called "hash-and-sign". It has led to a recent efficient candidate called Falcon [START_REF] Prest | [END_REF] based on Hard Problem 7.

In parallel, another family of constructions emerged with Lyubashevsky's "Fiat-Shamir with aborts" paradigm [START_REF] Lyubashevsky | Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures[END_REF] using Hards Problems 3 and 4. The underlying framework is called Fiat-Shamir with aborts because, unlike RSA and discrete logarithm-based constructions, lattice-based constructions involve sampling from sets that do not admit a nice algebraic structure. A naive sampling algorithm would leak partial key information, the same way as it did in schemes like GGH and NTRUSign; this is avoided by forcing the distribution of the output signature to be independent of the private key using rejection sampling. Many instantiations of the framework have been proposed [Lyu12; GLP12; Duc+13; PDG14; BG14] some of them very efficient. These works lead to many efficient post-quantum candidates.

Implementations of lattice-based signature schemes from both families are presented in Table 1.2.

Goal and contribution of the thesis

To address the shortcomings of existing cryptosystems and help build quantum-safe algorithms, the main goal of this thesis is the analysis of the real-world security of lattice-based post-quantum asymmetric schemes. Real-world in this context means that, in addition to the algorithms being selected as to offer a high conjectured black-box security in both classical and quantum computation models, the implementations should be efficient and secure for use in software, embedded systems, and in hardware.

In other words, in addition to black-box cryptanalysis, we intend to investigate the security of lattice-based cryptosystems in extended security models. It implies studying {classical, quantum, misuse, timing, physical}-attacks on lattice-based schemes and possible combinations. With this wide program, we focus, in particular, on the possibility of leveraging and addressing the new features introduced by the lattice structures. These new features will be encountered and detailed later in the thesis. They include for instance: rejection sampling for signatures (detailed in Section 2.2.5), use of transcendental functions (detailed in Section 2.3), use of Gaussian distributions (presented in Section 2.2.4), non-perfect correctness for public key encryption (presented in Section 4.1.1), private keys structured in large vectors of small elements and reliance on lattice reduction algorithms. With this thesis, we aim at:

• on the one hand, constructing provable algorithmic countermeasures when it is possible;

• on the other hand, estimating precisely the applicability and complexity of attacks in order to provide practical security assessments of the corresponding implementations. Part I Constructions. Concerning physical and timing attacks, the cryptographic research community made numerous contributions on the possibility of applying such attacks to lattice-based schemes [ADP18a; Bru+16; GP18; Rav+19; Bos+18a; CMP18]. To continue the effort towards efficient and secure implementations, we put on our designer's hat and investigate the algorithmic protections against timing and side-channel attacks along with proofs of impermeability against these attacks. This part focuses on signature schemes because they are more subject to attacks and their protection seem challenging due to hard-to-protect features like rejection sampling. We first focus on introducing algorithmic tools to tackle these features. Next, we apply them to several schemes. In Table 1.3, we outline the main literature gaps that joint research contributions presented in this thesis aim at filling in terms of protection of known lattice-based signatures schemes. [Mig+19] qTesla [START_REF] Bindel | [END_REF] this thesis Section 3.5

on the work of [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF], we introduce an improved generic quantum attack targeting public key encryptions. The security is then estimated as a function of the maximum number of decryption queries and the (quantum or classical) work necessary.

• Chapter 5. We introduce an algorithmic tool to assess the security of the mathematical problem underlying a lattice-based scheme when the scheme is the target of a combination of attacks (classical and side-channel for example). This tool automatically builds lattice reduction attacks and estimates their cost when hints of various forms are given. In other words, this tool allows to assess the new security of the scheme after attacks have been performed and a partial knowledge of the secret is available. The usefulness of the presented framework is demonstrated with the improvement of several known attacks.

Parts I and II concern different cryptosystems and notions. They can be read independently.

Publications

Constructive results

• Masking the GLP Lattice-Based Signature Scheme at Any Order [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF]. Gilles Barthe, Sonia Belaïd, Thomas Espitau, Pierre-Alain Fouque, Benjamin Grégoire, Mélissa Rossi and Mehdi Tibouchi.

This paper, whose results are presented in Chapter 3, proposes the first provable algorithmic countermeasure against physical attacks for a lattice-based signature. This countermeasure has been previously applied to the decryption procedure of some lattice-based encryption schemes, but the much more difficult case of signatures (which are highly nonlinear and typically involve randomness) were not considered until this paper. We focus on the GLP scheme of Güneysu, Lyubashevsky and Pöppelmann [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF]. We show how to provably mask it in the Ishai-Sahai-Wagner model [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF] at any order in a relatively efficient manner, using extensions of the techniques of Coron et al. for converting between arithmetic and Boolean masking [START_REF] Coron | High-Order Conversion from Boolean to Arithmetic Masking[END_REF]. Our proof relies on a mild generalization of probing security that supports the notion of public outputs. We also provide a proof-of-concept implementation to assess the efficiency of the proposed countermeasure. This paper has been published in the proceedings of the conference EUROCRYPT in 2018.

• An Efficient and Provable Masked Implementation of qTESLA.

[GR19] François Gérard and Mélissa Rossi.

The results of this paper are also presented in Chapter 3. In this paper, we study the lattice-based signature scheme qTESLA in the context of the masking countermeasure. Continuing the line of research opened by the previous paper [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] with the masking of the GLP signature scheme, we extend and modify it to mask qTESLA. Based on the work of Migliore et al. [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF], we slightly modify the parameters to improve the masked performance while keeping the same security. The masking can be done at any order and specialized gadgets are used to get maximal efficiency at order 1. We implemented our countermeasure in the original code of the submission and performed tests at different orders to assess the feasibility of our technique. This paper has been published in the proceedings of the conference CARDIS in 2019.

• GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited [START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF]. Gilles Barthe, Sonia Belaïd, Thomas Espitau, Pierre-Alain Fouque, Mélissa Rossi and Mehdi Tibouchi.

The results of this paper are presented in Chapters 2 and 3. We propose a constant-time implementation of the BLISS lattice-based signature scheme. The outstanding performance of the BLISS signature scheme stems in large part from its reliance on discrete Gaussian distributions, which allows for better parameters and security reductions. However, that advantage has also proved to be its Achilles' heel, as discrete Gaussians pose serious challenges in terms of secure implementations. Implementations of BLISS so far have included secret-dependent branches and memory accesses, both as part of the discrete Gaussian sampling and of the essential rejection sampling step in signature generation. These defects have led to multiple devastating timing attacks, and were a key reason why BLISS was not submitted to the NIST postquantum standardization effort. In fact, almost all of the actual candidates chose to stay away from Gaussians despite their efficiency advantage, due to the serious concerns surrounding implementation security. Moreover, simple countermeasures will often not cut it: a first contribution -not presented in this thesis as it was handled by Thomas Espitau and Mehdi Tibouchi-shows that a reasonable-looking countermeasure suggested in previous work to protect the BLISS rejection sampling can again be defeated using novel timing attacks, in which the timing information is fed to a phase retrieval machine learning algorithm in order to achieve a full key recovery. Fortunately, as a second contribution, we present careful implementation techniques that allow us to describe an implementation of BLISS with complete timing attack protection, achieving the same level of efficiency as the original unprotected code, without resorting on floating point arithmetic or platform-specific optimizations like AVX intrinsics. These techniques, including a new approach to the polynomial approximation of transcendental functions, can be applied to the masking of the BLISS signature scheme, and will hopefully make more efficient and secure implementations of lattice-based cryptography possible going forward. This paper has been published in the proceedings of the conference ACM-CCS in 2019.

• Isochronous Gaussian Sampling: From Inception to Implementation [START_REF] Howe | Isochronous Gaussian Sampling: From Inception to Implementation[END_REF] with James Howe, Thomas Prest, Thomas Ricosset and Mélissa Rossi.

The results of this paper are also presented in Chapter 2. Gaussian sampling over the integers is a crucial tool in lattice-based cryptography, but has proven over the recent years to be surprisingly challenging to perform in a generic, efficient and provable secure manner. In this paper, we present a modular framework for generating discrete Gaussians with arbitrary center and standard deviation. Our framework is extremely simple, and it is precisely this simplicity that allowed to make it easy to implement, provably secure, portable, efficient, and provably resistant against timing attacks. Our sampler is a good candidate for any trapdoor sampling and it is actually the one that has been recently implemented in the Falcon signature scheme. Our second contribution -not presented in this thesis as it was mainly handled by another co-author James Howe -aims at systematizing the detection of implementation errors in Gaussian samplers. We provide a statistical testing suite for discrete Gaussians called SAGA (Statistically Acceptable GAussian). In a nutshell, our two contributions take a step towards trustable and robust Gaussian sampling real-world implementations. This paper has been published in the proceedings of the conference PQ-CRYPTO in 2020.

Cryptanalysis results

• Assessment of the Key-Reuse Resilience of NewHope [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF]. Aurélie Bauer, Henri Gilbert, Guénaël Renault and Mélissa Rossi.

The results of this paper are presented in Chapter 4. NewHope is a suite of two efficient Ring-LWE based key encapsulation mechanisms (KEMs) that has been proposed to the NIST call for proposals for post-quantum standardization. In this paper, we study the security of NewHope when an active adversary accesses a key establishment and is given access to an oracle, called key mismatch oracle, which indicates whether her guess of the shared key value derived by the party targeted by the attack is correct or not. This attack model turns out to be relevant in key reuse situations since an attacker may then be able to access such an oracle repeatedly with the same key either directly or using faults or side channels, depending on the considered instance of NewHope. Following this model we show that, by using NewHope recommended parameters, several thousands of queries are sufficient to recover the full private key with high probability. This result has been experimentally confirmed using Magma CAS implementation. While the presented key mismatch oracle attacks do not break any of the designers' security claims for the NewHope KEMs, they provide better insight into the resilience of these KEMs against key reuse. In the case of the CPA-KEM instance of NewHope, they confirm that key reuse (e.g. key caching at server side) should be strictly avoided, even for an extremely short duration. In the case of the CCA-KEM instance of NewHope, they allow to point out critical steps inside the CCA transform that should be carefully protected against faults or side channels in case of potential key reuse. This paper has been published in the proceedings of the conference CT-RSA in 2019.

• (One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF]. Jan-Pieter D'Anvers, Mélissa Rossi and Fernando Virdia.

The results of this paper are also presented in Chapter 4. Lattice-based encryption schemes are often subject to the possibility of decryption failures, in which valid encryptions are decrypted incorrectly. Such failures, in large number, leak information about the private key, enabling an attack strategy alternative to pure lattice reduction. Extending the "failure boosting" technique of D'Anvers et al. in PKC 2019, we propose an approach that we call "directional failure boosting" that uses previously found "failing ciphertexts" to accelerate the search for new ones. We analyse in detail the case where the lattice is defined over polynomial ring modules quotiented by X n + 1 and give a proof of concept on a simple Mod-LWE-based scheme parametrized à la Kyber768/Saber. We show that, using our technique, for a given private key (single-target setting), the cost of searching for additional failing ciphertexts after one or more have already been found, can be sped up dramatically. We thus demonstrate that, in this single-target model, these schemes should be designed so that it is hard to even obtain one decryption failure. Besides, in a wider security model where there are many target private keys (multi-target setting), our attack greatly improves over the state of the art. This paper has been published in the proceedings of the conference EUROCRYPT in 2020.

• LWE with Side Information: Attacks and Concrete Security Estimation [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF]. Dana Dachman-Soled, Léo Ducas, Huijing Gong and Mélissa Rossi.

The results of this paper are presented in Chapter 5. We propose a framework for cryptanalysis of lattice-based schemes, when side information -in the form of "hints" -about the secret and/or error is available. Our framework generalizes the so-called primal lattice reduction attack, and allows the progressive integration of hints before running a final lattice reduction step. Our techniques for integrating hints include sparsifying the lattice, projecting onto and intersecting with hyperplanes, and/or altering the distribution of the secret vector. Our main contribution is to propose a toolbox and a methodology to integrate such hints into lattice reduction attacks and to predict the performance of those lattice attacks with side information. While initially designed for side-channel information, our framework can also be used in other cases: exploiting decryption failures, or simply exploiting constraints imposed by certain schemes (LAC, Round5, NTRU), that were previously not known to (slightly) help lattice attacks. We implement a Sage 9.0 toolkit to actually mount such attacks with hints when computationally feasible, and to predict their performances on larger instances. We provide several end-to-end application examples, such as an improvement of a single trace attack on Frodo by Bos et al (SAC 2018). Contrary to ad-hoc practical attacks exploiting side-channel leakage, our work is a generic way to estimate security loss even given very little side-channel information. This paper has been accepted to the conference CRYPTO in 2020.

Other cryptanalysis publications

As the subject of this thesis originally included code-based and multivariate cryptography, we also studied cryptanalytic tools for these structures. In particular, we used Gröbner basis techniques for a student project with Goldreich pseudorandom generator.

• A side-channel assisted cryptanalytic attack against QcBits [START_REF] Rossi | A Side-Channel Assisted Cryptanalytic Attack Against QcBits[END_REF]. Mélissa Rossi, Mike Hamburg, Michael Hutter and Mark E. Marson.

QcBits is a code-based public key algorithm based on a problem thought to be resistant to quantum computer attacks. It is a constant time implementation for a quasi-cyclic moderate density parity check (QC-MDPC) Niederreiter encryption scheme, and has excellent performance and small key sizes. In this paper, we present a side-channel key-recovery attack against QcBits. We first used differential power analysis (DPA) against the syndrome computation of the decoding algorithm to recover partial information about one half of the private key. We then used the recovered information to set up a system of noisy binary linear equations. Solving this system of equations gave us the entire key. Finally, we propose a simple but effective countermeasure against the power analysis used during the syndrome calculation. This paper has been published in the proceedings of the conference CHES in 2017.

• On the Concrete Security of Goldreich's Pseudorandom Generator [START_REF] Couteau | On the Concrete Security of Goldreich's Pseudorandom Generator[END_REF]. Geoffroy Couteau, Aurélien Dupin, Pierrick Méaux, Mélissa Rossi and Yann Rotella.

Local pseudorandom generators allow to expand a short random string into a long pseudorandom string, in such a way that each output bit depends on a constant number d of input bits. Due to its extreme efficiency features, this intriguing primitive enjoys a wide variety of potential applications in cryptography and complexity. In the polynomial regime, where the seed is of size n and the output of size n s for s > 1, the only known solution, commonly known as Goldreich's PRG, proceeds by applying a simple d-ary predicate to public random size-d subsets of the bits of the seed. While the security of Goldreich's PRG has been thoroughly investigated (with a variety of results deriving provable security guarantees against classes of attacks in some parameter regimes and necessary criteria to be satisfied by the underlying predicate), little is known about its concrete security and efficiency. Motivated by its numerous theoretical applications and the hope of getting practical instantiations for some of them, we initiate a study of the concrete security of Goldreich's PRG, and evaluate its resistance to cryptanalytic attacks. Along the way, we develop a new guess-and-determine-style attack, and identify new criteria which refine existing criteria and more accurately capture the security guarantees of candidate local PRGs. This paper has been published in the proceedings of the conference ASIACRYPT in 2018.

Part I

Constructive results

Chapter 2 Protecting lattice-based signatures against timing attacks Figure 2.1: Timing attacks consist in analyzing the time that an algorithm takes to make its computations. In this example, the timing corresponds to the number of multiplications while computing exp(-x 2 ). When x = 0 (for the blue algorithm), there is no multiplication. When x = 3 (for the purple one), an exponentiation should be done and several multiplications are necessary. Thus, the timing is correlated to the secret value x. The purpose of this chapter is to modify the algorithms so that the timing does not depend on the secret value x.

This chapter describes how to protect lattice-based signature schemes against timing attacks. It tackles the problem of Gaussian distributions. This work began with the latmasking working group (Gilles Barthe, Sonia Belaïd, Thomas Espitau, Pierre-Alain Fouque and Mehdi Tibouchi) because we were not able to mask a lattice-based signature called BLISS [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF]. In fact, there was a slight timing leakage in the Gaussian sampling, as presented in the last attacked and protected version [START_REF] Espitau | Side-Channel Attacks on BLISS Lattice-Based Signatures: Exploiting Branch Tracing against strongSwan and Electromagnetic Emanations in Microcontrollers[END_REF]. Interestingly, we were able to kill both timing and side-channel breaches with one stone: the tools we made to handle Gaussians in order to mask BLISS can also be applied for provably protecting BLISS against timing attacks. It has been gratifying designing the polynomial approximation presented in Section 2.3 with Mehdi Tibouchi's precious help. The purpose was to use simple functional analysis techniques to show that Gaussian distributions are not that annoying, as they can be transformed into polynomials. Finally, Mehdi Tibouchi implemented the resulting protected scheme to show that the protections could be almost inexpensive. In addition to other contributions (like a timing attack highlighting the timing leakage performed by Mehdi Tibouchi and Thomas Espitau), this work was part of [START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF] which was accepted to the ACM-CCS conference en 2019.

The techniques used in this previous work could be reused for Falcon's Gaussian sampler too. Thus, by joining an ongoing project with Thomas Prest -my Thales advisor at that time -and Thomas Ricosset, we were able to formalize Falcon Gaussian sampler and proved its security against timing attacks. We finally figured that this sampler could also be made generic to be reused in other settings. We sent our preliminary work to Thomas Pornin, who implemented our significant leakage through timing side-channels, which have led to several devastating attacks against the implementations [Bru+16; PBY17; Esp+17; Boo+18; TW19]. The main feature of BLISS exploited in these attacks is the use of discrete Gaussian distributions, either as part of the Gaussian sampling used to generate the random nonces in signatures or as part of the crucial rejection sampling step that forms the core of the Fiat-Shamir with aborts framework that supports BLISS security.

Generally speaking, Gaussian distributions are ubiquitous in theoretical lattice-based cryptography, thanks to their convenient behavior concerning proofs of security and parameter choices. However, their role in practical implementations is less clear, mainly because of the concerns surrounding implementation attacks. For this reason, some schemes limit or proscribe the use of Gaussians [START_REF] Bindel | [END_REF][START_REF] Lyubashevsky | CRYSTALS-DILITHIUM[END_REF]. For example, BLISS was not submitted to the NIST post-quantum standardization effort partly due to those concerns. Besides, the second round candidate Dilithium [START_REF] Ducas | CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme[END_REF], which can be seen as a direct successor of BLISS, replaces Gaussian distributions by uniform ones, at the cost of larger parameters and a less efficient implementation, specifically citing implementation issues as their justification.

However, in some situations, Gaussians are unavoidable. , etc.), it is important to come up with Gaussian samplers over the integers, which are not only efficient, but also provably secure, resistant to timing attacks, and in general easy to deploy.

Signature security property

All the recent signature schemes are claimed EUF-CMA (existential unforgeability under chosen message attack). Let us introduce the definition.

Adversary Challenger

(KeyGen,Sign,Verify)

←------------ pk ←-- sk, pk ← KeyGen(1 λ ) Q s queries                          m (1) ---→ σ (1) ← Sign(sk, m (1) ) σ (1) ←-- . . . m (Qs) ---→ σ (Qs) ← Sign(sk, m (Qs) ) σ (Qs) ←--- forgery m * , σ * ----→ b := Verify(pk, m * , σ * ) ∧ (m * / ∈ {m (1) , . . . , m (Qs) })
Security Game 1: EUF-CMA game.

Security Model 1. Let Q s be a fixed maximum amount of signature queries. A signature scheme (KeyGen, Sign, Verify) is EUF-CMA-secure if any probabilistic polynomial time adversary has a negligible probability of winning in the EUF-CMA game presented in Security Game 1.

This security definition does not capture any timing attacker. The goal of the following work is to design a stronger security property combining EUF-CMA and timing guarantees.

Definitions and tools

Isochrony

Let us now formalize the timing security guarantees that a signature implementation can claim. To do so, we introduce the notion of isochronous existential unforgeability under chosen message attack (I-EUF-CMA), which combines the standard EUF-CMA security property with the timing security.

After discussing with Thomas Prest, Thomas Ricosset and James Howe, we concluded that the term "isochronous" should be preferred to "constant-time". Indeed, the timing security is ensured if the execution time does not depend on the private key, may it vary. An algorithm can run in variable time and still be impervious to timing attacks.

Security Model 2 (Isochrony). An implementation (KeyGen, Sign, Verify) of a signature scheme is isochronously EUF-CMA-secure, or I-EUF-CMA secure for short if any probabilistic polynomial time adversary has a negligible winning probability in the experiment from Security Game 2. In that security experiment, ExecObs takes as input an algorithm and its arguments, executes the program, and outputs the result of the computation together with the timing leakage

L (i)
Sign , consisting of a measurement of the execution time of the i-th execution of the algorithm Sign.

Adversary Challenger

(KeyGen,Sign,Verify)

←------------ pk ←-- (sk, pk) ← KeyGen(1 λ ) Q s queries                                µ (1) --→ σ (1) , L (1)
Sign ← ExecObs(Sign, µ (1) , sk)

σ (1) , L (1) Sign
←------. . .

µ (Qs) ---→ σ (Qs) , L (Qs)
Sign ← ExecObs(Sign, µ (Qs) , sk)

σ (Qs) , L (Qs) Sign ←------- forgery µ * , σ * ----→ b := Verify(pk, µ * , σ * ) ∧ (µ * / ∈ {µ (1) , . . . , µ (Qs) })
Security Game 2: The I-EUF-CMA security game. ExecObs is a universal Turing machine that takes as input an algorithm and several possible arguments, and it returns the output of the algorithm on those arguments, together with the timing leakage L .

In the following sections, we use some assumptions to ensure isochrony provably. First, we will study the distribution of the execution time as a function of elementary operations. We thus need to consider that the latter cannot leak through timing.

Assumption 1. The elementary operations {+, -, ×, /} over integer and floating-point numbers are assumed to be performed in an isochronous way: their execution time is independent of their inputs.

The previous assumption can be validated if the elementary operations are performed with specific certified isochronous instructions. With general CPU instructions, [Por20] showed that Assumption 1 is not always verified.

Gaussians

For σ, µ ∈ R with σ > 0, we call Gaussian function of parameters σ, µ and denote by ρ σ,µ the function defined over R as ρ σ,µ (x

) := exp -(x-µ) 2 2σ 2
. Note that when µ = 0 we omit it in index notation, i.e. ρ σ (x) := ρ σ,0 (x). The parameter σ (resp. µ) is often called the standard deviation (resp. center) of the Gaussian. In addition, for any countable set S R we abusively denote by ρ σ,µ (S) the sum z∈S ρ σ,µ (z) when the latter converges.

In all this thesis, we denote by D S,σ,µ and call discrete Gaussian distribution of parameters σ, µ the distribution over S defined by D S,σ,µ (z) := ρ σ,µ (z)/ρ σ,µ (S). Here too, when µ = 0 we omit it in index notation, e.g. D S,σ (z) := D S,σ,0 (z). We also use the notation B p to denote the Bernoulli distribution of parameter p

We define the support of a probability distribution, denoted Supp(•), as the set of elements with nonzero probability.

Generalized Rényi divergence results

We present the definition of the Rényi divergence, which we will use massively in our security proofs. Lemma 2 and its proof are a formalization based on the work of [Pre17, Section 3.3]. The generalization to arbitrary security parameters in Lemma 4 is also a slight contribution of this thesis.

Definition 1 (Rényi Divergence). Let P, Q be two distributions such that Supp(P) ⊆ Supp(Q). For a ∈ (1, +∞), we define the Rényi divergence of order a by

R a (P, Q) :=   x∈Supp(P) P(x) a Q(x) a-1   1 a-1 .
In addition, we define the Rényi divergence of order +∞ by

R ∞ (P, Q) := max x∈Supp(P) P(x) Q(x)
.

The Rényi divergence is not a distance; for example, it is neither symmetric nor does it verify the triangle inequality, which makes it less convenient than the statistical distance. On the other hand, it does verify cryptographically useful properties, including a few listed below.

In this thesis, random variables, i.e. variables whose values depend on outcomes of a random phenomenon, are denoted in lowercase calligraphic letters e.g. a, b, x. Random vectors are denoted in uppercase calligraphic letters e.g. C, X, Z.

Lemma 1 ([Bai+15]

). For two distributions P, Q and two finite families of distributions (P i ), (Q i ), the Rényi divergence verifies these properties:

• Data processing inequality. For any function f , R a (f (P), f (Q)) ≤ R a (P, Q) where the distribution f (P) (resp. f (Q)) is obtained by applying f to x ← P (resp. x ← Q).

• Probability preservation. For any event E ⊆ Supp(Q) and a ∈ (1, +∞),

Q(E) ≥ P(E) a a-1 /R a (P, Q), (2.1) Q(E) ≥ P(E)/R ∞ (P, Q). (2.2)
• Multiplicativity. Assume that P and Q are the joint distribution of a pair of random variables (x 1 , x 2 ). Assume also that x 1 and x 2 are independent. We then denote P(x 1 , x 2 ) :=

P 1 (x 1 ) • P 2 (x 2 ) and Q(x 1 , x 2 ) := Q 1 (x 1 ) • Q 2 (x 2 ). Then, R a (P, Q) = R a (P 1 , Q 1 ) • R a (P 2 , Q 2 ).
Application for security arguments. A first demonstrated in [START_REF] Bai | Improved Security Proofs in Lattice-Based Cryptography: Using the Rényi Divergence Rather Than the Statistical Distance[END_REF] and later in [Pre17, Section 3.3], the Rényi divergence has proved to be convenient for security arguments in latticebased cryptography. We introduce two general lemmas (Lemmas 2 and 4) that will be used for security arguments in this chapter. In some cases, the queries to the distributions are not independent 1 , thus, one cannot apply the multiplicativity directly in our proofs. To handle these dependencies, we introduce the following proposition.

Proposition 2. Let P and Q denote two distributions of a N -uple of random variables (x i ) i<N . For 0 ≤ i < N , assume P i (resp Q i ) is the marginal distribution of X i , and let P i|<i (•|x <i ) denote the conditional distribution of x i given that (x 0 , . . . , x i-1 ) = x <i . Let a > 1. Suppose that for all 0 ≤ i < N , there exists r a,i ≥ 1 such that for all i-uple x <i in the support of Q restricted to its first i variables, R a (Q i|x <i , P i|x <i ) ≤ r a,i .

(2.3)

Then: R a (Q, P) ≤ i<N r a,i . (2.4)
Proof: We prove the result in the case N = 2, the general case then follows by induction. We have:

R a (Q, P) a-1 = x 1 ,x 2 (Q 1 (x 1 ) • Q 2|1 (x 2 |x 1 )) a (P 1 (x 1 ) • P 2|1 (x 2 |x 1 )) a-1 (2.5) = x 1 Q 1 (x 1 ) a P 1 (x 1 ) a-1 •   Ra Q 2|1 (•|x 1 ), P 2|1 (•|x 1 ) ≤r a,2    a-1 (2.6) ≤ (r a,1 • r a,2 ) a-1 (2.7)
This concludes the proof.

Lemma 2. Consider a cryptosystem denoted C P in which a Q-uple (x 0 , . . . x Q-1 ) is drawn according to a distribution P. Assume that C P is λ-bit secure against a search problem. Let us consider a copy of the latter cryptosystem, denoted C Q , where the only difference is that (x 0 , . . . x Q-1 ) is drawn according to a distribution Q such that Supp(Q) ⊆ Supp(P).

We denote (x 0 , . . . x Q-1 ) the random variables corresponding to (x 0 , . . . x Q-1 ) that follow P or Q depending on the case. For 0 ≤ i < Q, we denote by P i|<i (•|x <i ) (resp. Q i|<i (•|x <i )) the conditional distribution of x i given the knowledge of (x 1 , . . . , x i-1 ) = x <i under P (resp. Q). If, for all 0 ≤ i < Q, and for all i-uple x <i in the support of Q restricted to its first i variables,

R 2λ-1 (Q i|x <i , P i|x <i ) ≤ 1 + 1 4Q , (2.8)
then C Q is (λ -1)-bit secure against the search problem.

1 We thank Damien Stehlé for pointing that out.

Note that when the drawing of x i is independent from the preceding drawings, Eq. (2.8) is equivalent to assume for all 0

≤ i < Q, R 2λ-1 (Q i , P i ) ≤ 1 + 1 4Q .
(2.9)

When they are not independent, we informally assume that the Rényi divergence is small no matter the preceding knowledge.

Proof: Let us assume that C Q is not (λ -1)-bit secure against the search problem. Then, we assume that an attacker that breaks the scheme C Q by solving the search problem with a probability, denoted ε Q , that is higher than 2 -(λ-1) exists. Thus,

ε Q > 2 -(λ-1) .
To succeed, the attacker draws a Q-uple (x 0 , . . . x Q-1 ) (in Supp(Q)) according to the distribution Q. Let us denote ε P the probability that the same attacker breaks the scheme C P with querying the distribution P instead of Q. By probability preservation, for all a ∈ (1, +∞),

ε P ≥ ε a/(a-1) Q /R a (Q, P) (2.10)
Let us set a := 2λ -1 in Eq. (2.10). For the numerator, we have

ε a/(a-1) Q > 2 -(λ-1) 2λ-1 2(λ-1) = √ 2 • 2 -λ .
(2.11) Thus, ε P satisfies

ε P > √ 2 • 2 -λ R 2λ-1 (Q, P) (2.12)
We apply Proposition 2 using the hypothesis in Eq. (2.8),

R 2λ-1 (Q, P) ≤ 1 + 1 4Q Q ≤ e 1/4 ≤ √ 2.
(2.13) Thus,

ε P > 2 -λ . (2.14)
We can conclude that our attacker is also able to break C P by solving the search problem with a success probability strictly higher than 2 -λ .

Thus, assuming that C Q is not (λ -1)-bit secure against the search problem leads to proving that C P is not λ-bit secure against the search problem either. The lemma is, therefore, proved by contraposition.

Relative error lemma

The following lemma, also introduced by Prest in [START_REF] Prest | Sharper Bounds in Lattice-Based Cryptography Using the Rényi Divergence[END_REF], shows that a bound of δ on the relative error between two distributions implies a bound O(aδ 2 ) on the log of the Rényi divergence (as opposed to a bound O(δ) on the statistical distance).

Lemma 3 (Lemma 3 of [START_REF] Prest | Sharper Bounds in Lattice-Based Cryptography Using the Rényi Divergence[END_REF]). Let P, Q be two distributions such that Supp(P) = Supp(Q).

Suppose that the relative error between P and Q is bounded:

∃δ > 0 such that ∀x ∈ Supp(Q) Q(x) P(x) -1 ≤ δ.
Then, for all a ∈ (1, +∞):

R a (Q, P) ≤ 1 + a(a -1)δ 2 2(1 -δ) a+1 1 a-1 ∼ δ→0 1 + aδ 2 2
Protecting lattice-based signatures against timing attacks

Let us now introduce a new security theorem that reformulates Lemma 2 with a different "close enough" condition that is expressed in terms of relative error using Lemma 3. Lemma 4. Consider a cryptosystem denoted C P in which a Q-uple (x 0 , . . . x Q-1 ) is drawn according to a distribution P. Assume that C P is λ-bit secure against a search problem. Let us consider a copy of the latter cryptosystem, denoted C Q , where the only difference is that (x 0 , . . . x Q-1 ) is drawn according to a distribution Q such that Supp(Q) = Supp(P).

We denote (x 0 , . . . x Q-1 ) the random variables corresponding to (x 0 , . . . x Q-1 ) that follow P or Q depending on the case. For 0 ≤ i < Q, we denote by P i|<i (•|x <i ) (resp. Q i|<i (•|x <i )) the conditional distribution of x i given the knowledge of (x 1 , . . . , x i-1 ) = x <i under P (resp. Q). If, for all 0 ≤ i < Q and for all i-uple x <i in the support of Q restricted to its first i variables, P i|x <i and Q i|x <i satisfy ∀x ∈ Supp(P)

P i|x <i (x) -Q i|x <i (x) P i|x <i (x) ≤ 1 2 (2λ -1) • Q , (2.15)
then C Q is (λ -1)-bit secure against the search problem.

Proof: Let us fix 0 ≤ i < Q and a i-uple x <i in the support of Q restricted to its first i variables.

Eq. (2.15) can be rewritten as follows.

1 -δ ≤ Q i|x <i P i|x <i ≤ 1 + δ with δ := 1 2 (2λ -1) • Q . Since Supp(Q i|x <i ) = Supp(P i|x <i ) (because Supp(P) = Supp(Q))
, we apply Q times Lemma 3 with a = 2λ -1 and get

R 2λ-1 (Q i|x <i , P i|x <i ) ≤ 1 + (2λ-1)• 1 2(2•λ-1)Q 2 = 1 + 1 4Q .
The application of Lemma 2 allows to conclude.

Gaussian sampling

The purpose of Gaussian sampling is to perform the instruction x ← D Z,σ,µ where D Z,σ,µ is a discrete Gaussian with parameters σ and µ as defined in Section 2.2.2. The latter are either parameters of the cryptosystem or intermediate variables.

Several works devoted to sampling according to discrete Gaussian distributions [MW17; Kar+18; DN12a] or related distributions, such as rounded Gaussians [START_REF] Hülsing | Rounded Gaussians -Fast and Secure Constant-Time Sampling for Lattice-Based Crypto[END_REF] exist. Different methods exist, according to the standard deviation size, as well as whether it is constant or variable. Encryption schemes typically require small standard deviations, while signatures use larger ones, which are fixed for Fiat-Shamir schemes and vary for hash-and-sign constructions. It is customary to use a small standard deviation "base sampler" and build upon it to achieve the desired large standard deviation: this is the approach presented in [START_REF] Micciancio | Gaussian Sampling over the Integers: Efficient, Generic, Constant-Time[END_REF]. These works can also be distinguished according to whether they require floating-point arithmetic. In particular, the rounded Gaussians of [START_REF] Hülsing | Rounded Gaussians -Fast and Secure Constant-Time Sampling for Lattice-Based Crypto[END_REF] offer numerous attractive properties, but they have some statistical limitations in terms of distinguishing advantage, and they rely on floating-point implementations. We present here the isochronous Gaussian Sampling building blocks that we will use in this thesis.

Optimization with positive samples

Before showing the sampling techniques, one optimization could be to sample from |D Z,σ | where the latter denotes the distribution of the absolute value of the samples from D Z,σ . Therefore, to sample from D Z,σ , one must use a random sign flip after drawing from |D Z,σ | to recover the entire distribution D Z,σ .

Remark 1. One can remark that |D Z,σ | = D Z + ,σ . Indeed D Z + ,σ (z) = ρ σ (z)/ρ σ (Z + ) while |D Z,σ |(z) ∝ 2 • ρ σ (z) if z = 0 ρ σ (z) if z = 0 Isochronous Cumulative Distribution Table (CDT)
Let us assume that we want to draw a sample from a distribution D. In particular; one might take D := |D Z,σ | for a direct Gaussian sampling with a sign generation just after as will be presented later in Chapter 3 with Gadget 11. Alternatively, one might take D = D Z + ,σ for using different techniques as will be presented in Algorithms 12 and 13.

In any case, to draw from D, the general inverse transform sampling technique originally introduced in [Dev86, Section 2.2] can be used. It needs a Cumulative Distribution Table (CDT for short): precompute a table of the cumulative distribution function of D. The table should cover the interval at the points where the distribution has a non-negligible probability 2 -128 . Then, to produce a sample; one can generate a random value in [0, 1] with 128 bits of precision, and return the index of the first entry in the table strictly larger than that value. In variable time, this can be done relatively efficiently with a binary search, but this leaks the resulting sample through memory access patterns. As a result, an isochronous implementation has essentially no choice but to read the entire table each time and carry out each and every comparison. This process is summed up in Algorithm 2. The parameter w is the number of elements of the CDT and θ is the precision of its coefficients. The CDT table contains w elements t j for j ∈ [0, w -1] such that t j := 0≤i≤j D(i) with θ bits of absolute precision.

Algorithm 2 -Cumulative Distribution Table Sampling (SampleCDT)

Params: w, θ, (t j ) j∈[0,w-1] Result: A sample z following D 1 z := 0 2 pick u ∈ [0, 1) uniformly with θ bits of absolute precision 3 for 0 ≤ j < w do

b := (t j ≤ u) /* b = 1 if (t j ≤ u), b = 0 otherwise */ 5 z := z + b 6 end 7 return z
Although a basic CDT implementation would store the cumulative probabilities with 128 bits of precision, it is, in fact, possible to only store lower precision approximations, as discussed in [PDG14; Wal19] (see also [START_REF] Prest | Sharper Bounds in Lattice-Based Cryptography Using the Rényi Divergence[END_REF] for an alternate approach using "conditional distribution functions"). Nevertheless, even with these optimizations, a direct CDT leads to highly inefficient implementations because the tables are often very heavy. Besides, this sampling does not handle variable center and standard deviation.

Protecting lattice-based signatures against timing attacks

Generic Convolution techniques

An efficient approach, originally introduced by Pöppelmann et al. [START_REF] Pöppelmann | Enhanced Lattice-Based Signatures on Reconfigurable Hardware[END_REF] and later improved and generalized by Micciancio and Walter [START_REF] Micciancio | Gaussian Sampling over the Integers: Efficient, Generic, Constant-Time[END_REF], assumes that we can generate a base Gaussian distribution D Z + ,σ 0 with not too small standard deviation σ 0 using an isochronous CDT for example. And, this allows combining samples issued with the base distribution to achieve larger standard deviations. These convolution techniques are highly generic and can be applied for any variable center and standard deviation. Inevitably, this convolution technique is no always optimal for practical schemes with particular specificities. For example, for BLISS, the fixed large standard deviation can be leveraged (see Section 2.4.5). Furthermore, for our sampler for Falcon in Section 2.5, we leverage the fact that the variation magnitude of the center and standard deviation is very small. Both of the specific techniques use rejection sampling, explained below.

Rejection sampling

Let us present the acceptance-rejection method [CRW04; MM10; Lyu12; Duc+13]. This technique, that allows to convert a set of samples from random instances of a family g v of distributions into a subset of samples from a target distribution f , is based on the following lemma.

Lemma 5 (Acceptance-Rejection Lemma as stated in [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF]). Let V be an arbitrary set, h : V → R and f : Z m → R be probability distributions. If g v : Z m → R is a family of distributions indexed by v ∈ V with the following property

∃M ∈ R such that ∀v ∈ V ∀z ∈ Z m M g v (z) ≥ f (z).
The distribution of the output of the following procedure

1. v ← h 2. z ← -g v 3. output (z, v) with probability f (z) M gv(z) is identical to the output of 1. v ← h 2. z ← -f 3. output (z, v) with probability 1/M .
A first use of Lemma 5 is the possibility to eliminate secret-dependent output distributions with a secret-independent number of iterations as sketched in Section 2.2.6. Another key idea of the rejection sampling is the possibility to build efficient Gaussian sampling by 1. constructing a distribution that looks somewhat like the desired Gaussian but is not statistically close; 2. using rejection sampling to correct the discrepancy. This is particularly useful when step 1 can be performed efficiently. This idea is applied to both our Gaussian sampler for BLISS signature scheme in Section 2.4 and our isochronous sampler for Falcon in Section 2.5.

An example of application

Let us consider the Fiat-Shamir with aborts signature scheme introduced in [START_REF] Lyubashevsky | Lattice Signatures without Trapdoors[END_REF]. This scheme is the ancestor of BLISS (described in Section 3.4), Dilithium (see Section 3.3.6) and qTesla (see Section 3.5). This scheme is based on SIS (see Hard Problem 4) and we present the key generation and signature in Algorithms 3 and 4. We refer to [START_REF] Lyubashevsky | Lattice Signatures without Trapdoors[END_REF] for the parameter

1 c $ ← -{v : v ∈ {-1, 0, 1} k , v 1 ≤ κ} 2 z ← D m Z,σ
3 return sig := (z, c) with probability 1 M and program hash(Az -Tc, m) = c choice and verification algorithm. The hash function is chosen to satisfy hash : {0,

1} * → {v : v ∈ {-1, 0, 1} k , v 1 ≤ κ}.
Thanks to the rejection sampling lemma (we refer to [Lyu12, Theorem 5.1] for the detailed proof), the signature algorithm is indistinguishable from the hybrid presented in Algorithm 5.

Remark 2. The number of iterations is variable and follows a geometric distribution of parameter M . Note that even though the number of iterations varies, it is independent from the secret. This stays true even if an attacker is able to select a subset of signatures by filtering2 the output c. Indeed, assume that an attacker has access to the expectation of rejection conditionned with c, i.e. E y [(z, c) rejected | c]. The following computation shows that this quantity is independent from S and c. Let S and c be fixed quantities,

p sc := E y [(z, c) rejected | c] = 1 -1/M • E y ρ σ ( z 2 ) ρ σ ( z -Sc 2 ) (2.16) = 1 -1/M • E y ρ σ ( y + sc 2 ) ρ σ ( y 2 ) (2.17) = 1 - 1 M ρ σ (Z n ) y ρ σ ( y 2 )ρ σ ( y + sc 2 ) ρ σ ( y 2 ) (2.18) = 1 - 1 M ρ σ (Z n ) y ρ σ ( y + sc 2 ) (2.19) = 1 - 1 M ρ σ (Z n ) z ρ σ ( z 2 ) (2.20) = 1 -1/M. ( 2

.21)

One may argue that, by fixing c, we also filter elements y though the hashing function and thus the sum will not be on all y. However, in the random oracle model, the choices of c and y can be seen as independents as long as (u, m) are not repeated which happens with negligible probability.

GALACTICS: A polynomial approximation tool

This section, along with Section 2.4, are part of a work [START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF] Here, we approximate the transcendental functions over an interval using integer polynomials to avoid floating operations. Moreover, we aim to approximate using polynomials with small coefficients so that we can use small-sized integers and obtain a straightforward implementation of Horner's polynomial evaluation algorithm.

Definition 2 (Polynomial Approximation). Let K ∈ R + , for f a nonzero function on an interval I, we denote by

P I f a polynomial in R[x] that satisfies ∀x ∈ I, P I f (x) -f (x) f (x) < 2 -K (2.22)
Such a polynomial is referred to as an approximation that coincides with f up to K bits of relative precision on I.

Lemma 6. Let f : I → R be a function defined on an interval

I ⊂ R such that ∀x ∈ I 0 ≤ f (x) ≤ 1. Consider a cryptosystem denoted C that requires drawing a Q-uple (a 0 , . . . a Q-1 ) ∈ {0, 1} Q such that a i ← B f (x i )
where the x i are drawn from a distribution on I. Assume that C is λ-bit secure against a search problem. Let

K := log 2 2 • (2 • λ -1) • Q .
Let us consider a copy of the latter cryptosystem, denoted C approx , where the only difference is that each

a i ← B f (x i ) is replaced by a i ← B P I f (x i )
for the same x i where P I f is such that

∀x ∈ I, P I f (x) -f (x) f (x) < 2 -K (2.23) and ∀x ∈ I P I f (x) -f (x) 1 -f (x) ≤ 2 -K . (2.24)
Then, C approx is (λ -1)-bit secure against the search problem.

Proof: For all x ∈ I,

B f (x) (1) -B P I f (x) (1) B f (x) (1) = P I f (x) -f (x) f (x) and B f (x) (0) -B P I f (x) (0) B f (x) (0) = P I f (x) -f (x) 1 -f (x) . Thus, ∀b ∈ {0, 1} B f (x) (b) -B P I f (x) (b) B f (x) (b) ≤ 2 -K = 1 2 (2λ -1) • Q .
Using Lemma 4, one can safely replace the distribution B f (x) by the distribution

B P I f (x)
and the resulting cryptosystem will be (λ -1)-bit secure against the search problem.

Remark 3. The condition of Eq. (2.24) has been added in a recent modification of this thesis. Thus, in our applications, Eq. (2.24) will be checked experimentally once a polynomial is found. The next paragraphs focus on a polynomial approximation verifying Eq. (2.23).

In this section, we aim at exhibiting a polynomial P I f that validates Definition 2 with implementation friendly features, i.e. short-sized coefficients and a short degree. More precisely, we must minimize two parameters in order to achieve Eq. (2.22) as tightly as possible, namely

• η, the number of bits of its coefficients,

• γ, its degree.

The procedure is as follows:

1. In a first attempt, we exhibit a candidate polynomial for f whose coefficients are in the field R. This step gives us the minimum degree γ that is needed. 2. In a second attempt, the coefficients of the candidate polynomial are rounded to fulfill the requirement on the number of bits η.

Polynomial approximation in R[x]

We start by looking for a polynomial P R in R[x] that approximates f on a defined interval I such that ∀x ∈ I, f (x) ≤ 1/2. In this section, we re-define the infinite norm as

f ∞ := sup I |f (x)|.
Such a bound is convenient as Eq. (2.22) is equivalent to

P I f f -1 ∞ < 2 -K . (2.25)
However, the main drawback of the infinite norm is that it is not Euclidian. One possible efficient method to polynomially approximate with the infinite norm is introduced in [START_REF] Brisebarre | Efficient polynomial L ∞ -approximations[END_REF]. In the following, we present a different method which trades efficiency with accuracy: the approximation consists of the interpolation of a continuous interval instead of a discrete set of samples. This procedure is more adapted to our setting since we want an approximation for all x in an interval I.

To approximate on I, we can over-approximate the infinite norm by a Euclidian norm in order to use orthogonal projections. We then propose the use of Sobolev H 2 inner product. This Euclidean metric was introduced in [Sob63] and allowed to upper bound the infinite norm. Let us describe this inner product.

Definition 3 (Sobolev H 2 inner product). For u and v two differentiable functions defined on an interval I, Sobolev H 2 inner product is defined by

u, v S := 1 |I| I uv + |I| I u v . The corresponding norm |•| S is |u| 2 S := 1 |I| I u 2 + |I| I u 2 .
And the interesting property of this norm is the following.

Lemma 7 ([Kel20]). The Sobolev norm |•| S satisfies u ∞ ≤ √ 2 • |u| S .
Proof: Let x 0 ∈ I be such that |u(x)| ≥ |u(x 0 )| for all x ∈ I. We then write

u(x) = u(x 0 ) + x x 0 u Hence, |u(x)| ≤ |u(x 0 )| + x x 0 |u | ≤ 1 |I| I |u| + I |u |
Using Cauchy-Schwarz, we have

I |u| 2 ≤ |I| I |u| 2 and I |u | 2 ≤ |I| I |u | 2 . Then, |u(x)| ≤ 1 |I| |I| I |u| 2 + |I| I |u | 2
Using the equality x + y ≤ √ 2 x 2 + y 2 for x, y ≥ 0, we have

|u(x)| ≤ √ 2 1 |I| 2 • |I| I |u| 2 + |I| I |u | 2 Thus, ||u|| ∞ ≤ √ 2 • |u| S
which concludes the proof.

Based on this norm, we compute a polynomial, denoted P R , as an orthogonal projection minimizing |P R /f -1| S and get

P R f -1 ∞ ≤ √ 2 • P R f -1 S small .
Let R <d [X] be the space of polynomials of degree < d. To find an element of the form P R f that minimizes P R f -1 S , we build the following vector space:

E d := X → P (X) f (X) : P ∈ R <d [X]
Assuming that f is a transcendental function, the function X → 1 does not belong in E d for any d. However, for each d, there exists an element of the form P R f ∈ E d that minimizes P R f -1 S . The latter element corresponds to the orthogonal projection of 1 on E d with respect to Sobolev H 2 inner product.

For each d, we thus derive an orthonormal basis of E d by Gram-Schmidt orthonormalizing the canonical basis

1/f, X/f, • • • , X d-1 /f with respect to |•| S ; getting a basis denoted (g 0 , • • • , g d-1 ). Let Π d denote the projection of 1 on E d , Π d = d-1 i=0 1, g i S g i |g i | S . (2.26) With Lemma 7, Π d -1 ∞ ≤ √ 2 • |Π d -1| S .
With the application of the log function, a slightly underestimated quality of the approximation can be obtained as

κ(d) := -log 2 √ 2 • Π d -1 S .
(2.27) Therefore, to achieve a precision K, as shown in Algorithm 6, it is sufficient to select the degree γ as being the minimum degree such that κ(γ) > K, i.e. Π γ -1 ∞ < 2 -K , and set P R =Π γ • f. Algorithm 6 -Polynomial Approximation with large coefficients (floatapprox) Params: The function f , the interval I Data: The target relative precision K Result: A polynomial P R verifying Eq. (2.25) along with its degree

1 d := 1 2 repeat 3 Π d := Projection of x → 1 on E d with respect to |.| S 4 κ(d) := -log 2 √ 2 • Π d -1 S 5 d := d + 1 6 until κ ≥ K 7 return P R :=Π d • f and γ := d

Integer polynomial approximation

Let us assume that we have found a polynomial P R ∈ R[X]

P R (X) = a 0 + a 1 • X + • • • + a γ X γ (2.28)
with (a i ) i∈[0,γ] ∈ R verifying Eq. (2.25). We now want to derive P I f from P R with coefficients of the following form.

P I f (X) = b 0 • 2 -m 0 + b 1 • 2 -m 1 • X + • • • + b γ • 2 -mγ • X γ , (2.29)
where (m i ) i∈[0,γ] are integers and

(b i ) i∈[0,γ] are η-bit signed integers (i.e. ∈ [-2 η-1 , 2 η-1 [).
In order to obtain these coefficients, we need to operate a rounding of P R and minimize the precision loss. An intuitive idea could be to multiply each coefficient a i by a large power of two and round it to the nearest integer. Actually, one can lose less precision by using classical lattice reduction techniques.

In a nutshell, the idea is to round P R with its closest element in a Euclidean lattice that represents the elements in Z 2 η [X]/f (X). In this objective, for each coefficient a i , we first fix m i to the unique integer such that .30) Let us create an Euclidean lattice with the following basis

a i • 2 m i ∈ [-2 η-1 , 2 η-1 [. ( 2
B := 2 -η-m i • X i f (X) i∈[0,γ]
.

(2.31)

Our notion of closeness still refers to the Sobolev norm, which is an unusual norm for Euclidean lattices. The lattice reduction must be adapted to use the Sobolev norm (using Gram matrix corresponding to Sobolev's inner product). And, this lattice can be LLL-reduced3 with respect to the Sobolev H 2 norm. A Babai rounding of the polynomial P R /f with respect to the same Sobolev H 2 norm gives candidates coefficients for P I f . The quality of the rounding can be evaluated as

κ round (γ, η) := -log 2 √ 2 • P I f f - P R f S .
(2.32)

The rounding always implies a loss of accuracy in the approximation. One can compute the relative precision of P I f by using Eqs. (2.27) and (2.32)

K := 2 -κ(γ) + 2 -κ round (γ,η) .
If K > K, then P I f verifies Eq. (2.22), i.e. P I f is a correct approximation that coincides with f up to K bits of relative precision on I. Indeed, in that case:

∀x ∈ I, |P I f (x)-f (x)| |f (x)| ≤ P I f -f f ∞ = P I f f -1 ∞ ≤ P I f f -P R f ∞ + P R f -1 ∞ ≤ √ 2 • P I f f -P R f S + √ 2 • P R f -1 S = 2 -κ(γ) + 2 -κ round (γ,η) ≤ 2 -K .
Algorithm 7 -Sketch of the full polynomial approximation Params: The function f , the interval I Data: The target relative precision K, the target size η Result: A polynomial, the achieved precision K , the achieved size η 1 (P R , γ) := floatApprox(K) 2 (m i ) i∈[0,γ] defined with Eq. (2.30) 3 B computed with Eq. (2.31). In Algorithm 7, we informally sketch all the steps for finding our final approximation. The algorithm is ad-hoc and works by trial and error on the input parameters. For example, several cases can appear.

1. The final relative precision K is too small compared to the target one. In this case, Algorithm 7 must be run with a higher input K in order to increase the degree γ.

2. The final size of the coefficients η is larger than the target one. This happens when the lattice reduction was not successful enough to get a close vector in the lattice. Here too, taking a more significant input degree can help to get a finer approximation. ---------------------- --------------------- The final polynomial effectively provides 2 -21 relative precision with x → exp(-x) on [1, 2] and the sizes of its coefficients do not exceed 25.

The Sage tool

Isochronous BLISS

The BLISS signature scheme introduced in 2013 in [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF] was possibly the most efficient lattice-based signature scheme so far introduced at that time. It has been implemented in both software [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF] and hardware [START_REF] Pöppelmann | Enhanced Lattice-Based Signatures on Reconfigurable Hardware[END_REF] and boasted performance numbers comparable to classical factoring and discrete-logarithm based schemes. BLISS can be seen as a ring-based optimization of the earlier lattice-based scheme of Lyubashevsky [START_REF] Lyubashevsky | Lattice Signatures without Trapdoors[END_REF], sharing the same "Fiat-Shamir with aborts" structure [START_REF] Lyubashevsky | Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures[END_REF].

Please note that its parameters were chosen before the NIST standardization process and may now be considered not enough conservative compared to those of the NIST candidates.

BLISS signature scheme

Algorithm 8 -BLISS key generation Result: Signing key sk, verification key pk 1 Generate two polynomials f and g uniformly at random in R q with exactly nδ 1 entries in {±1} and nδ 2 entries in {±2}

2 S = (s 1 , s 2 ) := (f, 2 • g + 1) 3 if N κ (S) ≥ C 2 • 5 • ( δ 1 • n + 4 • δ 2 • n ) • κ then 4 restart to step 2 5 end 6 a q := (2 • g + 1)/f mod q (restart if f is not invertible.) 7 A = (a 1 , a 2 ) := (2 • a q , q -2) mod 2q 8 return (pk, sk) := (A, S)
One can give a simplified description of the scheme as follows: the public key pk is a (NTRUlike) ratio of the form a q = s 2 /s 1 mod q, where the signing key sk is composed of polynomials s 1 , s 2 ∈ R q (the cyclotomic ring is defined in Eq. (1.3)) are small and sparse. The integer n is a power of two. See Algorithm 8 for a description of the key generation. Its security is based on the ring variant of short integer solution (see Hard Problem 6). The parameters κ, C, δ 1 , δ 2 , q, p are part of BLISS specifications, and we refer to [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF] for the details on the function N κ .

The BLISS signature procedure, described in Algorithm 9, works as follows. To sign a message m, one first generates commitment values y 1 , y 2 ∈ R q with normally distributed coefficients (i.e. using the distribution D Z,σ ), and then computes a hash c of the message m together with ζ • a 1 • y 1 + y 2 mod 2q (where ζ(q -2) = 1 mod 2q) using a cryptographic hash function, hash, modeled as a random oracle taking values in the set of elements of R q with exactly κ coefficients equal to 1 and the others to 0.

Algorithm 9 -BLISS Signature

Data: m, pk = a 1 , sk = S Result: Signature sig 1 y 1 ← D n Z,σ , y 2 ← D n Z,σ 2 u := ζ • a 1 • y 1 + y 2 mod 2q /* ζ(q -2) = 1 mod 2q */ 3 c := hash( u Mst mod p, m) 4 choose a random bit b 5 z 1 := y 1 + (-1) b s 1 c 6 z 2 := y 2 + (-1) b s 2 c 7 if RS(z := (z 1 , z 2 ), S, c) then 8 restart to step 1 9 end 10 z † 2 := ( u Mst -u -z 2 Mst ) mod p 11 return sig := (z 1 , z † 2 , c)
Algorithm 10 -Detailed function RS (Step 7 in Algorithm 9)

Data: z = (z 1 , z 2 ), S = (s 1 , s 2 ), c ∈ R q Result: a bit equal to 0 with probability 1/ M exp(-c • S 2 /(2σ 2
)) cosh( z, Sc /σ 2 ) and 1 otherwise 1 Compute

x 1 ∈ I 1 := - σ 2 α 2 , 0 and x 2 ∈ I 2 := - 2B 2 σ α , 2B 2 σ α such that x 1 := c • S 2 - σ 2 α 2 and x 2 := 2 • z, c • S
2 Generate a pair (u 1 , u 2 ) of fixed-precision numbers uniformly at random in [0, 1] 2 3 Let a := 1 if u 1 ≤ exp( x 1 2σ 2 ), and a := 0 otherwise

4 Let b := 1 if cosh( x 2 2σ 2 ) • u 2 ≤ 1, and b := 0 otherwise 5 return a ∧ b
The signature is the triple (c, z 1 , z 2 ), with z i := y i + s i c, and a rejection sampling (RS) phase is performed to ensure that the distribution of z i is independent of the private key (see Section 2.2.5 for the rejection sampling theory). The rejection rate is defined as

M := exp 1 2α 2
for α a parameter of the scheme. A detailed rejection sampling procedure is presented in Algorithm 10. It is written in a form that will be helpful for the isochronous transformation. Originally, the approach taken in BLISS paper relies on iterated Bernoulli trials with known constant probabilities. The variable time nature of these algorithms has led to multiple attacks.

An alternate approach is to simply evaluate the values exp( x 1 2σ 2 ) and cosh( x 2 2σ 2 ) with sufficient precision, and compare them to uniform random values in [0, 1]. Here, the exp and cosh are separated to account for the different polynomial approximations. The intervals I 1 and I 2 are derived from BLISS construction.

The signature procedure also includes several optimizations on top of the above description. In particular, to improve the repetition rate, it targets a bimodal Gaussian distribution for the z i 's, so there is a random sign flip, in Step 4 of Algorithm 9, in their definition. In addition, to reduce the signature size, the signature element z 2 is actually transmitted in compressed form z † 2 , and accordingly. Thus, the element u is also compressed. The notation • Mst represents this compression: The Tail (parameter chosen in the specifications) least significant bits are dropped. The signature compression does not affect our technique at all, because it only involves non-sensitive parts of the signature generation algorithm (the input of the hash function and the returned signature itself).

The verification procedure is given in Algorithm 11 for completeness since it does not manipulate sensitive data. B 2 and B ∞ are parameters detailed in BLISS specifications.

Algorithm 11 -BLISS Verification

Data: m, sig, pk 1 if (z 1 2 d • z † 2 ) 2 > B 2 then 2 return reject 3 end 4 if (z 1 2 d • z † 2 ) ∞ > B ∞ then 5 return reject 6 end 7 t := hash( ζ • a 1 • z 1 + ζ • q • c Mst + z † 2 mod p, m) 8 if t = c then 9 return reject 10 end 11 return accept
The original BLISS paper describes a family of concrete parameters for the signature scheme, stored in Table 2.1. The BLISS-I and BLISS-II parameter sets are optimized for speed and compactness respectively, and both target 128 bits of security. BLISS-III and BLISS-IV are claimed to offer 160 and 192 bits of security respectively. Finally, a BLISS-0 variant is also given as a toy example offering a relatively low security.

Isochrony

We propose here a provable isochronous implementation of the signature algorithm of BLISS, mainly relying on an alternate implementation of the rejection sampling step, carried out by computing a sufficiently precise polynomial approximation of the rejection probability using pure integer arithmetic.

The key generation of BLISS can also be protected using sorting networks. Nevertheless, the key generation is now obsolete in terms of complexity and performance compared to BLISS-B or more recent signature implementations (Dilithium, qTESLA). Thus, in this thesis, we focus on presenting the isochronous signature algorithm.

The goal of this section is to apply Lemma 6 for approximating :

• the exp(•) in step 3 of Algorithm 10 (see Section 2.4.3);

• the cosh(•) in step 4 of Algorithm 10 (see Section 2.4.4);

• the exp(•) in step 1 of Algorithm 9 (see Section 2.4.5).

The final security and isochrony statements are provided in Section 2.4.6.

Polynomial approximation for the exponential

Choosing the approximation interval Recall that the input interval is I 1 = -σ 2 /α 2 , 0 . But, to anticipate further optimization, we approximate the polynomial in a slightly larger interval, but still finite,

I 3 := [-2 • ln(2) • σ 2 /α 2 , 0].
Choosing the factor K NIST suggested Q s = 2 64 maximum signature queries for postquantum standardization. During the rejection sampling, the call to exp() and cosh() is done M < 2 times per signatures on average, so the polynomial approximations used in the rejection sampling step can assume that the number of queries is Q ≈ Q s = 2 64 . We are willing to apply Lemma 6 with the original bit security of λ = 256 and Q = 2 64 . The target relative precision must be 1

2 (2λ -1) Q = 2 -37 .
(2.33) Thus, we look for a polynomial denoted P I 3 exp that verifies

∀x ∈ I 3 , exp( x 2σ 2 ) -P I 3 exp (x) exp( x 2σ 2 ) ≤ 2 -K (2.34)
with K = 37. In order to account for the slight loss of precision as part of the fixed point evaluation of the polynomials using Horner's rule, we need to take slightly more precise values: we verify that K ≥ 39 suffices (one could use general error bounds for Horner such as [Hig02, Eq. ( 5.3)]. However, since our evaluations occur on small integer intervals, it is easy to check their precision by exhausting the intervals).

Using our approximation tool We use our polynomial approximation tool presented in Section 2.3 with BLISS-I parameters. The final polynomial has degree 10 and 45-bit coefficients. ---------------------- --------------------- Experimental verification of Eq. ( 2.24) To comply with Lemma 6, we must check that

∀x ∈ I 3 , exp x 2σ 2 -P I 3 exp (x) 1-exp x 2σ 2 ≤ 2 -40 .
Perspective 1. The condition of Eq. (2.24) has been added in a recent modification of this thesis. An interesting line of research would be to take Eq. (2.24) directly into account in the Galactics polynomial approximation to obtain both bounds.

We experimentally check that Eq. ( 2.24) is verified with the outputted polynomial. First, we notice that such a bound exists by studying the variations of the left member. More precisely, this member decreases when x → 0, this can be seen with computations on x = -2 -i for large i in high precision. The limit when x → 0 is also a finite very small number. Then, we compute the maximum by exhausting I 3 . Indeed, we recall that for BLISS, the input x is an integer in I 3 . We finally have

∀x ∈ I 3 , exp x 2σ 2 -P I 3 exp (x) 1 -exp x 2σ 2 ≤ 2 -44 , (2.35)
which is enough to validate the condition of Eq. (2.24).

Polynomial approximation of the hyperbolic cosine

The input interval for the hyperbolic cosine is large, namely

I 2 = - 2B 2 σ α , 2B 2 σ α ≈ [-5534960, 5534960]
for BLISS-I. Due to the parity of the hyperbolic cosine, the study on I 2 can be reduced to

I 2 = 0, 2B 2 σ α ≈ [0, 5534960] for BLISS-I.
The target approximation factor is the same as for the exponential, namely K ≥ 39.

First Approach After one day of computations, the following instructions succeeded to output a valid polynomial with 48 coefficients of 110 bits.

sage: load('polynomial_approximation.sage') ....: galactics = GALACTICS_approximation(0, 5534960, 512, 65, 100, "(exp(x / 2 / 215^2) + exp(-x / 2 / 215^2) / 2") ....: galactics.approximate() ----------------------- ---------------------

[...]

Exact polynomial:

P = 1 * 2 ^0 + 579356348280174377 * 2 ^-93 * x ^2 + 776355318672508413 * 2 ^-130 * x ^4 + 915092737617992344722936430591 * 2 ^-208 * x ^6 + 477972884153784129 * 2 ^-206 * x ^8 + 683198250418101963 * 2 ^-246 * x ^10 + 732080158605593691080137637887 * 2 ^-326 * x ^12 + 941246584139471315 * 2 ^-327 * x ^14 + 1009039488665294857 * 2 ^-368 * x ^16 + 848404038966405199 * 2 ^-409 * x ^18 + 574427366621078729 * 2 ^-450 * x ^20 + 639792480494866645 * 2 ^-492 * x ^22 + 596411567633024933 * 2 ^-534 * x ^24 + 1038265388175552617133165772799 * 2 ^-617 * x ^26 + 642737561059887937 * 2 ^-619 * x ^28 + 835957399885546368823128489983 * 2 ^-702 * x ^30 + 788833826198999147 * 2 ^-705 * x ^32 + 180800091273276529 * 2 ^-746 * x ^34 + 296114798686759457 * 2 ^-790 * x ^36 + 940728566765727412999436632063 * 2 ^-875 * x ^38 + 150149332642775351 * 2 ^-876 * x ^40 + 572450757456113259692666388479 * 2 ^-962 * x ^42 + 748157035942843819 * 2 ^-965 * x ^44 + -2318931663498473299 * 2 ^-1010 * x ^46 + 11469920785630361661 * 2 ^-1054 * x ^48 + -72070497548995658817801780461567 * 2 ^-1139 * x ^50 + 45346083844645413249 * 2 ^-1141 * x ^52 + -857389151161771913179 * 2 ^-1188 * x ^54 + 112389859384283396677 * 2 ^-1228 * x ^56 + -414355076723513568697 * 2 ^-1273 * x ^58 + 337060337629183540215 * 2 ^-1316 * x ^60 + -265830663567489890942195238699007 * 2 ^-1399 * x ^62 + 336319019176325683112175007170559 * 2 ^-1443 * x ^64 + -170475232994946739825 * 2 ^-1446 * x ^66 + 167183977538710670933 * 2 ^-1490 * x ^68 + -71970509923746855587 * 2 ^-1533 * x ^70 + 216967001776759787417 * 2 ^-1579 * x ^72 + -35646442335471927163 * 2 ^-1621 * x ^74 + 81298181032640091129 * 2 ^-1667 * x ^76 + -159830707981302343261 * 2 ^-1713 * x ^78 + 147677672072565905368102480117759 * 2 ^-1798 * x ^80 + -23863574853001513117 * 2 ^-1801 * x ^82 + 113128579100766722931 * 2 ^-1849 * x ^84 + -109674964769571482255 * 2 ^-1895 * x ^86 + 21170189159645535701 * 2 ^-1939 * x ^88 + -3128582308920305019 * 2 ^-1983 * x ^90 + 85067057155831645461 * 2 ^-2035 * x ^92 + -11559169938839276831 * 2 ^-2080 * x ^94 + 96586818007198473957 * 2 ^-2132 * x ^96
This approximation is convenient for the masking countermeasure (we refer to the masking chapter in Section 3.4.1). However, the degree and size of the coefficients are large. In isochrony, an optimization using shifts can be done.

Second approach We use the following lemma for a more convenient approximation.

Lemma 8. Let c := 2σ 2 ln(2). Assume that P I 3 exp is a precision K approximation of exp • 2σ 2 on I 3 . Let us define the following function.

t c : I 2 → I 3 x → x -x c c.
(2.36)

The following polynomial

P I 2 cosh (x) := =exp x 2σ 2 2
x c

• P I 3 exp (t c (x)) +2 -x c • exp c 2σ 2 • P I 3 exp (-t c (x) -c) 2 (2.37) is a precision K -1 approximation of cosh • 2σ 2 on I 2 .
Proof: By definition, t c (x) belongs in I 3 , thus

∀x ∈ I 2 |P I 3 exp (t c (x)) -exp tc(x) 2σ 2 | | exp tc(x) 2σ 2 | ≤ 2 -K
Then, let us compute the relative error for P I 2 cosh . For

x ∈ I 2 , |P I 2 cosh (x)-cosh x 2σ 2 | | cosh x 2σ 2 | = 2 x c •P I 3 exp (tc(x))+2 -x c •exp c 2σ 2 •P I 3 exp (-tc(x)-c)-exp x 2σ 2 -exp -x 2σ 2 exp x 2σ 2 +exp -x 2σ 2 ≤ 2 x c •P I 3 exp (tc(x))-exp x 2σ 2 exp x 2σ 2 +exp -x 2σ 2 + 2 -x c •exp c 2σ 2 •P I 3 exp (-tc(x)-c))-exp -x 2σ 2 exp x 2σ 2 +exp -x 2σ 2 ≤ 2 x c •P I 3 exp (tc(x))-exp x 2σ 2 exp x 2σ 2 + 2 -x c •exp c 2σ 2 •P I 3 exp (-tc(x)-c)-exp -x 2σ 2 exp -x 2σ 2 = P I 3 exp (tc(x))-exp tc(x) 2σ 2 exp tc(x) 2σ 2 + 2 -x c exp c 2σ 2 •P I 3 exp (-tc(x)-c)-exp -tc(x) 2σ 2 2 -x c 2 -x c exp -tc(x) 2σ 2
•exp c 2σ 2

≤ P I 3 exp (tc(x))-exp tc(x) 2σ 2 exp tc(x) 2σ 2
+ P I 3 exp ( ∈I 3 -t c (x) -c)-exp -tc(x)-c 2σ 2 exp -tc(x)-c 2σ 2 ≤ 2 -K + 2 -K = 2 -K+1 .
Note that Eq. (2.37) can be computed exactly in a fast and isochronous way. Indeed, the factor 2

x c consists in a bit shift. Namely, it consists of at most 86 shifts for BLISS-I (because

x c ≤ B 2 α ln(2)σ ).
Note that Lemma 6 cannot be applied with both approaches because the requirement of ∀x ∈ I, 0 ≤ f (x) ≤ 1 is not verified. We introduce one last lemma to handle this issue.

Lemma 9. Assume that P I 2 cosh (x) is a precision K approximation of cosh • 2σ 2 on I 2 . Then,

1 P I 2 cosh (x)
is also a precision K approximation of

1 cosh • 2σ 2 on I 2 . Proof: For x ∈ I 2 , we have 1 2P I 2 cosh (x) - 1 2 cosh ( x 2σ 2 ) 1 2 cosh ( x 2σ 2 ) = P I 2 cosh (x)-cosh x 2σ 2 P I 2 cosh (x)
.

Next, we want to us the following result,

∀p, q ∈ R p -q p ≤ p -q q + p -q q 2 .
(2.38)

Let us first prove Eq. (2.38). We have p-q p = p-q q

• q p . If |q| ≤ |p|, the result is direct. If |q| ≥ |p|, we have q p ≤ p q ≤ 1 + p-q q .
The application of Eq. ( 2.38) to p = P I 2 cosh (x) and q = cosh x 2σ 2 allows to conclude with:

1 2P I 2 cosh (x) - 1 2 cosh x 2σ 2 1 2 cosh x 2σ 2 P I 2 cosh (x) -cosh x 2σ 2 cosh x 2σ 2 ≤ 2 -K .
Experimental verification of Eq. ( 2.24) An experimental verification of the condition in Eq. ( 2.24) can be performed similarly to Section 2.4.3. For the first approach, by exhausting I 2 , we get

∀x ∈ I 2 , cosh x 2σ 2 -P I 2 cosh (x) 1 -cosh x 2σ 2 ≤ 2 -56 ≤ 2 -39 .
For the second approach, the bound can be derived from Eq. (2.35) with a proof similar to the one of Lemma 9 (except that there is an 1 -exp in the denominator). Thus, we get

∀x ∈ I 2 , cosh x 2σ 2 -P I 2 cosh (x) 1 -cosh x 2σ 2 ≤ 2 -44+1 ≤ 2 -39 .

Isochronous Gaussian generation for BLISS

The Gaussian sampling step is key to obtaining a fast implementation of BLISS, as it represents half or more of the computation time of signature generation: for each signature, one needs to generate 1024 samples of the discrete Gaussian distribution D Z,σ (possibly several times over, in case a rejection occurs), and the standard deviation is relatively large (σ = 215 for BLISS-I). This step has also been specifically targeted by cache timing attacks such as [START_REF] Groot Bruinderink | Flush, Gauss, and Reload -A Cache Attack on the BLISS Lattice-Based Signature Scheme[END_REF]. In the following, we review the different possible techniques.

Direct CDT One can aim at drawing from |D Z,σ | (as defined in Section 2.2.4) with a CDT and draw a uniformly random sign. Since the standard deviation is a fixed parameter and the center is 0, one can consider the CDT sampling presented in Section 2.2.4. Here, for ensuring 128-bit precision on the table elements, we need to make sure that the number of elements of the table, denoted w, is defined such that exp(-w 2 /(2σ 2 )) < 2 -λ . Thus, the table should contain w = σ √ 2λ log 2 ≈ 2730 entries for BLISS-I, we are looking at 22 kB's worth of memory access for every generated sample. The resulting implementation is highly inefficient.

Using Convolution methods One might want to apply convolution techniques like [START_REF] Micciancio | Gaussian Sampling over the Integers: Efficient, Generic, Constant-Time[END_REF] (presented in Section 2.2.4). For the parameters of BLISS-I, one can check that the optimal choice is to let

σ 2 0 = σ 2 (9 2 +7 2 )(3 2 +2 2 )
. One can then generate a sample x statistically close to |D Z,σ | from 4 samples x 0,0 , x 0,1 , x 1,0 , x 1,1 from |D Z,σ 0 |, as x = 9x 0 + 7x 1 , where x i = 3x i,0 + 2x i,1 . Since σ 0 ≈ 4.99 is much smaller than σ, using a CDT approach for the base sampler is more reasonable: the CDT table now stores 63 entries. Generating a sample requires reading through the table 4 times, for a total of 2 kB of memory access and 128 bits of randomness per sample. It turns out, however, that the performance of the resulting implementation in our setting is still somewhat underwhelming.

A strategy for Gaussian sampling with large standard deviations Finally, yet another strategy is to generate a discrete Gaussian of a fixed small standard deviation, use it to construct a distribution that looks like D Z + ,σ , and use rejection sampling to correct the discrepancy. This is actually the approach taken in the original BLISS paper [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF]. Concretely, the sampling is done using the distribution D Z + ,σ 2 where σ 2 = σ/k for a given parameter k. The sampling is described in Algorithm 12.

Algorithm 12 -BLISS-like Gaussian Sampling

Params: k, σ Result: A sample z following D Z + ,σ 1 x ← D Z + ,σ/k 2 y $ ← -{0, . . . , k -1} 3 z := k • x + y 4 Goto 1 with probability exp -y(y + 2kx)/(2σ 2 ) 5 if z = 0 then 6 Goto 1 with probability 1/2 7 end 8 b $ ← {0, 1} 9 return (-1) b • z
The idea of Steps 1 to 4 is that z = kx + y looks "somewhat like" a sample from D Z + ,σ , and rejecting z except with probability exp -y(y + 2kx)/(2σ 2 ) yields a value that actually follows D Z + ,σ . Let us detail why the latter is true. We apply Lemma 5 from Section 2.2.5. Here, we are in the particular case where g v is not a family of distributions but a single distribution without being indexed by v. The distribution function g is

g(z) = g(kx + y) = ρ σ 2 (x) kρ σ 2 (Z + )
because, once x is drawn, by Euclidian division properties, z is uniquely written as kx + y for y ∈ {0, . . . , k -1}. And the desired output distribution function f is

f (z) = f (kx + y) = ρ kσ 2 (kx + y) ρ kσ 2 (Z + ) . Now the ratio is proportional (written ∝) to f (z)/g(z) ∝ ρ kσ 2 (kx+y) ρσ 2 (x) = exp -(kx+y) 2 2k 2 σ 2 2 + x 2 2σ 2 2 ∝ exp -k 2 x 2 +y 2 +2kxy 2σ 2 + k 2 x 2 2σ 2 ∝ exp -y(y+2kx) 2σ 2
.

In addition, one can compute the constant average repetition rate as M = f g ∞ .

The idea of Steps 5 to 9 is to draw a random sign. More precisely, at Step 5, z follows D Z + ,σ , which is not exactly |D Z,σ | (see Remark 1). We thus need to divide the probability of 0 by two; it is performed with a simple rejection sampling step.

Making it isochronous. One can think that because of the probabilistic property of Step 4 in Algorithm 12, this cannot be isochronous. However, thanks to the statistical indistinguishability provided by Lemma 5, the number of iterations follows a geometric distribution with parameter M and thus is independent from any secrets.

One ingredient to add is a base sampler for the distribution |D Z,σ 2 |, since the one in the original BLISS paper does not lend itself to a convenient isochronous implementation. Fortunately, choosing k = 256, makes the standard deviation σ 2 ≈ 0.80 very small, and hence a CDT approach only requires 10 table entries for achieving 128-bit absolute precision.

The second ingredient is the rejection sampling. As observed in the BLISS paper, this rejection sampling step (Step 4 of Algorithm 12) has the same form as the one used for the overall signing algorithm (Step 7 in Algorithm 9, detailed in Algorithm 10). The isochronous implementation of that step has been described in Algorithm 10, and we can simply reuse that work to obtain our Gaussian sampling. In particular, we can derive a simple rejection sampling procedure (see Procedure 1) with a Bernoulli distribution.

Procedure 1 -Detailed Rejection Sampling of BLISS Gaussian Sampler (Step 4 in Algorithm 12)

1 x 3 := -y(y + 2kx) 2 Generate u a fixed-precision number uniformly at random in [0, 1] 3 return 1 if u ≤ exp( x 3
2σ 2 ), and 0 otherwise

Here too, we use GALACTICS to generate a polynomial approximation of exp • 2σ 2 . There are two slight differences with the previous approximation.

1. The relative target precision must be higher because the number of queries to the distribution is also higher. More precisely, the Bernoulli distribution with exponential parameter is called once per attempt at generating a Gaussian sample. The number of attempts is small (≤ 2 on average) due to rejection in Gaussian sampling. However, the Gaussian sampling is repeated 2n times to generate all the coefficients of y 1 , y 2 , and M times overall, where M is the repetition rate of the signature scheme. Therefore, the expected number of calls to the Bernoulli distribution as part of Gaussian sampling when generating Q s signatures, is bounded as

Q ≤ 2M • 2n • Q s ≤ 2 78
for BLISS-I. This implies that, in order to apply Lemma 6, the relative target precision must be computed for λ = 256 and

Q = 2 78 , 1 2 • (2 • λ -1) • Q = 2 -44 . (2.39)
2. We use the Euclidean division optimization of Eq. (2.36), which is used for the hyperbolic cosine approximation. In that way, the approximation interval is

I 3 = [-2σ 2 ln(2)
, 0] and a fixed number of shifts are used to compute 2

x 3 2σ 2 ln(2) .
Here is the new polynomial approximation.

sage: load('polynomial_approximation.sage') ....: galactics = GALACTICS_approximation( -2 * 215^2 * ln(2), 0, 128, 48, 45, "exp(x / 2 / 215^2)") ....: galactics.approximate() --------------------- To check Eq. ( 2.24), similarly to Section 2.4.3, we compute

[...] ----------------------- | Final security : 50 | | Max size coeffs : 45 | -
∀x ∈ I 3 , exp x 2σ 2 -P I 3 exp (x) 1 -exp x 2σ 2 ≤ 2 -55 .
Finally, in practice, this yields a Gaussian sampling of very reasonable efficiency, whose cost is dominated by the cost of the rejection sampling step, and of the generation of the uniform randomness. This is the approach we choose for our work.

The presented Gaussian sampler can be seen as a variant of FACCT [START_REF] Zhao | FACCT: FAst, Compact, and Constant-Time Discrete Gaussian Sampler over Integers[END_REF]. There are multiple differences between our works, however: in particular, FACCT relies on floating-point arithmetic, which we specifically seek to avoid, and uses off-the-shelf software to obtain a doubleprecision floating-point polynomial approximation of the function exp.

Perspective 2. The authors of the qTesla4 second round NIST submission [START_REF] Bindel | [END_REF] proposed an ingenious approach to improve isochronous CDT-based discrete Gaussian sampling. In practice, one needs to generate many samples from the discrete Gaussian distribution in each signature (one for each coefficient of the y i polynomials). The idea is to batch all of the searches through the CDT table corresponding to those samples. This can be done isochronously by applying an oblivious sorting algorithm (e.g. network sorting) to the concatenation of the CDT with the list of uniform random samples. This can be used in conjunction with the convolution technique of [PDG14; MW17] in order to reduce the total size of the table to be sorted (which is the sum of the CDT size and of the desired number of samples). A detailed investigation of this question is left as interesting perspective.

Security and isochrony statement

We denote by I-BLISS the modified version of the original BLISS (as described in [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF]) with all the modifications presented in the last sections. In other words, I-BLISS is a BLISS version where 1. as explained in Section 2.4.5: in step 1, the Algorithm 12 is called with • a CDT sampling with 128-bit absolute precision instead of D Z + ,σ 2 ,

• the polynomial in Section 2.4.5 instead of exp • 2σ 2 ; 2. as explained in Section 2.4.3: in step 7, the Algorithm 10 is called with

• P I 1 exp instead of exp • 2σ 2 , • P I 2
cosh instead of cosh • 2σ 2 (either with or without the optimization).

Theorem 1. Let us assume that the original BLISS cryptosystem achieves λ-bit security by making at most Q s = 2 64 signature queries. Then, the bit-security of I-BLISS achieves (λ -3)bit security.

Proof: The proof consists in calling three times Lemma 6. 5 More precisely, let us introduce intermediate cases.

1. (Ideal) an unmodified version of BLISS signature is called.

2. (Inter 1 ) Only the exponential is approximated.

(Inter 2 )

Only the hyperbolic cosine is approximated.

(Real)

The exponential in Algorithm 12 is also approximated.

The Ideal case is assumed to achieve λ-bit security. We first apply Lemma 6 to our final polynomial approximation for assessing the bit security of the Inter 1 case. Eqs. (2.34) and (2.35) show that Lemma 6 hypothesis are verified. In Section 2.4.3, K is defined to validate Eq. ( 2.33) and it is chosen as K = 39, we thus get that λ Inter 1 ≥ λ -1. Secondly, we apply Lemma 6 for assessing the bit security of the Inter 2 case. Here too, K is chosen as K = 39. Thanks to Lemma 9 and the experimental verifications that follow, we get that λ Inter 2 ≥ λ Inter 1 -1 ≥ λ-2. We finally apply Lemma 6 one last time for assessing the bit security of the Real case where the exponential in Algorithm 12 is approximated. Here too, K is larger due to larger number of queries, K = 47. Similarly, we get λ Real ≥ λ Inter 2 -1 ≥ λ -3.

Proposition 3. For any execution of our implementation of the signature generation σ, L Sign ← ExecObs(Sign, µ, pk, sk), the leakage L Sign can be perfectly publicly simulated from the number of executions of the main loop. The latter, by Lemma 5, follows exactly a geometric law of parameter M , independent from any secret.

Indeed, we have made sure that each step of the algorithm, except for the rejection sampling, is devoid of secret-dependent branches or memory accesses. As a result, the sequence of visited program points and memory accesses from each step is perfectly publicly simulatable, and the overall leakage L Sign is obtained by repeating those simulations a number of times that is equal to the number of executions of the main loop. From these two results, together with the security of the rejection sampling, and the EUF-CMA security of BLISS, we can deduce that our implementation achieves I-EUF-CMA security.

Performance and implementation

Mehdi Tibouchi implemented our isochronous BLISS for the SUPERCOP toolkit for measuring cryptographic software performance [START_REF] Daniel | System for Unified Performance Evaluation Related to Cryptographic Operations and Primitives[END_REF]. Note that the implementation is not completely up We also provide a comparison to Ducas and Lepoint's original, variable-time implementation of BLISS on the same platform [START_REF] Ducas | BLISS: Bimodal Lattice Signature Schemes[END_REF].

The Dilithium performance numbers are, for the fastest parameter set available in SUPER-COP, namely the dilithium2 implementation, which corresponds to "medium" security parameters in [START_REF] Ducas | CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme[END_REF] (no implementation is provided for the "weak" parameters). Timings both for the portable C (ref) and AVX2 platform-specific (avx2) implementations are given in Table 2.2. For qTesla, we also use the fastest available implementation (qtesla1, only in portable C6 ), which corresponds to essentially the same lattice security level as BLISS-I. The performance in Table 2.2 is consistent with the one publicly provided7 with equivalent CPUs.

As we can see in the table, the performance level achieved here is similar to the original variable-time BLISS implementation, and the serious timing attack vulnerabilities exposed in multiple papers are prevented.

Legitimacy of the comparison

In addition, our implementation is faster than qTesla-I and the portable C implementation of Dilithium. It even outperforms the AVX2 implementation of Dilithium by a significant margin, while providing stronger isochrony guarantees (since the Dilithium ring-valued hash function presents a mild timing leakage that causes the isochrony security to rely on non-standard assumptions). Admittedly, the Dilithium parameters were derived using a more conservative methodology for assessing the cost of lattice attacks and hence probably achieve a significantly higher level of security against them. Besides, its reliance on MLWE implies larger parameter sizes. Nevertheless, according to Wunderer's recent reevaluation [START_REF] Wunderer | A detailed analysis of the hybrid lattice-reduction and meetin-the-middle attack[END_REF] of what is likely the strongest attack against BLISS (namely the Howgrave-Graham hybrid attack), it is reasonable to think that BLISS-I does reach its stated security level of around 128 bits.

A generic isochronous sampler for Falcon

In this section, we propose a generic isochronous Gaussian sampler over the integers based on the ideas of the previous sections. It is more precisely the 'small standard deviation' counterpart of our BLISS isochronous Gaussian sampling. This work [START_REF] Howe | Isochronous Gaussian Sampling: From Inception to Implementation[END_REF] has been done with James Howe, Thomas Prest and Thomas Ricosset.

This sampler was originally designed for the Falcon signature scheme [START_REF] Prest | [END_REF], but we figured that it is actually generic and can be applied in other settings. It has all the properties which are expected of a sampler for widespread deployment. It is simple and modular, making analysis and subsequent improvements easy. It is efficient and portable, making it amenable to a variety of scenarios.

The main assumption of our setting is to consider that all the standard deviations are bounded and that the center is in [0, 1]. In other words, denoting the upper bound and lower bound on the standard deviation as σ max > σ min > 0, we present an algorithm that samples the distribution D Z,σ,µ for any µ ∈ [0, 1] and σ min ≤ σ ≤ σ max .

The Gaussian sampler

Our sampling algorithm is called SamplerZ and is described in Algorithm 13. It is based on the general idea of constructing a distribution that looks somewhat like the desired Gaussian and use rejection sampling to correct the discrepancy.

Algorithm 13 -Gaussian Sampling (SamplerZ)

Data: µ ∈ [0, 1], σ ≤ σ max Result: A sample z following D Z,σ,µ 1 while True do 2 z 0 ← D Z + ,σmax 3 b $ ← -{0, 1} 4 z := (2b -1) • z 0 + b 5 x := z 2 0 2σ 2 max -(z-µ) 2 2σ 2 6 if RS(σ, x) then 7 return z 8 end 9 end
The first step consists in sampling an element with a fixed half Gaussian distribution. The obtained z 0 sample is then transformed into z := (2b -1) • z 0 + b where b is a bit drawn uniformly in {0, 1}. Let us denote by BG σmax the distribution of z. The distribution of z is a discrete bimodal half-Gaussian of centers 0 and 1. More formally, for any z ∈ Z,

BG σmax (z) := 1 2 D Z + ,σmax (-z) if z ≤ 0 D Z + ,σmax (z -1) if z ≥ 1.
(2.40)

Then, to recover the desired distribution D Z,σ,µ for the inputs (σ, µ), one might want to apply the rejection sampling technique presented in Section 2.2.5 and accept z with probability

D Z,σ,µ (z) BG σmax (z) ∝    exp z 2 2σ 2 max -(z-µ) 2 2σ 2 if z ≤ 0 exp (z-1) 2 2σ 2 max -(z-µ) 2 2σ 2 if z ≥ 1 ∝ exp z 2 0 2σ 2 max - (z -µ) 2 2σ 2 .
The element inside the exp is computed in step 5 of Algorithm 13. Next, we also introduce an algorithm denoted RS.

Protecting lattice-based signatures against timing attacks Algorithm 14 -Rejection Sampling for SamplerZ (RS)

-3 -2 -1 0 1 2 3 4 µ ∝ D Z,σ,µ ∝ BG σmax
Data: σ min ≤ σ ≤ σ max , x < 0 Result: a bit b that follows B σ min σ •exp(x) 1 p := σ min σ • exp(x) 2 i := 1 /* Lazy Bernoulli sampling */ 3 repeat 4 i := i • 2 8 5 u $ ← -{0, 2 8 -1} 6 v := p • i & 0xff 7 until u = v 8 return (u < v)
The latter performs the rejection sampling (Algorithm 14): using exp(•), it returns a Bernoulli sample with the according probability. For isochrony matters, detailed in [How+20, Section 6] and highlighted in Section 2.5.5 (in step 1), the acceptance probability is rescaled by a factor σ min σ . As z follows the BG σmax distribution, after the rejection sampling, the final distribution of SamplerZ(σ, µ) is then proportional to σ min σ • D Z,σ,µ , which is, after normalization exactly equal to D Z,σ,µ .

From steps 2 to 8 in Algorithm 14, we present a lazy comparison. In fact, instead of generating a uniform random value in [0, 1] with a high bit-precision, one can generate the randomness 8 bits by 8 bits and make comparisons on the fly. This technique is not constant-time, but it remains isochronous as the number of repetitions does not leak any information about x.

Thus, with this construction, one can derive the following proposition using Lemma 5.

Proposition 4 (Correctness). Let us assume that all the uniform distributions are perfect, then the construction of SamplerZ (in Algorithms 13 and 14) is such that SamplerZ(σ, µ) = D Z,σ,µ .

In practical implementations, one cannot achieve perfect distributions.

Notation

Value for Falcon Calls to sign (as per NIST)

Q s ≤ 2 64 Calls to SamplerZ Q samplZ Q s • 2 • n ≤ 2 75 Calls to D Z + ,σmax Q bs N iter • Q samplZ ≤ 2 76 Calls to exp Q exp Q bs ≤ 2 76

Security statement

Table 2.3 gives the notations for the number of calls to SamplerZ, D Z + ,σmax , exp and the considered values when the sampler is instantiated for Falcon. Due to the rejection sampling in step 9 in Algorithm 13, there will be a (potentially infinite) number of iterations of the while loop. We will show later in Lemma 10, that the number of iterations follows a geometric law of parameter

≈ σ min • √ 2π 2•ρσ max (Z + ) . For the example of Falcon, σ min • √ 2π 2•ρσ max (Z + ) ≤ 2.
The following Theorem estimates the security of SamplerZ.

Theorem 2 (Security of SamplerZ). Consider a cryptosystem, denoted C ideal that makes at most Q s independent queries to SamplerZ. Assume that C ideal is λ-bit secure against a search problem.

Let us consider a copy of the latter cryptosystem, denoted C real , where the only differences are that

• each query to D Z + ,σmax is replaced by a query to a CDT sampler (defined in Section 2.2.4)8 , denoted BaseSampler

• each query to exp() is replaced by a query to a polynomial denoted ApproxExp.

If the two following conditions are respected;

∀x < 0, max ApproxExp(x) -exp(x) exp(x) , ApproxExp(x) -exp(x) 1 -exp(x) ≤ 1 2 • (2 • λ -1) • Q exp (Cond. (1)) R 2•λ-1 BaseSampler, D Z + ,σmax ≤ 1 + 1 4 • Q bs (Cond. (2))
then, C real is (λ -2)-bit secure against the search problem.

Proof: Let us introduce an intermediate case where only the base sampler is modified (the exponential stays a perfect distribution). The 3 cases are defined as follows.

1. (Ideal) an unmodified version of SamplerZ is called 2. (Inter) Only the exponential is considered as perfect.

(Real)

The modified SamplerZ is called.

We first apply Lemma 2 for assessing the bit security of the Inter case. Thanks to Condition (2), we get that λ Inter ≥ λ -1. We then apply Lemma 6 for assessing the bit security of the Real case. Thanks to Condition (1), we get λ Real ≥ λ Inter -1 ≥ λ -2.

To get concrete numerical values, we assume that 256 bits are claimed. For an implementation of Falcon, the numerical values are

1 2 • (2 • λ -1) • Q exp ≈ 2 -43 and 1 4 • Q bs ≈ 2 -78 .

A polynomial approximation again

To achieve condition (1) with ApproxExp, we use again our GALACTICS tool.

sage: load('polynomial_approximation.sage') ....: galactics = GALACTICS_approximation(0, ln(2), 128, 46, 45, "exp(x)") ....: galactics.approximate() Thanks to an Euclidean division optimization similar to Eq. (2.36), this polynomial is enough to validate condition (1). For validating Eq. (2.24), we use the same technique than in Section 2.4.3 and compute an experimental maximum by discretizing [0, ln(2)]. We get

[...] ----------------------- | Final security : 47 | | Max size coeffs : 45 | ---------------------
∀x ∈ [0, ln(2)], exp x 2σ 2 -P I 3 exp (x) 1 -exp x 2σ 2 ≤ 2 -45 .
Flexibility on the implementation of the polynomial. Depending on the platform and the requirement for the signature, one can adapt the polynomial to fit their constraints. For example, if one wants to minimize the number of multiplications, implementing the polynomial with Horner's form is the best option.

The polynomial is written in the following form:

P 1 (x) := a 0 + x(a 1 + x(a 2 + x(a 3 + x(a 4 + x(a 5 + x(a 6 + x(a 7 + x(a 8 + x(a 9 + xa 10 ))))))))).
Evaluating P 1 is then done serially as follows:

y := a 10 y := a 9 + y × x . . . Some architectures enjoy some level of parallelism, in which case it is desirable to minimise the depth of the circuit computing the polynomial9 . Writing P 1 in Estrin's form [START_REF] Estrin | Organization of Computer Systems: The Fixed Plus Variable Structure Computer[END_REF] is helpful in this regard. This writing is denoted P 2 .

y := a 1 + y × x y := a 0 + y × x
x 2 := x × x x 4 := x 2 × x 2 P 3 (x) := (x 4 × x 4 ) × ((a 8 + a 9 × x) + x 2 × a 10 ) + (((a 0 + a 1 × x) + x 2 × (a 2 + a 3 × x)) + x 4 × ((a 4 + a 5 × x) + x 2 × (a 6 + a 7 × x)))
In Table 2.4, we present the different methods with their associated number of multiplications, additions, depth of the circuit and size of the coefficients.

An experimentally derived base sampler

To achieve condition (2) with BaseSampler, we rely on a cumulative distribution table (CDT) as described in Section 2.2.4. Instead of providing 128-bit absolute precision to the table entries (as presented in Section 2.4.5), we propose an experimental alternative. We can derive a table that experimentally verifies Condition (1).

Let a := 2 • λ -1. To derive the parameters w and θ we use a simple script that, given σ max and θ as inputs:

1. Computes the smallest tailcut w such that the Rényi divergence R a between the ideal distribution D Z + ,σmax and its restriction to {0, . . . , w} (noted

D [w],σmax ) verifies R a (D [w],σmax , D Z + ,σmax ) ≤ 1 + 1/(4Q bs );

Rounds the probability density table (PDT) of D [w]

,σmax with θ bits of absolute precision. This rounding is done "cleverly" by truncating all the PDT values except the largest:

• for z ≥ 1, the value D [w],σmax (z) is truncated: P DT (z) = 2 -θ 2 θ D [w],σmax (z) .
• in order to have a probability distribution, P DT (0) = 1 -z≥1 P DT (z).

3. Derives the CDT from the PDT and computes the final R a (SampleCDT w=19,θ=72 , D Z + ,σmax ).

Taking σ max = 1.8205 and θ = 72 as inputs, we found w = 19.

• PDT(0) = 2 -72 × 1697680241746640300030 • PDT(1) = 2 -72 × 1459943456642912959616 • PDT(2) = 2 -72 × 928488355018011056515 • PDT(3) = 2 -72 × 436693944817054414619 • PDT(4) = 2 -72 × 151893140790369201013 • PDT(5) = 2 -72 × 39071441848292237840 • PDT(6) = 2 -72 × 7432604049020375675 • PDT(7) = 2 -72 × 1045641569992574730 • PDT(8) = 2 -72 × 108788995549429682 • PDT(9) = 2 -72 × 8370422445201343 • PDT(10) = 2 -72 × 476288472308334 • PDT(11) = 2 -72 × 20042553305308 • PDT(12) = 2 -72 × 623729532807 • PDT(13) = 2 -72 × 14354889437 • PDT(14) = 2 -72 × 244322621 • PDT(15) = 2 -72 × 3075302 • PDT(16) = 2 -72 × 28626 • PDT(17) = 2 -72 × 197 • PDT(18) = 2 -72 × 1
Our experiment showed that for any a ≥ 511, R a (SampleCDT w=19,θ=72 , D Z + ,σmax ) ≤ 1 + 2 -80 ≤ 1 + 1 4Q bs , which validates condition (2) for the Falcon implementation.

Isochrony statement

In this section, we outline the arguments that prevent Algorithm 13 against timing attacks as defined in Security Model 2. One of the differences with the BLISS Gaussian sampler in Section 2.4.5, is that the standard deviation and center are not public parameters, and some knowledge on their distribution can lead to attacks (see [START_REF] Fouque | Key Recovery from Gram-Schmidt Norm Leakage in Hash-and-Sign Signatures over NTRU Lattices[END_REF]). Therefore, we need to formally prove that it is isochronous with respect to the joint distribution of σ, µ and the output z.

To prove that we introduce two intermediary results. We first cite Lemma 10, which shows that the number of iterations in the while loop of Algorithm 13 is independent of σ, µ, z. Next, we cite Theorem 3 that outlines an intrinsic property of our sampler: it is perfectly isochronous with respect to z and statistically isochronous (for the Rényi divergence) with respect to σ, µ. We refer to [How+20, Section 6] for the detailed proofs of Lemma 10 and Theorem 3 which Thomas Prest should be credited for.

Lemma 10 (Particular case of Lemma 7 of [START_REF] Howe | Isochronous Gaussian Sampling: From Inception to Implementation[END_REF]). For all µ ∈ [0, 1] and σ min ≤ σ ≤ σ max , the number of iterations of the while loop in SamplerZ(σ, µ) (Algorithm 13) follows a geometric law of parameter

P true (σ, µ) ≈ σ min • √ 2π 2 • ρ σmax (Z + )
.

Theorem 3 (Particular case of Theorem 8 of [START_REF] Howe | Isochronous Gaussian Sampling: From Inception to Implementation[END_REF]). Let µ ∈ [0, 1] and σ min ≤ σ ≤ σ max .The running time of SamplerZ(σ, µ) (Algorithm 13) follows a distribution T σ,µ such that, for any ∈ (0, 1),

R a (T σ,µ , T ) 1 + C • a • 2
where C > 0 is a constant and T is a distribution independent of its inputs σ, µ and its output z.

Finally, we introduce a theorem that states the isochrony of a signature using our sampler.

Theorem 4. Consider an adversary A making Q s signature queries against a signature algorithm that uses SamplerZ. Assume that A breaks the security by solving a search problem with success probability 2 -λ for some λ ≥ 1. Learning the running time of each call to SamplerZ does not increase the success probability of A by more than a constant factor.

Proof: We denote by D the publicly available signature distribution. We consider two cases:

• Strong: we give powerful timing attack capabilities to the adversary by allowing her to learn the exact runtime of each call to SamplerZ(σ, µ) without knowing (σ, µ). She then learns the joint distribution (D, (T σ 0 ,µ 0 , . . .

T σ Q-1 ,µ Q-1
)) where Q is the total number of calls to SamplerZ (for Falcon Q = 2nQ s ), T σ,µ denotes the runtime of SamplerZ(σ, µ) (as in Theorem 3) and (σ i , µ i ) are the unknown possibly dependent input parameters of SamplerZ.

• Standard: we assume that the attacker has no access to the runtime of each sampling and thus we can write without loss of generality that she has access to (D, T Q ) where T is a distribution defined in Theorem 3.

P Strong ≤ P Standard • R λ ((D, (T σ 0 ,µ 0 , . . . T σ Q-1 ,µ Q-1 )), (D, T Q ) (λ-1)/λ . (2.41)
Note that D and (T σ 0 ,µ 0 , . . . T σ Q-1 ,µ Q-1 ) are independent, thus

P Strong ≤ P Standard • R λ ((T σ 0 ,µ 0 , . . . T σQ,µQ ), T Q ) (λ-1)/λ . (2.42)
Let us replace by 1 √ λQ in Theorem 3 and get

∀σ ∈ [σ min , σ max ], ∀µ ∈ [0, 1] R λ (T σ,µ , T ) 1 + C Q .
Therefore, we can apply Proposition 2 and get

P Strong P Standard • 1 + C Q Q (λ-1)/λ
(2.43)

2 -λ • 2 • e C .
(2.44)

Applications and limitations

After Thomas Ricosset performed preliminary benchmarks, Thomas Pornin has implemented our sampler as part of the new isochronous implementation of Falcon [START_REF] Pornin | New Efficient, Constant-Time Implementations of Falcon[END_REF]. This implementation can use floating-point hardware or AVX2 instructions when available but also includes floatingpoint emulation code that uses only usual integer operations. On ARM Cortex M4 CPUs, which can only support single-precision floating-point instructions, this implementation provides assembly implementations for the core double-precision floating-point operations more than twice faster than the generic emulation. As a result, our sampler can be efficiently implemented on embedded platforms as limited as Cortex M4 CPUs, while some other samplers (e.g. [START_REF] Karmakar | Pushing the speed limit of constant-time discrete Gaussian sampling. A case study on the Falcon signature scheme[END_REF] due to a huge code size) are not compact enough to fit embedded platforms. The benchmarks of this sampler implementation are performed on a single Intel Core i7-6500U CPU core clocked at 2.5 GHz. In Table 2.5, we present the running times of our isochronous sampler in standard double-precision floating-point and in an AVX2 implementation. To compare with [START_REF] Zhao | Compact and Scalable Arbitrarycentered Discrete Gaussian Sampling over Integers[END_REF], we scale the numbers to be based on 2.5GHz. Note that for our sampler, the number of samples per second is on average for 1.2915 < σ ≤ 1.8502 while for [ZSS19] σ = 2 is fixed.

In Table 2.6, the running times of the Falcon isochronous implementation [Por19] that contains our sampler are presented. One can compare it with a second non-isochronous implementation nearly identical except for the base sampler which is a faster lazy CDT sampler, and the rejection sampling which is not scaled by a constant. Compared to the non-isochronous implementation, the isochronous one is about 22% slower but remains very competitive speed-wise. Cache-timing protection. Following this implementation of the proposed sampler also ensures cache-timing protection [START_REF] Facon | Detecting cache-timing vulnerabilities in post-quantum cryptography algorithms[END_REF], as the design should13 bypass conditional branches by using a consistent access pattern (using linear searching of the table) and have isochronous runtime. This has shown to be sufficient in implementations of Gaussian samplers in Frodo [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF][START_REF] Naehrig | [END_REF].

Advantages and limitations. Our sampler has an acceptance rate ≈ σ min σmax+0.4 making it especially suitable when σ min and σ max are close. In particular, our sampler is, so far, the fastest isochronous sampler for the parameters in Falcon. However, the larger the gap between σ min and σ max , the lower the acceptance rate. In addition, our sampler uses a cumulative distribution table (CDT) which is accessed in an isochronous way. This table grows while σ max grows, while making both running time and memory usage larger. When σ max is large or far from σ min , there exist faster isochronous samplers based on convolution [START_REF] Micciancio | Gaussian Sampling over the Integers: Efficient, Generic, Constant-Time[END_REF] and rejection sampling [ZSS19] 14 techniques.

Perspective 3 (Application of this sampler to other schemes). A natural question is how our algorithms presented in Section 2.5.1 could be adapted for other schemes than Falcon, for example [MP12; DLP14; GM18; Ber+18; CGM19]. An obvious bottleneck seems to be the size of the CDT used in SampleCDT, which is linear in the standard deviation. For larger standard deviations, where linear searching becomes impractical, convolutions can be used to reduce σ, and thus the runtime of the search algorithm [START_REF] Pöppelmann | Enhanced Lattice-Based Signatures on Reconfigurable Hardware[END_REF][START_REF] Khalid | Compact, scalable, and efficient discrete Gaussian samplers for latticebased cryptography[END_REF]. It would also be interesting to see if the tree-based method of [START_REF] Karmakar | Pushing the speed limit of constant-time discrete Gaussian sampling. A case study on the Falcon signature scheme[END_REF] has better scalability than our CDT-based method, in which case we would recommend it for more significant standard deviations. On the other hand, once the base sampler is implemented, we do not see any obvious obstacle for implementing our whole framework. For example, [START_REF] Chen | Approximate Trapdoors for Lattices and Smaller Hash-and-Sign Signatures[END_REF] or using Peikert's sampler [START_REF] Peikert | An Efficient and Parallel Gaussian Sampler for Lattices[END_REF] (in Falcon) entail a small constant number of standard deviations; therefore the rejection step would be very efficient once a base sampler for each standard deviation is implemented. This chapter describes how to protect lattice-based Fiat-Shamir with aborts signature schemes against side-channel attacks with masking. Having studied the joys of masking within my first months in Thales alongside Sonia Belaïd, industrial advisor at that time, this topic has been an important part of this PhD. Her PhD was focused on the theoretical side of the masking countermeasure mostly applied to symmetric cryptography, and she wanted to study its behaviour on lattice signatures. It eventually ended up into the creation of the latmasking working group with Sonia Belaïd, Gilles Barthes, Thomas Espitau, Pierre-Alain Fouque, Mehdi Tibouchi and Benjamin Grégoire. In 2017, we masked our first lattice-based signature scheme [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF]. Even in the comparatively simple case of GLP, the masking was surprisingly challenging. The probabilistic nature of the signature generation, as well as its reliance on rejection sampling, presented difficulties that had not occurred in earlier schemes. We first wanted to avoid the heavy Boolean/arithmetic conversions à la [START_REF] Coron | Secure Conversion between Boolean and Arithmetic Masking of Any Order[END_REF], but they turned out to be necessary. More importantly, we noted that, in this type of signature schemes, some of the intermediate values might be revealed to the attacker without threatening the security. The only drawback was that we needed to assume non-standard assumptions. We also had to make a proof of concept to show how the countermeasure scaled, and we benefited Mehdi Tibouchi's fast implementation skills. Eventually, our work was accepted for publication [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF], and we wanted to study other signature schemes that use more contrived distributions. BLISS [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF] seemed an interesting candidate for this purpose. While dissecting the rejection sampling step of the latter in order to mask it, a new (slight) timing breach has been highlighted. Later, Thomas Espitau and Mehdi Tibouchi set up a new timing attack, and we turned our back to masking at the benefit of protecting BLISS against timing attacks (see Chapter 2). We figured that some of the timing protection techniques could also help for the masking. Eventually, the masking wasn't really the main contribution of the paper which later arose from this work [START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF], but it is, nevertheless, highlighted in this chapter.

Our works led to a different research track started with another PhD student, François Gérard. We wondered about the properties that make a lattice-based signature "maskingfriendly". We ended with our ambitious "Maskarade" project where we wanted to design the perfect masking-friendly lattice-based signature. Finally, our scheme was close to the NIST candidate qTESLA [START_REF] Bindel | [END_REF](except for its key generation) and more reasonably, we preferred to focus on the latter. It was a very interesting study as it went from the masking proofs and parameter choices to the randomness optimization. François Gérard finally implemented the masked version in a very optimized and portable way, and this ended up in a publication in 2019 [START_REF] Gérard | An Efficient and Provable Masked Implementation of qTESLA[END_REF]. In this chapter, as well as in [Bar+18; Bar+19a; GR19], my contribution concerns the theoretical design and proofs of masked algorithms.

Introduction and motivations

As stated in our introductory chapter (Section 1.1.3), certain cryptographic implementations may be vulnerable to physical attacks in addition to black-box attacks or timing attacks. This family of powerful attacks targets the algorithms' practical implementations. For example, an attacker can observe the device's emanations (e.g. temperature, EM radiation) to recover the secret data. As the demands for practical implementations of postquantum cryptographic schemes get more pressing ahead of the NIST postquantum standardization process, understanding the security of those schemes against physical attacks is of paramount importance. However, the implementation of lattice-based primitives poses new sets of challenges as far as side-channel and other physical attacks are concerned. In particular, the reliance on Gaussian distributions, rejection sampling or the number-theoretic transform for polynomial multiplication has shown to open the door to new types of physical attacks for which it is not always easy to propose efficient countermeasures.

For instance, Groot Bruinderink et al. [START_REF] Groot Bruinderink | Flush, Gauss, and Reload -A Cache Attack on the BLISS Lattice-Based Signature Scheme[END_REF] demonstrated a cache attack targeting the Gaussian sampling of the randomness used in BLISS signatures [START_REF] Ducas | Lattice Signatures and Bimodal Gaussians[END_REF], which recovers the entire private key from the side-channel leakage of a few thousand signature generations. Fault attacks have also been demonstrated on all kinds of lattice-based signatures [START_REF] Espitau | Loop-Abort Faults on Lattice-Based Fiat-Shamir and Hash-and-Sign Signatures[END_REF]. In particular, Espitau et al. recover the full BLISS private key using a single fault on the generation of the randomness (and present a similarly efficient attack on GPV-style signatures). Besides, ACM CCS 2017 has featured several papers [Esp+17; PBY17] exposing further sidechannel attacks on BLISS, its variant BLISS-B, and their implementation in the strongSwan VPN software. They are based on a range of different side channels (cache attacks, simple and correlation electromagnetic analysis, branch tracing, etc.), and some of them target new parts of the signature generation algorithm, such as the rejection sampling.

This chapter proposes to apply the so-called masking countermeasure to lattice-based Fiat-Shamir with aborts signatures to prevent side-channel attacks. It presents the results of [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF], [START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF] and [START_REF] Gérard | An Efficient and Provable Masked Implementation of qTESLA[END_REF] in a combined way with a unified framework. We first briefly present the technical context in Sections 3.1.1 and 3.1.2. Then, in Section 3.2, we present the new security notions first introduced in [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] along with an updated list of gadgets and techniques that are necessary for masking (taking the follow-ups into account). In Section 3.3, we show how they can be applied to GLP. In Section 3.4, we show that this could be extended to BLISS. Finally, in Section 3.5, we present the last masking contribution to the NIST candidate qTESLA.

The masking countermeasure

The masking countermeasure, which performs computations on secret-shared data, appears as a natural countermeasure in the side-channel landscape. It is actually the most deployed one. Simultaneously introduced by Goubin and Patarin in [START_REF] Goubin | DES and Differential Power Analysis (The "Duplication" Method)[END_REF] and Chari et al. [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF], it consists of randomizing the sensitive data which depend on the secret values and known variables. Each secret input x is basically split into d + 1 variables (x i ) 0≤i≤d referred to as shares: d of them are generated uniformly at random whereas the last one is computed such that their additive combination reveals the secret value x. The integer d is called masking order. This technique has been widely applied in prequantum cryptography. Let us introduce two types of additive combinations in the following definition.

Definition 4 (Arithmetic and Boolean masking). A sensitive value x ∈ Z is shared with mod q arithmetic masking if it is split into d + 1 shares (x i ) 0≤i≤d with the same bit-size such that

x = x 0 + • • • + x d (mod q).
(Arithmetic masking mod q)

It is shared with Boolean masking if it is split into d + 1 shares (x i ) 0≤i≤d with the same bit-size such that

x = x 0 ⊕ • • • ⊕ x d . (Boolean masking)
We sketch here why the masking is a sound technique to prevent side-channel attacks. If the device leaks information on one manipulated variable at a time, a d-order masking generally resists to stronger attacks that can combine information on at most d points of measure. In particular, the authors of [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF] have shown that the number of measurements required to mount a successful differential power consumption attack (presented in Section 1.1.3) increases exponentially with the number of shares. Their model was considering the very classical case where each manipulated bit is leaking the sum of its value and a Gaussian noise. Therefore, the masking order represents a trade-off between security and efficiency. In practice, most masked schemes are in first-order (i.e. with two shares) or second-order (i.e. with three shares).

While the conceptual idea behind the masking countermeasure is pretty simple, implementing a fully shared algorithm has shown to be a complex task. Although it is straightforward on linear operations on which masking is equivalent to applying the original operation on each share of the sensitive data, the procedure is much more complicated on non-linear functions. Let us first introduce the generic model before explaining how to build proofs.

The ISW model

Theoretical leakage models have been introduced in order to reason correctly on the security of implementations exposed to side-channel attacks. These models followed the observation of [START_REF] Chari | Towards Sound Approaches to Counteract Power-Analysis Attacks[END_REF] that the combination of an increasing number of noisy variables exponentially increases the difficulty of an attack. The idea of a model where the attacker receives a fixed number of variables would correspond to a case where the attacker is only able to combine a fixed number of intermediate variables because of the measurement noise. These models provide proof frameworks for checking that every sensitive intermediate value is always protected. The probing model or ISW model from its inventors [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF] is undoubtedly the most deployed. Throughout all this chapter, we fix d ≥ 0 corresponding to the masking order.

Definition 5 (ISW model). A cryptographic implementation is d-probing secure iff the joint distribution of any set of at most d intermediate variables is independent of the secrets.

Informally, an algorithm is secure in the d-probing model if an attacker has a negligible probability of breaking the security with the knowledge of the public data and with access to d intermediate variables of his choice. This model is convenient to prove the security of an implementation as it manipulates finite sets of exact values. However, at first sight, this model does not seem to reflect the reality of the physical attacks as the latter need noisy leakage models. In 2014, the reduction established in [START_REF] Duc | Unifying Leakage Models: From Probing Attacks to Noisy Leakage[END_REF] allowed to relate the d-probing security to a side-channel security up to a certain level of noise. We will, therefore, exclusively consider the d-probing security in this thesis.

Signature security property

In this thesis, we consider the masking protection of signature schemes in their general security model. However, the EUF-CMA security definition (as described in Security Model 1 in Section 2.1) does not capture any physical attacker. The goal of the following definition is to design a stronger security property combining EUF-CMA and physical guaranties. It can be seen as a d-probing model counterpart of the "EUF-CMA in the isochronous model" notion introduced in Section 2.2.1 in the context of timing security1 . Definition 6. A KeyUpdate algorithm is defined as an algorithm that takes a shared private key (sk i ) 0≤i≤d as input and outputs another shared private key (sk i ) 0≤i≤d such that i sk i = i sk i mod q if the sharing is arithmetic or i sk i = i sk i if the sharing is Boolean. The KeyUpdate algorithm is necessary for the in-between signature queries because an attacker could make d probes for each signature generation which uses (sk i ) 0≤i≤d . Typically, the KeyUpdate will be a naive refreshing (see Algorithm 21).

Security Model 3. Let Q be a fixed maximum amount of signature queries. A signature scheme (KeyGen, Sign, Verify) with signing key update algorithm KeyUpdate is EUF-CMA-secure in the d-probing model if any probabilistic polynomial time adversary has a negligible probability of winning the Security Game 3.

If a EUF-CMA signature scheme (KeyGen, Sign, Verify) is such that its algorithms KeyGen(•) and Sign(•) are d-probing secure, according to Definition 5, then one can prove that the signature scheme is EUF-CMA-secure in the d-probing model with a naive refreshing KeyUpdate. This proof will be later detailed for GLP signature scheme in Theorem 8.

Remark 4. Security Model 3 assumes that the attacker does not get any leakage during the KeyUpdate. In this model, the KeyUpdate is not part of the signing procedure. Another definition could assume that the attacker also gets leakage during the KeyUpdate. In this alternative definition, the total number of observations should be bounded by d. In other words, instead of the condition ∀i ∈ {1, . . . , Q}, |O

Adversary Challenger

(KeyGen,Sign,Verify,KeyUpdate)

←------------------- O KeyGen ----→ pk, L KeyGen ←------- (sk, pk), L KeyGen ← ExecObs(O KeyGen , KeyGen, 1 λ ) Q queries                                m (1) , O (1) Sign ------→ σ (1) , L (1)
Sign ← ExecObs(O (1)
Sign , Sign, sk, m (1) )

σ (1) , L (1) Sign ←------ sk ← KeyUpdate(sk) . . . m (Q) , O (Q) Sign ------→ σ (Q) , L (Q) Sign ← ExecObs(O (Q) Sign , Sign, sk, m (Q) ) σ (Q) , L (Q) Sign ←------ sk ← KeyUpdate(sk) forgery m * , σ * ----→ b := Verify(pk, m * , σ * ) ∧ (m * / ∈ {m (1) , . . . , m (Q) })∧ ∧|O KeyGen | ≤ d ∧ ∀i ∈ {1, . . . , Q}, |O (i) Sign | ≤ d Security Game 3: d-probing EUF-CMA game.
ExecObs is a universal Turing machine that takes as input a series of observations O * , an algorithm and several possible arguments. It returns the output of the algorithm on those arguments, together with the leakage values L * corresponding to the desired observations.

Probing security and gadgets

Any algorithm is not directly easy to prove d-probing secure according to Definition 5 and Security Model 3. For instance, in non-linear operations, the mixture of shares to compute the result makes it mandatory to introduce random variables and the bigger the program is, the more dependencies to be considered. For example, in [START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF], Rivain and Prouff introduced a masked algorithm SecMult for multiplying two shared integers. Unfortunately, one case was missing in the proof and the latter could not be easily patched. That is why Barthe et al. formally defined in [START_REF] Barthe | Strong Non-Interference and Type-Directed Higher-Order Masking[END_REF] two security properties, both stronger than Definition 5, namely non-interference (Definition 8) and strong non-interference (Definition 9). The key idea is to detail and quantify the statement "independent from the secret" of Definition 5 by numbering dependencies in terms of shares of the inputs and outputs. That way, introducing these properties eases the security proofs because (1) one can focus on proving the properties on small parts of the algorithms, and (2) one can securely compose the bricks together and inserting refreshing gadgets (which refresh sharings using fresh randomness) if necessary at carefully chosen locations2 .

Algorithm inputs outputs

Gadget decomposition inputs outputs A (u, v)-gadget is a probabilistic algorithm that takes as inputs u shared values and returns distributions over v-tuples of shared values. (u, v)-gadgets are used to implement functions that take u inputs and produce v outputs.

Gadgets will be typically written in pseudo-code as they represent sub-parts of larger algorithms. We now turn to the definition of probing security for gadgets.

Definition 8. d-non-interference (d-NI):

A gadget is d-non-interfering if and only if the joint distribution of every set of at most d intermediate variables, corresponding to probes, depends on at most d shares of each input. We also say that every set of at most d intermediate variables can be perfectly simulated with at most d shares of each input.

Example 3.1.1. Consider a multiplication algorithm that takes two shared values

(a 0 , a 1 , a 2 ), (b 0 , b 1 , b 2 ) ∈ [0, 255] 3 . We want to compute (c 0 , c 1 , c 2 )∈ [0, 255] 3 such that c 0 ⊕ c 1 ⊕ c 2 = (a 0 ⊕a 1 ⊕a 2 )∧(b 0 ⊕b 1 ⊕b 2 )
. Gadget 1 (a particular case of sec& in Gadget 3 that will be described below) is an example of achieving 2-NI security. Let us consider several pairs of intermediate values. The joint distribution of (r 0,1 , r 1,0 ) for instance follows

{(u, u ⊕ a 0 b 1 ⊕ a 1 b 0 ) : u $ ← -[0, 255]},
which only depends on a 0 , a 1 and b 0 , b 1 (two shares of each input). The joint distribution of

(r 2,1 , c 0 ) is {(u, v) : u, v $ ← -[0,
255]}, which does not depend on any of the inputs. Gadget 2 is functionally equivalent but it is not 2-NI secure. The pair (r 0,1 , r 1,0 ) can be simulated with at most two shares of each input whereas the pair (r 0,2 , c 2 ) cannot. Indeed, its joint distribution

is {(u, u ⊕ a 0 b 2 ⊕ a 2 b 0 ⊕ a 2 b 2 ⊕ a 1 b 2 ⊕ a 2 b1) : u $ ← -[0,
255]}, which depends on 3 shares of each input. It is not even 1-NI because c 1 cannot be simulated with one share of each. We can see that d-SNI implies d-NI, which implies d-probing security if the masking is uniform. The d-SNI property is mostly needed for the refreshing gadgets. The latter are crucial in an implementation as they regenerate the sharing using fresh randomness. We now introduce the affine property for gadgets as introduced in [START_REF] Barthe | Strong Non-Interference and Type-Directed Higher-Order Masking[END_REF]. Definition 10. A gadget is affine if and only if it manipulates its input share by share.

Gadget 1 -Example d-NI ∧ Data: (a 0 , a 1 , a 2 ), (b 0 , b 1 , b 2 ) ∈ [0, 255] 3 Result: (c 0 , c 1 , c 2 ) ∈ [0, 255] 3 1 r 0,1 , r 0,2 , r 1,2 $ ← -[0, 255] 2 r 1,0 := (r 0,1 ⊕ a 0 b 1 ) ⊕ a 1 b 0 3 r 2,0 := (r 0,2 ⊕ a 0 b 2 ) ⊕ a 2 b 0 4 r 2,1 := (r 1,2 ⊕ a 1 b 2 ) ⊕ a 2 b 1 5 c 0 := a 0 b 0 ⊕ (r 0,1 ⊕ r 0,2 ) 6 c 1 := a 1 b 1 ⊕ (r 1,0 ⊕ r 1,2 ) 7 c 2 := a 2 b 2 ⊕ (r 2,0 ⊕ r 2,1 ) 8 return (c 0 , c 1 ) Gadget 2 -Example Incorrect ∧ Data: (a 0 , a 1 , a 2 ), (b 0 , b 1 , b 2 ) ∈ [0, 255] 3 Result: (c 0 , c 1 , c 2 ) ∈ [0, 255] 3 1 r 0,1 , r 0,2 $ ← -[0, 255] 2 r 1,0 := (r 0,1 ⊕ a 0 b 1 ) ⊕ a 1 b 0 3 r 2,0 := (r 0,2 ⊕ a 0 b 2 ) ⊕ a 2 b 0 4 r 2,1 := a 1 b 2 ⊕ a 2 b 1 5 c 0 := a 0 b 0 ⊕ (r 0,1 ⊕ r 0,2 ) 6 c 1 := a 1 b 1 ⊕ r 1,0 7 c 2 := a 2 b 2 ⊕ (r 2,0 ⊕ r 2,
In other words, one observation in an affine gadget can be simulated with only one share of its input. This property will be used for compositions.

The maskComp tool.

For certain composition proofs, we will use the maskComp tool from Barthe et al. [START_REF] Barthe | Strong Non-Interference and Type-Directed Higher-Order Masking[END_REF]. Mehdi Tibouchi was the one handling this tool. It uses a type-based information flow analysis with cardinality constraints and ensures that the composition of gadgets is d-NI secure at arbitrary orders, by inserting refresh gadgets when required.

Examples of gadgets

Many gadgets are necessary to mask an implementation : multiplication, refreshings, linear operations, unmasking... Let us describe some gadgets existing in the literature. We first introduce a basic gadget that generalizes Gadget 1. sec& Logical and: This gadget is denoted sec&. It computes the logical and between two values given in a Boolean masked form (x i ) 0≤i≤d and (y i ) 0≤i≤d , the output (z i ) 0≤i≤d , also in a Boolean masked form is such that

( i z i ) = ( i x i )∧( i y i ). A d-NI masked algorithm has been introduced in [ISW03; RP10]. It is detailed in Gadget 3.
Gadget 3 -Bitwise AND of Boolean maskings (sec&) Data: Boolean maskings (x i ) 0≤i≤d , (y i ) 0≤i≤d of integers x, y; the bit size w of the masks Result: A Boolean masking (z i ) 0≤i≤d of x ∧ y (z i ) 0≤i≤d := (x i ∧ y i ) 0≤i≤d for i = 0 to d do for j = i + 1 to d do pick a uniformly random w-bit value r ij

r ji := (x i ∧ y j ) ⊕ r ij r ji := r ji ⊕ (x j ∧ y i ) z i := z i ⊕ r ij z j := z j ⊕ r ji end end return (z i ) 0≤i≤d
Let us consider now the refreshing gadget. It has been originally introduced in [START_REF] Ishai | Private Circuits: Securing Hardware against Probing Attacks[END_REF].

Ref ⊕
Full Refreshing: Refreshes a Boolean sharing (x i ) 0≤i≤d using fresh randomness. It is denoted Ref ⊕ [Cor14, Algorithm 4] and is made of a succession of d + 1 linear refresh operations. The output, (z i ) 0≤i≤d , is still such that ( i z i ) = ( i x i ). The details of this gadget are in Gadget 4.

Gadget 4 -Refresh algorithm (Ref ⊕ )

Data: A Boolean masking (x i ) 0≤i≤d of some value x; the bit size w of the returned masks Result: An independent Boolean masking (z i ) 0≤i≤d of x (z i ) 0≤i≤d := (x i ) 0≤i≤d for i = 0 to d do for j = 1 to d do pick a uniformly random w-bit value r

z 0 := z 0 ⊕ r z j := z j ⊕ r end end return (z i ) 0≤i≤d
In the literature, mask conversion gadgets exist; these gadgets allow to switch from one type of masking to another type of masking. A first-order masked algorithm of this type has been introduced in [START_REF] Goubin | A Sound Method for Switching between Boolean and Arithmetic Masking[END_REF] and a generic version with order d masked algorithm has been introduced in [START_REF] Coron | Secure Conversion between Boolean and Arithmetic Masking of Any Order[END_REF]. We adapted them to the lattice setting where the modulus is not always a power of two and the algorithms are presented in Appendix A.

Finally, we present a gadget that allows to remove the sharing of a data (i.e. to unmask). It is of particular use in signature schemes where the output can be public.

Full⊕

Securely unmasking: This gadget is denoted Full⊕. It securely refreshes and unmasks an element (x i ) 0≤i≤d given in Boolean masking form. It outputs z such that z = ( i x i ). This gadget has been introduced and proved d -NI in [START_REF] Coron | Secure Conversion between Boolean and Arithmetic Masking of Any Order[END_REF], it is presented in Gadget 5. We write the security property of Full⊕ in Lemma 11.

Gadget 5 -Refresh-and-unmask algorithm (Full⊕) from [START_REF] Coron | Secure Conversion between Boolean and Arithmetic Masking of Any Order[END_REF] Data: A Boolean masking (x i ) 0≤i≤d of some value x; the bit size w of the masks Result: z, the unmasked value x

1 (z i ) 0≤i≤d ← Ref ⊕ ((x i ) 0≤i≤d , w) 2 z := x 0 ⊕ ... ⊕ x d 3 return z Lemma 11 ([CGV14]). Full⊕ is d-NI secure.
Proof: Full⊕ is composed of a d-SNI secure refreshing Ref ⊕ (made of d+1 linear refreshings inside the loop in Step 2) of the shares and of a Boolean addition of these resulting shares. The attacker is not able to observe an intermediate variable in all the linear refreshings (since she only has δ ≤ d available observations). Thus, we consider that the i th refreshing is left unobserved. As a consequence, all the following observations are independent of x's share except for their sum. That is, Full⊕ is d-NI secure.

New techniques for masking lattice-based signatures

In order to protect against physical attacks, one would legitimately like to apply the masking countermeasure to lattice-based cryptography. High order masking can be done quite efficiently and has been applied to the decryption procedure of some lattice-based encryption schemes. Nonetheless, the much more difficult case of lattice-based signatures has not been considered until now despite the obvious need for protection. The "masking unfriendly" operations of lattice-based signature schemes are: hard-to-protect implementations of Gaussian distributions and rejection sampling (this technique has been presented in Chapter 2 in Section 2.2.5). For example, the sampling of the Gaussian randomness often involves either very large lookup tables, which are expensive to mask efficiently. The bad news is that most lattice-based signature schemes contain either Gaussian distributions, rejection sampling or both.

A new security property for lattice-based signature schemes

A new security property must be introduced to reason on the security of lattices-based schemes in which some intermediate variables may be revealed to the adversary. Intuitively, a gadget with public outputs O is d-non-interfering with public outputs (d-NIo) iff every set of at most d intermediate variables can be perfectly simulated with at most d shares of each input and the public outputs O. The idea here is not to state that public outputs do not leak sensitive information, but rather that the masked implementation does not leak more information than the one that is released through public outputs. We capture this intuition by letting the simulator depend on the distribution of the public outputs.

Definition 11. A gadget with public outputs is a gadget together with a distinguished subset of intermediate variables whose values are broadcasted during execution.

We now turn to the definition of probing security for gadgets with public outputs. This lemma states that a gadget that does not leak any information also does not leak more information than the one revealed by a subset of its intermediate variables.

Remark 5. Let G be a d-NIo-gadget as described in Definition 12. When the subset O G is also part of the returned values, the algorithm is considered d-NI and not d-NIo because the outputs were already available to the attacker in the first place. However, if the gadget G is a part of the composition of another larger gadget G and if the subset of O G does not appear in the returned values of G , its unmasked returned values are effectively considered as public outputs.

Since d-NIo security is weaker than d-NI security, we must justify that it delivers the required security guarantee. This is achieved by combining the proofs of security for a modified version of the signature scheme that returns the public outputs, and the proofs of correctness and security for the masked version. To sum up, for a correct masking proof for lattice-based signature, one needs • probing security proofs for all the gadgets;

• a proof of composition for the whole algorithm;

• a proof of security for a modified version of the signature scheme that returns the public outputs.

Design of new Gadgets

As shown in the previous section, a complete proof of masking seems tedious to provide as many proofs are necessary. The good news is that many gadgets are applicable to several signature schemes. Therefore, the proof for the gadgets can be done, once and for all, and then be applied to all signature schemes. Thus, only the composition proof remains for each scheme. In the following, we list all the necessary gadgets for masking lattice-based signature schemes. Some gadgets enjoy proofs generated with the maskComp tool [START_REF] Barthe | Strong Non-Interference and Type-Directed Higher-Order Masking[END_REF]. The other gadgets were easily proved thanks to the composability of the NI and SNI properties.

To avoid overloading this chapter, we do not present all the 14 gadgets that were designed and proved during the thesis. We only present some representative ones in Sections 3.2.3 and 3.2.4. However, a contribution of this thesis is (1) to unify and exhaust all the tools necessary to mask lattice-base Fiat-Shamir with aborts signature and (2) give graphical intuition of the composition proofs. Thus, the other gadgets are still presented in Appendix A. In Table 3.1; we gather all the gadgets introduced during this thesis along with their input and output description, their action, their security property, the reference to their algorithm and to their security proof. Boolean

(z i ) Boolean ( i z i ) = ( i x i ) d - SNI Gadget 4 [Cor14, Alg. 4] Ref +q (x i ) Arithmetic (z i ) Arithmetic ( i z i mod q) = ( i x i mod q) d - SNI see Gadget 4 same as [Cor14, Alg. 4] sec& (x i ), (y i ) Boolean (z i ) Boolean ( i z i ) = ( i x i ) ∧ ( i y i ) d - NI Gadget 3 [ISW03; RP10] Full⊕ (x i ) Boolean z unmasked z = ( i x i ) d - NI Gadget 5
Lemma 11

Full+ q (x i ) Arithmetic z unmasked z = ( i x i mod q) d - NI same as Lemma 11 MAdd (x i ), (y i ) Arithmetic a unmasked (z i ) Arithmetic i z i = a i x i + i y i mod q d - NI Gadget 6 Lemma 13 sec + (x i ), (y i ) Boolean (z i ) Boolean ( i z i ) = ( i x i ) + ( i y i ) d - NI Gadget 8
Lemma 14

sec +q (x i ), (y i ) Boolean (z i ) Boolean ( i z i ) = ( i x i )+( i y i ) mod q d - NI Gadget 7
Lemma 14

A q B (x i ) Arithmetic (z i ) Boolean ( i z i ) = ( i x i mod q) d -

SNI

Gadget 13 (simple) Gadget 14 (recur.)

Lemma 23

B A q (x i ) Boolean (z i ) Arithmetic ( i z i mod q) = ( i x i ) d - SNI Gadget 15
Lemma 24 sec|.|

(x i ) Boolean (z i ) Boolean ( i z i ) = | i x i | d - NI Gadget 16
Lemma 25

UGen - In the lattice setting, the sharings are often written in arithmetic mod q masked form. We then extend the definition of Ref ⊕ for this operation.

(z i ) Arithmetic the distribution of ( i z i mod q) is uniform d - NIo Gadget 9 (int

Ref +q

Full Arithmetic Refreshing: Denoted Ref +q , this gadget refreshes an arithmetic mod q sharing (x i ) 0≤i≤d using fresh randomness. The output, (z i ) 0≤i≤d , is such that ( i z i mod q) = ( i x i mod q). The algorithm is the same as Gadget 4 with a + mod q in the steps 5 and 6. The security proof holds; it is d-SNI.

Full+q

Full Addition: This gadget is denoted Full+ q . It sums the shares of a masked arithmetic input (x i ) 0≤i≤d . The output z is such that z = ( i x i mod q). The algorithm is the same as Gadget 5 with a Ref +q instead of Ref ⊕ and + mod q instead of ⊕. The security proof holds; it is d-NI.

Multiplication and Addition

MAdd

Multiply and add: This gadget is denoted MAdd. It performs the addition of masked arithmetic inputs (x i ) 0≤i≤d and (y i ) 0≤i≤d with a multiplication with an unmasked input a. It outputs (z i ) 0≤i≤d , arithmetically masked such that i z i = a i x i + i y i mod q. Given in Gadget 6; this algorithm is straightforwardly d-NI as proved in Lemma 13.

Gadget 6 -Multiplication and Addition (MAdd) We build the set I as follows: For each v ∈ (v 1 , ..., v δ ), there exists i ∈ [0, d] such that the value v can be written of the form z i , x i , ax i or y i and we include such a i in I. The later set contains thus at most δ indices. Besides, by construction, we can simulate each v ∈ (v 1 , ..., v δ ) with the corresponding share of the inputs. In the end, any set of δ ≤ d intermediate variables can be perfectly simulated with at most δ shares of each sensitive input. This is enough to prove that MAdd is d-NI secure.

Data: a, (x i ) 0≤i≤d , (y i ) 0≤i≤d 1 for 0 ≤ i ≤ d do

Modular addition sec +q

Modular addition: This gadget is denoted sec +q . It performs the addition mod q of two Boolean masked inputs (x i ) 0≤i≤d and (y i ) 0≤i≤d . It outputs

(z i ) 0≤i≤d such that ( i z i ) = ( i x i ) + ( i y i ) mod q.
The algorithm is given in Gadget 7, it uses another Gadget 8 as a subroutine.

Gadget 7 -Mod-q addition of Boolean maskings (sec +q )

Data: Boolean maskings (x i ) 0≤i≤d , (y i ) 0≤i≤d of integers x, y; the bit size w of the masks (with 2 w > 2q) Result: A Boolean masking (z i ) 0≤i≤d of x + y mod q 1 if q is a power of two then

2 (z i ) 0≤i≤d ← sec + ( (x i ) 0≤i≤d , (y i ) 0≤i≤d , w 3 return (z i ∧ (q -1)) 0≤i≤d 4 else 5 (q i ) 0≤i≤d := 2 w -q, 0, . . . , 0 6 (s i ) 0≤i≤d ← sec + (x i ) 0≤i≤d , (y i ) 0≤i≤d , w 7 (s i ) 0≤i≤d ← sec + (s i ) 0≤i≤d , (q i ) 0≤i≤d , w 8 (b i ) 0≤i≤d := s i (w -1) 0≤i≤d 9 (b i ) 0≤i≤d ← Ref ⊕ (b i ) 0≤i≤d , w 10
(z i ) 0≤i≤d ← sec& (s i ) 0≤i≤d , (b i ) 0≤i≤d , w 11 (b i ) 0≤i≤d ← Ref ⊕ (b i ) 0≤i≤d , w 12
(z i ) 0≤i≤d ← (z i ) 0≤i≤d ⊕ sec& (s i ) 0≤i≤d , (¬b i ) 0≤i≤d , w 13 return (z i ) 0≤i≤d 14 end
Gadget 8 -Integer addition (sec + ) Data: Boolean maskings (x i ) 0≤i≤d , (y i ) 0≤i≤d of integers x, y; the bit size w of the masks Result: A Boolean masking

(z i ) 0≤i≤d of x + y 1 (p i ) 0≤i≤d := (x i ⊕ y i ) 0≤i≤d 2 (g i ) 0≤i≤d ← sec& (x i ) 0≤i≤d , (y i ) 0≤i≤d , w 3 for j = 1 to W := log 2 (w -1) -1 do 4 pow := 2 j-1 5 (a i ) 0≤i≤d := (g i pow) 0≤i≤d 6 (a i ) 0≤i≤d ← sec& (a i ) 0≤i≤d , (p i ) 0≤i≤d , w 7 (g i ) 0≤i≤d := (g i ⊕ a i ) 0≤i≤d 8 (a i ) 0≤i≤d := (p i pow) 0≤i≤d 9 (a i ) 0≤i≤d ← Ref ⊕ (a i ) 0≤i≤d , w 10
(p i ) 0≤i≤d ← sec& (p i ) 0≤i≤d , (a i ) 0≤i≤d , w 11 end 12 (a i ) 0≤i≤d := (g i 2 W ) 0≤i≤d 13 (a i ) 0≤i≤d ← sec& (a i ) 0≤i≤d , (p i ) 0≤i≤d , w 14 (g i ) 0≤i≤d := (g i ⊕ a i ) 0≤i≤d 15 (z i ) 0≤i≤d := x i ⊕ y i ⊕ (g i 1) 0≤i≤d
For the non-power of two particular case, the approach is to first compute (s i ) = sec + (x i ), (y i ) , which is a Boolean sharing of the sum s = x + y without modular reduction, and then (s i ) 0≤i≤d = sec + (s i ) 0≤i≤d , (q i ) 0≤i≤d for a Boolean masking (q i ) 0≤i≤d of the value -q in two's complement form (or equivalently 2 w -q). The result is a masking of s = s -q in two's complement form. In particular, we have s ≥ q if and only if the most significant bit b of s is 0. Denote by z the desired modular addition x + y mod q. We thus have:

z = s if b = 1; s if b = 0.
As a result, we can obtain the masking of z in a secure way as:

(z i ) 0≤i≤d = sec& (s i ) 0≤i≤d , (b i ) 0≤i≤d ⊕ sec& (s i ) 0≤i≤d , (¬b i ) 0≤i≤d .
We consider signed integers, so the in step 4 is an arithmetic shift and actually writes the sign bit in the whole register. This concludes the description of sec +q .

Lemma 14. Gadgets sec + and sec +q are d-NI secure.

Proof: Gadget sec + is built from the Kogge-Stone adder of [START_REF] Coron | Conversion from Arithmetic to Boolean Masking with Logarithmic Complexity[END_REF] with secure AND and secure linear functions such as exponentiations and Boolean additions. As to ensure its security with the combination of these masked atomic functions, the tool maskComp was used to insert the mandatory d-SNI refreshings (Ref ⊕ ) properly. As deeply explained in its original paper, maskComp provides a formally proven d-NI secure implementation.

Gadget sec +q is built from the gadget sec + and sec& and linear operations (like ⊕). We also use the tool maskComp to generate a verified implementation automatically. Note that the tool automatically adds the two refreshes (lines 9 and 11) and provides a formally proven d-NI secure implementation.

Remark 6. This arbitrary modulus version is quite expensive when q is not a power of two as it uses sec + , Ref ⊕ and sec& twice. Nevertheless, the modulus of the arithmetic masking is fixed by the scheme parameters. Then, for a "masking friendly" design, we will see that choosing a power of two for the modulus when it is possible allows a significant speedup. In Section 3.3, we keep the non-power of two moduli, and in Section 3.5 we make such a trade-off.

Some new large gadgets

In this subsection, we define gadgets that can be generalized for polynomials in R q (defined in Eq. (1.3)) where q is a modulus and n is an integer. For a polynomial p ∈ R q , we will denote by p (i) its i-th coefficient represented in a centered manner p (i) ∈ {-q/2, . . . q/2-1}.

Definition 13. For an integer k such that 0 < k ≤ (q -1)/2, we denote by R q,k the elements of R q (defined in Eq. (1.3)) with coefficients in the range [-k, k].

Generate a polynomial uniformly in a ring

In many lattice-based signature schemes, polynomials are sampled such that their coefficients are sampled uniformly and independently from an integer interval of the form

[-k, k].
In most cases, one would like to obtain those values in masked form, using orderd arithmetic masking modulo q. Note that since all of these coefficients are completely independent, the problem reduces to obtaining an order-d mod-q arithmetic masking of a single random integer in [-k, k]Accordingly, we will first create an algorithm called UGen-Coeff, which generates an order-d mod-q arithmetic masking of a single random integer in [-k, k]. Next, we will use UGen-Coeff in an algorithm called UGen, which generates a sharing of a value in R q (defined in Eq. (1.3)). UGen is calling UGen-Coeff n times and is described in Gadget 10. UGen-Coeff is described hereafter and will be given in Gadget 9. The design of this gadget has been improved in this thesis since its paper version [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF].

UGen

Uniform Generation: This gadget denoted UGen-Coeff in its coefficient version and UGen in its polynomial version outputs (z i ) 0≤i≤d in mod q arithmetic masked form such that the distribution of ( i z i mod q) is uniform. It is described in Gadget 9 and Gadget 10.

Gadget 9 -Uniform data generation for integers (UGen-Coeff) Data: k Result: A uniformly random integer in [-k, k] in mod-q arithmetic masked form (z i ) 0≤i≤d . 1 Let w 0 be the smallest integer such that 2 w 0 > |K| where K := -2k -1 2 Generate uniformly random w 0 -bit values

(x i ) 0≤i≤d 3 initialize (k i ) 0≤i≤d := (K, 0, • • • , 0) 4 (δ i ) 0≤i≤d ← sec + (x i ) 0≤i≤d , (k i ) 0≤i≤d 5 (b i ) 0≤i≤d := (δ i ) 0≤i≤d
(w 0 -1)

6 b := Full⊕ (b i ) 0≤i≤d 7 if b = 0 then 8 Goto 2 9 end 10 z i ← B A q ((x i ) 0≤i≤d , q) 11 z 0 := a 0 -k 12 return (z i ) 0≤i≤d
Gadget 10 -Uniform data generation (UGen) Data: k and d Result: A uniformly random polynomial z in R q,k in arithmetic masked form

(z i ) 0≤i≤d . 1 (z i ) 0≤i≤d := {0} d 2 for j = 0 to n -1 do 3 (a i ) 0≤i≤d ← UGen-Coeff(k, d) 4 (z i ) 0≤i≤d := (z i + a i X j ) 0≤i≤d 5 end 6 return (z i ) 0≤i≤d
Lemma 15. Gadget UGen-Coeff is d-NIo secure with public output b.

Proof: Here we need to ensure that the returned shares of z cannot be revealed to the attacker through a d-order side-channel attack. The gadget xGen represents Step

xGen sec + Full⊕ (K, 0, • • • , 0) B Aq if b = 1 (x i ) 0≤i≤d (δ i ) 0≤i≤d (b i ) 0≤i≤d b = 0 b = 1 (z i ) 0≤i≤d Figure 3.4: Randomness Generation UGen-Coeff 2.
It is just a random generation of shares. The idea is to prove that any set of δ ≤ d observations on UGen-Coeff can be perfectly simulated with at most δ shares of x.

Gadget UGen-Coeff is built with no cycle. In this case, from the composition results of [START_REF] Barthe | Strong Non-Interference and Type-Directed Higher-Order Masking[END_REF], it is enough to prove that each sub-gadget is d-NI to achieve global security.

From Lemmas 14 and 23, sec + and A q B are d-NI secure. is trivially d-NI secure as well since it applies a linear function. Besides, gadget Full⊕ is d-NI secure with Lemma 11, and its output is unmasked and thus considered as a public output of UGen-Coeff.

Corollary 1. Gadget UGen is d-NIo secure with public output b.

Proof: From Lemma 15, Gadget UGen is d-NIo secure since it only consists of the linear application of Gadget UGen-Coeff to build the polynomial coefficients.

Fixed center, fixed standard deviation Gaussian Generation

This gadget is needed for generating Gaussian samples. We mask the technique of cumulative distribution table (CDT) explained in Chapter 2 in Section 2.2.4 with D = |D Z,σ |. We recall that it consists in precomputing a table of the cumulative distribution function of |D Z,σ | with a certain precision θ. To produce a sample, we generate a random value in (0, 1] with the same precision, and return the index of the last entry in the table that is smaller than that value.

GGenσ

Gaussian Generation: This gadget denoted GGen σ -Coeff in its coefficient version and GGen σ in its polynomial version outputs (z i ) 0≤i≤d such that the distribution of ( i z i mod q) is Gaussian of standard deviation σ. It is presented in Gadget 11 and Gadget 12.

We present the masked version of table lookup in Gadget 11. The parameters w and θ are respectively the number of elements of the table and the bit precision of its entries. Gadget 11 follows Algorithm 2 in a masked form. The steps 4 to 6 compute (b i ) 0≤i≤d a masked form of the bit representing (t j > u). The steps 7 to 10 compute (z i ) 0≤i≤d a Boolean masked form of (z + b i ) 0≤i≤d (where (z i ) 0≤i≤d is initiated to 0). Recall, as noted in Section 2.2.4, that this algorithm samples only half of the Gaussian, this means that to get a centered distribution, one should sample random signs for each coefficient afterwards.

Gadget 11 -Gaussian Generation for integers (GGen σ -Coeff) Data: A table of w probability values t j with θ bits of precision. Result: An arithmetic masking of an element (z i ) 0≤i≤d following a Gaussian of standard deviation σ 1 (z i ) 0≤i≤d := (0, . . . , 0) 2 initialize (u i ) 0≤i≤d as a θ-bit Boolean masking of a uniform random value r ∈ (0, 1]

3 for 0 ≤ j ≤ w do 4 initialize (k i ) 0≤i≤d as a θ-bit Boolean masking of -t j 5 (δ i ) 0≤i≤d ← sec + (u i ) 0≤i≤d , (k i ) 0≤i≤d ) 6 (b i ) 0≤i≤d := (δ i ) 0≤i≤d (θ -1) 7 (b i ) 0≤i≤d ← sec& ((b i ) 0≤i≤d , (z i ) 0≤i≤d ) 8 initialize (J i ) 0≤i≤d as a θ-bit Boolean masking of the index j 9 (b i ) 0≤i≤d ← sec& (¬(b i ) 0≤i≤d , (J i ) 0≤i≤d ) 10 (z i ) 0≤i≤d := (b i ) 0≤i≤d ⊕ (b i ) 0≤i≤d 11 (z i ) 0≤i≤d ← Ref ⊕ ((z i ) 0≤i≤d ) 12 end 13 return B A q ((z i ) 0≤i≤d )
Remark 7. Due to the table, this process is quite heavy. For the table's size optimization, a Rényi divergence technique is often used. It consists in using an upper bound on the relative error between the CDT distribution and an ideal Gaussian. This upper bound decreases with the maximum number of queries to the algorithm and it is often lower than a statistical distance estimation. Thus, with Rényi divergence techniques, smaller tables allow the same bits of security. Interestingly, if GaussGen is part of the key generation, the latter cannot be applied. Firstly, the maximum amount of queries to the key generation is not clearly bounded. Secondly, the key generation's security is often based on a decisional problem, and it is currently an open problem to apply the Rényi divergence techniques to decisional problems. Another possible optimization to reduce the size of the table would be to use the recursivity provided in [START_REF] Micciancio | Gaussian Sampling over the Integers: Efficient, Generic, Constant-Time[END_REF]. As with the previous large gadgets, the GGen σ -Coeff gadget can be generalized for polynomials in R q by applying GGen σ -Coeff to each of the coefficients. We present the polynomial version in Gadget 12. From Lemma 16, we can make the following corollary.

iter Ref ⊕ iter Ref ⊕ iter Ref ⊕ ... Aq B (0, . . . , 0) (u i ) (z i ) (z i ) (u i ) (z i ) (u i ) (z i ) (z i ) (z i )
iter

(z i ) (u i ) sec + sec& ⊕ sec& (z i ) (δ i ) (b i ) (b i ) (b i ) (b i ) (k i ) (J i ) Figure 3.5: Masked GGen σ -Coeff structure Corollary 2. Gadget GGen σ is d-NI secure.
Gadget 12 -Gaussian Generation (GGen σ ) Data: A table of w probability values p j with θ bits of precision. Result: An arithmetic masking of a polynomial (z i ) 0≤i≤d whose coefficients follow a Gaussian of standard deviation σ 1 for j = 0 to n -1 do 2 z (j) ← GGen σ -Coeff() 3 end 4 return z := i z (i) • X i

Application to GLP signature scheme

As shown for Gadget 12, masked Gaussian sampling seems very inefficient. Nevertheless, there exist lattice-based signatures that appear to support side-channel countermeasures like masking more naturally, because they entirely avoid Gaussians and other contrived distributions. Both randomness and rejection samplings target uniform distributions in contiguous intervals. Examples of such schemes include the GLP scheme of Güneysu, Lyubashevsky and Pöppelmann [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF], which can be seen as the ancestor of BLISS, and later variants like the Dilithium scheme of Ducas et al. [START_REF] Lyubashevsky | CRYSTALS-DILITHIUM[END_REF].

The signature scheme

For GLP signature scheme, we will use the following parameters: n is a power of 2, q is a prime number congruent to 1 modulo 2n and R q is defined with Eq. (1.3). The elements of R q can be represented by polynomials of degree n -1 with coefficients in the range {-q-1 2 , . . . , q-1 2 -1}. We also use Definition 13 notation R q,k .

The key generation algorithm for the GLP signature scheme is as follows:

Algorithm 15 -GLP key generation Result: Signing key sk, verification key pk

1 s 1 , s 2 $ ← -R q,1
/* s 1 and s 2 have coefficients in {-1, 0, 1} */ 2 a $ ← -R q 3 t := as 1 + s 2 4 sk := (s 1 , s 2 ) 5 pk := (a, t)

Given the verification key pk = (a, t), if an attacker can derive the signing key, this can also be used to solve a DCK q,n problem defined in [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF].

Hard Problem 8 -Decisional Compact Knapsack problem (DCK) Let q, n be integer parameters.

Given a sample (a, b) ∈ R q × R q Distinguish whether this sample has been drawn from the uniform distribution over R q × R q or the distribution (a, as 1 + s 2 ) with a uniformly random in R q and s 1 ,s 2 uniformly random in R q,1 .

Let us now describe the signature scheme introduced in [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF]. Additional functions like transform and compress introduced in [GLP12] can be used to shorten the size of the signatures. Note, however, that for masking purposes, we only need to consider the original, non-compressed algorithm of Güneysu et al., which we describe below. Indeed, signature compression does not affect our masking technique at all, because it only involves unmasked parts of the signature generation algorithm (the input of the hash function and the returned signature itself). As a result, although this work only discusses the noncompressed scheme, we can directly apply our technique to the compressed GLP scheme with no change. In fact, this is what Mehdi Tibouchi's proof-of-concept implementation in Section 3.3.5 actually does. The signature scheme needs a particular cryptographic hash function,

hash : {0, 1} * → D n α , (3.1)
where D n α is the set of polynomials in R q that have all zero coefficients except for at most α = 32 coefficients that are in {-1, +1} (or α = 16 when using the updated parameters presented in [START_REF] Chopra | GLYPH: A New Instantiation of the GLP Digital Signature Scheme[END_REF]).

Let κ be a parameter. Algorithm 16 and Algorithm 17, respectively describe the GLP signature and verification. Here is the soundness equation for the verification :

az 1 + z 2 -tc = ay 1 + y 2 .
Algorithm 16 -GLP signature Data: m, pk = (a, t), sk = (s 1 , s 2 ) Result: Signature sig

1 y 1 , y 2 $ ← -R q,κ 2 c := hash(r := ay 1 + y 2 , m) 3 z 1 := s 1 c + y 1 4 z 2 := s 2 c + y 2 5 if z 1 or z 2 / ∈ R q,κ-α then 6 restart 7 end 8 return sig := (z 1 , z 2 , c) Algorithm 17 -GLP verification Data: m, sig = (z 1 , z 2 , c), pk = (a, t) 1 if z 1 , z 2 ∈ R q,κ-α and c = hash(az 1 + z 2 -tc, m) then 2 accept 3 else 4 reject 5 end
The parameter κ controls the trade-off between the security and the runtime of the scheme. The smaller κ gets, the more secure the scheme becomes and the shorter the signatures get but the time to sign increases. The authors of the implementation of [START_REF] Güneysu | Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems[END_REF] suggest κ = 2 14 , n = 512, α = 32 and q = 8383489 for ≈ 100 bits of security and κ = 2 15 , n = 1024, α = 32 and q = 16760833 for > 256 bits of security.

Security proof of the r-GLP variant

One of the operations in the signature generation is the computation of a hash function mapping to polynomials in R q of a very special shape (being in D n α in Eq. (3.1)). Masking the computation of this hash function would be highly inefficient and difficult to combine with the rest of the algorithm. Indeed, the issue with hashing is not obtaining a masked bit string (which could be done with something like SHA-3), but expanding that bit string into a random-looking polynomial c of fixed, low Hamming weight in a masked form. The corresponding operation is really hard to write down as a circuit. Moreover, even if that could be done, it would be terrible for performance because subsequent multiplications by c are no longer products by a known sparse constant, but full-blown ring operations that have to be fully masked. However, more importantly, this masking should intuitively be unnecessary. Indeed, when we see the signature scheme as the conversion of an identification protocol under the Fiat-Shamir transform, the hash function computation corresponds to the verifier's sampling of a random challenge c after it receives the commitment value r from the prover. In particular, the verifier always learns the commitment value r (corresponding to the input of the hash function), so if the identification protocol is "secure", one should always be able to reveal this value without compromising security. However, the security of the signature scheme only offers weak guarantees on the security of the underlying identification protocol, as discussed by Abdalla et al. [START_REF] Abdalla | From Identification to Signatures via the Fiat-Shamir Transform: Minimizing Assumptions for Security and Forward-Security[END_REF].

In usual Fiat-Shamir signatures, this is never an issue because the commitment value can always be publicly derived from the signature (as it is necessary for signature verification). However, things are more subtle in the Fiat-Shamir with aborts paradigm, since the value r is not normally revealed in executions of the signing algorithm that do not pass the rejection sampling step. In our setting, though, we would like to unmask the value to compute the hash function in all cases, before knowing whether the rejection sampling step will be successful. If we do so, the side-channel attacker can learn the pair (r, c) corresponding to rejected executions as well, and the original security proof does not cover this, nor does security with this additional leakage look reducible to the original security assumption. The purpose of the next paragraphs is to prove that unmasking the value r does not affect the security of the scheme. This stronger security requirement can be modeled as the unforgeability under chosen message attacks of a modified version of the GLP signature scheme in which the pair (r, c) is made public when a rejection occurs. We call this modified scheme r-GLP, and describe it as Algorithm 18. The modification means that, in the EUF-CMA security game, the adversary gets access not only to correctly generated GLP signatures but also to pairs (r, c) when rejection occurs, which is exactly the setting that arises as a result of unmasking the value r.

We now introduce a new computational problem to handle the security of our modified r-GLP scheme.

Hard Problem 9 -Rejected-Decisional Compact Knapsack problem (R-DCK) Let q, n, Q s , α, κ be integer parameters.

Given (a, b i , c i ) ∈ R q × R q × D n α for i ∈ [0, Q s -1]
Distinguish whether this sample has been drawn from 1. the procedure where a is drawn uniformly in R q ; -the b i are drawn uniformly in R q ; -the c i are drawn uniformly in D n α . 2. or the procedure where

-elements (s 1 , s 2 , a) are firstly drawn uniformly in R 2 1 × R q ; -for each i, elements (c i , y 1,i , y 2,i ) are drawn uniformly in D n α × R 2 q,κ . This step is repeated until s 1 c i + y 1,i / ∈ R q,κ-α or s 2 c i + y 2,i / ∈ R q,κ-α . -the final samples are (a, b i , c i ) = (a, ay 1,i + y 2,i , c i ).
To obtain a scheme that more directly follows the original one and to keep the overhead reasonable, we propose to use R-DCK q,n,Qs,α,κ as an extra assumption, which we view as a pragmatic compromise. The assumption is admittedly somewhat artificial, but the same can be said to begin with, of DCK q,n itself. Heuristically, R-DCK q,n,Qs,α,κ is similar, except that it removes smaller (hence "easier to distinguish") instances from the distribution. In essence, one expects that this makes distinguishing harder, even though one cannot really write down a reduction to formalize that intuition.

c + y 1 ∞ > κ -α] = P [ s 2 c + y 2 ∞ ].
Without loss of generality, we only consider y 1 , s 1 , z 1 . To the left, we represent the distribution for the coefficients of y 1 . In the middle, we represent the possible values for the coefficients of s 1 c. To the right, the distribution of y i is shifted by s i c to obtain the distribution of z 1 . The accepted (resp. rejected) z 1 are in green (resp. in orange.). We see that, no matter the shift of s i c, the fraction of rejected coefficients will stay = 2α 2κ+1 .

Algorithm 18 -Tweaked signature with public r Data: m, pk = (a, t), sk = (s 1 , s 2 ) Result: Signature sig

1 y 1 $ ← -R q,κ 2 y 2 $ ← -R q,κ 3 r := ay 1 + y 2 4 c := hash(r, m) 5 z 1 := s 1 c + y 1 6 z 2 := s 2 c + y 2 7 if z 1 or z 2 / ∈ R q,κ-α then 8 (z 1 , z 2 ) := (⊥, ⊥) 9 end 10 return sig := (z 1 , z 2 , c, r)
The following theorem states that the modified scheme is indeed secure, at least if we are willing to assume the hardness of the additional R-DCK q,n,Qs,α,κ assumption. We refer to the original paper [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] for the game-based proof.

Theorem 5. Assuming the hardness of the DCK q,n and R-DCK q,n,Qs,α,κ problems, the signature r-GLP, presented in Algorithm 18 is EUF-CMA secure in the random oracle model.

Remark 8. One can think that Algorithm 18 is insecure3 because the adversary have access to the rejected c's and the rejection probability is accessible (by counting the number of rejected signatures over the total number of signature queries). However, the rejection probability is, by construction, independent from s 1 , s 2 and c. Thus, even conditioned with smartly chosen c, the adversary cannot gain any information from this probability. More precisely, the former probability is

P [ s 1 c + y 1 ∞ > κ -α] = P [ s 2 c + y 2 ∞ > κ -α] = 2α 2κ + 1 .
It can be seen graphically with Fig. 3.6.

Remark 9. We can avoid the non-standard assumption R-DCK q,n,Qs,α,κ by hashing not r but f (r) for some statistically hiding commitment f (which can itself be constructed under DCK q,n , or standard lattice assumptions). We refer to the appendices of [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] for details. The downside of that approach is that it incurs a non-negligible overhead in terms of key size, signature size, and to a lesser extent signature generation time.

Masking r-GLP signature scheme

The whole r-GLP scheme is turned into a functionally equivalent scheme secure in the d-probing model with public outputs. Note that it suffices to mask the key generation in the d-probing model and the signature in the d-probing model with public output r, since the verification step does not manipulate sensitive data.

Remark 10. As the number of signature queries per private key can be high (up to 2 64 as required by the NIST competition), whereas, the key generation algorithm is typically only executed once per private key, the vulnerability of the key generation to side-channel attacks is, therefore, less critical. Only possible attacks are the side-channel attacks with single trace (see the Section 1.1.3 in the introductory chapter). However, here, the key generation can be easily provably masked, so we still present the technique.

For simplicity, we will show the masking on a single iteration version of the signature. The masking can be generalized by calling the masked signature again with an SNI refreshing of the private key (s 1 , s 2 ) if it fails.

To ensure protection against d-th order attacks, we suggest a masking countermeasure with d + 1 shares for the following sensitive data : y 1 , y 2 , s 1 and s 2 . All the public variables are (a, t) (i.e., the public key), m (i.e., the message), rs (i.e., the bit corresponding to the success of the rejection sampling), (z 1 , z 2 , c) (i.e., the signature). As mentioned before, because of the need of r recombination, even if r is an intermediate value, it is considered as a public output. Most operations carried out in the r-GLP signing algorithm are arithmetic operations modulo q, so we would like to use an arithmetic masking. The issue is that at some points of the algorithm, we need to perform operations that are better expressed using Boolean masking. Those parts will be extracted from both the key generation and the signature to be protected individually and then securely composed.

We present the masked key generation in Algorithm 19 and the masked signature algorithm in Algorithm 20.

Algorithm 19 -Masked r-GLP key generation

Result: Signing key sk, verification key pk Remark 11 (Public outputs b and rs). Recall that b is a public output of UGen (Gadget 10). Its value corresponds to the conditions of rejection in the uniform data generation (or equivalently the number of iterations of UGen (Gadget 10)). Giving it to the attacker does not impact the security of the scheme. Besides, the value rs, defined in line 9 in Algorithm 20, corresponds to the condition of rejection (or equivalently the number of iterations of Algorithm 20). Such knowledge does not impact on the scheme's security because the rejection probability does not depend on the position of the coefficients.

1 (s 1,i ) 0≤i≤d ← UGen(1) 2 (s 2,i ) 0≤i≤d ← UGen(1) 3 a $ ← -R q 4 (t i ) 0≤i≤d := MAdd(a, (s 1,i ) 0≤i≤d , (s 2,i ) 0≤i≤d ) 5 t := Full+ q ((t i ) 0≤i≤d ) 6 sk := ((s 1,i ) 0≤i≤d , (s 2,i ) 0≤i≤d ) 7 pk := (a, t) Algorithm 20 -Masked r-GLP signature Data: m, pk = (a, t), sk = ((s 1,i ) 0≤i≤d , (s 2,i ) 0≤i≤d ) Result: Signature sig 1 (y 1,i ) 0≤i≤d ← UGen(κ) 2 (y 2,i ) 0≤i≤d ← UGen(κ) 3 (r i ) 0≤i≤d := MAdd(a, (y 1,i ) 0≤i≤d , (y 2,i ) 0≤i≤d ) 4 r := Full + q ((r i ) 0≤i≤d ) 5 c := hash(r, m) 6 (z 1,i ) 0≤i≤d := MAdd(c, (s 1,i ) 0≤i≤d , (y 1,i ) 0≤i≤d ) 7 (z 2,i ) 0≤i≤d := MAdd(c, (s 2,i ) 0≤i≤d , (y 2,i ) 0≤i≤d ) 8 rs := RS((z 1,i ) 0≤i≤d , κ -α) ∧ RS((z 2,i ) 0≤i≤d , κ -α) 9 if rs = 1 then 10 (z 1 , z 2 ) := (Full + q ((z 1,i ) 0≤i≤d ), Full + q ((z 2,i ) 0≤i≤d )) 11 else 12 (z 1 , z 2 ) := (⊥, ⊥) 13 end 14 return sig := (z 1 , z 2 , c,
Proof: We refer to Table 3.1 for the security properties of the gadgets. Let us assume that an attacker has access to δ ≤ d observations on the whole signature scheme. Then, we want to prove that all these δ observations can be perfectly simulated with at most δ shares of each secret among y 1 , y 2 , s 1 and s 2 and the public variables. With 4 In r-GLP, r is returned along with the signature, so it is not considered as a public output. Besides, recall that b is a public output of UGen (Gadget 10), it corresponds to the number of iterations of the generation before outputting a sample.

(s 1,i ) (s 2,i ) a m rs if rs = 1 z 1 z 2 (y 1,i ) (y 2,i ) (r i ) r c c (z 1,i ) (z 2,i ) Figure 3.8: Composition of GLP Signature
such a result, the signature scheme is then secure in the d-probing model since no set of at most d observations would give information on the secret values.

In the following, we consider the following distribution of the attacker's δ observations: δ 1 (resp. δ 2 ) on the instance of UGen that produces shares of y 1 (resp. y 2 ), δ 3 on MAdd, δ 4 on Full+ q of r, δ 5 (resp. δ 6 ) on MAdd which produces z 1 (resp. z 2 ), δ 7 (resp. δ 8 ) on the instance of RS for z 1 (resp. z 2 ) and δ 9 (resp. δ 10 ) on Full+ q of z 1 (resp. z 2 ). Some other observations can be made on the hash and ∧, their number will not matter during the proof. Finally, we have 10 i=1 δ i ≤ δ. Now, we build the proof from right to left as follows. Both last Full+ q blocks in the very end of mSign are d-NI secure. Therefore, all the observations performed during the execution of Full+ q on z 1 (resp. z 2 ) can be perfectly simulated with at most δ 9 (resp. δ 10 ) shares of z 1 (resp. z 2 ).

RS is d-NIo secure and does not return any sensitive element. Thus, all the observations performed in gadget RS can be perfectly simulated with at most δ 7 shares of z 1 and δ 8 shares of z 2 . So, after RS, the observations can be simulated with δ 7 + δ 9 shares of z 1 and δ 8 + δ 10 shares of z 2 . MAdd is d-NI secure as well; thus, all the observations from the call of MAdd on y 1 can be perfectly simulated with δ 5 + δ 7 + δ 9 ≤ δ shares of y 1 and s 1 . Respectively, on y 2 , the observations can be perfectly simulated from δ 6 + δ 8 + δ 10 ≤ δ shares of y 2 and s 2 . The left Full+ q gadget is d-NI secure and does not return any sensitive element, then all the observations performed in this gadget can be perfectly simulated with at most δ 4 shares of r. The left MAdd gadget is d-NI secure; thus, all the observations from its call can be perfectly simulated with at most δ 3 + δ 4 shares of each one of the inputs y 1 and y 2 . UGen is also d-NI secure; thus, we need to ensure that the number of reported observations does not exceed δ. At the end of UGen, the simulation relies on (δ 3 + δ 4 ) + (δ 5 + δ 7 + δ 9 ) ≤ δ shares of y 1 and (δ 3 + δ 4 ) + (δ 6 + δ 8 + δ 10 ) ≤ δ shares of y 2 . With the additional δ 1 (resp. δ 2 ) observations performed on the first (resp. the second) instance of UGen, the number of observations remains below δ, which is sufficient to ensure the security of the whole scheme in the d-probing model. Proof: We still refer to Table 3.1 for the security properties of the gadgets.

Here too, let us assume that an attacker has access to δ ≤ d observations on the whole signature scheme. Hence, we want to prove that all these δ observations can be perfectly simulated with at most δ shares of each secret among s 1 and s 2 .

We now consider the following distribution of the attacker's δ observations: δ 1 (resp. δ 2 ) on the instance of UGen that produces shares of s 1 (resp. s 2 ), δ 3 on MAdd, and δ 4 on Full+ q , such that 4 i=1 δ i = δ. Now, we build the proof from right to left: Full+ q is used at the very end of the key generation, and it is d-NI secure. Thus, all the observations from the call of Full+ q can be perfectly simulated with δ 4 ≤ δ sensitive shares of the input t.

MAdd is d-NI; thus, all the observations from its call can be perfectly simulated with at most δ 3 + δ 4 ≤ δ shares of each one of the inputs s 1 and s 2 .

UGen is d-NIo, thus, we need to ensure that the number of reported observations does not exceed δ. At the end of UGen, the simulation relies on (δ 3 + δ 4 ) ≤ δ shares of s 1 and s 2 . With the additional δ 1 (resp. δ 2 ) observations performed on the first (resp. the second) instance of UGen, the number of observations on each block remains below δ. All the observations can thus be perfectly simulated with the only knowledge of the outputs; that is, the key generation algorithm is this d-NIo secure.

EUF-CMA in the d-probing model

Let UnmaskedRefresh be the unmasked version of a refreshing gadget. This algorithm is not subject to probing as in Security Model 3; the attacker cannot probe during the key update. Its output, however, is given to the signature oracle and can be probed.

Algorithm 21 -UnmaskedRefresh

Data: (x i ) 0≤i≤d 1 for 0 ≤ i ≤ d -1 do 2 Draw a uniformly random x i with the same bit size as

x i 3 end 4 x d := d k=0 x k -d-1 k=0 x k 5 return (x i ) 0≤i≤d
Theorem 8. Assuming the hardness of the DCK q,n and R-DCK q,n,Qs,α,κ problems, the signature scheme r-GLP masked at order d with key update algorithm UnmaskedRefresh is EUF-CMA secure in the d-probing model (see Security Model 3) and in the random oracle model.

Proof: Let Adv d-probing-EUF-CMA be the advantage of an adversary A against the d-probing-EUF-CMA security game for r-GLP masked at order d with key update algorithm UnmaskedRefresh. Remark that b is drawn under a publicly known distribution and is independent of the secret. Hence the advantage of an adversary against the EUF-CMA security game for GLP with returned value b, rs is exactly Adv EUF-CMA , the advantage of an adversary against the EUF-CMA security game for r-GLP. This advantage is negligible and has been quantified in the proof of Theorem 5 (we refer to [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] for the details).

In the following, we will prove that Adv d-probing-EUF-CMA = Adv EUF-CMA , which is sufficient to conclude the proof. Indeed, thanks to Theorem 5, under the hardness of the DCK q,n and R-DCK q,n,Qs,α,κ , Adv EUF-CMA and so Adv d-probing-EUF-CMA will be negligible.

In the d-probing-EUF-CMA setting, the signature oracle called S is stateful. Let us define this oracle by the following:

S(m, O Sign ) = Sign(m, pk, sk (i-1) ), L Sign where i ∈ [1, Q]
is the state, i.e. the index of the query, and sk (i) = KeyUpdate i (sk) (with the convention sk 0 = sk).

Leakage Simulators

• According to Theorem 6, r-GLP Sign is d-NIo secure. One subtlety is that the attacker A is able to make d observations on each call to the signature oracle but not during the key refreshings.

For any set of at most d observations during the i th call to the signature oracle, the d-NI security ensures the existence of a perfectly simulated leakage L (i),Sim Sign that is generated from at most d shares of sk (i-1) . Because the attacker is not able to get any observation during the UnmaskedRefresh, if i = 1, the d shares of sk (i-1) can be perfectly simulated from random. When i = 1, the observations are directly simulated with at most d shares of sk (0) = sk. In total, the Q leakages L

(1),Sim Sign ...L (Q),Sim Sign are perfectly simulated from at most d shares of sk. Thus, they are independent of the unmasked value of the secret.

• Identically, according to Theorem 7, for any set of at most d observations during the key generation, there exists a perfectly simulated leakage L Sim KeyGen that is independent of the unmasked value of the secret.

Here are the hybrid games involved in the security proof.

Game G 0 : This game is the security game of the EUF-CMA security in the dprobing model. Game G 1 : Let S' be a copy of S that outputs

O KeyGen

L (i),Sim Sign instead of L (i)
Sign for all i. In the following game, all the leakages given to the attacker are replaced by the simulated leakages.

Sign | ≤ d for all i ∈ [1, Q],
having access to L Sim provides no advantage to the attacker. Thus, the advantage for G 1 is the same as the advantage for G 2 .

Finally Adv d-probing-EUF-CMA = Adv EUF-CMA .

Proof of concept and performance

In our team, Mehdi Tibouchi has carried out an implementation of our masking countermeasure based on a recent, public domain implementation of the GLP signature scheme called GLYPH [START_REF] Chopra | GLYPH: A New Instantiation of the GLP Digital Signature Scheme[END_REF]. The GLYPH scheme actually features a revised set of parameters supposedly achieving a greater level of security (namely, n = 1024, q = 59393, κ = 16383 and α = 16), as well as a modified technique for signature compression. We do not claim to vouch for those changes but stress that, for our purposes, they are essentially irrelevant. Indeed, our countermeasure's overhead only depends on the masking order d, the bit size of the Boolean masks (which should be chosen as 32 bits both for GLYPH and the original GLP parameters) and the degree n of the ring R q (which is the same in GLYPH as in the high-security GLP parameters). Therefore, our results on GLYPH should carry over to a more straightforward implementation of GLP as well.

Implementation results on a single core of an Intel Core i7-3770 CPU are provided in Table 3.2. In particular, we see that the overhead of our countermeasure with 2, 3 and 4 shares (secure in the d-probing model for d = 1, 2, 3 respectively) is around 15×, 30× and 73×. Given the complete lack of optimizations of this implementation, we believe that this proof of concept is quite promising. The memory overhead is linear in the masking order, so quite reasonable in practice (all masked values are simply represented as a vector of shares).

Extension to Crystals-Dilithium signature scheme

Our work on GLP led to a concrete masked implementation of Dilithium with experimental leakage tests [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF]. In the latter, Migliore et al. noticed that replacing the prime modulus by a power of two allows obtaining a considerably more efficient masked scheme, by a factor of 7.3 to 9 for the most time-consuming masking operations.

Application to BLISS signature scheme

A full description of BLISS cryptosystem has been presented in the previous chapter in Section 2.4.1. We studied how to mask the signature algorithm of BLISS in addition to protecting it against timing attacks. The key generation of BLISS can be masked using sorting networks and a masked polynomial generation. Nevertheless, the key generation is now obsolete in terms of complexity and performance compared to BLISS-B or more recent signature implementations (Dilithium, qTESLA). Thus, in this thesis, we focus on presenting the masked signature algorithm.

Masking BLISS signature algorithm

Similar to r-GLP, let u-BLISS be the variant of BLISS that outputs u even in case of failure. We here justify the security of u-BLISS and prove the d-probing security of the key generation and the signature procedures. For the sake of clarity, we focus on a single iteration of the latter. In other words, from now on, the signature algorithm considered is the same as in Algorithm 9 except that if the rejection sampling asks for a restart, the algorithm outputs ⊥. The masking can be generalized by calling the masked signature algorithm with a refreshed private key when it fails. For efficiency purposes, our masking countermeasure splits each sensitive data, namely y 1 , y 2 , s 1 , s 2 , z 1 , z 2 into d + 1 shares and the intermediate variables that strictly depend on them. The public variables (a 1 , a 2 ) (i.e., the public key), m (i.e., the message), rs (i.e., the bit corresponding to the success of the rejection sampling), (z 1 , z 2 , c) (i.e., the signature) are left unmasked. Furthermore, because anyone can recombine u Mst mod p, even if u is an intermediate value, it is considered as a public output along with the bit rs.

We present the masked BLISS signature algorithm in Algorithm 22. The PolyEval() function refers to the masking of the isochronous rejection sampling procedure presented in Algorithm 10 in Chapter 2. It can easily be transformed to ensure d-probing security as follows.

Step 1 computes two elements x 1 and x 2 from sensitive values s and z. Multiplications must be processed with function sec& in the masked version. As for Step 2, two sets of d + 1 Boolean shares are generated at random in {0, 1} to represent the secret bits u 1 and u 2 . Steps 3 and 4 require the computation of exp(x 1 ) and cosh(x 2 ) with x 1 and x 2 sensitive values shared in Step 1. Thanks to the polynomial approximation of these two functions, as described in Sections 2.4.3 and 2.4.4, the evaluation of exp and cosh for these two sharings is only a combination of linear squaring and sec& operations. As for their comparison with functions of u 1 and u 2 , the computed arithmetic sharings are first converted into Boolean sharings (the sharing of u 1 can be first converted into an arithmetic masking to be subtracted to exp(x 1 ) which allows a comparison with public values). Then, a secure comparison is performed between Boolean sharings and outputs two masked bits of a and b. Finally, the last multiplication in Step 5 is computed with sec&, before a call to Full+ q outputs rs.

Algorithm 22 -Masked u-BLISS signature Data: m, pk = (a, t), sk = ((s 1i ) 0≤i≤d , (s 2i ) 0≤i≤d ) Result: Signature sig Proof: From Table 3.1, all the sub-gadgets involved in the computation of the signature are either d-NI secure, d-NIo secure, d-SNI secure, or they do not manipulate sensitive data. In the d-probing model, we assume that an attacker has access to δ ≤ d exact variables in the whole execution of the signature. Then, we want to prove that all these δ observations can be perfectly simulated with at most δ shares of each secret among y 1 , y 2 , s 1 , and s 2 , and the public variables. We consider the following distribution of the attacker's δ observations: δ 1 (resp. δ 2 ) on the instance of GGen σ which produces y 1 (resp. y 2 ), δ 3 on MAdd, δ 4 on the instance of Full+ q following MAdd, δ 5 on hash, δ 6 on B A q , δ 7 (resp. δ 8 ) on the instance of sec& involving s 1 (resp. s 2 ), δ 9 (resp. δ 10 ) on the instance of MAdd which outputs z 1 (resp. z 2 ), δ 1 1 (resp. δ 12 ) on the instance of Refresh which outputs z 1 (resp. z 2 ), δ 13 on Polyeval, δ 14 (resp. δ 15 ) on the instance of Full+ q that outputs the unmasked version of z 1 (resp. z 2 ) such that 16 i=1 δ i = δ. We build the proof from right to left. The final Full+ q are d-NI secure. As a consequence, all the observations from their call involving z 1 (resp z 2 ) can be perfectly simulated with at most δ 14 ≤ δ shares of z 1 (resp. at most δ 15 ≤ δ shares of z 2 ). The algorithm referred to as Polyeval is also assumed d-NI secure

(y 1 i ) 0≤i≤d ← GGen σ () (y 2 i ) 0≤i≤d ← GGen σ () (u i ) 0≤i≤d := MAdd(ζ • a 1 , (y 1 i ) 0≤i≤d , (y 2 i ) 0≤i≤d ) u := Full + q ((u i ) 0≤i≤d ) c := hash( u d , m) (b i ) 0≤i≤d $ ← -{0, 1} d+1 (b i ) 0≤i≤d ← B A q ((b i ) 0≤i≤d ) (b i ) 0≤i≤d := (2 • (b i ) -1 mod q) 0≤i≤d (z 1i ) 0≤i≤d ← sec&((b i ) 0≤i≤d , (s 1i ) 0≤i≤d ) (z 2i ) 0≤i≤d ← sec&((b i ) 0≤i≤d , (s 2i ) 0≤i≤d ) (z 1i ) 0≤i≤d := MAdd(c, (z 1i ) 0≤i≤d , (y 1 i ) 0≤i≤d ) (z 1i ) 0≤i≤d ← Ref +q ((z 1i ) 0≤i≤d ) (z 2i ) 0≤i≤d := MAdd(c, (z 2i ) 0≤i≤d , (y 1 i ) 0≤i≤d ) (z 2i ) 0≤i≤d ← Ref +q ((z 2i ) 0≤i≤d ) rs := PolyEval(sk, (z 1i ) 0≤i≤d , (z 2i ) 0≤i≤d , c) if rs = 1 then (z 1 , z 2 ) := (Full + q ((z 1,i ) 0≤i≤d ), Full + q ((z 2,i ) 0≤i≤d )) z † 2 := ( u d -u -z 2 d ) mod p return sig := (z 1 , z † 2 ,
(s 1,i ) (s 2,i ) ζ • a 1 m rs if rs = 1 z 1 z 2 (b i ) (y 1,i ) (b i ) (z 2,i ) (z 1,i ) (y 2,i ) (u i ) u c c (y 1,i ) (z 1,i ) (z 2,i ) (z 1,i ) (z 2,i )
Figure 3.9: Composition of BLISS Signature by construction. Thus, all the observations from its call involving z 1 (resp z 2 ) can be perfectly simulated with at most δ 13 ≤ δ shares of z 1 (resp. at most δ 13 ≤ δ shares of z 2 ) and the bit rs which is public information indicating whether or not the rejection sampling failed. Continuing from right to left, we consider both instances of Refresh. From its d-SNI security property and since the output and local observations are still less than δ, all observations from its call can be perfectly simulated with at most δ 11 ≤ δ (resp. δ 12 ≤ δ) input shares. Both instances of MAdd outputs variables that are immediately refreshed. MAdd is additionally d-NI secure and has δ 11 (resp. δ 12 ) output observations and δ 9 (resp. δ 10 ) internal ones.

In both cases, the addition of the internal and output observations remains below δ. Therefore, the d-NI property makes it possible to simulate all further observations with δ 11 + δ 9 ≤ δ shares of y 1,i , s 1,i and the knowledge of c (resp. δ 12 + δ 10 ≤ δ shares of y 2,i , s 2,i , and the knowledge of c). The sec& instances are d-NI secure, all the observations after their call can be perfectly simulated with δ 7 + δ 11 + δ 9 shares of s 1 and b (resp. δ 8 + δ 12 + δ 10 shares of s 2 and b). The gadget A q B is d-SNI, the fact that the addition of (δ 7 +δ 11 +δ 9 )+δ 8 +δ 12 +δ 10 ≤ δ output observations and δ 6 internal observations is less than δ is enough to guarantee the global security from its location. The hash step only manipulates public data. Full+ q is d-NI secure (its output is given as output of the signature u-BLISS, so it is technically not a public output, see Remark 5) and does not return any sensitive variable. Then all the observations performed from this gadget can be perfectly simulated with at most δ 4 shares of u i . MAdd is d-NI secure. δ 3 observations are performed on its intermediate variables, and at most δ 4 observations are performed on its outputs. As δ 3 + δ 4 ≤ δ, all further observations can be perfectly simulated with at most δ 3 + δ 4 shares of y 1 , δ 3 + δ 4 shares of y 2 and the knowledge of the public value a 1 . The last step of the proof is to verify that all the internal and output observations on each instance of GGen σ are less than δ. Internal observations are respectively δ 1 and δ 2 while output observations are bounded by (δ 3 + δ 4 ) + (δ 11 + δ 9 ) and (δ 3 + δ 4 ) + (δ 12 + δ 10 ) which are both less than δ. The d-NIo property of GGen σ concludes the proof.

EUF-CMA in the d-probing model

Based on Section 3.3.4, we can prove that the security of u-BLISS reduces to the EUF-CMA security of the original BLISS scheme by introducing a mild computational assumption which is close to the classical LWE problem (see Theorem 5). This assumption informally states that distinguishing the output distribution of u when a rejection occurs from the uniform distribution on R 2q is hard.

Remark 12. Similarly to Remark 2, assume that an attacker is able to select a subset of signatures by filtering5 the output u (or equivalently c) and assume that she has access to the expectation of rejection conditioned with c, i.e.

E y 1 ,y 2 ,b [(z 1 , z 2 , c) rejected | c].
The following computation shows that this quantity is independent from s 1 , s 2 and c. Let s 1 , s 2 and c be fixed quantities,

p bliss sc := E y 1 ,y 2 ,b [(z 1 , z 2 , c) rejected | c] = 1 M • E y 1 ,y 2 ,b exp - S • c 2 2σ 2 -1 cosh z, Sc σ 2 -1 = 1 M • E y 1 ,y 2 ,b ρ σ ( z 2 ) 1 2 ρ σ ( z -Sc 2 ) + 1 2 ρ σ ( z + Sc 2 ) = 1 M •      1 2 E y 1 ,y 2 ρ σ ( y + Sc 2 ) 1 2 ρ σ ( y 2 ) + 1 2 ρ σ ( y + 2Sc 2 ) b=0 + 1 2 E y 1 ,y 2 ρ σ ( y -Sc 2 ) 1 2 ρ σ ( y 2 ) + 1 2 ρ σ ( y -2Sc 2 ) b=1      = 1 M ρ σ (Z m ) • y 1 2 ρ σ ( y 2 )ρ σ ( y + Sc 2 ) 1 2 ρ σ ( y 2 ) + 1 2 ρ σ ( y + 2Sc 2 ) + y 1 2 ρ σ ( y 2 )ρ σ ( y -Sc 2 ) 1 2 ρ σ ( y 2 ) + 1 2 ρ σ ( y -2Sc 2 ) = 1 M ρ σ (Z m ) • z 1 =y+Sc ρ σ ( z 1 -Sc 2 )ρ σ ( z 1 2 ) ρ σ ( z 1 -Sc 2 ) + ρ σ ( z 1 + Sc 2 ) + z 2 =y-Sc ρ σ ( z 2 + Sc 2 )ρ σ ( z 2 2 ) ρ σ ( z 2 + Sc 2 ) + ρ σ ( z 2 -Sc 2 )
.

The summation domain for z 1 and z 2 is the same, so,

p bliss sc = 1 M ρ σ (Z m ) • z ρ σ ( z -Sc 2 )ρ σ ( z 2 ) ρ σ ( z -Sc 2 ) + ρ σ ( z + Sc 2 ) + ρ σ ( z + Sc 2 )ρ σ ( z 2 ) ρ σ ( z + Sc 2 ) + ρ σ ( z -Sc 2 ) = 1 M ρ σ (Z m ) • z ρ σ ( z 2 ) = 1 M .

Application to qTesla signature scheme

While the study of GLP and BLISS were proofs of concept, we now focus on applying an optimized masking countermeasure to qTESLA, a candidate to the NIST standardization process [START_REF] Bindel | qTESLA[END_REF]. The qTESLA signature scheme is also a Fiat-Shamir lattice-based signature derived from the original work of Lyubashevsky [START_REF] Lyubashevsky | Lattice Signatures without Trapdoors[END_REF]. This signature is, with Dilithium [START_REF] Ducas | CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme[END_REF], one of the most recent iterations of this line of research. We slightly modify the signature and parameters to ease the addition of the countermeasure while keeping the original security. This work has been done with François Gérard [START_REF] Gérard | An Efficient and Provable Masked Implementation of qTESLA[END_REF].

The qTESLA signature Scheme

Let us now describe qTESLA [START_REF] Bindel | [END_REF], a (family of) lattice-based signatures based on the Ring-LWE problem (see Hard Problem 5) and a round-2 candidate for the NIST post-quantum competition. The signature stems from several iterations of improvements over the original scheme of Lyubashevsky [START_REF] Lyubashevsky | Lattice Signatures without Trapdoors[END_REF]. It is, in fact, a concrete instantiation of the scheme of Bai and Galbraith [START_REF] Bai | An Improved Compression Technique for Signatures Based on Learning with Errors[END_REF] over ideal lattices. Its direct contender in the competition is Dilithium [START_REF] Ducas | CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme[END_REF], which is also based on this same idea of having a lattice variant of Schnorr signature. The security of Dilithium relies on problems over module lattices instead of ideal lattices, in the hope of increasing security by reducing algebraic structure, at the cost of a slight performance penalty. Hereunder, we explicitly describe the main algorithms, namely key generation, signature and verification. Beforehand, let us briefly recall the functionality of each of the subroutines for completeness. We redirect the interested reader to [START_REF] Bindel | [END_REF] or the NIST submission for a detailed description. In Table 3.3, we present the different parameters of qTESLA. We write x mod ± q to denote the unique integer x ct ∈ (-q/2 , . . . , q/2 ] (where the lower bound is included if q is odd) such that x ct ≡ x (mod q). We call this integer the centered representative of x modulo q. In the following, PRF is a pseudorandom function, GenA generates a uniformly random polynomial, GaussSampler samples a polynomial according to a Gaussian distribution, CheckS and CheckE verifies that a secret polynomial does not have too large coefficients, ySampler samples a uniformly random polynomial y ∈ R q,B (as defined in Definition 13), hash is a collision-resistant hash function, and Enc encodes a bit string into a sparse polynomial c ∈ R q,1 with ||c|| 1 = h. Remark 13. For the sake of practicability, we focus on the heuristic version of qTESLA as the use case. More specifically, in Section 5.5, we implement our countermeasure in qTESLA-I and qTESLA-III even though the techniques we are using are not specific to any parameter set. After this work was actually accepted at the CARDIS conference, the heuristic parameter sets, on which our experiments are based, were removed by the qTESLA team. We emphasize that the parameters we use were not broken but are not part of the standardization process anymore.

Key generation (Algorithm 23).

The key generation will output an RLWE sample together with some seeds used to generate public parameters and to add a deterministic component to the signing procedure. The algorithm starts by expanding some randomness into a collection of seeds and generates the public polynomial a before moving on to the two secret values s and e. Those two values are sampled from a Gaussian distribution and have to pass some checks to ensure that the products s • c and e • c do not have too large coefficients. After that, the main component t of the public key is computed as t = a • s + e. The output consists of the private key sk = (s, e, seed a , seed y ) and the public key pk = (seed a , t).

Sign (Algorithm 24). The sign procedure takes as input a message m and the private key sk, and it outputs a signature sig = (z, c). First, in order to generate the randomness needed in the algorithm, a seed is derived from a fresh random value r, seed y and m. Next, a polynomial y ∈ R q,B is sampled to compute the value v = a • y mod ± q. The algorithm will now hash the rounded version of v together with the message and encode the result in a sparse polynomial c with only h entries in {-1, 1}. The candidate signature is computed as z = y + s • c. Before outputting the result, two additional checks must be performed: we must ensure that z is in R q,B-S and that w = ve • c mod ± q is well rounded, meaning that ||[w] Lst || ∞ < 2 Lst-1 -E and ||w|| ∞ < q/2 -E should hold. When one of the checks fail, the signing procedure is restarted by sampling a new y. When eventually both checks pass, the signature sig = (z, c) is output.

Verify (Algorithm 25). Signature verification is pretty lightweight and straightforward for this type of signature. Taking as input the message m, signature sig = (z, c) and public key pk = (seed a , t), it works as follow: First, it generates the public parameter a, then computes w = a • zt • c and accepts the signature if z ∈ R q,[B-S] and c = Enc(hash([w] Mst , m)).

Masking qTESLA signature scheme

In the process of masking qTESLA, we decided to make slight modifications in the signing procedure in order to facilitate masking. The idea is that some design elements providing small efficiency gains may be really hard to carry on to the masked version and actually do even more harm than good. Our two main modifications are the modulus which is chosen as the closest power of two of the original parameter set and the removal of the PRF to generate the polynomial y.

Power of two modulo. Modular arithmetic is one of the core components of many cryptographic schemes. While, in general, it is reasonably fast for any modulus (but not necessarily straightforward to do in constant time), modular arithmetic in masked form is very inefficient, and it is often one of the bottlenecks in terms of running time. The gadget sec +q (See Gadget 7) is defined to add two integers in boolean masked form modulo q. The idea is to perform the addition over the integers naively and to subtract q if the value is larger than q. While this works completely fine, the computational overhead is large in practice and avoiding those reductions would drastically enhance execution time as noticed in [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF] (See Section 3.3.6). The ideal case is to work over Z 2 n . In this case, almost no reductions are needed throughout the execution of the algorithm and, when needed, can be simply performed by applying a mask on boolean shares. The reason why working with a power of two moduli is not the standard way to instantiate lattice-based cryptography is that it removes the possibility to use the number theoretic transform (NTT) to perform efficient polynomial multiplication in O(n log n). Instead, multiplication of polynomial has to be computed using the Karatsuba/Toom-Cook algorithm, which is slower for parameters used in state-of-the-art algorithms. Nevertheless, in our case, not having to use the heavy SecAddModp gadget largely overshadows the penalty of switching from NTT to Karatsuba. Since modulus for both parameter sets were already close to a power of two, we rounded to the closest one, i.e. 2 22 for qTESLA-I and 2 23 for qTESLA-III. This modification does not change the security of the scheme. Indeed, security-wise, for the heuristic version of the scheme that we study, we need a q such that q > 4B6 and the corresponding decisional LWE instance is still hard. However, the form of q does not impact the hardness of the problem as shown in [START_REF] Langlois | Hardness of decision (R)LWE for any modulus[END_REF] and, since q was already extremely close to a power of two for both parameters sets, the practical bit hardness of the corresponding instance is not sensibly changed.

Removal of the PRF. It is well known that in Schnorr-like signatures, a devastating attack is possible if the adversary gets two different signatures using the same y. Indeed, they can simply compute the secret s = z-z c-c . While such a situation is very unlikely due to the large size of y, a technique to create a deterministic version of the signature was introduced in [START_REF] David | Computational Alternatives to Random Number Generators[END_REF]. The idea is to compute y as PRF(secret_seed, m) such that each message will have a different value for y unless a collision is found in PRF. This modification acts as a protection against very weak entropy sources but is not necessary to the security of the signature and was not present in ancestors of qTESLA. Unfortunately, adding this determinism also enabled some side-channel attacks [Pod+17; GP18]. Hence, the authors of qTESLA decided to take the middle ground by keeping the deterministic design but also seeding the oracle with a fresh random value r7 . While those small safety measures certainly make sense if they do not incur a significant performance penalty, we decided to drop them and simply sample y at random at the beginning of the signing procedure. The reason is twofold. First, keeping deterministic generation of y implied masking the hash function evaluation itself, which is really inefficient if not needed and would unnecessarily complicate the masking scheme. Second, implementing a masking countermeasure is, in general, making the hypothesis that a reasonable source of randomness (or at least not weak to the point of having a nonce reuse on something as large as y) is available to generate shares and thus can also be used for the signature itself.

Masked sign The masked signature can be found in Algorithm 27. After generating the public parameter a with the original GenA procedure, the gadget UGen (See Gadget 10) is used to get polynomials y i such that y = N i=0 y i belongs to R q,B . Then, thanks to the distributive property of the multiplication of ring elements, we can compute v = a•y = N i=0 a•y i using regular polynomial multiplication, without relying on any complex gadget. The polynomial c is computed using the subroutine MaskedHash which is using the Rnd gadget (See Gadget 20) to compute qTESLA's rounding and hashing on a masked polynomial. Similarly to other Fiat-Shamir with aborts signatures (like GLP, Dilithium or qTesla), the computation of the hash function does not have to be performed in masked form since the knowledge of its inputs does not impact the security. Once c has been computed, the candidate signature can be computed directly on shares with the masked private key as z = y + s • c = N i=0 y i + s i • c. Using the RS and WRnd gadgets (See Gadgets 18 and 22), the security and correctness parts of the signature follow trivially.

Goto 2 10 end 11 (w i ) 0≤i≤d := MAdd(c, (e i ) 0≤i≤d , (v i ) 0≤i≤d ) 12 if r := WRnd ((w i ) 0≤i≤d , q/2 -E, 2 Tail-1 -E, Tail) = 0 then 13 Goto 2 14 end 15 z unmasked := Full + q ((z i ) 0≤i≤d ) 16 return (z unmasked , c)

Masked key generation The number of signature queries per private key can be high (up to 2 64 as required by the NIST competition). In contrast, the key generation algorithm is typically only executed once per private key. The performance of the masked key generation is, therefore, less critical. We present here an (inefficient) masked version of the key generation algorithm that can be found in Algorithm 28. One can remark that the bottleneck gadget, GGen σ (See Gadget 12), needs to make T comparisons for each coefficient of the polynomial which goes to a total of T • n comparisons for the whole generation. With a value of T around 200, sampling from the table is actually sensibly heavier than signing. Thus, our goal with this masked qTESLA key generation is to prove that masking without changing the design is costly but still doable. However, for a practical implementation in which the key generation might be vulnerable to side channels, one could prefer changing the design of the scheme. For example, Dilithium or GLP generate the keys uniformly at random on a small interval and thus avoid this issue. One downside of these faster key generation is that the parameters of the scheme should be adapted in order to avoid having too many rejections in the signing algorithm.

In Algorithm 28, the element a is generated in unmasked form because it is also part of the public key. Then, s and e are drawn using the gadget GGen σ . Another gadget MChk (See Gadget 23) is also introduced in the key generation. It checks that the sum of the h largest entries (in absolute value) is not above some bounds that can be found in Table 3.3. Then the public key t is computed in masked form and securely unmasked with the Full+ q gadget.

Algorithm 28 -Masked qTesla Key Generation

Result: sk = ((s i ) 0≤i≤d , (e i ) 0≤i≤d , sd), pk = (sd, t)

1 pre-seed r ← -{0, 1} κ 2 sd := PRF(pre-seed) 3 a := GenA(sd) 4 repeat 5 (s i ) 0≤i≤d ← GGen σ () 6 until chk1 := MChk((s i ) 0≤i≤d , h, S) = 0 7 repeat 8 (e i ) 0≤i≤d ← GGen σ () 9 until chk2 := MChk((e i ) 0≤i≤d , h, E) = 0 initialize (sign s i ) 0≤i≤d and (sign e i ) 0≤i≤d as two 1-bit arithmetic masking of either -1 or 1 (s i ) 0≤i≤d ← sec& ((sign s i ) 0≤i≤d , (s i ) 0≤i≤d ) (e i ) 0≤i≤d ← sec& ((sign e i ) 0≤i≤d
, (e i ) 0≤i≤d ) (t i ) 0≤i≤d := MAdd(a, (s i ) 0≤i≤d , (e i ) 0≤i≤d ) t := Full + q ((t i ) 0≤i≤d ) sk := ((s i ) 0≤i≤d , (e i ) 0≤i≤d , sd) pk := (sd, t) return sk, pk

EUF-CMA security in the d-probing model

We introduce a theorem that proves the d-NIo property of our masked key generation algorithm.

Theorem 10. The key generation algorithm presented in Algorithm 28 is d-NIo secure with public outputs chk1 and chk2.

Remark 14. The knowledge of chk1 and chk2 cannot give more information on the outputted private key. Indeed, it only gives information on the number of attempts before outputting a key pair.

Proof: The overall gadget decomposition of the key generation is in Fig. 3.10. We omit some of the non-sensitive values (like sd) for clarity. For simplicity and without losing generality, the theorem only considers one iteration of the key generation: the algorithm outputs ⊥ if the checks are not validated. The public outputs chk1 and chk2 are then related to the number of iterations that is independent of the final secrets e or s. The structure is very similar to the key generation of GLP in Algorithm 19, and there is no cycle in the structure. Thus, we can conclude that all the observations can be perfectly simulated with the only knowledge of the outputs.

In the following, we introduce a theorem that proves the d-NIo property of our masked signature algorithm. Here too, without losing generality, the theorem only considers one iteration for the signature: the signing algorithm outputs ⊥ if one of the tests in Steps 9 or 13 in Algorithm 27 has failed. We denote by r (j) 0≤j<n , rs (j) 0≤j<n and u (j) 0≤j<n the outputs of RS, WRnd and Rnd (the values for each coefficient j ∈ [0, n -1]).

Theorem 11. Each iteration of the masked signature in Algorithm 27 is d-NIo secure with public outputs 8 r (j) 0≤j<n , rs (j) 0≤j<n , u (j) 0≤j<n .

Proof: The overall gadget decomposition of the signature is in Fig. 3.11.

The gadget & multiplies each share of the polynomial y by the public value a. By linearity, it is d-NI. Thus, all the sub-gadgets involved are either d-NI secure, d-NIo secure or they do not manipulate sensitive data (See Table 3.1). We prove that the final composition of all gadgets is d-NIo. As there is no cycle in the structure, the proof can be easily built from right to left similarly as for the proof of Theorem 6.

Definition 14. We denote by (r, rs, u)-qTESLA a variant of qTESLA where all the values r (j) 0≤j<n , rs (j) 0≤j<n , u (j) 0≤j<n are outputted for each iteration during the signing algorithm.

8 The number of iterations of the gadget UGen is omited as a public output. Theorem 11 allows reducing the EUF-CMA security in the d-probing model of our masked qTESLA signature at order d to the EUF-CMA security of (r, rs, u)-qTESLA. The security proof of qTESLA does not fully support (r, rs, u)-qTESLA because the adversary is not supposed to see the values of the signing's failed attempts. However, we can prove, with a Theorem similar to Theorem 5, that under some computational assumptions, outputting u (j) 0≤j<n for each iteration does not affect the security. The values r (j) 0≤j<n , rs (j) 0≤j<n correspond to rejection's conditions, and more precisely, the positions of the coefficients of the polynomials that do not pass the rejections. Such knowledge does not impact the scheme's security because the rejection probability does not depend on the position of the coefficients.

(y i ) (v i ) (u i ) c (w i ) (z i ) (z i ) c (y i ) c (v i )

Optimized implementation and performance

This work was focused on performance and reusability, and François Gérard was the implementor. Our masked signature implementation still keeps the property of being compatible with the original verifying procedure of qTESLA and has been directly implemented within the code of the submission. Even if we target high order masking, we also implemented specialized gadgets for order 1 masking to provide a lightweight version of the masking scheme with a reasonable performance fitting nicely on embedded systems. We finally provided extensive performance data and showed that the cost of provable masking could be reasonable, at least for small orders.

We performed benchmarks for the two parameters sets qTESLA-I and qTESLA-III9 on a laptop with a CPU Intel Core i7-6700HQ running at 2.60GHz as well as on a cortex-M4 microcontroller for the masking of order 1.

Randomness We performed the tests with and without the random number generator activated (in gadgets). The reason why we decided to switch off the RNG 10 is to show how masking schemes of this magnitude are sensitive to the speed at which the device is capable of retrieving randomness. We also tested the smaller parameter set at order 1 on a Cortex-M4 microcontroller to see how it performs on a device more realistically vulnerable to side-channel attacks. We speculate that the scaling difference between the microcontroller and the computer is due to the fact that architectural differences matter less for the masking code than for the base signature code. Our tests with the randomness enabled were performed using xoshiro128** [START_REF] Blackman | Scrambled Linear Pseudorandom Number Generators[END_REF], a really fast PRNG that has been recently used to speed-up public parameters generation in a lattice-based cryptosystem [START_REF] Bos | Fly, you fool! Faster Frodo for the ARM Cortex-M4[END_REF]. An implementor who is looking for our technique's real-life application and believes that masking needs a strong randomness would maybe want to use, instead, a cryptographically secure PRNG. Another option could be to expand a seed with the already available cSHAKE function, but as we will see in the sequel, it might be pretty expensive as the number of random bytes required grows very fast with the number of shares.

Individual gadgets. The result for individual gadgets over 1 000 000 executions can be found in Table 3.4. The table is divided into two parts: the top part contains measurements for the signing gadgets implementing functionalities of the signature and the bottom part contains measurements for the base gadgets implementing elementary operations. Unsurprisingly, we see that the most expensive signing gadget is WRnd. Indeed, it has to perform two absolute value computations in addition to two comparisons. Nevertheless, an actual substantial overall gain of performances would rather come from an improvement of the conversion from arithmetic to boolean masking since it is the slowest base gadget and is used in all signing gadgets. Furthermore, it should also be pointed out that most gadgets have a non-negligible dependency on the speed of sec& since it is called multiple times in sec + , which itself appears multiple times in signing gadgets.

Signing procedure. The results for the full signature are given in Table 3.5. Since a large portion of the execution time is spent in calls to the random number generator, we decided to benchmark with and without the PRNG. The mention RNG off means that rand_uint32() was set to return 0. The mention RNG on means that rand_uint32() was set to return the next value of xoshiro128**. The purpose is to give an idea of how the algorithm itself is scaling, regardless of the speed at which the device is able to provide randomness. At the same time, the discrepancy between the values with and without the RNG underlines how masking schemes of this magnitude are sensitive to randomness sampling. In Table 3.7, we also computed the average number of calls to rand_uint32() to see how much randomness is needed for each order. Each call is retrieving a uniformly random 32-bit integer. As expected, this number is growing fast when the masking order is increased. The results for the masked signature at order 1 on cortex-M4 microcontroller are given in Table 3.6. We speculate that the scaling difference between the microcontroller and the computer is due to the fact that architectural differences matter less for the masking code than for the base signature code. Furthermore, we can see that qTESLA-III is scaling better than qTESLA-I. In addition to the natural variance of the experiments, we explain this result by the fact that increasing the masking order reduces the impact of the polynomial multiplication on the timing of the whole signature in favor of masking operations. Factoring out polynomial operations, qTESLA-III is scaling better because the probability of rejection for these parameters sets is lower than for qTESLA-I. Hence, even if n is twice as large, less than twice the masking operations are performed overall.

As noted in [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF], the power of two moduli allows getting a reasonable penalty factor for low masking orders. Without such a modification, the scheme would have been way slower. Besides, our implementation seems to outperform the masked implementation of Dilithium as given in [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF]. The timing of our order 1 masking for qTESLA-I is around 1.3 ms, and our order 2 is around 7.1 ms. This result comes with no surprise because the unmasked version of qTESLA already outperformed Dilithium. However, we do not know if our optimizations on the gadgets could lead to a better performance for a masked Dilithium.

Perspectives

This chapter has presented the masking techniques for lattice-based Fiat-Shamir with aborts signatures. Several key new problems were encountered:

1. Expensive Mask conversions. Most steps of the signing lattice algorithm involve linear operations on polynomials that can be cheaply masked using mod q arithmetic masking. However, for some operations like the generation of the randomness or the rejection sampling, this representation is less convenient. Therefore, we must carry out conversions from Boolean masking to arithmetic masking and the other way around.

2. Public outputs. For performance reasons, some intermediate variables may be revealed to the attacker. The scheme must then be proved secure with these public outputs. Besides, we introduced a new notion of security to account for public outputs.

3. "Masking Friendliness". Some sets of parameters are easier to mask than others. For example, by choosing a power of two as modulus, one can get better performance. Now that this is demonstrated providing one set of parameters that are more "masking-friendly" within the NIST competition could be an asset for the candidates.

Perspective 4. A vital perspective would be to improve masked Gaussian Sampling (See Gadget 11). Indeed, even with recursion techniques, the cumulative distribution table seems heavy to carry in a masked form. This is what keeps us from masking the Falcon signature scheme, which is the only hash-and-sign signature from the competition.

Part II

Cryptanalysis results

Figure 4.1: Decryption failure attacks consist in analyzing the success or failure of an algorithm. Sometimes, an algorithm can generate an -extremely rare-problematic intermediate value that ends up with a failure. In practice, failures are very rare and if they happen, the algorithm is simply restarted. However, this knowledge can trigger attacks. For example, the purple algorithm chooses x = 0 which is the only value that cannot be inverted in R. In that case, an attacker can conclude that the secret value was 0.

The study of this chapter focuses on decryption failure attacks on lattice-based public key encryption or key exchanges. Guénaël Renault, one of my advisors at ANSSI suggested this topic to me at the beginning of my PhD. It was a perfect entry into the field of latticebased KEMs. We started with the original lattice-based encryption scheme [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF], and we progressively understood the additional features that lead to NewHope Later on, a new family of generic attacks on schemes with stronger security models were introduced [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF]: they were no longer targeting the schemes in a misuse setting. After a post-quantum spring school in Oxford in 2019, with Jan-Pieter D'Anvers, Alessandro Bussoni, Henri Gilbert and Fernando Virdia, we started to consider a new hypothesis: the possible bootstrapping of the search for one failure in order to generate other ones. The key idea was to consider the possible decryption failures in a geometric way. A few months later, Jan-Pieter D'Anvers, Fernando Virdia and I wrote the results of this study in a paper [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF] and we were very proud by the implications of the results. On the one hand, our paper show that after obtaining only one failure, anyone can find other ones "for free" and thus break the security. On the other hand, our paper greatly improves the state of the art concerning the multitarget attack model. Our student paper "(One) failure is not an option" has been accepted to Eurocrypt 20201 . This chapter highlights the implications of the non-perfect correctness feature that is inherent in lattice-based key exchanges. It seems that it can lead to vulnerabilities in various settings. Even though there is no total break of any of the NIST candidates, we do not know for sure that a nonzero failure probability can be harmless in any use case.

Chapter content

Introduction and motivations

Key Encapsulation Mechanisms (KEM)

As opposed to signature schemes, this chapter will study the security of lattice-based Key Encapsulation Mechanisms (or KEMs). Informally, with a KEM, one can generate an encapsulated key and send it to a public channel. The receiver, that knows a private key, is able to recover the key from its encapsulated version.

Definition 15. A Key Encapsulation Mechanism KEM is a triple of algorithms containing 1. a probabilitic key generation algorithm, denoted KeyGen, that returns a public/private key pair (pk, sk);

2. a probabilitic encapsulation algorithm, denoted Encaps, that takes pk as input and generates an encapsulated key ct key and a key m key ;

3. a deterministic decapsulation algorithm, denoted Decaps that takes as input sk and ct key and returns m key or ⊥, denoting failure.

A KEM is correct if for sk, pk ← KEM.KeyGen(1 λ ), P [KEM.Decaps(sk, ct key ) = m key : (ct key , m key ) ← KEM.Encaps(pk)]

is negligible in the security parameter. We say that it is perfectly correct if the latter probability is zero for all sk, pk ← KEM.KeyGen(1 λ ).

Key Encapsulation Mechanisms can be built from a better known type of mechanism, namely Public Key Encryption mechanisms (PKE). The difference between a PKE and a KEM is slight: in a nutshell, instead of outputting a key m key , a chosen message m is given as input. Thus, the encapsulated key ct key becomes a ciphertext ct. When considering KEMs, we will sometimes abusively use the term "message" for the common key m key and "ciphertext" for the encapsulated key ct key . The NIST call specifically asks for quantum-resistant KEM proposals.

Security properties

We can define several security properties for key encapsulation mechanisms that are inherited from the security properties of the public key encryptions.

Security Model 4 (IND-CPA security [KL14]

). A KEM = (KeyGen, Encaps, Decaps) is IND-CPA, or "passively secure" if any probabilistic polynomial time adversary A has a negligible advantage of winning in the IND-CPA A,KEM (1 λ ) game presented in Security Game 4.

Adversary Challenger

KEM=(KeyGen,Encaps,Decaps)

←------------------- pk ←-- sk, pk ← KeyGen(1 λ ) (ct key , m key ) ← Encaps(pk) b $ ← -{0, 1} m key = m key if b = 0, m key $ ← -{0, 1} n otherwise pk,ct key ,m key ←-------- b - -→ b = b
Security Game 4: IND-CPA game for KEM.

IND-CPA is the basic security requirement for the KEM designers. We now introduce a stronger security property where a decapsulation oracle is provided. We assume that the maximum number of ciphertexts that can be queried to it for each key pair is

Q = 2 K ;
where in practice, K = 64 is often considered [NIS16, Section 4.A.2]. In this chapter, we keep the maximum number of queries as a parameter with no specific value in order to provide an adaptable granularity in the security assessment. Indeed, to mount an attack, the adversary trades off between the total number of queries and the work.

Security Model 5 (IND-CCA security [START_REF] Katz | Introduction to Modern Cryptography[END_REF]). A KEM = (KeyGen, Encaps, Decaps) is IND-CCA, or "actively secure", if any probabilistic polynomial time adversary A has a negligible probability of winning in the IND-CCA A,K (1 λ ) game presented in Security Game 5.

Adversary Challenger

KEM=(KeyGen,Enc,Dec)

←--------------- sk, pk ← KeyGen(1 λ ) (ct key , m key ) ← Encaps(pk) b $ ← -{0, 1} m key = m key if b = 0, m key $ ← -{0, 1} n otherwise pk,ct key ,m key ←-------- 2 K queries                              ct (1) key =ct key -------→ u (1) := Decaps(sk, ct (1) key )
u

←--. . .

ct (2 K ) key =ct key --------→ u (2 K ) := Decaps(sk, ct (2 K
) key )

u (2 K ) ←---- distinguishing b - -→ b = b
Security Game 5: IND-CCA game for KEMs.

Both properties originally existed for public-key encryption schemes (PKE). Lyubashevsky, Peikert and Regev [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF] introduced a simple protocol to build passively secure encryption from the Ring-LWE problem, inspired from the Diffie-Hellman key exchange [START_REF] Diffie | New directions in cryptography[END_REF] and ElGamal public-key encryption [START_REF] Elgamal | A public key cryptosystem and a signature scheme based on discrete logarithms[END_REF]. Others were later introduced in [Pei14; Din12]. Naturally, the protocol can also be adapted to work based on LWE with no ring structure (Hard Problem 3) and on Mod-LWE (Hard Problem 5). In order to obtain active security, designers usually use an off-the-shelf CCA compiler, usually a (post-quantum) variant [Den03; HHK17; TU16; SXY17; Jia+17] of the Fujisaki-Okamoto transform [START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF] (FO). These come with proofs of security in the (quantum) random oracle model, with explicit bounds about the loss of security caused by the transformation.

Attack model

One commonly occurring characteristic of lattice-based KEM schemes is the lack of perfect correctness. In other words, for sk, pk ← KEM.KeyGen(1 λ ), P [KEM.Decaps(sk, ct key ) = m key : (ct key , m key ) ← KEM.Encaps(pk)] < 1. This means that sometimes, ciphertexts generated honestly using a valid public key may lead to decapsulation failures under the corresponding private key. Throughout this thesis, we'll refer to such events as "key mismatches", "failures", "decryption failures" or "decapsulation failures".

Misuse on IND-CPA schemes. While in practice, schemes are parametrized in such a way that decryption failures do not undermine overall performance, these can be leveraged as a vehicle for key recovery attacks against the key pair used to generate them. Jaulmes and Joux [START_REF] Jaulmes | A Chosen-Ciphertext Attack against NTRU[END_REF] described such attacks against NTRU, after which it was extended in [START_REF] Howgrave-Graham | The Impact of Decryption Failures on the Security of NTRU Encryption[END_REF] and [START_REF] Gama | New Chosen-Ciphertext Attacks on NTRU[END_REF]. A similar attack on Ring-LWE based schemes was later presented by Fluhrer [START_REF] Fluhrer | Cryptanalysis of ring-LWE based key exchange with key share reuse[END_REF] and extended by Băetu et al. [START_REF] Băetu | Misuse Attacks on Post-quantum Cryptosystems[END_REF]. It is also shown in [START_REF] Daniel | HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction[END_REF] that the private key of the round 1 NIST candidate HILA5 can be recovered following Fluhrer's approach. The aforementioned attacks all use specially crafted, dishonestly derived, ciphertexts that increase the probability of failure. Section 4.2 presents an attack that fits in this framework.

Leveraging the decryption failures is only possible if the scheme is not IND-CCA (see Security Model 4) and the private key is kept for several queries. More precisely, these attacks are in a misuse situation where the same key pair (sk, pk) is reused for multiple key establishments by the private key owner in an IND-CPA implementation. While slightly less powerful than a chosen ciphertext attack where a decryption oracle is available, attacks leveraging decryption failures still belong to the active attack category. Admittedly, it is not surprising that an active attack can be successful on a passively secure scheme because these attacks are outside of their security models. The study in Section 4.2 is motivated by the belief that an in-depth understanding of the security offered by candidate KEM mechanisms submitted to the NIST call for proposals in key reuse situations is a useful part of their cryptanalytic evaluation, even for those candidates for which key reuse is considered as a misuse of the mechanism in an IND-CPA implementation. Having an accurate estimate of the number of decryption queries and the complexity of the private key recovery really helps to assess the possible danger2 .

Generic attack techniques for IND-CCA schemes. The aforementioned attacks can be prevented with a transformation that achieves chosen ciphertext security (see Security Model 5). It stops the adversary from being able to freely maleate ciphertexts. Indeed, the randomness used during the encapsulation is generated by submitting the message m key (and sometimes also the public key) to a random oracle. As this procedure is repeatable with knowledge of the message m key , one can check the validity of ciphertexts ct key during decapsulation. Hence, an adversary who wants to generate custom ephemeral ciphertexts ct key would need to know a preimage of the appropriate random coins for the random oracle.

Therefore, their only option is to mount a Grover's search by randomly generating ciphertexts corresponding to different messages (see Section 1.1.2 for details on the quantum Grover's algorithm). The authors of the NIST Post-Quantum candidate Kyber [START_REF] Schwabe | [END_REF] noted that it is possible to select ciphertexts with higher failure probability than average. D'Anvers et al. [START_REF] Anvers | On the impact of decryption failures on the security of LWE/LWR based schemes[END_REF] extended this idea to an attack called "failure boosting", where ciphertexts ct key with higher failure probability are generated in a first offline phase. Submitting only the selected "weak" ciphertexts speeds the search for decryption failures. [START_REF] Anvers | On the impact of decryption failures on the security of LWE/LWR based schemes[END_REF] provides an analysis of the effectiveness of the attack on several NIST candidates. At the same time, Guo et al. [START_REF] Guo | A Generic Attack on Latticebased Schemes using Decryption Errors[END_REF] described a similar generic adaptive attack that they applied against the IND-CCA secure ss-ntru-pke variant of NTRUEncrypt [START_REF] Zhang | PQC Round-2 candidate: NTRU[END_REF], which used an adaptive search for decryption failures exploiting infor-mation from previously collected ciphertexts. The latter two papers were merged into [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF]. Section 4.3 presents an extension of the latter technique that bootstraps the search for failures based on [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF]. Basically, our paper shows that, under certain hypothesis, even one failed decryption per private key can result in significantly easier further decryption failures and thus key recovery attacks. Our paper also tackles the multitarget setting where an attacker can aim at many key pairs in order to break at least one of them. This chapter unites two works [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF] and [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF] that were chronologically separated. The first work, presented in Section 4.2, was initiated in 2017 while the second one, presented in Section 4.3, started in 2019 after the introduction of the stronger generic attacks in [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF]. In this thesis, we improve (and simplify) the results of [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF] in Section 4.2 by combining them with the results of Chapter 5.

Key mismatch oracle

A decryption failure attack is a key recovery attack that leverages the lack of perfect correctness of the target scheme. In this section, we detail the access to the decryption failure information. The private key owner will be referred to as Alice. Note that Alice is also the party who initiates the two-round key establishment by sending her public key. Alice performs a key generation sk, pk ← KEM.KeyGen(1 λ ) and she keeps her key pair for many exchanges. Alice's private key sk is the target of the attack. A client, denoted Bob, can query Alice for making a key exchange using (ct key , m key ) ← KEM.Encaps(pk) and sending ct key to Alice. Alice thus derives the shared key with m key := KEM.Decaps(sk, ct key ). Bob derives his symmetric keys based on the common shared key m key . If Alice is later able to decrypt (and respond) based on m key , her version of m key , it means that no decryption failure happened.

Moreover, in the opposite case, if m key = m key ; the shared symmetric keys are different between Alice and Bob, Alice will not be able to respond, and Bob will notice a decryption failure. We introduce an oracle to capture this bit of information (success or failure of the key exchange). We use the generic name of key mismatch oracle.

Definition 16 (key mismatch oracle). Let KEM = (KeyGen, Encaps, Decaps) with a message space M and a ciphertext space Ct. For all key pairs sk, pk ← KeyGen(1 λ ), a key mismatch oracle is an oracle that outputs a bit corresponding to the success or failure of the decapsulation:

∀ct key ∈ Ct, m key ∈ M O sk (ct key , m key ) = 1 if Decaps(sk, ct key ) = m key 0 otherwise.
This definition can be identically translated to a PKE.

An example of decryption failure attack on an IND-CPA scheme

With its strong performance and its RLWE based security, NewHope is a high profile candidate of the NIST competition. Studying its security under several attacker models seems relevant.

Parameters: q = 12289, n = 1024, Error Distribution:

ψ n 8 Alice Bob 1. Key Generation seed $ ← {0, ..., 255} 32 A := P arse(hash(seed)) S, E ← ψ n 8 coin $ ← {0, ..., 255} 32 B := AS + E 2. Encapsulation Enc(pk, coin) sk := S ν B coin ←--{0, 1} n/4 S', E', E" coin ←--ψ n 8 pk := (seed, B) -------------→ A := P arse(hash(seed)) U := AS + E ν B := hash(ν B ) D := Encode(ν B ) C := BS' + E" + D 3. Decapsulation Dec(ct key , sk) ct key := (c, U) ← ------------- c := Compress(C) C' := Decompress(c) D' := C' -US m key := hash(ν B ) ν A := Decode(D') m key := hash(ν A )

Key mismatch oracle attack

We assume that NewHope is implemented in the misuse case described in Section 4.1.3. The use of the key mismatch oracle obviously leaks information on Alice's private key S as it is only passively secure. But the task of recovering S entirely seems much more complicated. Indeed as defined in Definition 16, the only information provided by the key mismatch oracle is a bit representing the success or mismatch of the key agreement. The difficulty for an attacker, called Eve, is to choose appropriate generated (ct key , m key ) pairs dishonestly to get useful information on small parts of S.

In a first step, Eve simplifies her part of the protocol in such a way that the knowledge of the key mismatch oracle output bit O sk (ct key , m key ) can be easily exploited. To do so, she can fix, for instance, ν E such that: ν E := (1, 0, . . . , 0) and thus m key := hash(ν E ).

(4.2)

The value of ν E = (1, 0, . . . , 0) has not been arbitrarily chosen; as we will see later, the 0 in positions 1 to 255 will help the success rate of the attack. From now on, the value of m key is fixed according to Eq. (4.2). Moreover, if we replace ct key by its definition: ct key = (c, U), the oracle of Definition 16 can be reformulated using the oracle O 1 defined below.

Definition 17. Let us introduce oracle O 1 such that O 1 sk (c, U) := O sk (c, U), m key With this new definition, Eve can adapt the values of c and U to leverage Oracle O 1 and retrieve information on S. In other words, since m key is fixed, the inputs (c, U) are the degrees of liberty for finding S. From Alice's side, the link between ν A and S passes through the functions Decode, Decompress (Algorithms 30 and 32) and the element D': ν A = Decode(D') = Decode(C -US) = Decode(Decompress(c) -US). Thus, from the definition of the Decode algorithm, the value of ν A [i], the i-th component of ν A , is deduced from the following sign computation:

Sign 3 j=0 (Decompress(c) -U • S)[i + 256 • j] -4s -q (4.3)
We recall here that 0 is positive by convention.

The problem for Eve is that she is unable to know the number of errors that will occur at the end of the decryption computations and the positions in which they appear. Indeed, the key mismatch oracle only gives one bit of information corresponding either to mismatch or success. If there is a mismatch, Eve knows that at least one bit of ν A is different from ν E , but she can not determine which one (or which ones). Therefore, in order to mount an effective attack, Eve needs to restrict all these different possibilities by making the following hypothesis:

Assumption 2. For i from 1 to 255, the component ν A [i] is equal to 0.
If Assumption 2 is verified, any failure in the communication comes from a single error in ν A located in the very first component ν A [0]. Indeed, in that case, the success of the exchange only depends on the first computed value ν A [0]. In particular, if we assume this hypothesis, the oracle O 2 depends only on the ν A [0], and we obtain the following result.

Lemma 17. Under Assumption 2, the initial oracle O 1 can be rewritten as

O 1 sk (c, U) = O 1 S (c, U) = Sign j=3 j=0 (Decompress(c) -US)[0 + 256 • j] -4s -q
For mounting her attack, Eve has to find pairs (c, U) that 1. target the smallest number of bits of S 2. verify Assumption 2 For item 1, the Decode algorithm takes coefficients of S four by four, and thus the size of the smallest target is a quadruplet of coefficients of S. Actually, for a given quadruplet of integers = ( 0 , 1 , 2 , 3 ) and a target index k (i.e. an index corresponding to the components of S that Eve wants to retrieve), by taking

U = s 2 x -k and c = 3 j=0 ( j + 4) mod 8 • x 256•j (4.4)
one can prove (see in Proposition 5) that Eve targets the quadruplet

S[k + 256 • j] j=0•••3 .
Indeed, the element x -k will "rotate" S to target S[k + 256 • j]/2 j=0•••3 and c is induced by the quadruplet = ( 0 , 1 , 2 , 3 ) that can vary.

About item 2, with the choice of Eq. (4.4), Assumption 2 is not validated if there exist k ∈ [0, 255] such that

Sign j=3 j=0 4 + S[k + 256 • j]/2 -8 < 0 (4.5)
A probability analysis can be done by listing of all quadruplets in [-k, k] that verify Eq. (4.5). Only a few unlikely quadruplet (e.g. [-8, -8, -8, -8]) verify it. For the considered set of parameters, Assumption 2 is correct for 98% of the private keys.

We can now introduce O 2 , a reformulation of O 1 depending on target index k and the quadruplet (see Eq. (4.4)):

O 2 S (k, ) := O 1 S s 2 x -k , 3 j=0 ( j + 4) mod 8 • x 256•j
Proposition 5. Final oracle. Let us assume that Assumption 2 is verified. Let k be a target index (k ∈ [0, 255]). For a given integer quadruplet in [-4, 3] 4 , the (c, U) is explicit in Eq. (4.4) is such that

O 2 S (k, ) = Sign j=3 j=0 j -S[k+256•j] 2 + 1+Sign( j ) 2s -8 -1 s ≈ s 0 Sign j=3 j=0 j -S[k+256•j] 2 -8
The quadruplet is restricted to [-4, 3] 4 so that j + 4 ∈ [0, 7]. Indeed, by definition, the Decompress function (Algorithm 32) takes its inputs in Z 8 . In the next section, we explain how to effectively use the form O 2 of the key mismatch oracle to extract the secret S.

Proof: Let k be an index defined in [0, 255] and let us fix = ( 0 , 1 , 2 , 3 ) ∈ [-4, 3] 4 . We show how the explicit values for (c, U) given in Equation 4.4 provide the expected result.

Let us compute the values Decompress(c)[256 • j] :

Decompress(c)[256 • j] = ( j +4 mod 8)×q 8 = ( j + 4 mod 8)s + ( j +4 mod 8) 8
= ( j + 4 mod 8)s+

( j +4 mod 8) 8 = ( j + 4 mod 8)s if j < 0 ( j + 4 mod 8)s + 1 if j ≥ 0
Under Assumption 2 the equation given by Lemma 17 thus becomes:

Sign j=3 j=0 ( j + 4 mod 8).s -s S[k + nj] 2 -4s + 1 + Sign( j ) 2 -(8s + 1)
Since belong in [-4, 3] 4 , we can remove the modulo and divide by s to obtain the final oracle.

Key recovery

With Proposition 5, one can see that the secret S is directly in jeopardy. In fact, the output of the oracle greatly depends on the coefficients of the secret, and it is possible to manipulate them separately by groups of four. Several iteration methods on can be performed to recover the coefficients of S, and the real challenge is to minimize the number of queries to the key mismatch oracle.

In [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF], we present a technique that consists in studying the variation of a function f 1 , 2 , 3 ( 0 ) = O 2 S (k, ( 0 , 1 , 2 , 3 )) for fixed k, 1 , 2 , 3 (where the three last integers are fixed randomly and k ∈ [0, 255]). The minimum of this function corresponds to 0 = S[k]/2. In our paper [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF], we considered • by mistake instead of • in the Decompress function. Consequently, the term 1+Sign( j ) 2s

was not taken into account. It led to an underestimation of the number of queries necessary to recover the full secret, originally estimated at around 18, 500 queries. Indeed, the term 1+Sign( j ) 2s

actually leads to some wrong candidates for finding the minimum of the function f 1 , 2 , 3 which complicates the attack. In [START_REF] Yue Qin | A Complete and Optimized Key Mismatch Attack on NIST Candidate NewHope[END_REF], the authors claimed that the attack actually needs more redundancy in the search for the minimum and thus that more queries are needed for a full key recovery. In this thesis, in view of the results of Chapter 5, we take a different path that does not increase the number of queries previously estimated. The technique to query the oracle remains exactly the same, but the obtained data is analyzed through the prism of Chapter 5. More precisely, in Section 5.6.2, we will show that there exists an attack 80 bits below the claimed security with the same number of queries as estimated in [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF], namely 18, 500 average queries.

Experiment This work is still supported by the proof of concept coded in Magma CAS in 2017 [START_REF] Bosma | The Magma algebra system I. The user language[END_REF] 4 . We ran 1000 experiments and we were able to run the attack on 95% of the private keys (because of Assumption 2). The latter attack outputs a candidate for the private key within 17, 000 queries on average. This candidate is close to the secret and can be used for decreasing lattice-reduction attacks as shown in Section 5.6.2.

(One) failure is not an option: an improved attack on a CCA scheme

Let us now introduce [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF]. Contrary to the decryption failure attack on the passively secure NewHope KEM presented in Section 4.2, a generic attack cannot use specially crafted ciphertexts (as in Eq. (4.4)).

The target: a generic scheme. similar failure probability and security to Kyber and Saber. These parameters can be found in Table 4.1. The security estimates are generated using the Core-SVP methodology [START_REF] Alkim | Post-quantum key exchange-a new hope[END_REF] and the LWE estimator5 [Alb+18], while the failure probability of Kyber and Saber is given as reported in their respective NIST round 2 documentations [START_REF] Schwabe | [END_REF][START_REF] Anvers | [END_REF]. The failure probability of our chosen parameters is determined by calculating the variance of the error term and assuming the distribution to be Gaussian.

Remark 16. We do not consider the case of "plain" LWE based schemes like FrodoKEM [START_REF] Naehrig | [END_REF] or Round5 [START_REF] Baan | Round5: Compact and Fast Post-quantum Public-Key Encryption[END_REF]. Nonetheless, we believe that the attack methodology could translate to the LWE setting as the failure condition and the failure probabilities are similar to the investigated case.

Remark 17. Several lattice-based candidates submitted to the NIST post-quantum cryptography standardization process use variants of the protocol by Lyubashevsky et al. [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF]. Deviating from the original design, most candidates perform an additional rounding of the ciphertext v , in order to reduce bandwidth. The designers of New Hope [Pöp+19] and LAC [START_REF] Lu | PQC Round-2 candidate: LAC[END_REF] choose to work directly over rings (or equivalently, they choose a module of rank l = 1) and add error correction on the encapsulated message, while the designers of Kyber [START_REF] Schwabe | [END_REF] and Saber [START_REF] Anvers | [END_REF] choose a module of rank l > 1 and perform an additional rounding of b (and b in case of Saber). We here focus on the basic version given in Algorithms 33 to 37 and leave the study of the effect of compression for further work.

Introduction of the failure boosting. The "failure boosting" is a technique introduced in [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF] to increase the failure rate of (Ring/Mod)-LWE/LWR based schemes by honestly generating ciphertexts and only querying weak ones, i.e. those that have a failure probability above a certain threshold f t > 0. This technique is especially useful in combination with Grover's algorithm, in which case the search for weak ciphertexts can be sped up quadratically (see Section 1.1.2). The attack assumes that a key pair has been drawn by the target (sk, pk) ← KEM.Keygen(1 λ ) and the attacker knows pk, and she wants to find sk. The failure boosting consists of two phases: a precomputation phase, and a phase where the decryption oracle is queried.

Precomputation phase. The adversary does an offline search for weak ciphertexts. For finding one weak ciphertext, the adversary has to proceed as follows.

1. Generate an encapsulation pair with (ct key , m key ) ← KEM.Encaps(pk).

If P fail

pk (ct key , m key ) > f t , keep ct key in a weak ciphertext list, otherwise go to Step 1. In Step 2, P fail pk (.) is defined as the failure probability given a public key pk, a certain ciphertext ct key and common shared key m key . It is computed as follows. Let D enc pk be the probability distribution of the output of KEM.Encaps(pk). In other words, for ct key ∈ Ct and m key ∈ M, D enc pk (ct key , m key ) := P [(ct key , m key ) ← KEM.Encaps(pk)]. The probability of finding a weak ciphertext can be expressed as follows:

α ft :=    (ct key , m key ) ∈ (Ct, M) : P fail pk (ct key , m key ) > f t    D enc pk (ct key , m key ). (4.7)
An adversary thus needs to perform on average α -1 ft work to obtain one weak ciphertext, or α -1 ft assuming Grover's search achieves a full speed-up. Decryption oracle query phase. After the precomputation phase, an adversary has a probability β ft that a weak ciphertext results in a failure, where β ft can be calculated as a weighted average of the failure probabilities of weak ciphertexts:

Thus to obtain one decryption failure with probability 1 -e -1 , an adversary needs to perform approximately β -1 ft queries and therefore α -1 ft β -1 ft work (or α -1 ft β -1 ft using a quantum computer).

Application to the generic lattice-based scheme. Throughout this chapter, we use the extended definition for the norms as presented in Section 1.2.4. Following the execution of the protocol in Algorithms 36 and 37, for a private key6 composed of (s, e) and a ciphertext ct key and a common key m key both generated from small elements s , e and e , we get by construction

O (s,e) (ct key , m key ) = 0 ⇐⇒ es T -se T + e ∞ > q/4 (4.9)
where we recall that O is defined in Definition 16. Thus,

P fail pk (ct key , m key ) = (s,e) P es T -se T + e ∞ > q/4 • P [(s, e, pk) ← KEM.Keygen(1 λ )].
(4.10) The analysis of [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF] provides several assessments of α ft and β ft with several schemes. The better an adversary can predict P fail pk (ct, K), the more efficient failure boosting will be. With no information about the secret, except its distribution, an adversary is bound to standard failure boosting as presented above. For a graphical intuition, a twodimensional toy example is depicted in Fig. 4.3, where the red arrow abusively represents the secret as a vector. Ciphertexts that lie in the dashed area will provoke a failure as the inner product with the secret vector will exceed the threshold q t . The blue circle is a circle of ciphertexts that have a certain failure probability f t as estimated by an adversary who does not know the secret. During the failure boosting procedure, we will generate random ciphertexts and only select the ciphertexts with a higher failure probability than f t , i.e. that are outside the blue circle. One can graphically see in Fig. 4.3 that these ciphertexts will have a higher failure probability and a higher norm. Note that Fig. 4.3 is an oversimplified 2-dimension example that does not take into account the polynomial structure and the high dimensionality of the space.

Definitions on failure events

In this section, we rewrite the access to the bit of information given by the key mismatch oracle in an inequality in the scalar product. This expression in Eq. (4.9) can be simplified by defining the vector S as the vertical concatenation of -s and e, the vector C as the concatenation of e and s , and by replacing e with G, as shown below:

S := -s e C := e s G := e . (4.11)
For a more visual explanation, until the end of this chapter, S and C are written as column vectors. Here, S contains the secret elements of the private key and C and G consist of elements used to construct the ciphertext and common key 7 . By using these vectors, the error expression can be rewritten: a failure occurs when S T C + G ∞ > q/4.

The standard deviation of the terms in the polynomial S T C equals √ 2nσ s σ e , versus a standard deviation of σ e for the terms of G. Therefore, the influence of G on the failure rate is limited, i.e. S T C + G ∞ ≈ S T C ∞ . Let q t := q/4 denote the failure threshold, we will consider that O S (ct key , m key ) = 0 ⇐⇒ S T C ∞ > q t . (4.12)

However, with some extra work, one could have rewritten a more accurate Eq. (4.12) as S T C ∞ > q t -G ∞ , and instead of considering q t to be fixed, taken the distribution of q t -G ∞ as shown in [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF]. For the ease of the implementation and due to the low influence of G on the failure rate, we prefer to stick with Eq. (4.12). We now introduce a more handy way of writing the failure condition (Eq. (4.12)) by only using vectors in Z q .

Definition 18 (Coefficient vector). For S ∈ R l×1 q , we denote by S ∈ Z ln×1 q , the representation of S where each polynomial is decomposed as a list of its coefficients in8 Z q starting by the low degree coefficients.

Definition 19 (Rotations). For r ∈ Z and C ∈ R l×1 q , we denote by C (r) ∈ R l×1 q , the following vector of polynomials

C (r) := X r • C(X -1 ) mod X n + 1.
Correspondingly, C (r) ∈ Z ln×1 q denotes its coefficient vector.

It is easy to show that C (r) is constructed as to ensure that for r ∈ [0, ..., n -1], the r th coordinate of S T • C is given by the scalar product S T • C (r) . In other words, one is now able to decompose S T C as a sum of products:

S T • C = r∈[0,n-1] S T • C (r) • X r . (4.13)
One can observe that this construction is only valid for the modulo X n + 1 ring structure, but it could be adapted for other ring structures. Note that for any r ∈ Z, C (r+n) = -C (r) and C (r+2n) = C (r) . Besides, taking into account the extension of the norms to vectors of polynomials, one can make the following remark.

Remark 18. Note that for any r ∈ Z,

C (r) 2 = C 2 = C 2 and C (r) ∞ = C ∞ = C ∞ .
The decomposition in Eq. (4.13) will allow a geometric interpretation of the failures as it will be shown in the rest of the chapter. First, let us introduce a brief example to illustrate Definitions 18 and 19.

Example 4.3.1. For a secret S and a ciphertext C in Z 2×1 q [X]/(X 3 + 1):

S = s 0,0 + s 0,1 X + s 0,2 X 2 s 1,0 + s 1,1 X + s 1,2 X 2 , C = c 0,0 + c 0,1 X + c 0,2 X 2 c 1,0 + c 1,1 X + c 1,2 X 2 (4.14)
we get the following vectors:

S =        s 0,0 s 0,1 s 0,2 s 1,0 s 1,1 s 1,2        , C (0) =        c 0,0 -c 0,2 -c 0,1 c 1,0 -c 1,2 -c 1,1        C (1) =        c 0,1 c 0,0 -c 0,2 c 1,1 c 1,0 -c 1,2        C (2) =        c 0,2 c 0,1 c 0,0 c 1,2 c 1,1 c 1,0        C (3) =        -c 0,0 c 0,2 c 0,1 -c 1,0 c 1,2 c 1,1        . . .
Now, let us verify Eq. (4.13) by considering the coefficient of X 1 in S T C:

s 0,0 c 0,1 + s 0,1 c 0,0 -s 0,2 c 0,2 + s 1,0 c 1,1 + s 1,1 c 1,0 -s 1,2 c 1,2 = S T • C (1) . (4.15)
In case of a failure event, S T C satisfies Eq. (4.12). Therefore, at least one element among all the coefficients

S T • C (0) , . . . , S T • C (2n-1)
is larger than q t . Indeed, note that ∀r ∈ [0, 2n

-1] S T • C (r) < -q t =⇒ S T • C (r+n) > q t .
Definition 20 (Failure event). A failure event will be denoted with F .More precisely, for r ∈ [0, 2n -1], we denote by F r the failure event where

S T • C (r) > q t .
The event F r gives a two-fold information: it provides the location of the failure in the S T C polynomial, and it also provides the sign of the coefficient that caused the failure. Thus, O S (ct key , m key ) = 1 ⇐⇒ ∃r ∈ [0, 2n -1] S T • C (r) > q t (F r ).

(4.16)

An assumption on the failing ciphertexts. In order to predict the results of our attack, we will make the following orthogonality assumption.

Assumption 3. Let N 2nl, and C 0 , • • • , C N be ciphertexts that lead to failure events

F r 0 , • • • , F r N . The vectors C (r 0 ) 0 , • • • , C (r N ) N
are considered orthogonal when projected on the hyperplane orthogonal to S.

This assumption is an approximation that is supported by the fact that normallydistributed vectors in high-dimensional space have a strong tendency towards orthogonality [START_REF] Cai | Distributions of Angles in Random Packing on Spheres[END_REF].

Directional failure boosting

Once N ≥ 1 decryption failures C 0 , . . . , C N -1 are found, additional information about the private key S becomes available, and can be used to refine the failure estimation for new ciphertexts and thus speed up failure boosting. We now introduce an iterative two-step method to perform directional failure boosting.

Step 1 An estimate, denoted E, of the 'direction' of the secret S in Z ln q is obtained from C 0 , . . . , C N -1 .

Step 2 The estimate E is used to inform the search for weak ciphertexts and improve the failure probability prediction for a new ciphertext C N . One is able to refine Eq. (4.9)'s criterion P fail pk (ct key , m key ) ≥ f t .

Once new failing ciphertexts are found in step 2, one can go back to step 1 and improve the estimate E and thus bootstrap the search for new failures.

To give an intuition, a two-dimensional toy representation can be found in Fig. 4.4. Like in the classical failure boosting technique (presented before in Fig. 4.3), the red arrow depicts the secret S, while the additional blue arrow marks estimate E. Using this estimate, we can refine the acceptance criterion to the depicted ellipse to reflect our knowledge about the secret better. Ciphertexts outside this ellipse will be flagged as weak ciphertexts, and while the probability of finding such a ciphertext is the same, the failure probability of weak ciphertexts is now higher. As in, more of the blue zone lies in the dashed area.

Step 1: Estimating the direction E

Informally, E should be a vector that has approximately the same direction as S. Denoting the angle between E and S as θ ES , the bigger | cos(θ ES )|, the closer our estimate is to ±S and the better our estimate of failure probability will be. Since we focus on estimating the direction of S, E will always be normalized.

In this section, we derive an estimate E of the direction of the secret S given N ≥ 1 ciphertexts C 0 , . . . , C N -1 . Our goal is to find E such that | cos(θ ES )| is as big as possible. We will first discuss the case where the adversary has one ciphertext, then the case where she has two, followed by the more general case where she has N ciphertexts.

One ciphertext. Assume that a unique failing ciphertext C is given. For a failure event F r , E = C (r) / C (r) 2 is a reasonable choice as cos(θ ES ) is bigger than average. This can be seen as follows:

|cos(θ ES )| = S T • E S 2 E 2 = S T • C (r) S 2 C (r) 2 > q t S 2 C (r) 2 .
(4.17)

Keeping in mind that the cosine of angles between random vectors strongly tends to zero in high dimensional space, so that even a relatively small value of |cos(θ ES )| might be advantageous.

Table 4.2: Experimental probability of finding the correct relative rotations and thus building the correct estimate E with the knowledge of 2, 3, 4 and 5 failing ciphertexts. This experiment has been performed by generating 1000 times each number of ciphertexts and trying to find the correct values of the r i .

ciphertexts 3 ciphertexts 4 ciphertexts 5 ciphertexts

P [r i = δ i,0 ∀i ∈ [1, N -1]]
84.0% 95.6% > 99.0% > 99.0%

One can argue that it is not possible to compute C (r) without knowledge of r; but in the general case, the failure location is unknown. However, E = C (0) / C (0) 2 is an equally good estimate regardless of the value of r. Indeed, C (0) approximates a rotation of the secret S := X -r • S instead of S, which can be seen using the equality A

T • B = X i A T • X i B: S T • C (r) = X -r • S T • X -r X r C (0) = X -r • S T • C (0) . (4.18)
Furthermore, multiplicating a polynomial in R q with a power of X does not change its infinity norm, as the multiplication only results in the rotation or negation of coefficients. Thus, using an estimate of the direction of X -r • S is as good as an estimate of the direction of S when predicting the failure probability of ciphertexts, and we can use

E = C (0) / C (0) 2 .
Multiple ciphertexts. Now, we assume that N linearly independent failing ciphertexts C 0 , . . . , C N -1 , resulting from failure events F r 0 , . . . , F r N -1 respectively, are given. In [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF], we introduce a generalized method to recover the relative positions denoted δ 1,0 , . . . , δ N -1,0 with high probablity. The technique is based on the "loopy belief propagation" algorithm [START_REF] Pearl | Probabilistic reasoning in intelligent systems: networks of plausible inference[END_REF]. Basically, we represent the ciphertexts C 0 , . . . , C N -1 as nodes in a fully connected graph. For two ciphertexts C i and C j , for any r ∈ [0, 2n -1], the inner product

C (r+r i ) i T • C (r+r j ) j
is slightly correlated to the secret because both C (r+r i ) i and C (r+r j ) j fail for the same rotated secret X -r S. The algorithm takes random pairs of ciphertexts and propagate the best relative positions. It finally converges with outputting a δ 1,0 , . . . , δ N -1,0 . We refer to our paper for more details on the method. In Table 4.2, we show the experimental results obtained using this technique by Jan-Pieter D'Anvers, who is to be credited for the idea of loopy belief propagation.

Once these relative positions are found, they can be combined in an estimate E with E := C tot / C tot 2 where

C tot :=   C (0) 0 / C (0) 0 2 + i∈[1,N -1] C (δ i,0 ) i / C (δ i,0 ) i 2   /N. (4.19)
Step 2: Finding weak ciphertexts

In this section, we are given an estimate E and we refine the acceptance criterion. Instead of accepting if P fail pk (ct key , m key ) ≥ f t , our condition is slightly changed to a new condition denoted Q fail pk (ct key , m key , E) > f t .

First, for r ∈ [0, 2n -1], we will estimate the probability that a ciphertext leads to an error in the r th location. Decomposing the vectors S and C in a component orthogonal to E, denoted with subscript ⊥, and a component parallel to E, denoted with subscript , we obtain a failure expression. We write "| E" to represent the knowledge of the vector E.

P S T • C (r) > q t | E =P S T • C (r) + S ⊥ T • C (r) ⊥ > q t | E =P     S 2 C (r) 2 cos(θ SE ) cos(θ C (r) E ) + S 2 C (r) 2 sin(θ SE ) sin(θ C (r) E ) cos(θ SC r )   > q t | E   =P   cos(θ SC r ) > q t -S 2 C (r) 2 cos(θ SE ) cos(θ C r E ) S 2 C (r) 2 sin(θ SE ) sin(θ C r E ) | E  
where θ SE and θ C (r) E are the angles of S and C (r) with the estimate E respectively, and where θ SC r is the angle between S ⊥ and C

⊥ . We assume no other knowledge about the direction of the secret apart from the directional estimate E. In this case, using Assumption 3, θ SC r can be estimated as a uniform angle in a (2nl -1)-dimensional space. Then θ SC r is assumed to follow the random angle probability distribution (defined as Θ 2nl-1 in [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF]).

The values E, C 2 and cos(θ C (r) E ) are known, meanwhile the values S and θ SE can be modelled using their probability distribution. Thus, we can approximate the probability P S T • C (r) > q t | E .

Assumption 4. We assume that failures at different locations are independent.

According to [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF], Assumption 4 is a valid assumption for schemes without error-correcting codes.

We can then calculate the failure probability of a certain ciphertext as:

Q fail pk (ct key , m key , E) := 1 - 2n r=0 1 -P S T • C (r) > q t | E (4.20)
As this expression gives us a better prediction of the failure probability of ciphertexts by using the information embedded in E, we can more accurately (Grover) search for weak ciphertexts and thus reduce the work to find the next decryption failure. Moreover, the better E approximates the direction of S, the easier it becomes to find a new decryption failure.

Verification of the accuracy of the estimate

To verify the efficiency of the directional failure boosting, one must quantify the accuracy of the estimate E computed according to Section 4.3.2. In this purpose, the cosine cos(θ SE ) (actually, it is cos(θ S E ) for S being a fixed rotation of the secret that can be recovered with 2N tests) can be experimentally computed. We refer to our paper for more information on the experiment [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF].

Finalizing the attack with lattice reduction

Once multiple failures are found, the private key can be recovered with lattice reduction techniques as presented in [DVV18, Section 4] and in [GJN19, Step 3 of the attack]. The following section simply outlines how their technique transposes to our framework. As shown in Section 4.3.2, an estimate E of the direction of a rotated version S = X r S with an unknown value r is provided. Therefore, similarly to [START_REF] Guo | A Generic Attack on Latticebased Schemes using Decryption Errors[END_REF], an attacker can obtain an estimation of S (and not only its direction) by rescaling

E := E • N q t •   C (0) 0 + i∈[1,n-1] C (r i ) i 2   -1 , using the approximation E T • 1/N C (0) 0 + i∈[1,n-1] C (r i ) i
≈ q t . Then, for each possible r ∈ [0, 2n -1], an attacker can perform lattice reduction and recover candidates for s, e that are accepted if they verify b = As + e. One caveat is that an attacker may have to run a lattice reduction up to 2n times. Since E -S is small, the attacker can construct an appropriate lattice basis encoding E -S as a unique shortest target vector and solves the corresponding Unique-SVP problem with the BKZ algorithm [SE94; CN11; Alk+16b; Alb+17]. The block size of BKZ will depend on the accuracy of the estimate E. Indeed, the standard deviation of E i -S i is of the order of σ s • sin(θ S E ) (assuming that θ S E is small and S 2 ≈ E 2 ).

Anticipating Chapter 5, the information given by our estimate can be modeled by approximate hints : for all i ∈ [0, ln -1],

S i + e = E i
where e follows a centered normal distribution of standard deviation σ 2 s • sin(θ S E ) 2 . Thus, when many decryption failures are available, sin(θ S E ) gets very small, and the complexity of total key recovery including the primal lattice reduction is dominated by the work required for constructing E. For example, in the case of our toy scheme, if cos(θ S E ) > 0.985, using the tool introduced in Chapter 5 (or [START_REF] Martin R Albrecht | On the concrete hardness of learning with errors[END_REF]), the BKZ block size becomes lower than 363 which leads to less than 2 100 quantum work (in the Core-SVP [Alk+16b] 0.265β model). As we will see in Section 4.3.4, this is less than the work required to find the first failure.

Remark 19. One can think that the failures obtained by directional failure boosting will not be totally independent. Indeed, the failing ciphertexts are roughly following the same direction. However, applying our Assumption 3, in high dimensions, for a reasonable number n of failures (N 2ln), the hypercone in which the failures belong is large enough in order for linear dependencies to happen with very low probability.

Estimation of the attack performance

The key takeaway of this section is that, for Table 4.1 parameters, the more failing ciphertexts have been found, the easier it becomes to obtain the next one, and that most of the effort is concentrated in finding the first failure. The final work and query overheads are stored in Table 4.4.

In this section, we will derive the optimal work and queries for an adversary, in order to obtain N ciphertexts with probability 1 -e -1 . We introduce the following notation: to find the (i + 1) th failing ciphertext; the adversary performs Q i queries. Using a Poisson distribution, the success probability of finding the (i + 1) th ciphertext in Q i queries is 1-e -Q i β i,f i . The probability of obtaining N failures can then be calculated as the product of the success probabilities of finding ciphertexts 0 to N -1:

P N = N -1 i=0 (1 -e -Q i β i,f i ). (4.21)
This is a slight underestimation of the success probability of the attack because if an adversary finds a failing ciphertext in less than Q i samples, she can query more ciphertexts in the next stages i + 1, . . . , N . However, this effect is small due to the large value of Q i .

The total amount of precomputation quantum work and the total amount of queries to obtain the N failing ciphertexts by performing Q i tries for each ciphertext, can be expressed as

W tot N := N -1 i=0 Q i √ α i,f i :=W i Q tot N := N -1 i=0 Q i . (4.22)
Recall that for now, we assume there is no upper limit to the number of decryption queries that can be made, and we focus on minimizing the amount of work. The values of Q i that minimize the total quantum work W tot N can be found using the following Lagrange multiplier, minimizing the total amount of work to find N failures with probability 1-e -1 using the above probability model:

L(Q 0 , • • • , Q N -1 , λ) = N -1 t=0 Q i √ α i,f i + λ (1 -e -1 ) - N -1 i=0 (1 -e -Q i β i,f i ) (4.23)
By equating the partial derivative of L in Q 0 , • • • , Q N -1 and λ to zero and solving the resulting system of equations, we obtain the optimal values of Q 0 , • • • , Q N -1 to mount our attack.

The resulting total work and queries of obtaining N ciphertext using directional failure boosting are given in done in less than double the work and queries, or less than one extra bit of complexity. For schemes with a lower failure probability, failing ciphertexts will be more correlated to the secret, so that the directional information is higher and directional failure boosting will be more effective.

In conclusion, the security of a scheme with low failure probability under a single target decryption failure attack can be approximated by the amount of work and queries that an adversary needs to do in order to obtain the first decryption failure. We emphasize the fact that obtaining many failures for a low overhead threatens the security of the scheme (See Section 4.3.3).

Applications

In Fig. 4.6, the total work and queries needed to obtain n ciphertexts with probability 1 -e -1 is plotted for both the traditional failure boosting, and our directional failure boosting approach. For a fair comparison between both results, we adapted the method for estimating the total work and queries with success probability 1 -e -1 using the traditional failure boosting of [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF]. For more information about our method, we refer to our paper [START_REF] Anvers | One) failure is not an option: Bootstrapping the search for failures in lattice-based encryption schemes[END_REF].

Minimizing the number of queries instead

In case a maximal number of decryption queries is imposed, say Q = 2 K , the same attack strategy can be applied. However, to limit the number of queries Q tot N necessary in the attack, a stronger preprocessing α -1 i,ft might be necessary to increase the failure probability β i,ft of weak ciphertexts over 2 -K . The only change needed to accomplish this consists in selecting the threshold f t for each i appropriately.

Too much preprocessing when K = 64. Note that, for most practical schemes (e.g. Kyber or Saber), increasing the failure probability β 0,ft over 2 -64 is not practically feasible or would require too much preprocessing α -1 0,ft . For example, considering the parameters given in Table 4.1, achieving β 0,ft > 2 -64 requires an amount of total quantum work for finding the first failure larger than 2 190 .

Application to ss-ntru-pke and improvement of Guo et al. [START_REF] Guo | A Generic Attack on Latticebased Schemes using Decryption Errors[END_REF] In [START_REF] Guo | A Generic Attack on Latticebased Schemes using Decryption Errors[END_REF], an adaptive multitarget attack is proposed on the ss-ntru-pke version of NTRUEncrypt [START_REF] Zhang | NTRUEncrypt[END_REF], a Ring-LWE based encryption scheme that claims security against chosen ciphertext attacks. The parameters of this scheme are given in Table 4. 5.

The attack performs at most 2 64 queries on at most 2 64 targets and has a classical cost of 2 216 work, and a quantum cost of 2 140 when speeding up the offline phase with Grover's search. We adapt directional failure boosting to this attack model and propose both a single and multitarget attack.

For the single target attack, our proposed methodology in Section 4.3.4 needs more than 2 64 queries to obtain a ciphertext. To mitigate this, we increase the pre-computational work √ α -1 so that the failure probability of weak ciphertexts β increases over a certain f t , which is chosen as 2 -57 to make sure the total queries are below 2 64 . The effect is a bigger overall computation, but a reduction in the number of necessary decryption queries. The rest of the attack proceeds as discussed in Section 4.3.4. The work or queries needed to obtain an extra failing ciphertext with the knowledge of N failing ciphertexts can be seen in Fig. 4.7a. The cost of this single target attack is 2 139.6 , which is close to the cost of their multitarget attack 2 139.5 , as can be seen in Table 4.6.

In the multitarget case, we can use a maximum of 2 64 • 2 64 queries to find the first failing ciphertext, after which we use the methodology of the single target attack to obtain further ciphertext with a limited amount of queries. In practice, we stay well below the query limit to find the first failure. In this case, the work is dominated by finding the second decryption failure, as we need to do this in under 2 64 queries. The resulting work to obtain an extra ciphertext is depicted in Fig. 4.7b. The cost of this attack is 2 96.6 , which is well below the cost of 2 139.5 reported by Guo et al.

Perspectives

This chapter provides an intuition of the danger of the decryption failures for the latticebased KEMs.

• When implemented in a misuse situation with key reuse in the IND-CPA version, the security of a lattice-based scheme can dramatically decrease. For the example of NewHope (Section 4.2), the security is largely decreased with less than 2 14 queries; and it can be totally broken with less than 2 20 queries. It is thus absolutely necessary to avoid these misuse situations.

• When implemented in an IND-CCA version, the work of Section 4.3 leads us to believe that having access to one failure could jeopardize the whole security. However, our results lays the first stones, and further work is still required. First, our results only apply to a simple scheme that does not correspond to any of the NIST latticebased candidates thought. Second, in our example, accessing to the first failure cost 2 102 queries, which seem above the NIST limit of 2 64 . Studying the security in a limited query setting (and/or in a multitarget case) is left as an interesting future work.

Perspective 5 (Application to schemes with error correction). For schemes with strong error correction, such as LAC [START_REF] Lu | PQC Round-2 candidate: LAC[END_REF], the error probability of the ciphertext before error correction is relatively high, which results in a lower correlation between the secret and failing ciphertexts. This would complicate the effectiveness of directional failure boosting in several ways: finding the right rotation of ciphertext to combine them into E becomes less straightforward, and the resulting E would be less correlated with the secret. However, by finding one failure, an adversary would already have more than one equation due to the multiple errors. Thus the effectiveness of directional failure boosting in these circumstances can not be derived from our results and would be an interesting future research topic.

Perspective 6 (Multitarget attack with limited number of queries.). In case an attacker has multiple possible targets 2 T but can perform at most 2 K queries at each target, she can initially search for one of more ciphertexts using a small and thus more optimal β ft > 2 -(T +K) , before focussing on one target and limiting to β ft > 2 -K , which requires more preprocessing and possibly more work. In this case, finding the first decryption failure is not necessarily the limiting factor for the adversary. While the attack strategy has been touched upon in Section 4.3.5, finding the optimal attack strategy and its efficiency would be interesting future work.

Perspective 7 (On the choice of the 2 64 queries limit). As seen in Chapters 2 and 4, the queries limitation is crucial for security assessments. One the one hand, it helps defining the parameters to avoid timing and classical attacks. On the other hand, it helps avoiding decryption failure attacks. All the security estimations are based on the 2 64 queries limit suggested by the NIST. Allowing more queries, in an order of 2 80 for instance, would be devastating for existing schemes. For ensuring the same security, the designers would need to derive larger parameters and, thus, slower algorithms. Besides, the 2 64 limits seems low for schemes that are supposed to be instantiated in the next decades. An interesting perspective can be to precisely study and motivate a choice for the maximum queries limit depending of the future usage in the cryptographic protocols.

Chapter 5

Lattice reduction attacks with side information

Figure 5.1: The security of an algorithm is commonly expressed in "bits", where n-bit security means that the attacker would have to perform 2 n operations to break it. After a complete timing, physical or decryption-failure attack, the full secret is known and the security decreases to 0. However, the attacks do not often provide the full secret but only side information on it. This chapter gives a way to compute the remaining attack complexity when some side information on the secret is given.

This work has been the last project of this PhD. It somehow wraps up the works of the previous chapters in a unified framework to estimate the complexity of lattice reduction with side information (side-channels, failures or implementation constraints). Huijing Gong and her advisor Dana Dachman-Soled joined Léo Ducas and me in this project and they provided precious help on the theoretical side.

This chapter corresponds to the final version of [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF] recently accepted to the CRYPTO conference1 . It has been very interesting and stimulating to develop such a federating framework with so many applications. Although my contributions are mainly related to the inclusion of the hints and the applications along with their implementations, everyone of us contributed to all parts of this research.

The tool that we designed looks very handy for cryptanalysis and, hopefully, it will help finish attacks that recover partial information on the secret. To ensure an easy use, a small tutorial is presented on the Github of our tool at: https://github.com/lducas/ leaky-LWE-Estimator.

Introduction and motivations

The ongoing standardization process and anticipated deployment of lattice-based cryptography raises an important question: How resilient are lattices to side-channel attacks or other forms of side information? While there are numerous works addressing this question for specific cryptosystems (See [ADP18b; Bru+16; GP18; Rav+19; Rav+18; Bos+18a] for side-channel attacks targeting lattice-based NIST candidates), these works use rather ad-hoc methods to reconstruct the private key, requiring new techniques and algorithms to be developed for each setting. For example, the work of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] uses brute-force methods for a portion of the attack, while [START_REF] Bootle | LWE Without Modular Reduction and Improved Side-Channel Attacks Against BLISS[END_REF] exploits linear regression techniques. Moreover, ad-hoc methods do not allow (1) to take advantage of decades worth of research and (2) optimization of standard lattice attacks. Second, most of the side-channel attacks from prior work consider substantial amounts of information leakage and show that it leads to feasible recovery of the entire key, whereas one may be interested in more precise tradeoffs in terms of information leakage versus concrete security of the scheme. The above motivates the focus of this chapter: Can one integrate side information into a standard lattice attack, and if so, by how much does the information reduce the cost of this attack? Given that side-channel resistance is the next step toward the technological readiness of lattice-based cryptography, and that we expect numerous new projects in this growing area, we believe that a general framework and a prediction software are in order.

In this chapter, we propose a framework that generalizes the so-called primal lattice reduction attack, and allows the progressive integration of "hints" (i.e. side information that takes one of several forms) before running the final lattice reduction step. This study is summarized in Figs. 5.2 and 5.3 and developed in Section 5.3.We also present a Sage 9.0 toolkit to actually mount such attacks with hints when computationally feasible, and to predict their performance on larger instances. Our predictions are validated by extensive experiments. Our tool and these experiments are described in Section 5.5. We finally demonstrate the usefulness of our framework and tool via three example applications. Our main example (Section 5.6.1) revisits the side-channel information obtained from the first side-channel attack of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] against Frodo. In that article, it was concluded that a divide-and-conquer side-channel template attack would not lead to a meaningful attack using standard combinatorial search for reconstruction of the secret. Our technique allows to integrate this side-channel information into lattice attacks, and to predict the exact security drop. For example, the CCS2 parameter set very conservatively aims for 128-bits of post-quantum security (or 448 "bikz" as defined in Section 5.3.4); but after the leakage of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] we predict that its security drops to 29 "bikz", i.e. that it can be broken with BKZ-29.

Interestingly, we note that our framework is not only useful in the side-channel scenario; we are, for example, also able to model decryption failures as hints fitting our framework. This allows us to reproduce some predictions from [START_REF] Anvers | On the impact of decryption failures on the security of LWE/LWR based schemes[END_REF]. This is discussed in Section 5.6.2.

Perhaps more surprisingly, we also find a novel improvement to analyze a few schemes (LAC [START_REF] Lu | PQC Round-2 candidate: LAC[END_REF], Round5 [START_REF] Garcia-Morchon | Round5. Tech. rep. NIST[END_REF]) without any side-channel or oracle queries. Indeed, such schemes use ternary distribution for secrets, with a prescribed numbers of 1 and -1: this hint fits our framework, and lead to a (very) minor improvement, discussed in Section 5.6.3.

Lastly, our framework also encompasses and streamlines existing tweaks of the primal attack: the choice of ignoring certain LWE equations to optimize the volume-dimension trade-off, as well as the re-centering [START_REF] Nguyen | Giophanthus and *LWR-based submissions[END_REF] and isotropization [Hof+09; Che+18] accounting for potential a-priori distortions of the secret. It also implicitly solves the question of the optimal choice of the coefficient for Kannan Bounded Distance Decoding problem (denoted BDD see Hard Problem 2) to unique Shortest Vector Problem (denoted uSVP see Hard Problem 1) [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF].

Technical overview. Our work is based on a generalization of the Bounded Distance Decoding problem (see Hard Problem 2) to a Distorted version (DBDD), which allows to account for the potentially non-spherical covariance of the secret vector to be found.

Each hint will affect the lattice itself, the mean and/or the covariance parameter of the DBDD instance, making the problem easier (see Fig. 5.3). At last, we make the distribution spherical again by applying a well-chosen linear transformation, reverting to a spherical BDD instance before running the attack. Thanks to the hints, this new

LWE/BDD Section 5.3.2 --------→ DBDD Λ 0 ,Σ 0 ,µ 0 Section 5.4   Hint DBDD Λ 1 ,Σ 1 ,µ 1 . . . Section 5.4   Hint DBDD Λ h ,Σ h ,µ h Section 5.3.3 --------→ uSVP Λ Section 5.3.4
--------→ Lattice reduction instance will be easier than the initial one. Let us assume that v, l, k and σ are parameters known by the attacker. Our framework can handle four types of hints on the secret s or on the lattice Λ.

• Perfect hints: s, v = l intersect the lattice with an hyperplane.

• Modular hints : s, v = l mod k sparsify the lattice.

• Approximate hints : s, v = l + σ decrease the covariance of the secret.

• Short vector hints : v ∈ Λ project orthogonally to v.

While the first three hints are clear wins for the performance of lattice attacks, the last one is a trade-off between the dimension and the volume of the lattice. This last type of hint is in fact meant to generalize the standard trick consisting of 'ignoring' certain LWE equations; ignoring such an equation can be interpreted geometrically as such a projection orthogonally to a so-called q-vector.

All the transformations of the lattice above can be computed in polynomial time. However, computing with general distribution in large dimension is not possible; we restrict our study to the case of Gaussian distributions of arbitrary covariance, for which such computations are also poly-time.

Some of these transformations remain quite expensive, in particular, because they involve rational numbers with very large denominators, and it remains rather impractical to run them on cryptographic-grade instances. Fortunately, up to a necessary hypothesis of primitivity of the vector v (with respect to either Λ or its dual depending on the type of hint), we can also predict the effect of each hint on the lattice parameters, and therefore run faster predictions of the attack cost.

From Leaks to Hints. At first, it may not be so clear that the types of hints above are so useful in realistic applications, in particular since they need to be linear on the secret. Of course our framework can handle rather trivial hints such as the perfect leak of a secret coefficient s i = l. Slightly less trivial is the case where only the low-order bits leaks, a hint of the form s i = l mod 2.

We note that most of the computations done during an LWE decryption are linear: leaking any intermediate register during a matrix vector product leads to a hint of the same form (possibly mod q). Similarly, the leak of a NTT coefficient of a secret in a Ring/Module variant can also be viewed as such.

Admittedly, such ideal leaks of a full register are not the typical scenario and leaks are typically not linear (for the addition in Z q ) on the content of the register. However, such non-linearities can be handled by approximate hints. For instance, let s 0 be a secret coefficient (represented by a signed 16-bits integer), whose a priori distribution is supported by {-5, . . . , 5}. Consider the case where we learn the Hamming weight of s 0 , say H(s 0 ) = 2. Then, we can narrow down the possibilities to s 0 ∈ {3, 5}. This leads to two hints:

• a modular hint: s 0 = 1 mod 2,

• an approximate hint: s 0 = 4 + 1 , where 1 has variance 1.

While closer to a realistic scenario, the above example remains rather simplified. A detailed example of how realistic leaks can be integrated as hints will be given in Section 5.6.1, based on the leakage data from [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF].

Preliminaries

Linear Algebra

We use bold lower case letters to denote vectors, and bold upper case letters to denote matrices. Let •, • denote the inner product of two vectors of the same size. Let us introduce the row span of a matrix (denoted Span(•)) as the subspace generated by all R-linear combinations of the rows of its input.

Definition 21 (Positive Semidefinite

). A n × n symmetric real matrix M is positive semidefinite if scalar xMx T ≥ 0 for all x ∈ R n ; if so we write M ≥ 0. Given two n × n real matrix A and B, we note A ≥ B if A -B is positive semidefinite. Definition 22. A matrix M is a square root of Σ, denoted √ Σ, if M T • M = Σ,
Our techniques involve keeping track of the covariance matrix Σ of the secret and error vectors as hints are progressively integrated. The covariance matrix may become singular during this process and will not have an inverse. Therefore, in the following, we introduce some degenerate notions for the inverse and the determinant of a square matrix. Essentially, we restrict these notions to the row span (denoted Span()) of their input. For X ∈ R d×k (with any d, k ∈ N), we will denote Π X the orthogonal projection matrix onto Span(X). More formally, let Y be a maximal set of independent row-vectors of X; the orthogonal projection matrix is given by Π

X := Y T • (Y • Y T ) -1 • Y. Its complement (the projection orthogonally to Span(X)) is denoted Π ⊥ X := I d -Π X .
We naturally extend the notation Π F and Π ⊥ F to subspaces F ⊂ R d . By definition, the projection matrices satisfy

Π 2 F = Π F , Π T F = Π F and Π F • Π ⊥ F = Π ⊥ F • Π F = 0.
Definition 23 (Restricted inverse and determinant). Let Σ be a symmetric matrix. We define a restricted inverse denoted Σ ∼ as

Σ ∼ := (Σ + Π ⊥ Σ ) -1 -Π ⊥ Σ . It satisfies Span(Σ ∼ ) = Span(Σ) and Σ • Σ ∼ = Π Σ .
We also denote rdet(Σ) as the restricted determinant defined as follows.

rdet(Σ) := det(Σ + Π ⊥ Σ ).

The idea behind Definition 23 is to provide an (artificial) invertibility property to the input Σ by adding the missing orthogonal part and to remove it afterwards. For example, if Σ = A 0 0 0 where A is invertible,

Σ ∼ = A 0 0 0 + 0 0 0 1 -1 - 0 0 0 1 = A -1 0 0 0 and rdet Σ = det(A).

Statistics

Recall that random variables, i.e. variables whose values depend on outcomes of a random phenomenon, are denoted in lowercase calligraphic letters e.g. a, b. Random vectors are denoted in uppercase calligraphic letters e.g. C, X, Z.

Before hints are integrated, we will assume that the secret and error vectors follow a multidimensional normal (Gaussian) distribution. Hints will typically correspond to learning a (noisy, modular or perfect) linear equation on the secret. We must then consider the altered distribution on the secret, conditioned on this information. Fortunately, this will also be a multidimensional normal distribution with an altered covariance and mean. In the following, we present the precise formulae for the covariance and mean of these conditional distributions. The notations derive from the ones defined Section 2.2.2 because we consider a generalized continuous distribution.

Definition 24 (Multidimensional normal distribution). Let d ∈ Z, for µ ∈ Z d and Σ being a symmetric positive semidefinite matrix of dimension d × d, we denote by G d Σ,µ the multidimensional normal distribution supported by µ + Span(Σ) by the following

x ∈ R d → 1 (2π) rank(Σ) • rdet(Σ) exp - 1 2 (x -µ) • Σ ∼ • (x -µ) T .
Theorem 12 shows the altered distribution of a normal random variable conditioned on its noisy linear transformation value, following from the more generalized result of [Liu19, Equations (6) and ( 7)], which we refer to for the calculative proof.

Theorem 12 (Conditional distribution X| X, v + e). Suppose that X ∈ Z d has a G d Σ,µ
distribution and e has a G 1 σ 2 e ,0 distribution. Let us fix v ∈ R d as a nonzero vector and z ∈ Z. We define the following scalars:

z := X, v + e, µ 2 := v, µ and σ 2 := vΣv T + σ 2 e If σ 2 = 0, the conditional distribution of X (z = z) is G d Σ ,µ , where µ = µ + (z -µ 2 ) σ 2 vΣ Σ = Σ - Σv T vΣ σ 2 . If σ 2 = 0, the conditional distribution of X (z = z) is G d Σ,µ .
Remark 20. We note that Theorem 12 is also valid for X| X, v by letting σ e = 0.

Lattices

Recall for Section 5.1 that a lattice, denoted here as Λ, is a discrete additive subgroup of R m , which is generated as the set of all linear integer combinations of n (m ≥ n) linearly independent basis vectors {b j } ⊂ R m , namely,

Λ := j z j b j : z j ∈ Z ,
A matrix B having the basis vectors as rows is called a basis matrix. Recall that the volume of a lattice Λ is defined as Vol(Λ) := det(BB T ). The dual lattice of Λ in R n is defined as follows.

Λ * := {y ∈ Span(B) | ∀x ∈ Λ, x, y ∈ Z}.
Note that, (Λ * ) * = Λ, and Vol(Λ * ) = 1/ Vol(Λ). For a detailed introduction of dual lattices properties, we refer to [START_REF] Micciancio | Lattices Algorithms and Applications (course CSE206A)[END_REF].

Lemma 18 ([Mar13, Proposition 1.3.4]). Let Λ be a lattice and let F be a subspace of R n . If Λ ∩ F is a lattice, then the dual of Λ ∩ F is the orthogonal projection onto F of the dual of Λ. In other words, each element of Λ * is multiplied by the projection matrix Π F :

(Λ ∩ F ) * = Λ * • Π F .
Definition 25 (Primitive vectors). A set of vector y 1 , . . . , y k ∈ Λ is said primitive with respect to Λ if Λ ∩ Span(y 1 , . . . , y k ) is equal to the lattice generated by y 1 , . . . , y k . Equivalently, it is primitive if it can be extended to a basis of Λ. If k = 1, y 1 , this is equivalent to y 1 /i ∈ Λ for any integer i ≥ 2.

To predict the hardness of the lattice reduction on altered instances , we must compute the volume of the final transformed lattice. We devise a highly efficient way to do this, by observing that each time a hint is integrated, we can update the volume of the transformed lattice, given only the volume of the previous lattice and information about the current hint (under mild restrictions on the form of the hint). In the following, we present technical lemmas that will be useful for progressively computing the volume of the transformed lattice when different types of hints are integrated. We refer to the original paper for their proofs [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF].

Lemma 19 (Volume of a lattice slice). Given a lattice Λ with volume Vol(Λ), and a primitive vector v with respect to Λ

* . Let v ⊥ denote subspace orthogonal to v. Then Λ ∩ v ⊥ is a lattice with volume Vol(Λ ∩ v ⊥ ) = v • Vol(Λ).
Lemma 20 (Volume of a sparsified lattice). Let Λ be a lattice, v ∈ Λ * be a primitive vector of Λ * , and k > 0 be an integer.

Let Λ = {x ∈ Λ | x, v = 0 mod k} be a sublattice of Λ. Then Vol(Λ ) = k • Vol(Λ).
Lemma 21 (Volume of a projected lattice). Let Λ be a lattice, v ∈ Λ be a primitive vector of Λ.

Let Λ = Λ • Π ⊥ v be a sublattice of Λ. Then Vol(Λ ) = Vol(Λ)/ v . More generally, if V is a primitive set of vectors of Λ, then Λ = Λ • Π ⊥ V has volume Vol(Λ ) = Vol(Λ)/ det(VV T ).
Lemma 22 (Lattice volume under linear transformations). Let Λ be a lattice in R n , and M ∈ R n×n a matrix such that ker M = Span(Λ) ⊥ . Then we have Vol(Λ • M) = rdet(M) Vol(Λ). interpret DBDD as the promise that the secret follows a Gaussian distribution of center µ and covariance Σ.

DBDD BDD uSVP

The ellipsoid can be seen as an affine transformation (that we call "distortion") of the centered hyperball of radius rank(Σ). Let us re-use the notation for the hyperball introduced in Eq. (1.1), i.e. for any d ∈ N B d (0, d) denotes an hyperball of dimension and radius d. In particular B d (0, d) = E(0, I d ). One can thus write using Definition 22:

E(µ, Σ) = B rank(Σ) (0, rank(Σ)) • √ Σ + µ. (5.2)
From the Span inclusion in Eq. ( 5.1), one can deduce that the condition is equivalent to requiring µ / ∈ Span(Σ) and rank(Σ + µ T • µ) = rank(Σ) + 1 = rank(Λ). This detail is necessary for embedding it properly into a uSVP instance (See later in Section 5.3.3).

Particular cases of Hard Problem 11. Let us temporarily ignore the condition in Eq. ( 5.1) to study some particular cases. As shown in Fig. 5.4, when Σ = I d , DBDD Λ,µ,I d is BDD instance. Indeed, the ellipsoid becomes a shifted hyperball E(µ,

I d ) = {x ∈ µ + R d×d | x -µ 2 ≤ d} = B d + µ.
If in addition µ = 0, DBDD Λ,0,I d becomes a uSVP instance on Λ.

Embedding LWE into DBDD

In the typical primal attack framework (Fig. 5.2), one directly views LWE as a BDD instance of the same dimension. For our purposes, however, it will be useful to apply Kannan's Embedding at this stage and therefore increase the dimension of the lattice by 1. While it could be delayed to the last stage of our attack, this extra fixed coefficient 1 will be particularly convenient when we integrate hints (see Remark 25 in Section 5.4). It should be noted that no information is lost through this transformation. Indeed, the parameters µ and Σ allow us to encode the knowledge that the solution we are looking for has its last coefficient set to 1 and nothing else.

In more details, the solution s := (e, z) of an LWE instance is extended to s := (e, z, 1), (5.3) which is a short vector in the lattice Λ = (x, y, w) |x + yA Tbw = 0 mod q . A basis of this lattice is given by the row vectors of

  qI m 0 0 A T -I n 0 b 0 1   .
Denoting µ χ and σ 2 χ the average and variance of the LWE distribution χ (See Hard Problem 10), we can convert this LWE instance to a DBDD Λ,µ,Σ instance with µ = [µ χ • • • µ χ 1] and Σ = σ 2 χ I m+n 0 0 0 . The lattice Λ is of full rank in R d where d := m + n + 1, and its volume is q m . Note that the rank of Σ is only d -1: the ellipsoid has one less dimension than the lattice. It then validates the requirement of Eq. (5.1).

Remark 21. Typically, Kannan's embedding from BDD to uSVP leaves the bottom right matrix coefficient as a free parameter, say c, to be chosen optimally. The optimal value is the one maximizing

(z; c) det(Λ) 1/d = (m + n)σ χ + c (c • q m ) 1/d
, namely, c = σ χ according to the arithmetic-geometric mean inequality. Some prior work [Alb+17; BMW19] instead chose c = 1. While this is benign since σ χ is typically not too far from 1, it remains a sub-optimal choice. Looking ahead, in our DBDD framework, this choice becomes irrelevant thanks to the isotropization step introduced in the next section; we can therefore choose any value without affecting the final result.

Converting DBDD to uSVP

In this section, we explain how a DBDD instance (Λ, µ, Σ) is converted into a uSVP one. Two modifications are necessary.

First, let us show that the ellipsoid in Hard Problem 11 is contained in a larger centered ellipsoid (with one more dimension) as follows:

E(µ, Σ) ⊂ E(0, Σ + µ T • µ).
(5.4) Using Eq. ( 5.2), one can write

E(µ, Σ) = B rank(Σ) (0, rank(Σ)) • √ Σ + µ ⊂ B rank(Σ) (0, rank(Σ)) • √ Σ ± µ,
where B rank(Σ) is defined in Eq. (1.1). And, with Equation Eq. ( 5.1), one can deduce rank(Σ + µ T • µ) = rank(Σ) + 1, then:

B rank(Σ) (0, rank(Σ)) • √ Σ ± µ ⊂ B rank(Σ)+1 (0, rank(Σ) + 1) • √ Σ µ .
We apply Definition 22 which confirms the inclusion of Eq. (5.4):

E(µ, Σ) ⊂ B rank(Σ)+1 (0, rank(Σ) + 1) • √ Σ µ = E(0, Σ + µ T • µ).
Thus, we can homogenize and transform the instance into a centered one with Σ := Σ + µ T • µ.

Secondly, to get an isotropic distribution (i.e. with all its eigenvalues being 1), one can just multiply every element of the lattice with the pseudoinverse of √ Σ . We get a new covariance matrix Σ

= √ Σ ∼ • Σ • √ Σ ∼T = Π Σ • Π Σ T . And since Π Σ = Π T Σ and Π 2 Σ = Π Σ (see Section 5.2.1), Σ = Π Σ = Π Λ ,
the last equality coming from Eq. (5.1). In a nutshell, one must make by the two following changes:

homogenize: (Λ, µ, Σ) → (Λ, 0, Σ := Σ + µ T • µ) isotropize: (Λ, 0, Σ ) → (Λ • M, 0, Π Λ )
where M := ( √ Σ ) ∼ . From the solution x to the uSVP Λ•M problem, one can derive x = xM ∼ the solution to the DBDD Λ,µ,Σ problem. Note that, to solve a DBDD instance, one can ignore the isotropization and directly apply lattice reduction before the second step. This leads, however, to less efficient attacks.

Remark 22. One should note that the first homogenization step "forgets" some information about the secret's distribution. This, however, is inherent to the conversion to a unique-SVP problem which is geometrically homogeneous and is already present in the original primal attack.

Security estimates of uSVP: bikz versus bits

The attack on a uSVP instance consists of applying, the algorithm BKZ-β, presented in Section 1.2.2, on the uSVP lattice Λ for an appropriate block size parameter β. The cost of the attack grows with β, however, modeling this cost precisely is at the moment rather delicate, as the state of the art seems to still be in motion. Numerous NIST candidates choose to underestimate this cost, keeping a margin to accommodate future improvements, and there seems to be no clear consensus on which model to use (see [START_REF] Albrecht | Estimate All the LWE, NTRU Schemes![END_REF] for a summary of existing cost models).

While this problem is orthogonal to our work, we still wish to be able to formulate quantitative security losses. We therefore express all concrete security estimates using the blocksize β as our measure of the level of security, and treat the latter as a measurement of the security level in a unit called the bikz. We thereby leave the question of the exact bikz-to-bit conversion estimate outside the scope of this chapter, and recall that those conversion formulae are not necessarily linear, and may have small dependency in other parameters. For the sake of concreteness, we note that certain choose, for example, to claim 128 bits of security for 380 bikz, and in this range, most models suggest a security increase of one bit every 2 to 4 bikz.

Remark 23. We also clarify that the estimates given within this chapter only concern the pure lattice attack via the uSVP embedding discussed above. In particular, we note that some NIST candidates with ternary secrets [Lu+19] also consider the hybrid attack of [START_REF] Howgrave-Graham | A Hybrid Lattice-Reduction and Meet-in-the-Middle Attack Against NTRU[END_REF], which we ignore in this work. We nevertheless think that the compatibility with our framework is plausible, with some effort.

Predicting β from a uSVP instance The state-of-the-art predictions for solving uSVP instances using BKZ were given in [Alk+16b; Alb+17]. Namely, for Λ a lattice of dimension dim(Λ), it is predicted that BKZ-β can solve a uSVP Λ instance with secret s when

β/ dim(Λ) • s ≤ δ 2β-dim(Λ)-1 β • Vol(Λ) 1/ dim(Λ) (5.5)
where δ β is the so called root-Hermite factor of BKZ-β presented in Section 1.2.2. We recall that, for β ≥ 50, the root-Hermite factor is predictable :

δ β = (πβ) 1 β • β 2πe 1/(2β-2)
.

(5.6)

Note that the uSVP instances we generate are isotropic and centered so that the secret has covariance Σ = I (or Σ = Π Λ if Λ is not of full rank) and µ = 0. Thus, on average, we have s 2 = rank(Σ) = dim(Λ). Therefore, β can be estimated as the minimum integer that satisfies β ≤ δ 2β-dim(Λ)-1 β

• Vol(Λ) 1/ dim(Λ) .

(5.7) While β must be an integer as a BKZ parameter, we nevertheless provide a continuous value, for a finer comparison of the difficulty of an instance.

Remark 24. To predict security, one does not need the basis of Λ, but only its dimension and its volume. Similarly, it is not necessary to explicitly compute the isotropization matrix M of Section 5.3.3, thanks to Lemma 22: Vol(Λ • M) = rdet(M) Vol(Λ) = rdet(Σ ) -1/2 Vol(Λ). These two shortcuts will allow us to efficiently make predictions for cryptographically large instances, in our lightweight implementation of Section 5.5.

Refined prediction for small blocksizes For experimental validation purposes of our work, we prefer to have accurate prediction even for small blocksizes; a regime where those predictions are not accurate with the current state of the art. Léo Ducas suggested a refined strategy using BKZ-simulation and a probabilistic model, we refer to the paper [Dac+20] for more details.

Including hints

In this Section, we define several categories of hints-perfect hints, modular hints, approximate hints (conditioning and a posteriori ), and short vector hints-and show that these types of hints can be integrated into a DBDD instance. Hints belonging to these categories typically have the form of a linear equation in s (and possibly additional variables). As emphasized in Section 5.1, these hints have lattice-friendly forms and their usefulness in realistic applications may not be obvious. We refer to Section 5.6 for detailed applications of these hints. The technical challenge, therefore, is to characterize the effect of such hints on the DBDD instance-i.e. determine the resulting (Λ , µ , Σ ) of the new DBDD instance, after the hint is incorporated.

Henceforth, let I = DBDD Λ,µ,Σ be a fixed instance and let s be its secret solution. Each hint will introduce new constraints on s and will ultimately decrease the security level.

Non-Commutativity It should be noted that many types of hints commute: integrating them in any order will lead to the same DBDD instance. Potential exceptions are numerical modular hints (See later in Section 5.4.2) and a posteriori approximate hints (See later in Section 5.4.4): they do not always commute with the other types of hints, and do not always commute between themselves, unless the vectors v's of those hints are all orthogonal to each other. The reason is: in these cases, the distribution in the direction of v is redefined which erases the prior information.

Perfect Hints

Definition 26 (Perfect hint). A perfect hint on the secret s is the knowledge of v ∈ Z d-1 and l ∈ Z, such that s, v = l.

A perfect hint is quite strong in terms of additional knowledge. It allows decreasing the dimension of the lattice by one. One could expect such hints to arise from the following scenarios:

• The full leak without noise of an original coefficient, or even an unreduced intermediate register since most of the computations are linear. For the second case, one may note that optimized implementations of NTT typically attempt to delay the first reduction modulo q, so leaking a register on one of the first few levels of the NTT would indeed lead to such a hint.

• A noisy leakage of the same registers, but with still a rather high guessing confidence. In that case it may be worth making the guess while decreasing the success probability of the attack.3 This could happen in a cold-boot attack scenario. This is also the case in the single trace attack on Frodo [Bos+18a] that we will study as one of our examples in Section 5.6.1.

• More surprisingly, certain schemes, including some NIST candidates offer such a hint 'by design'. Indeed, LAC and Round5 choose ternary secret vectors with a prescribed number of 1's and -1's, which directly induce one or two such perfect hints. This will be detailed in Section 5.6.3.

Integrating a perfect hint into a DBDD instance Let v ∈ Z d-1 and l ∈ Z be such that s, v = l. Note that the hint can also be written as

s, v = 0,
where s is the extended LWE secret as defined in Eq. ( 5.3) and v := (v ; -l).

Remark 25. Here we understand the interest of using Kannan's embedding before integrating hints rather than after: it allows to also homogenize the hint, and therefore to make Λ a proper lattice rather than a lattice coset (i.e. a shifted lattice).

Including this hint is done by modifying the DBDD Λ,µ,Σ to DBDD Λ ,µ ,Σ , where:

Λ = Λ ∩ x ∈ Z d | x, v = 0 Σ = Σ - (vΣ) T vΣ vΣv T (5.8) µ = µ - v, µ vΣv T vΣ (5.9)
We now explain how to derive the new mean µ and the new covariance Σ . Let z be the random variable s, v , where s has mean µ and covariance Σ. Then µ is the mean of s conditioned on z = 0, and Σ is the covariance of s conditioned on z = 0. Using Theorem 12, we obtain the corresponding conditional mean and covariance.

We note that lattice Λ is an intersection of Λ and a hyperplane orthogonal to v. Given B as the basis of Λ, by Lemma 18, a basis of Λ can be computed as follows:

1. Let D be dual basis of B. Compute D ⊥ := D • Π ⊥ v . 2.
Apply LLL algorithm on D ⊥ to eliminate linear dependencies. Then delete the first row of D ⊥ (which is 0 because with the hyperplane intersection, the dimension of the lattice is decremented).

3. Output the dual of the resulting matrix.

While polynomial time, the above computation is quite heavy, especially as there is no convenient library offering a parallel version of LLL. Fortunately, for predicting attack costs, one only needs the dimension of the lattice Λ and its volume. These can easily be computed assuming v is a primitive vector (See Definition 25) of the dual lattice: the dimension decreases by 1, and the volume increases by a factor ||v||. This is stated and proved in Lemma 19. Intuitively, the primitivity condition is needed since then one can scale the leak to s, f v = f l for any non-zero factor f ∈ R and get an equivalent leak; however there is only one factor f that can ensure that f v ∈ Λ * , and is primitive in it.

Remark 26. Note that if v is not in the span of Λ-as typically occurs if other nonorthogonal perfect hints have already been integrated-Lemma 19 should be applied to the orthogonal projection v = v • Π Λ of v onto Λ. Indeed, the perfect hint s, v = 0 replacing v by v is equally valid.

Modular Hints

Definition 27 (Modular hint). A modular hint on the secret s is the knowledge of

v ∈ Z d-1 , k ∈ Z and l ∈ Z, such that s, v = l mod k.
We can expect such hints to arise from several scenarios:

• obtaining the value of an intermediate register during LWE decryption would likely correspond to giving such a modular equation modulo q. This is also the case if an NTT coefficient leaks in a Ring-LWE scheme. It can also occur "by design" if the LWE secret is chosen so that certain NTT coordinates are fixed to 0 modulo q, as is the case in some instances of Order LWE [START_REF] Bolboceanu | Order-LWE and the Hardness of Ring-LWE with Entropic Secrets[END_REF].

• obtaining the absolute value a = |s| of a coefficient s implies s = a mod 2a, and such a hint could be obtained by a timing attack on an unprotected implementation of a table-based sampler, in the spirit of [START_REF] Groot Bruinderink | Flush, Gauss, and Reload -A Cache Attack on the BLISS Lattice-Based Signature Scheme[END_REF].

• obtaining the Hamming weight of the string b 1 b 2 . . . b 1 b 2 . . . used to sample a centered binomial coefficient s = b i -b i (as done in NewHope and Kyber [Sch+19; Pöp+19]) reveals, in particular, s mod 2. Indeed, the latter string (or at least some parts of it) is more likely to be leaked than the Hamming weight of s.

Integrating a modular hint into a DBDD instance. Let v ∈ Z d , k ∈ Z and l ∈ Z be such that s, v = l mod k. Note that the hint can also be written as

s, v = 0 mod k (5.10)
where s is the extended LWE secret as defined in Eq. ( 5.3) and v := (v ; -l). We refer to Remark 25 for the legitimacy of such dimension increase. Intuitively, such a hint should only sparsify the lattice, and leave the average and the variance unchanged. This is not entirely true, this is only (approximately) true when the variance is sufficiently large in the direction of v to ensure smoothness, i.e. when k 2 vΣv T ; one can refer to [MR07, Lemma 3.3 and Lemma 4.2] for the quality of that approximation. In this smooth case, we therefore have:

Λ = Λ ∩ x ∈ Z d | x, v = 0 mod k (5.11) µ = µ (5.12) Σ = Σ (5.13)
On the other hand, if k 2 vΣv T , then the residual distribution will be highly concentrated on a single value, and one should therefore instead use a perfect s, v = l + ik for some i.

Numerical solution. One can wonder how to include the hint if the smoothness is not ensured and if it is not a perfect hint. One can always resort to a numerical computation of the average µ c and the variance σ 2 c of the one-dimensional centered discrete Gaussian of variance σ 2 = vΣv T over the coset l + kZ. Thus, the lattice should then be sparsified as in the smooth case with Equation Eq. (5.11) and the following corrections must be applied:

µ = µ + µ c -v, µ vΣv T vΣ (5.14) Σ = Σ + σ 2 c (vΣv T ) 2 - 1 vΣv T (vΣ) T (vΣ) (5.15) (5.16)
Intuitively, these formulae completely erase prior information on s, v , before it is replaced by the new average and variance in the adequate direction. Both can be derived using Theorem 12.

As for perfect hints, the computation of Λ can be done by working on the dual lattice. More specifically:

1. Let D be dual basis of B.

2. Redefine v := v • Π Λ , noting that this does not affect the validity of the hint.

3. Append v/k to D and obtain D 4. Apply LLL algorithm on D to eliminate linear dependencies. Then delete the first row of D (which is 0 since we introduced a linear dependency).

5. Output the dual of the resulting matrix.

Also, as for perfect hints, the parameters of the new lattice Λ can be predicted: the dimension is unchanged, and the volume increases by a factor k under a primitivity condition, which is proved by Lemma 20.

Approximate Hints (conditioning)

Definition 28 (Approximate hint). An approximate hint on secret s is the knowledge of v ∈ Z d-1 and l ∈ Z, such that s, v + e = l, where e models noise following a centered normal distribution of standard deviation σ 2 e , independent of s.

One can expect such hints from:

• any noisy side channel information about a secret coefficient. This is the case of our study in Section 5.6.1.

• decryption failures. In Section 5.6.2, we show how this type of hint can represent the information gained by a decryption failure.

To include this knowledge in the DBDD instance, we must combine this knowledge with the prior knowledge on the solution s of the instance.

Integrating an approximate hint into a DBDD instance Let v ∈ Z d-1 and l ∈ Z be such that s, v ≈ l. Note that the hint can also be written as s, v + e = 0

(5.17

)
where s is the extended LWE secret as defined in Eq. The new covariance and mean follow from Theorem 12.

Consistency with Perfect Hint Note that if σ e = 0, we fall back to a perfect hint s, v = l. The above computation of Σ Eq. (5.19) (resp. µ Eq. (5.20)) is indeed equivalent to Eq. (5.8) (resp. Eq. (5.9)) from Section 5.4.1. Note however, in our implementation, that to avoid singularities, we require the span of Span(Σ + µ T µ) = Span(Λ) (See the requirement in Equation Eq. (5.1)): If σ e = 0, one must instead use a Perfect hint.

Multi-dimensional approximate hints The formulae of [START_REF] Liu | Linear Transformation of Multivariate Normal Distribution: Marginal, Joint and Posterior[END_REF] are even more general, and one could consider a multidimensional hint of the form sV + e = l, where V ∈ R n×k and e a Gaussian noise of any covariance Σ e . However, those general formulae require explicit matrix inversion which becomes impractical in large dimension. We therefore only implemented full-dimensional (k = n) hint integration in the super-lightweight version of our tool, which assumes all covariance matrices to be diagonal. These will be used for hints obtained from decryption failures in Section 5.6.2.

Approximate Hint (a posteriori)

In certain scenarios, one may more naturally obtain directly the a posteriori distribution of s, v , rather than a hint s, v + e = l for some error e independent of s. Such a

The dimension of the lattice decreases by one (or by k, if one directly integrates a matrix of k vectors) and the volume of the lattice also decreases according to Lemma 21.

Worthiness and choice of short vector hints Integrating such a hint induces a tradeoff between the dimension and the volume, and therefore it is not always advantageous to integrate. We refer to [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF] for a discussion on the worthiness of the short vector hints. In the typical studied cases, the short vector hints are either the q-vectors or some simple transformation of the q-vectors (See Section 5.6.3 for example).

Implementation

Our sage implementation

We propose three implementations of our framework, all following the same python/sage 9.0 API.4 More specifically, the API and some common functions are defined in a sage file denoted DBDD_generic.sage, as a class DBDD_Generic. Three derived classes are then given:

1. The class DBDD (provided in DBDD.sage) is the full-fledged implementation: i.e. it fully maintains all information about a DBDD instance as one integrates hints: the lattice Λ, the covariance matrix Σ and the average µ. While polynomial time, maintaining the lattice information can be quite slow, especially since consecutive intersections with hyperplanes can lead to manipulations on rationals with large denominators. It also allows to finalize the attack, running the homogenization, isotropization and lattice reduction, based on the fplll library available through sage.

We note that if one were to repeatedly use perfect or modular hints, a lot of effort would be spent on uselessly alternating between the primal and the dual lattice. Instead, we implement a caching mechanism for the primal and dual basis, and only update them when necessary.

2. The class DBDD_predict (provided in DBDD_predict.sage) is the lightweight implementation: it only fully maintains the covariance information, and the parameters of the lattice (dimension, volume). It must therefore work under assumptions about the primitivity of the vector v; in particular, it cannot detect hints that are redundant. If one must resort to this faster variant on large instances, it is advised to consider potential (even partial) redundancy between the given hints, and to run a comparison with the previous on small instances with similarly generated hints.

3. The class DBDD_predict_diag (provided in DBDD_predict_diag.sage) is the superlightweight implementation. It maintains the same information as the above, but requires the covariance matrix to remain diagonal at all times. In particular, one can only integrate hints for which the directional vector v is colinear with a canonical vector.

Tests and validation

In our paper [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF], we present a demonstration of our tool with some extracts of Sage 9.0 code. We implement two tests to verify the correctness of our scripts, and more generally the validity of our predictions. The hint vectors v were chosen as random ternary vectors of weight 5. Consistency checks. Our first test simply verifies that all three classes always agree perfectly. More specifically, we run all three versions on a given instance, integrating the same random hint in all of them, and compare their hardness prediction. We first test using the full-fledged version that the primitivity condition does hold, and discard the hint if not, as we know that predictions cannot be correct on such hints. This verification passes.

Prediction verifications. We now verify experimentally the prediction made by our tool for various types of hints, by comparing those predictions to actual attack experiments. This is done for a given set of LWE parameters, and increasing the number of hints. The details of the experiments and the results are given in Fig. 5.5. While our predictions seem overall accurate, we still note a minor discrepancy of up to 2 or 3 bikz in the low blocksize regime. This exceeds the error made by prediction on the attack without any hint, which was below 1 bikz, even in the same low blocksize regime.

We suspect that this discrepancy is due to residual q-vectors, or small combinations of them, that are hard to predict for randomly generated hints but would still benefit by lattice reduction. We tested that hypothesis by running similar experiments, but leaving certain coordinates untouched by hints, so to still explicitly know some q-vectors for short-vector hint integration, if they are "worthy". This did not to improve the accuracy of our prediction. We are at the moment unable to explain it. We nevertheless find our predictions satisfactory, considering that even without considering hints, previous predictions [START_REF] Martin R Albrecht | Revisiting the expected cost of solving uSVP and applications to LWE[END_REF] were much less accurate.

Applications

The purpose of this section is to exemplify our tool on a several known side-channel, decryption-failures, or classical attacks. We chose several simple scenarios already existing in the literature to show how our framework can be used. Even though the results in themselves are not claimed to beat the best known attacks, we believe that it opens the path for more applications and more elaborate hybrid lattice attacks. 5.6.1 Hints from side channels: application to [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] In [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF], W. Bos et al. study the feasibility of a single-trace power analysis of the Frodo Key Encapsulation Mechanism [START_REF] Naehrig | [END_REF]. We refer to Section 1.1.3 for more details on this single-trace attack model. Specifically, in a first approach, they analyze the possibility of a divide-and-conquer attack targeting a multiplication in the key generation. This attack was claimed unsuccessful in [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] because the brute force phase after recovering a candidate for the private key was too expensive. Along with this unsuccessful result, a successful powerful extend-and-prune attack is provided in [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF].

Keeping the purpose of this section in mind, improving the former unsuccessful divide-and-conquer attack of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] is a perfect application for understanding the impact of our framework. However, note that we do not claim to have found the best single-trace attack on Frodo as more powerful dedicated attacks, like in [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF], exist.

Frodo KEM. FrodoKEM is based on small-secret-LWE (Hard Problem 10), we outline here some details necessary to understand the attack. Note that we use different letter notations from [START_REF] Naehrig | [END_REF] for consistency with this chapter. For parameters n and q, the private key is (z ∈ Z n q , e ∈ Z n q ) where the coefficients of z and e, denoted z i and e i , can take several values in a small set that we denote L. The public key is A ∈ Z n×n q , b = zA + e . The goal of the attack is to recover z by making measurements during the multiplication between z and A when computing b in the key generation. Note that there is no multiplication involving e and thus we do not target it in this attack. Six sets of parameters are considered: CCS1, CCS2, CCS3 and CCS4 introduced in [Bos+16] and NIST1 and NIST2 introduced in [START_REF] Naehrig | FrodoKEM[END_REF]. For example, with NIST1 parameters, n = 640, q = 2 15 and L = {-11, • • • , 11}.

Side-channel simulation. The divide-and-conquer attack provided by [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] simulates side-channel information using ELMO, a power simulator for a Cortex M0 [START_REF] Mccann | Towards Practical Tools for Side Channel Aware Software Engineering: 'Grey Box' Modelling for Instruction Leakages[END_REF]. This tool outputs simulated power traces using an elaborate leakage model with Gaussian noise. Thus, it is parameterized by the standard deviation of the side-channel noise. For proofs of concept, the authors of [START_REF] Mccann | Towards Practical Tools for Side Channel Aware Software Engineering: 'Grey Box' Modelling for Instruction Leakages[END_REF] suggest to choose the standard deviation of the simulated noise as σ SimNoise := 0.0045, for a realistic leakage modelization. This standard deviation was also the one chosen in [Bos+18a, Fig. 2b] and W. Bos et al. implemented a Matlab script, that calls ELMO, to simulate the side-channel information applied on Frodo. This precise side-channel simulator was provided to us by the authors of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] and we were able to re-generate all their data with Matlab still using σ SimNoise = 0.0045. In a nutshell, these attacks include a profiling phase and an online phase. Let us detail the template divide-and-conquer attack for Frodo implemented in [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF].

1. The profiling phase consists in using a copy of the device and recording a large number of traces using many different known secret values. From these measures, the attacker can derive the multidimensional distribution of several interest points when the traces share a same secret coefficient. More precisely, in the case of FrodoKEM, for a given index i ∈ [0, n -1], the interest points will be the instants in the trace when z i is multiplied by the coefficients of A (n interest points in total). Let us define c i := (T [t i,0 ], . . . , T [t i,n-1 ]) c ∈ R n , (

where T denotes the trace measurement and (t i,k ) denote the instants of the mutiplication of z i with the coefficients A i,k for (i, k) ∈ [0, n -1]. The random variable vector associated to c i is denoted C i . For each i ∈ [0, n -1] and x ∈ L, the goal of the profiling phase is to learn the center of the probability distribution By hypothesis for template attacks (see [CRR03, Section 2.1]), D i,x is assumed to follow a multidimenstional normal distribution of standard deviation σ SimNoise . Thus, the attacker recovers the center of D i,x for each i ∈ [0, n -1] and x ∈ L by averaging all the measured c i that validate z i = x. The center of D i,x is denoted t i,x and we call it a template. Before going further, [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] actually make the following independence assumption.

Assumption 5. t i,x only depends on x and is independent from the index i. Thus, t i,x = t x .

Essentially, this common assumption considers that the index i ∈ [0, n -1] of the target coefficient do not influence the leakage. Consequently, the attacker only has to derive t 0,x for example.

2. In a second step, the attacker knows the templates t x for all x ∈ L. She also knows the interest points t i,k as defined above in Eq. (5.27). She will construct a candidate z for the secret z by recovering the coefficients one by one. For each unknown secret coefficient z i , she makes the measurement c i as defined in Eq. (5.27). Using this measurement, she can derive an a posteriori probability distribution: with her fixed i ∈ [0, n -1] and measured c i ∈ R, she computes for all x ∈ L,

P [z i = x | C i = c i ] = P [z i = x] P [C i = c i ] • P [C i = c i | z i = x]
(5.28) One can use the presented attack in "black-box" to generate the score tables using the script from [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF]. As an example, using the NIST1 parameters, show several measured scores (S[-11], • • • , S[11]) corresponding to several secret coefficients in Table 5.1. The first line corresponds to a secret equal to 0, the second line to 1 and the third and fourth line to -1. The last line is an example of failed guessing because we see that the outputted candidate is not -1. We remark that the values having the opposite sign are assigned a very low score, we conjecture that it is because the sign is filling the register and then the Hamming weight of the register will be very far from the correct one.

∝ P [z i = x] • exp - c i -t x
With this template attack, one can recover z ≈ z. However, W. Bos et al. could not conclude the attack with a key recovery even though much information leaked about the secret. Frustratingly, a brute force phase to derive z from z cannot lead to any security threat as stated in [Bos+18a, Section 3]. They actually pointed out an interesting open question: "possibly [...] novel lattice reduction algorithms [can] take into account sidechannel information". The following solves this open question by combining the knowledge obtained in the divide-and-conquer template attack of [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] with our framework. Our refinement. We first instantiate a DBDD instance with a chosen set of parameters. Then we assume that, for each secret coefficient z i , we are given the associated score table S i thanks to the presented template attack. We simply go back to the a posteriori distribution in Eq. (5.29) by applying the exp() and renormalizing the score table . As an example, we show the probability distributions derived from Table 5.1, along with their variances and centers in Table 5.2.

Finally, we use our framework to introduce n a posteriori approximate hints to our DBDD instance with the derived centers and variances for each score table. When the variance is exactly 0, we integrate perfect hints instead.

Results. One can note that the obtained security fluctuates a bit from instance to instance, as it depends on the strength of the hints, which themselves depend on the randomness of the scheme. In the first two lines of Table 5.3, we show the new security with the inclusion of the approximate hints averaged on 50 tests per set of parameters.

Guessing. To improve the attack further, one can note from Table 5.2 that certain key values have a very high probability of being correct, and assuming it is, one can replace an approximate hint with a perfect one. For example, considering the second line of Table 5.2, the secret has a probability of 0.95 to be 1 and thus guessing it trades a perfect hint for a decrease of the success probability of the attack by 5%. This hybrid attack exploiting hints, guesses and lattice reduction, works as follows. Let g be a parameter.

1. Include all the approximate and perfect hints given by the score tables, 2. Order the coefficients of the secret z i according to the maximum value of their a posteriori distribution table, 3. Include perfect hints for the g first coefficients and then solve and check the solution.

Increasing the number of guesses g leads to a trade-off between the cost of the attack and its success probability. We have chosen here a success probability larger than 0.6, while reducing the attack cost by 38 to 145 bikz depending on the parameter set. Given that 1 bit of security corresponds roughly to 3 or 4 bikz, this is undoubtedly advantageous.

The results presented above are very recent (lastly improved on May the 20th 2020). We remark that, with these results, the attacks with guesses on the parameters CCS1 and CCS2 seem doable in practice while it was not the case with our original results. However, some improvements of the implementation remain to be done in order to actually mount the attack. The full-fledged implementation cannot handle the large matrices of the original DBDD instance. We require another class of implementation which fully maintains all information about the instance, like the DBDD class, and assumes that the covariance matrix Σ is diagonal to simplify the computations, like the DBDD_predict_diag class.

Perspective 8 (Second-guessing.). It should be noted that, given a single trace, one cannot naively retry the attack to boost its success probability. Indeed, the "second-best" guess may already have a much lower success probability than the first, and an interesting perspective boils down to setting up a hybrid attack mixing lattice reduction within our framework, and key-ranking.

Hints from decryption failures

Another kind of hint our framework can model are hints provided by decryption failures.

Application to [START_REF] Anvers | Decryption Failure Attacks on IND-CCA Secure Lattice-Based Schemes[END_REF] In addition to the immediate application of our framework on Section 4.3's decryption failure attack (see Section 4.3.3), one can also apply our framework to the anterior work of D'Anvers et al. [START_REF] Anvers | On the impact of decryption failures on the security of LWE/LWR based schemes[END_REF], as originally presented in our paper [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF]. In the latter, to compare the predictions given by our tool to the ones from [START_REF] Anvers | On the impact of decryption failures on the security of LWE/LWR based schemes[END_REF], we chose FRODOKEM-976 parameters, for which we were able to reproduce the data 5 . We note that our framework produces essentially similar predictions, as shown in Fig. 5.6, and refer to our paper for more details on the technique.

Application to the results of Section 4.2.

([Bau+19])

As a contribution of this thesis, we apply our framework to the work of Section 4.2.3 for an alternative way to recover the private key. In Section 4.2.3, let k be fixed in [0, 255], the attacker wants to recover the secret S[k] ∈ [-8, 8] and she has access to the sign of a function f 1 , 2 , 3 that can be written as

f 1 , 2 , 3 ( 0 ) = V 1 , 2 , 3 constant + 0 - ∈[-8,8]

S[k]

2 + 1 + Sign( 0 ) 2s . As shown in [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF], depending on the value of V 1 , 2 , 3 that can be negative, two changes of sign can happen when iterating 0 = {-4, . . . 3}. If two changes of sign do not happen, we redraw the values of ( 1 , 2 , 3 ) until two changes of sign occur (we refer to [Bau+19, Section 4.2] for proving that it terminates). Therefore, let us assume that there are two changes of sign, which is obtained after ≈ 18 decryption oracle queries on average. So, this strategy takes around 18 × 1024 ≈ 18, 500 oracle queries, referring to [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF] for more details about the queries estimation.

Similarly to Section 5.6.1, we perform a learning phase to derive an a posteriori distribution knowning the position of the changes of sign of f 1 , 2 , 3 . Before the attack, with a functional analysis, one can learn the possible position of the changes of sign with the knowledge of the value of S[k] with the study of the variations of f 1 , 2 , 3 . For example, if S[k] = -5, the function can be written as follows

f 1 , 2 , 3 ( 0 ) = V 1 , 2 , 3 + F [ 0 + 4]
with F = [1.5, 0.5, 0.5, 1.5, 2.50065, 3.50065, 4.50065, 5.50065]. Thus, if there are two changes of sign when iterating f 1 , 2 , 3 with 0 = {-4, . . . 3}, the only possible issue is that f 1 , 2 , 3 ( 0 ) < 0 for 0 ∈ {-3, -2}. From this learning phase, one can derive the aposteriori knowledge of the secret coefficient when knowing the position of the change of sign. More precisely, we obtain an aposteriori knowledge presented in Table 5.4. We can see that for any recovered sign variation of f 1 , 2 , 3 , there is 1. either one possible value a for S[k], which leads to a perfect hint (diagonal)

S[k] = a;
2. or two possible consecutive values (a, a + 1) for S[k], which leads to an approximate hint (diagonal) S[k] + e = a + 0.5 where e ∼ N 1 (0, 1/12).

It only remains to apply the tool of Chapter 5 to estimate the new security of the scheme with the knowledge of the secret. We estimate around 1000 approximate hints and 20 perfect ones. By using our tool, the expected bikz security becomes 660, which corresponds to going from 256 bits of security to roughly 175 bits of security. The number of queries is the same as estimated in [START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF] : 18, 500.

Hints from structural design

LAC is a Ring-LWE round two candidate of the NIST post-quantum competition [START_REF] Lu | PQC Round-2 candidate: LAC[END_REF].

The secrets are two polynomials s 0 , s 1 (denoted s and e in the specifications) whose coefficients follow a distribution ψ n,h , the uniform distribution over ternary vectors {-1, 0, 1} n with exactly h/2 ones and h/2 minus ones. Thus, two structural perfect hints can be derived:

n-1 i=0 s 0 [i] = 0 and n-1 i=0 s 1 [i] = 0.
The same structure appears in the submission Round5 (only for s 0 ) as it also require the number of -1 coefficients to be balanced with number of 1 coefficients of their ternary polynomial. This new knowledge has been included in the security analysis, and the results are stored in Table 5.5. For Round5, we arbitrarily chose for our testing the parameter set R5ND_{1, 3, 5}KEM_0d. A structure also appears in the NTRU submission [START_REF] Zhang | PQC Round-2 candidate: NTRU[END_REF], our framework can be applied but there are some subtleties due to the underlying ring and the homogenous property of the underlying BDD problem. We refer to our paper for further details on NTRU [START_REF] Dachman-Soled | LWE with Side Information: Attacks and Concrete Security Estimation[END_REF].

Remark 28. Note, however, that integrating such hints removes some q-vectors from the lattice. For LAC, we note that while q-vectors are not in the lattice, a difference of 2 such vectors is still in it, for example, the short vector hint (q, -q, 0, 0, . . . , 0) ∈ Λ.

We iteratively integrate (q, -q, 0, 0, . . . , 0), (0, q, -q, 0, . . . , 0), (0, 0, q, -q, . . . , 0), . . . until such hints are not worthy anymore, i.e. until such hints do not decrease the cost of the attack anymore.

Remark 29. A similar structure is present in the candidate NTRU-Prime in its streamlined and LPR versions [START_REF] Daniel | PQC Round-2 candidate: NTRU Prime[END_REF]. In the secret vector, the number of ±1's is fixed to an integer w without knowing the exact number of positive and negative ones. Thus, one can include a modular hint

n-1 i=0 s 0 [i] = w mod 2.
The loss of security is, however, essentially negligible.

Perspectives

Perspective 9 (Many other side-channel applications). The applications showed in this frameworks can exemplify our tool. However, there is much left to do on the application and side-channel side. Among the interesting perspectives, one can cite a power analysis on the NTT computation or the application in a cold-boot scenario. Perspective 10 (Adaptation of this tool to the dual attack). The dual attack is a distinguishing attack that is also part of the security analysis of several schemes. For most NIST schemes it is significantly less efficient than the primal attack, but adapting this work for this attack is still a natural question. In principle, the dual attack could also be made to work within our framework. However, we see two difficulties. First, the cost of the dual attack can not be analyzed solely based on the blocksize of SVP oracle calls. Secondly, the cost of the dual attack has not been confirmed by extensive experiments, unlike the primal one.

(0, 0, ..., 0)

Ref ⊕ sec +q (x 0 , 0, ..., 0) (b i ) 0≤i≤d

Step 0

Ref ⊕ sec +q (x 1 , 0, ..., 0) (b i ) 0≤i≤d

(z i ) 0≤i≤d (z i ) 0≤i≤d
Step 1

... (z i ) 0≤i≤d

Step j ... (z i ) 0≤i≤d

Step d simulated with z 0 (for the observations performed after the unobserved linear refreshing) and at most δ 0 -1 shares of a (for the observations made before the unobserved linear refreshing).

AbsVal: Compute an absolute value sec|.|

Absolute value: This gadget denoted sec|.| takes an input (x i ) 0≤i≤d in a Boolean masked and returns an output (z i ) 0≤i≤d in Boolean masked form such that ( i z i ) = | i x i |. It is described in Gadget 16.

For some masked comparisons, two comparisons on each signed coefficients are necessary. And, sometimes, it is actually less intensive to explicitly compute the absolute value and do only one comparison. The gadget takes as input any integer x masked in Boolean form on w bits and outputs its absolute value (i.e. x if x < 2 w-1 and x -2 w if x ≥ 2 w-1 ). Since computers are performing two's complement arithmetic, the absolute value of x can be computed as follows:

1. m := x RADIX -1 2. |x| := (x + m) ⊕ m

We recall that we consider signed integers. So, one can note that the in the first step is an arithmetic shift and actually writes the sign bit in the whole register. If x is negative then m = -1 (all ones in the register) and if x is positive then m = 0. The gadget sec|.| is using the same technique to compute |x|. The small difference is that the sign bit is in position w instead of position RADIX. This is why step 1 is moving the sign bit (modulo 2 w ) in first position before extending it to the whole register to compute the mask.

Gadget 16 -Absolute Value (sec|.|)

Data: A boolean masking (x i ) 0≤i≤d of some integer x ∈ Z and an integer w Result: A boolean masking (z i ) 0≤i≤d corresponding to the absolute value of x 1 (mask i ) 0≤i≤d := (x i ) 0≤i≤d (w -1) 2 (x i ) 0≤i≤d ← Ref ⊕ ((x i ) 0≤i≤d ) 3 (x i ) 0≤i≤d ← sec + ((x i ) 0≤i≤d , (mask i ) 0≤i≤d )) 4 (z i ) 0≤i≤d := ((x i ) 0≤i≤d ⊕ (mask i ) 0≤i≤d ) ∧ (2 w -1) 5 return (z i ) 0≤i≤d

For computing the absolute value of an element x modulo q. It consists in calling sec|.|(x, log 2 (q) ). We consider that the attacker made δ ≤ d observations. In the following, we prove that all these δ observations can be perfectly simulated with at most δ shares of (x i ) 0≤i≤d .

In the following, we consider the following distribution of the attacker's δ observations: δ 1 observed during the computations of the shift that produces shares of (mask i ) 0≤i≤d , δ 2 observed during the computations of the Ref ⊕ that produces

1. 1

 1 Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.1.1 Classical attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.1.2 Quantum attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.1.3 Side-channel attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.1.4 Misuse attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 1.2 Lattice-based cryptography . . . . . . . . . . . . . . . . . . . . . . . . 7 1.2.1 Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.2.2 Geometric lattice-based hard problems . . . . . . . . . . . . . . . . . . . 8 1.2.3 Other hard lattice-based problems . . . . . . . . . . . . . . . . . . . . . 10 1.2.4 Ring variants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.2.5 Lattice constructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.3 Goal and contribution of the thesis . . . . . . . . . . . . . . . . . . . . 15 1.4 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.4.1 Constructive results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1.4.2 Cryptanalysis results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.4.3 Other cryptanalysis publications . . . . . . . . . . . . . . . . . . . . . . 19

Figure 1

 1 Figure 1.1: A two-dimensional lattice

Figure 1 . 2 :

 12 Figure 1.2: Successive minima on a two-dimensional lattice

5 Falcon

 5 with aborts Ring-SIS (Hard Problem 6) Sections 2.4 and 3.4 Crystals-Dilithium [Duc+18; Lyu+19] Fiat-Shamir with aborts Mod-SIS (Hard Problem 6) Section 3.3.6 qTesla [Alk+15; Alk+17; Bin+19] Fiat-Shamir with aborts Ring-LWE (Hard Problem 5) Section 3.

  4

Algorithm 3 -

 3 Lyubashevsky key generation Result: Private key sk = S, Public key pk = (A, T) Data: m, pk, sk Result: Signature sig 1 y ← D m Z,σ 2 u := Ay 3 c := hash(u, m) 4 z := y + sc 5 return sig := (z, c) with probability ρσ( z 2 ) M ρσ( z-Sc 2 ) Algorithm 5 -Hybrid signature algorithm Data: m, pk, sk Result: Signature sig

  4 B := LLL-reduced B with respect to |.| S 5 P I f f := Babai Reduction of P R f in B . 6 K computed with Eqs. (2.27) and (2.32) 7 η := maximal size of the coefficients of P I f 8 return P I f , K , η

  -| Final security : 21 | | Max size coeffs : 25 | -

  sage: load('polynomial_approximation.sage') ....: galactics = GALACTICS_approximation(-2*ln(2)*215^2/1^2, 0, 128, 45, 45, "exp(x / 2 / 215^2)") ....: galactics.approximate()[...]

  -| Final security : 47 | | Max size coeffs : 45 | -

  -| Final security : 55 | | Max size coeffs : 109 | -

  -....................................

Figure 2 . 2 :

 22 Figure 2.2: Graphical intuition of the distributions in SamplerZ. For a clear explanation, we have removed the normalization factors, they do not impact the rejection sampling.

Figure 3

 3 Figure 3.1: A side-channel attack consists in analyzing physical parameters related to the execution of an algorithm. Here, an X-ray machine records the emanations of the circuits of the blue algorithm. With statistics techniques, one can derive the secret value from the emanations .

Figure 3 . 2 :

 32 Figure 3.2: Masking is a countermeasure to prevent side-channel attacks. The purple algorithm adds some noise in its circuits by generating many secrets at the same time while the right secret is the sum of all the values.

  (i)Sign | ≤ d, one should have i∈{1,...,Q} |O (i)Sign | ≤ d. Typically, the KeyUpdate algorithm will be protected as presented later in Gadget 4.

Figure 3 . 3 :

 33 Figure 3.3: Gadget decomposition

  1 ) 8 return (c 0 , c 1 ) Definition 9. d-strong-non-interference (d-SNI): A gadget is d-strongly non-interfering if and only if the joint distribution of every set of size d 0 ≤ d containing d 1 intermediate variables and d 2 := d 0 -d 1 returned values can be perfectly simulated with at most d 1 shares of each input.

  Definition 12. d-non-interference for gadgets with public outputs(d-NIo): A gadget with public outputs O is d-NIo if and only if the joint distribution of every set of at most d intermediate variables can be perfectly simulated with the public outputs and at most d shares of each input. The use of public outputs induces a weaker notion of security. Lemma 12. Let G be a d-NI-gadget. Then G is d-NIo secure for every subset O of intermediate variables.

  Some new small gadgets Extend Ref ⊕ and Full⊕ to arithmetic sharing

2 z

 2 i := ax i + y i 3 end 4 return (z i ) 0≤i≤d Lemma 13. The MAdd gadget is d-NI secure. Proof: Let δ ≤ d be the number of observations made by the attacker. The only possible observations are the sensitive values x, y and z. We would like to consider all the possible d-uple of intermediate variables. To be exhaustive, the proof consists in filling an empty set I with at most δ indices in [0, d] such that the distribution of any tuple (v 1 , ..., v δ ) of intermediate variables of the block can be perfectly simulated from the sensitive values.

Lemma 16 .

 16 The gadget GaussGen in Gadget 12 is d-NI secure. Proof: A graphical representation of Gadget 12 is in Fig. 3.5. First, assume that each iteration (without the refresh) is d-NI. Then the algorithm is a linear succession of d-NI and d-SNI gadgets. The only subtlety is that the element (r i ) forms cycles that are broken with the d-SNI property of the refresh. Now let us show that each iteration denoted iter is d-NI. The result comes from the structure of this sub-gadget: it has only one cycle which is broken by the affine property of the ⊕ gadget.

Figure 3 . 6 :

 36 Figure 3.6: Graphical intuition for computing P [ s 1c + y 1 ∞ > κ -α] = P [ s 2 c + y 2 ∞ ].Without loss of generality, we only consider y 1 , s 1 , z 1 . To the left, we represent the distribution for the coefficients of y 1 . In the middle, we represent the possible values for the coefficients of s 1 c. To the right, the distribution of y i is shifted by s i c to obtain the distribution of z 1 . The accepted (resp. rejected) z 1 are in green (resp. in orange.). We see that, no matter the shift of s i c, the fraction of rejected coefficients will stay = 2α 2κ+1 .

  r) Theorem 6. The masked r-GLP sign in Algorithm 20 is d-NIo secure with public output {b, rs} 4 .

Theorem 7 .

 7 The masked GLP key generation in Algorithm 19 is d-NIo secure with public output b.

← A 2 .

 2 (sk, pk), L KeyGen ← ExecObs(O KeyGen , KeyGen, 1 λ ) 3. (m * , σ * ) ← A H,S (pk, L KeyGen ) 4. return 1 if Verify(pk, m * , σ * ) = 1 and |O KeyGen | ≤ d and ∀i ∈ {1, . . . , Q}, |O (i) Sign | ≤ d and (m * , σ * ) has not been returned by the signature oracle return 0 otherwise.

1. O KeyGen ← A 2 .Game G 2 :

 22 (sk, pk), L KeyGen ← ExecObs(O KeyGen , KeyGen, 1 λ ) 3. (m * , σ * ) ← A H,S (pk, L Sim KeyGen ) 4. return 1 if Verify(pk, m * , σ * ) = 1 and |O KeyGen | ≤ d and ∀i ∈ {1, . . . , Q}, |O (i) Sign | ≤ d and (m * , σ * ) has not been returned by the signature oracle return 0 otherwise. By definition of L Sim , this game is perfectly indistinguisable from G 0 . This game is the security game of the EUF-CMA security. 1. (sk, pk) ← KeyGen(1 λ ) 2. (m * , σ * ) ← A H,Sign(•,sk) (pk) 3. return 1 iff Verify(pk, m * , σ * ) = 1 and (m * , σ * ) has not been returned by the oracle Sign(•, sk). Since in game G 1 , |O KeyGen | ≤ d and |O (i)

  u) else return sig := (⊥, ⊥, u) end Theorem 9. The masked u-BLISS sign algorithm is d-NIo secure with public output rs.

Figure 3 . 11 :

 311 Figure 3.11: Masked qTESLA Signature structure

  [START_REF] Alkim | Post-quantum key exchange-a new hope[END_REF] then to the NIST lattice-based key exchange submissions that directly inherited the framework [Pöp+19; Nae+19; Sch+19]. The study was done through the prism of the decryption failures attacks. The latter family of attacks has been originally suggested by Fluhrer in[START_REF] Fluhrer | Cryptanalysis of ring-LWE based key exchange with key share reuse[END_REF] against a reconciliation-based key exchange à la[START_REF] Peikert | Lattice Cryptography for the Internet[END_REF]. With members of the ANSSI team: Aurélie Bauer, Henri Gilbert and Guénaël Renault, we found a way to adapt Fluhrer's attack to the recent decryption-based NewHope in a passively secure setting with key reuse[START_REF] Bauer | Assessment of the Key-Reuse Resilience of NewHope[END_REF]. Although our attack did not infringe any of the designed security claimes for NewHope, the main message of the paper was to warn the potential users on possible misuse contexts (see Section 4.1.3 for a definition)where the key is reused in scheme secure against passive attacks. It enables powerful decryption failures attacks.

Figure 4 . 2 :

 42 Figure 4.2: Simplified NewHope

Algorithm 36 -

 36 KEM.Encaps Data: pk Result: a ciphertext ct key , a common key m key 1 m $ ← -{0, 1} 256 2 (m key ; coin) := hash 0 (pk, m) 3 ct key := PKE.Enc(pk, m, coin) 4 m key := hash 1 (m key , coin) 5 return (ct key , m key ) Algorithm 37 -KEM.Decaps Data: sk, ct key Result: a common key m key 1 m := PKE.Dec(sk, ct key ) 2 (m key , coin ) := hash 0 (pk, m ) 3 ct key := PKE.Enc(pk, m ; coin ) 4 if ct key = ct key then 5 return m key := hash 1 (m key , coin ) 6 else 7 return m key :=⊥ // Could return a pseudo-random string to implicitly reject

P

  fail pk (ct key , m key ) := sk P [O sk (ct key , m key ) = 0] • P [(sk, pk) ← KEM.Keygen(1 λ )]. (4.6)

β

  ft := (ct key ,m key ):P fail pk (ct key ,m key )>ft D enc pk (ct key , m key ) • P fail pk (ct key , m key ) (ct key ,m key ):P fail pk (ct key ,m key )>ft D enc pk (ct key , m key ).

Figure 4 . 3 :

 43 Figure 4.3: Simplified diagram to represent the ciphertexts (in blue).The weak ones are defined as the ciphertexts with a probability higher than f t .

Figure 4 . 4 :

 44 Figure 4.4: The directional information allows a refined acceptance criterion, here represented as an ellipse.

Figure 4 . 5 :

 45 Figure 4.5: Quantum work W i and number of decryption queries Q i required to find a new failing ciphertext, given the i failing ciphertexts found previously.

Figure 5 . 2 :

 52 Figure 5.2: Primal attack without hints (prior art).

Figure 5 . 3 :

 53 Figure 5.3: The primal attack with hints (our work).

Figure 5 . 4 :

 54 Figure 5.4: Graphical intuition of DBDD, BDD and uSVP in dimension two: the problem consists in finding a nonzero element of Λ in the colored zone. The identity hyperball is larger for uSVP to represent the fact that, during the reduction, the uSVP lattice has one dimension more than for BDD.

+ σ 2 e

 2 (5.3), v := (v ; -l), and e has N 1 (0, σ 2 e ) distribution. The unique shortest non-zero solution of DBDD Λ,µ,Σ , is also the unique solution of the instance DBDD Λ ,µ ,Σ where Λ = Λ(5.18)Σ = Σ -(vΣ)T vΣ vΣv T Eq. (5.18) comes fromΛ := Λ ∩ x ∈ Z d | x, v + e = 0, for all possible e ∼ N 1 (0, σ 2 e ) = Λ.

  n = m = 70, q = 3301, σ = 20 n = m = 80, q = 3301, σ = 20

Figure 5 . 5 :

 55 Figure 5.5: Experimental verification of the security decay predictions for each type of hint. Each data point was averaged over 256 samples.

D

  i,x (c) := P [C i = c | z i = x] .

  ], a score table, denoted (S i [x]) x∈L is derived from the a posteriori distribution as follows,S i [x] := ln (P [z i = x | C i = c i ]) (5.30) = ln (P [z i = x]) -c i -t x output candidate for z i is zi := argmax x∈L (S i [x]).

2 0 2 1 2 2 2 3 2 4 2 5 2 6 2 7 2 Figure 5 . 6 :

 256 Figure 5.6: Security decrease as a function of the number of failures in FRODOKEM-976.

Values 0 {0

 0 that verify f 1 , 2 , 3 ( 0 ) < 0

  Ref ⊕ sec +q (x j , 0, ..., 0) (z i ) 0≤i≤d

  , 0, ..., 0) (b i ) 0≤i≤d

Figure A. 1 :Figure A. 2 :

 12 Figure A.1: Graphical Representation of A q B

Lemma 25 .

 25 The gadget sec|.| in Gadget 16 is d-NI secure. Proof: A graphical representation of sec|.| is in Fig. A.4.

Table 1 . 1 :

 11 Lattice-based public key encryption or key encapsulation mechanisms

Table 1 . 3 :

 13 Constructive contributions of this thesis

	Signature scheme	Provable timing protection Provable high-order masking
		Chapter 2	Chapter 3
	GLP	[GLP12]	this thesis Section 3.3
	BLISS	this thesis Section 2.4	this thesis Section 3.4
	Falcon	this thesis Section 2.5	see Perspective 4
	Crystals-Dilithium	[Lyu+19]

  done with Gilles Barthe, Sonia Belaïd, Thomas Espitau, Pierre-Alain Fouque and Mehdi Tibouchi. The purpose of this section is to use Lemma 4 for replacing transcendental functions with finite input set (the density function of an ideal distribution P) by polynomials with the same support.

	The well-studied techniques for approximating transcendental functions with polynomials have
	become very relevant in implementations of Gaussian sampling algorithms. They are in particu-
	lar useful as the exp(•), and cosh(•) functions are necessary for Gaussian and Bimodal Gaussian
	distributions. One first naive technique could be to use a Taylor development or the transcen-
	dental function. However, one can find lower degrees and get a higher accuracy. For example,
	in [Pre17] Prest suggests a Gaussian sampler that uses Padé approximants to evaluate the ex-
	ponential function of the rejection probability. More recently, Zhao et al. have proposed a
	polynomial approximation using the Sollya software package [SMC10]. Their resulting imple-
	mentation runs without floating-point division [ZSS18] since that operation is known to leak
	through timing. Zhao et al. use floating-point multiplications instead to compute the exponen-
	tial, but this instruction does not always have isochronous execution guarantees either.

  -....................................

	Exact polynomial:
	P = 16763669 * 2 ^-24
	+ -33417471 * 2 ^-25 * x	^1
	+ 16480621 * 2 ^-25 * x	^2
	+ -10466641 * 2 ^-26 * x	^3
	+ 18114369 * 2 ^-29 * x	^4
	+ -4979525 * 2 ^-30 * x	^5
	+ 10527017 * 2 ^-35 * x	^6

Table 2 . 1 :

 21 Concrete parameters for BLISS.

	BLISS-	0	I	II	III	IV
	n	256	512	512	512	512
	q	7681	12289 12289	12289	12289
	σ	100	215	107	250	271
	δ 1 , δ 2	.55 , .15 .3 , 0 .3 , 0 .42 , .03 .45, .06
	Tail (bits dropped in • Mst ) p := 2q/2 Tail	5 480	10 24	10 24	9 48	8 96
	κ	12	23	23	30	39
	α	0.5	1.0	0.5	0.7	0.55
	B 2	2492	12872 11074	10206	9901
	B ∞	530	2100	1563	1760	1613

  -....................................

	Exact polynomial:
	P = 1 * 2	^0
	+ 6235378607933 * 2 ^-59 * x	^1
	+ 17680552620763 * 2 ^-78 * x	^2
	+ 33422396137565 * 2 ^-97 * x	^3
	+ 5923120905557 * 2 ^-113 * x	^4
	+ 26872204609341 * 2 ^-134 * x	^5
	+ 25398480056119 * 2 ^-153 * x	^6
	+ 20570037805739 * 2 ^-172 * x	^7
	+ 3629577032917 * 2 ^-189 * x	^8
	+ 35066854785757 * 2 ^-212 * x	^9
	+ 14707071337199 * 2 ^-231 * x ^10

  -....................................

	Exact polynomial:
	P = 1 * 2	^0
	+ 24941514431733 * 2 ^-61 * x	^1
	+ 4420138155217 * 2 ^-76 * x	^2
	+ 33422396152215 * 2 ^-97 * x	^3
	+ 11846242059507 * 2 ^-114 * x	^4
	+ 26872223790743 * 2 ^-134 * x	^5
	+ 12699467954197 * 2 ^-152 * x	^6
	+ 20576945247259 * 2 ^-172 * x	^7
	+ 29170523303177 * 2 ^-192 * x	^8
	+ 2292170444093 * 2 ^-208 * x	^9
	+ 20154220626817 * 2 ^-231 * x ^10
	+ 15924804363279 * 2 ^-251 * x ^11

Table 2 . 2 :

 22 Performance results and comparison (kcycles).

		Median Isochronous?
	Dilithium (ref)	515	Yes
	Dilithium (avx2)	332	Yes
	qTesla-I (ref)	418	Yes
	Original BLISS	194	No
	Our implementation	220	Yes
	to date with this thesis description (e.g. the polynomials in the implementation are not the
	latest ones).

Table 2 . 3 :

 23 Number of calls to SamplerZ, BaseSampler and ApproxExp

Table 2 . 4 :

 24 Comparison of the polynomial methods for computing exp

	Polynomial Mults Adds Depth Size of the coefficients
	P 1 (Horner)	10	10	10	45
	P 2 (Estrin)	13	9	4	45

Table 2 . 5 :

 25 Number of samples per second at 2.5 GHz for our sampler and[START_REF] Zhao | Compact and Scalable Arbitrarycentered Discrete Gaussian Sampling over Integers[END_REF]. Strong , P Standard denote the success probability of A in the Strong and Standard cases, respectively. We set a := λ and apply probability preservation.

	Algorithm	Number of samples
	This work 10	1.84 × 10 6 /sec
	This work (AVX2) 11	7.74 × 10 6 /sec
	[ZSS19] (AVX2) 12	5.43 × 10 6 /sec
	Let P

Table 2 . 6 :

 26 Falcon signature generation time at 2.5 GHz.

	Degree	Non-isochronous (using AVX2)	Isochronous (using AVX2)
	512	210.88 µs (153.64 µs)	257.33 µs (180.04 µs)
	1024	418.76 µs (311.33 µs)	515.28 µs (361.39 µs)

  Chapter content 3.1 Introduction and motivations . . . . . . . . . . . . . . . . . . . . . . . 63 3.1.1 The masking countermeasure . . . . . . . . . . . . . . . . . . . . . . . . 64 3.1.2 The ISW model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 3.1.3 Probing security and gadgets . . . . . . . . . . . . . . . . . . . . . . . . 66 3.2 New techniques for masking lattice-based signatures . . . . . . . . . 70 3.2.1 A new security property for lattice-based signature schemes . . . . . . . 70 3.2.2 Design of new Gadgets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.2.3 Some new small gadgets . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 3.2.4 Some new large gadgets . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 3.3 Application to GLP signature scheme . . . . . . . . . . . . . . . . . . 79 3.3.1 The signature scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 3.3.2 Security proof of the r-GLP variant . . . . . . . . . . . . . . . . . . . . 81 3.3.3 Masking r-GLP signature scheme . . . . . . . . . . . . . . . . . . . . . . 84

3.3.4 EUF-CMA in the d-probing model . . . . . . . . . . . . . . . . . . . . . 87 3.3.5 Proof of concept and performance . . . . . . . . . . . . . . . . . . . . . 89 3.3.6 Extension to Crystals-Dilithium signature scheme . . . . . . . . . . . . 89 3.4 Application to BLISS signature scheme . . . . . . . . . . . . . . . . . 90 3.4.1 Masking BLISS signature algorithm . . . . . . . . . . . . . . . . . . . . 90 3.4.2 EUF-CMA in the d-probing model . . . . . . . . . . . . . . . . . . . . . 93 3.5 Application to qTesla signature scheme . . . . . . . . . . . . . . . . . 93 3.5.1 The qTESLA signature Scheme . . . . . . . . . . . . . . . . . . . . . . . 94 3.5.2 Masking qTESLA signature scheme . . . . . . . . . . . . . . . . . . . . 96 3.5.3 EUF-CMA security in the d-probing model . . . . . . . . . . . . . . . . 99 3.5.4 Optimized implementation and performance . . . . . . . . . . . . . . . . 101 3.6 Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Table 3 . 1 :

 31 Security properties of the gadgets necessary in this thesis.

	Security proof
	Property Algorithms
	Action
	Output
	Name Input	Ref

⊕ (x i )

Table 3 . 2 :

 32 Implementation results. Timings are provided for 100 executions of the signing algorithm, on one core of an Intel Core i7-3770 CPU-based desktop machine.

	Number of shares (d + 1) Unprotected	2	3	4	5
	Total CPU time (s)	0.540	8.15 16.4 39.5 62.1
	Masking overhead	-	×15 ×30 ×73 ×115

Table 3 .

 3 3: Parameters for qTESLA-I and qTESLA-III

	Parameters qTESLA-I	qTESLA-III	Description
	n	512	1024	Dimension of the ring
	q	4 205 569 ≈ 2 22	8 404 993 ≈ 2 23	Modulus
	σ	22.93	10.2	Standard deviation
	h	30	48	Nonzero entries of c
	E	1586	1147	Rejection parameter
	S	1586	1233	Rejection parameter
	B	2 20 -1	2 21 -1	Bound for y
	Tail	21	22	Bits dropped in [•] M

Table 3 . 4 :

 34 Median speed of principal gadgets in clock cycles over 1000000 executions

	Masking order	Order 1	Order 2	Order 3	Order 4	Order 5
	UGen	98	410	840	1 328	2 416
	Rnd	164	1 400	2 454	4 314	6 142
	WRnd	280	2 080	3 914	6 432	9 034
	RS	178	1 440	2 496	4 432	6 254
	sec +q	44	294	592	870	1 192
	sec&	20	28	44	70	96
	A q B	96	786	1 152	3 148	3 500
	B A q	20	42	108	288	884

Table 3 . 5 :

 35 Median speed of masked signature in kilo clock cycles over 10000 executions

	Masking order	Un-masked	Order 1	Order 2	Order 3	Order 4	Order 5
	qTESLA-I (RNG off)	646	2 394	7 000	9 220	16 578	24
	qTESLA-I (RNG on)	671	2 504	13 879	24 583	39 967	59
	qTESLA-I (RNG on) Scaling	1	×4	×21	×37	×60	×89
	qTESLA-III (RNG off)	1 253	4 295	9 946	14 485	25 351	34
	qTESLA-III (RNG on)	1 319	4 880	21 932	33 521	59 668	83
	qTESLA-III (RNG on) Scaling	1	×3	×17	×25	×45	×63

Table 3 . 6 :

 36 Median speed of masked signature in kilo clock cycles over 1000 executions for qTESLA-I on cortex-M4 microcontroller

	Masking order	Unmasked	Order 1
	qTESLA-I CortexM4	11 304			23 520
	Table 3.7: Average number of calls to rand_uint32() (×1000)
	Masking order	Order 1	Order 2	Order 3	Order 4	Order 5
	qTESLA-I	86	1 383	2 762		4 924	7 638
	qTESLA-III	115	1 827	3 722		6 482	10 006

  4.1 Introduction and motivations . . . . . . . . . . . . . . . . . . . . . . . 108 4.1.1 Key Encapsulation Mechanisms (KEM) . . . . . . . . . . . . . . . . . . 108 4.1.2 Security properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 4.1.3 Attack model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 4.1.4 Key mismatch oracle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 4.2 An example of decryption failure attack on an IND-CPA scheme . 112 4.2.1 NewHope KEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 4.2.2 Key mismatch oracle attack . . . . . . . . . . . . . . . . . . . . . . . . . 115 4.2.3 Key recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 4.3 (One) failure is not an option: an improved attack on a CCA scheme118 4.3.1 Definitions on failure events . . . . . . . . . . . . . . . . . . . . . . . . . 122 4.3.2 Directional failure boosting . . . . . . . . . . . . . . . . . . . . . . . . . 124 4.3.3 Finalizing the attack with lattice reduction . .

. . . . . . . . . . . . . . 128 4.3.4 Estimation of the attack performance . . . . . . . . . . . . . . . . . . . 129 4.3.5 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 4.4 Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Table 4 . 3 :

 43 Accuracy of the estimate derived from several failures. Expected value of cos(θ SE ). The closer to 1, the more accurate E is.

	#failures	1	2	3	5	10	20	30	50	100
	theoretical	0.328 0.441 0.516 0.613 0.739 0.841 0.885 0.926 0.961
	experimental 0.318 0.429 0.502 0.600 0.727 0.832 0.878 0.921 0.958

  Table 4.4 and Fig. 4.5. One can see that the majority of the work lies in obtaining the first ciphertext and that obtaining more than one ciphertext can beTable 4.4: Quantum work W totN and queries Q tot N required to find N failing ciphertexts with probability 1 -e -1 . Finding the first ciphertext requires the heaviest amount of computation. After the third failing ciphertext is found, the following ones are essentially for free.

	ciphertexts N			1	2	3	5	10	20	30
	log 2 (W tot N ) log 2 (W tot N /W tot 1 )	112.45 -	112.77 0.32	112.78 0.33	112.78 0.33	112.78 0.33	112.78 0.33	112.78 0.33
	log 2 (Q tot N ) log 2 (Q tot N /Q tot 1 )	102.21 -	102.86 0.65	102.87 0.66	102.87 0.66	102.87 0.66	102.87 0.66	102.87 0.66
			2 117	work/queries to obtain next ciphertexts
			2 103
		total work/queries	2 5 2 19 2 33 2 47 2 61 2 75 2 89	2 0	2 1 available failing ciphertexts 2 2 2 3 2 4 work query	2 5

Table 4 . 5 :

 45 Quantum work W tot N and number of decryption queries Q tot N required to obtain N failing ciphertexts with probability 1 -e -1 , given the number of previously found failing ciphertexts. Parameters of the ss-ntru-pke[START_REF] Zhang | NTRUEncrypt[END_REF] scheme.

	total work	2 114 2 115 2 116 2 117	work to obtain n ciphertexts work work -traditional		total queries	2 104 2 105 2 106 2 107	queries to obtain n ciphertexts queries queries -traditional
		2 113						2 103
		2 0	2 1	2 2 ciphertexts 2 3	2 4	2 5		2 102	2 0	2 1	2 2 ciphertexts 2 3	2 4	2 5
			(a) Quantum work W tot N					(b) Queries Q tot N
	Figure 4.6: l	n	q		σ s	σ e		Failure probability Claimed
												Security
	ss-ntru-pke	1	1024	2 30 + 2 13 + 1	724	724	> 2 -80	2 198

  Quantum work W tot N and number of decryption queries Q tot N required to find a new failing ciphertext for ss-ntru-pke, given the ones found previously.Table 4.6: Comparison of costs for different attacks against ss-ntru-pke [Zha+17].

					work/queries to obtain next ciphertexts				work/queries to obtain next ciphertexts
		2 137								2 91
		2 121								2 81
	total work/queries	2 57 2 73 2 89 2 105							total work/queries	2 41 2 51 2 61 2 71
		2 41								2 31
		2 9 2 25	2 0	work query	2 1	2 2 available failing ciphertexts 2 3	2 4	2 5	2 21	2 0	work query	2 1	2 2 available failing ciphertexts 2 3	2 4	2 5
					(a) Single target attack						(b) Multitarget attack
	Figure 4.7: scheme		claimed	multitarget	our single target	our multitarget
							security	attack [GJN]			attack		attack
				ss-ntru-pke	2 198	2 139.5				2 139.6			2 96.6

  Template attack. The divide-and-conquer side-channel attack proposed by W. Bos et al. belongs in the template attack family. Template attacks were introduced in [CRR03].

Table 5 .

 5 1: Examples of scores associated to the secret values s i ∈ {0, ±1}, after the side-channel analysis of[START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF] for NIST1 parameters. The best score in each score table is highlighted. This best guess is correct for the first 3 score table, but incorrect for the last one.

	z i

Table 5 . 2 :

 52 Probability distributions derived from Table5.1, along with variances and centers.

Table 5 .

 5 3: Cost of the attacks without/with hints without/with guesses.

			NIST1 NIST2 CCS1 CCS2 CCS3 CCS4
	Attack without hints	(bikz)	487	708	239	448	492	584
	Attack with hints	(bikz)	330	423	128	123	219	230
	Attack with hints & guesses (bikz)	292	298	70	29	124	129
	Number of guesses g		100	250	200	300	250	250
	Success probability		0.86	0.64	0.87	0.77	0.81	0.84

Table 5 .

 5 4: Aposteriori knowledge after Section 4.2.3 attack

Table 5 . 5 :

 55 New security estimates in bikz

		LAC-128	LAC-192	LAC-256
	without hints	509.03	985.64	1104.83
	with 2 hints	505.94	982.74	1101.61
		R5ND_{1}KEM_0d R5ND_{3}KEM_0d R5ND_{5}KEM_0d
	without hints	494.39	658.67	877.71
	with 1 hint	492.94	657.23	876.24

Some invasive attacks consists in injecting faults during the execution of an algorithm. They are not considered in this thesis.

https://en.wikipedia.org/wiki/Latticework

https://en.wikipedia.org/wiki/Bravais_lattice

We thank Damien Stehlé for suggesting this approach.

Using BKZ was not relevant for the sizes manipulated. Besides, unlike for LLL, there is no function for BKZ that allows giving the Gram matrix as input.

While qTesla uses uniform randomness during signature generation, it does use discrete Gaussians for key generation.

We thank Damien Stehlé for noting that Lemma 4 cannot be used directly.

The "heuristic" qTesla-I parameters were recently removed from the qTesla submission documents, and the remaining "provable" parameters are significantly less efficient. Since our goal is to compare it to comparable fast schemes, qTesla-I appears to be the most suitable parameter choice.

https://bench.cr.yp.to

One slight difference is that the sign is not drawn, thus we replace t0 with 2t0

We are thankful to Thomas Pornin for bringing up this fact.

[START_REF] Pornin | New Efficient, Constant-Time Implementations of Falcon[END_REF] standard double-precision floating-point (IEEE 754) with SHAKE256.

[START_REF] Pornin | New Efficient, Constant-Time Implementations of Falcon[END_REF] AVX2 implementation wth eight ChaCha20 instances in parallel (AVX2).

[START_REF] Zhao | Compact and Scalable Arbitrarycentered Discrete Gaussian Sampling over Integers[END_REF] constant-time implementation with hardware AES256 (AES-NI).

Compilers may alter the design, thus one should always verify the design post-compilation.

This definition was actually introduced in the full version of our GLP paper[START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF] in

before the isochronous one[START_REF] Barthe | GALACTICS: Gaussian Sampling for Lattice-Based Constant-Time Implementation of Cryptographic Signatures, Revisited[END_REF] in

Notice that non-interference was already used in practice[START_REF] Rivain | Provably Secure Higher-Order Masking of AES[END_REF][START_REF] Coron | Higher-Order Side Channel Security and Mask Refreshing[END_REF] to prove probing security of implementations.

We thank Damien Stehlé for suggesting this approach.

We thank Damien Stehlé for suggesting this approach.

The other condition on q in the parameters table of the submission is to enable the NTT

Note that the fault attacks is still possible in case of failure of the RNG picking r

As explained in Remark 13, the heuristic parameter sets on which our experiments are based, are now removed by the qTESLA team. We emphasize that the parameters we use for the implementation were not broken but are not part of the standardization process anymore. Furthermore, our theoretical work is somewhat oblivious to the underlying parameter set used to instantiate the signature, and the code can be adapted to implement the provably-secure sets as well.

We refer to our animated Eurocrypt video https://www.youtube.com/watch?v=5zg2N82LpRs for a presentation of the geometric idea of the paper.

A similar need to investigate the resilience of candidate algorithms in misuse situations was encountered in the framework of the CAESAR competition aimed at selecting authenticated encryption primitives. In that competition, much analysis was conducted on the resistance of candidates to key recovery attacks in misuse cases such as nonce or decryption misuse (i.e. allowing nonce re-use in the leakage of the decryption failure oracles), and this provided quite useful information for the algorithms selection process.

This seed is not necessary in the IND-CPA version but it is used in the IND-CCA transformed version where Alice re-encapsulates for checking the validity of the ciphertext.

The estimator can be found at https://bitbucket.org/malb/lwe-estimator/.

Here, for the ease of the writing, we consider that e is also part of the private key.

Here, all the elements in Zq are represented as integers belonging in [-q/2, q/2].

We refer to our animated Crypto video https://www.youtube.com/watch?v=wCaLcbWnwDI for a presentation of the geometric intuition.

One may then re-amplify the success probability by retrying the attack making guesses at different locations

While we would have preferred a full python implementation, we are making a heavy use of linear algebra over the rationals for which we could find no convenient python library.

https://github.com/KULeuven-COSIC/PQCRYPTO-decryption-failures/

Cited on pages 16, 62-65, 76, 83, 88, 184.

Cited on pages 18, 108, 112, 118, 126-128, 130.

Cited on pages 25, 63.

Remerciements

Algorithm 23 -qTESLA key generation Result: Signing key sk = (s, e, seed a , seed y ), verification key pk = (seed a , t) counter := 1 pre-seed $ ← -{0, 1} κ seed s,e,a,y := PRF(pre-seed) a := GenA(seed a ) repeat s := GaussSampler(seed s ,counter) counter := counter + 1 until CheckS(s) = 0 repeat e := GaussSampler(seed e ,counter) counter := counter + 1 until CheckE(e) = 0 t := a • s + e mod q sk := (s, e, seed a , seed y ) pk := (seed a , t) return (pk, sk)

Algorithm 24 -qTESLA signature algorithm Data: message m, sk = (s, e, seed a , seed y ) Result: sig = (z, c) counter := 1 r $ ← -{0, 1} κ rand := PRF(seed y , r, hash(m)) y := ySampler(rand, counter) a := GenA(seed a ) v := a • y mod ± q c := Enc(hash( v Mst , m)) z := y + s • c if z ∈ R q,B-S then counter := counter + 1 Goto 3 end return (z, c) Algorithm 25 -qTESLA verification algorithm Data: message m, signature sig = (z, c) and public key pk = (seed a , t) Result: 0 if the signature is accepted else -1 a := GenA(seed a ) w := a • zt • c mod ± q if z ∈ R q,B-S or c = Enc(hash( w Mst , m)) then return -1 end return 0 Once all checks have been passed, the signature can be safely unmasked using sec +q (See Gadget 7).

Algorithm 26 -Masked Hash

Data: The n coefficients a (j) to hash, in arithmetic masked form (a (j) i ) 0≤i≤d and the message to sign m Result: Hash of the polynomial c 1 Let u be a byte array of size n 2 for j = 1 to n do 3 u j ← Rnd((a (j) i ) 0≤i≤d , Tail) 4 end 5 c := hash(u, m) 6 c := Enc(c) 7 return c Algorithm 27 -qTESLA masked signature algorithm Data: message m, private key sk = ((s i ) 0≤i≤d , (e i ) 0≤i≤d ), seed sd Result: Signature sig = (z unmasked , c) 1 a := GenA(sd) 2 (y i ) 0≤i≤d ← UGen(B) 3 for i = 0, . . . , d do 4 v i := a • y i 5 end 6 c := MaskedHash((v i ) 0≤i≤d , m) 7 (z i ) 0≤i≤d := MAdd(c, (s i ) 0≤i≤d , (y i ) 0≤i≤d ) 8 if rs := RS((z i ) 0≤i≤d , B -S) = 0 then if t < q then ν i := 1 else ν i := 0 5 end 6 return ν

NewHope KEM

Parameters Let q be a prime number. Depending on the context, the elements in Z q can be equivalently represented as integers in {0, . . . , q -1} or in {-q-1 2 , . . . , q-1 2 }. The notation R q refers to the polynomial ring Z q [x]/(x n + 1) with n a power of 2. If P belongs to R q , it is a polynomial of degree at most (n -1) with coefficients P (i) belonging to the set Z q . Such elements can also be represented as vectors whose i-th coordinate is the coefficient related to x i . Let us define ψ κ the centered binomial distribution of parameter κ: one may sample from ψ κ for integer κ > 0 by computing κ i=1 b i -b i , where the b i ,b i ∈ {0, 1} are uniform independent bits. Its standard deviation is κ/2. Property 1. The elements generated according to a centered binomial distribution ψ k of parameter κ are in the interval [-κ, κ]. In NewHope, κ = 8; thus, the coefficients of the small elements are in [-8, 8].

By convention, for a ∈ Z, we define Sign(a) as positive (i.e "+1") when a ≥ 0 and as negative (i.e "-1") when a < 0. If x ∈ R, the integer x is defined as x + 1 2 ∈ Z. NewHope [Pöp+19] is a Ring-LWE based key establishment scheme (see Hard Problem 5) derived from NewHope-Usenix [START_REF] Alkim | Post-quantum key exchange-a new hope[END_REF], that is simplified because it does not use the reconciliation anymore. In this section, we describe NewHope, where we omit some details (e.g. the so-called NTT transform or the encoding of the messages) to simplify the presentation. This does not imply any loss of generality for our attack. To ease the understanding, we will describe the CPA-KEM version of NewHope in this section as the key mismatch oracle can be easily derived.

The polynomial ring R q used in NewHope has the following parameters: (n, q) = (1024, 12289) or (n, q) = (512, 12289). The coefficients of the small elements drawn from R q follow a centered binomial distribution ψ n κ with κ = 8. The standard deviation is a = 8 2 = 2. We decided to focus on explaining the attack for n = 1024. Indeed, for n = 512 there is twice less redundancy, and the attack is easier. Thus, we fix n = 1024. These elements will be seen as vectors of size n with integer components. We denote s = 1536 which is such that q = 8s + 1. The aim of the system is to share a key of size n 4 = 256 bits.

A public value A ∈ R q is derived from a published seed. Four specific functions are introduced: Encode, Decode, Compress and Decompress. They are described in Algorithms 29 to 32. Note that we partly deviate from the notation of the original specification of these algorithms, since we use the parameter s (the original description is in [START_REF] Alkim | NewHope without reconciliation[END_REF]). The following paragraphs describe these functions.

Algorithm 31 -Compression

Compress and Decompress.

The function Compress (Algorithm 31) takes as input a vector C in R q and applies on each of its components a modulus switching to obtain an element c in Z 8 [x]/(x n + 1). Compressing a vector C essentially means keeping the 3 most significant bits of each coefficient. The function Decompress (Algorithm 32) shifts the bits of the input c ∈ [0, 8[ n to place them among the most significant bits. These functions are not the inverse of each other.

Encode and Decode.

The Encode function takes a n/4-bit input ν with n/4 = 256 and creates an element D ∈ R q which stores 4 times the element ν. The redundancy is used by the function Decode to recover ν with a noisy D.

Let us now describe this scheme represented in Fig. 4.2.

1. Setup: Alice generates S and E with ψ 8 . She sends her public key pk := (seed, B := AS + E) to Bob.

Key Encapsulation:

From a random coin acting as a seed 3 , Bob derives 3 small secrets S', E' and E" in R q and a random element ν B of size n/4 which will be used to construct the encapsulated key. He computes U := AS' + E'. He encodes ν B into a redundant element D of R q using the algorithm Encode (Algorithm 29). Bob uses Compress (Algorithm 31) to compress C := BS' + E" + D into an element with very small coefficients as described above. He sends ct key := (Compress(C), U) to Alice. He deduces the shared secret as m key := hash(ν B ).

Key Decapsulation:

Alice decompresses ct key with Decompress into C'(Algorithm 32). She computes C' -US which is close to

Since ES' + E" -E'S is small, she recovers an estimated value ν A of ν B with a decoding algorithm called Decode( Algorithm 30). From ν A , she can deduce m key := hash(ν A ). Alice and Bob get the same key m key = m key with high probability.

Remark 15. This Section presents NewHope-CPA-KEM, which is the target of this Section. Note that a PKE called NewHope-CPA-PKE has also been introduced in [Pöp+19].

Algorithm 33 -PKE.KeyGen

Result: (sk, pk) Algorithm 34 -PKE.Enc For the need of the study, we had to consider a generic scheme based on Mod-LWE (see Hard Problem 5) with no rounding and no error-correcting code. Although no such implementation exists without these features, we take inspiration from two NIST candidates Saber [START_REF] Anvers | [END_REF] and Crystals-Kyber [START_REF] Schwabe | [END_REF] to design a simpler scheme with similar specifications. The parameters are chosen to provide similar resistance to known quantum and classical attacks while being simpler to analyse due to the lack of rounding and error-correcting code.

Let q, n, l, σ s , σ z be public parameters, and we use the polynomial ring R q = Z q [x]/(x n + 1) as defined in Eq. (1.3). We describe a general passively secure (Security Model 4) public key encryption scheme derived from [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF] based on Mod-LWE (Hard Problem 5) in Algorithms 33 to 35. In the latter, a random coin ∈ {0, 1} 256 acts as a seed for drawing from Gaussian distributions. These Gaussian distributions follow Section 2.2.2 notations. The message space is defined as M := {polynomials in R q with coefficients in {0, 1}}.

We show the corresponding IND-CCA secure (see Security Model 5) KEM Decapsulation and Encapsulation in Algorithms 36 and 37 using a CCA transformation derived from the Fujisaki-Okamoto transform [START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF]. hash 0 and hash 1 are hash functions. In the KEM, the ciphertext space is Ct = (R l q , R q ) and the space of the common key m key , called as "message space" is M = {0, 1} 256 .

We selected a set of parameters to implement Algorithms 33 to 37. They ensure a 5.3 Distorted Bounded Distance Decoding (DBDD)

Definition

We first introduce a variant of the LWE problem as presented in Hard Problem 3. Indeed, we need the search LWE problem in its short-secret variant which is the most relevant to practical LWE-based encryption. As shown in [START_REF] Albrecht | Estimate All the LWE, NTRU Schemes![END_REF], all the (Mod, Ring, plain)LWEbased schemes can be embedded into Hard Problem 10.

Hard Problem 10 -Search LWE problem with short secrets Let n, m and q be positive integers, and let χ be a distribution over Z.

Given the pair A ∈ Z m×n q , b = zA T + e ∈ Z m q where: 1. A ∈ Z m×n q is sampled uniformly at random, 2. z ← χ n , and e ← χ m are sampled with independent and identically distributed coefficients following the distribution χ.

Find z.

The primal attack (See for example [START_REF] Martin R Albrecht | Revisiting the expected cost of solving uSVP and applications to LWE[END_REF]) against (search)-LWE proceeds by viewing the LWE instance as an instance of a Bounded Distance Decoding (BDD) problem, converting it to a uSVP instance (via Kannan's embedding [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF]), and finally applying a lattice reduction algorithm to solve the uSVP instance. The central tool of our framework is a generalization of BDD that accounts for potential distortion in the distribution of the secret noise vector that is to be recovered.

Hard Problem 11 -Distorted Bounded Distance Decoding problem (DBDD)

Let Λ ⊂ R d be a lattice, Σ ∈ R d×d be a symmetric matrix and µ ∈ Span(Λ) ⊂ R d such that Span(Σ) Span(Σ + µ T • µ) = Span(Λ).

(5.1)

The Distorted Bounded Distance Decoding problem DBDD Λ,µ,Σ is the following problem:

Given µ, Σ and a basis of Λ.

where E(µ, Σ) denotes the ellipsoid

We will refer to the triple I = (Λ, µ, Σ) as the instance of the DBDD Λ,µ,Σ problem.

Intuitively, Hard Problem 11 corresponds to knowing that the secret vector x to be recovered follows a distribution of variance Σ and average µ. The quantity (x -µ) • Σ ∼ • (x -µ) T can be interpreted as a non-canonical Euclidean squared distance xµ 2 Σ , and the expected value of such a distance for a Gaussian x of variance Σ and average µ is rank(Σ). One can argue that, for such a Gaussian, there is a constant probability that xµ 2 Σ is slightly greater than rank(Σ) 2 . Since we are interested in the average behavior of our attack, we ignore this benign technical detail. In fact, we will typically scenario is typical in template attacks, as we exemplify via the single trace attack on Frodo from [START_REF] Bos | Assessing the Feasibility of Single Trace Power Analysis of Frodo[END_REF], which we study in Section 5.6.1.

Given the a posteriori distribution of s, v , one can derive its mean µ ap and variance σ 2 ap and apply the corrections to compute the new mean and covariance exactly as in Eqs. (5.14) and (5.15).

Λ = Λ

(5.21)

(5.23)

Short vector hints

Definition 29 (Short vector hint). A short vector hint on the lattice Λ is the knowledge of a short vector v such that v ∈ Λ.

Note that such hints are not related to the secret, and are not expected to be obtained by side-channel information, but rather by the very design of the scheme. In particular, the lattice Λ underlying LWE instance modulo q contains the so-called q-vectors, i.e. the vectors (q, 0, 0, . . . , 0) and its permutations. These vectors are in fact implicitly exploited in the literature on the cryptanalysis of LWE since at least [START_REF] Lindner | Better Key Sizes (and Attacks) for LWE-Based Encryption[END_REF]. Indeed, in some regimes, the best attacks are obtained by 'forgetting' certain LWE equations, which can be geometrically interpreted as a projection orthogonally to that vector. Note that, among all hints, the short vector hints should be the last to be integrated. In our context, we need to generalize this idea beyond q-vector because the q-vectors may simply disappear after the integration of a perfect or modular hint. For example, after the integration of a perfect hint s, (1, 1, . . . , 1) = 0, all the q-vectors are no longer in the lattice, but (q, -q, 0, . . . , 0) still is, and so are all its permutations.

Resolving the DBDD problem resulting from this projection will not directly lead to the original secret, as projection is not injective. However, as long as we keep n + 1 dimensions out of the n + m + 1 dimensions of the original LWE instance, we can still efficiently reconstruct the full LWE secret by solving a linear system over the rationals.

Integrating a short vector hint into a DBDD instance It is the case when the secret vector is short enough to be a solution after applying projection

To compute a basis of Λ , one can simply apply the projection to all the vectors of its current basis, and then eliminate linear dependencies in the resulting basis using LLL.

Remark 27. Once a short vector hint v ∈ Λ has been integrated, Λ has been transformed into Λ . And, if one has to perform another short vector hint integration v 1 ∈ Λ, v 1 should be projected onto Λ with v • Π Λ ∈ Λ . In our implementation, however, this has been taken into account and one can simply apply the same transformation as above, replacing a single vector v by a matrix V.

Appendix

A

Appendix: Masked Gadgets

Adapting the mask conversions

Using sec +q instead of sec + in the algorithms of [CGV14, Section 4], we also immediately obtain an algorithm denoted A q B for converting a mod-q arithmetic masking x = d i=0 x i mod q of a value x ∈ [0, q) into a Boolean masking z = d i=0 z i of the same value. The naive way of doing so (see Gadget 13), which is the counterpart of [CGV14, §4.1], is to simply construct a Boolean masking of each of the shares x i , and to apply sec +q to those masked values iteratively. This is simple and secure, but as noted by Coron et al., this approach has cubic complexity in the masking order d (because sec + and hence sec +q are quadratic). A more advanced, recursive approach allows to obtain quadratic complexity for the whole conversion: this is described in [CGV14, Section 4.2], and directly applies to the lattice-based signatures setting. It was not applied in our paper but it is presented here as a contribution of this thesis in Gadget 14. When a masked value composed of an odd number of shares d is presented to the algorithm, it first splits them in two uneven parts of size d/2 + 1 and d/2 before proceeding to the recursive call. The subroutine Expand takes as input an arbitrary number of shares d and the bit size of the masks. It expands them in 2d shares (with a 0 padding) and then refreshes them using Ref ⊕ (., w). Applying Expand to both parts, we end up with a part p 1 of size d + 1 and a part p 2 of size d -1. We merge the two last shares of p 1 and append a zero to p 2 to get two size d masking that are finally added together to yield the final boolean masking.

Aq B

Mask conversion: This gadget denoted A q B converts an input (x i ) 0≤i≤d in mod q arithmetic masked form to (z i ) 0≤i≤d in Boolean masked form such that ( i z i ) = ( i x i mod q). It is described in Gadget 13, and a more efficient version is in Gadget 14.

Gadget 13 -Conversion arithmetic to Boolean masking; simple cubic version

Data: Arithmetic masking (x i ) 0≤i≤d modulo q of an integer x; the bit size w of the returned masks (with

Gadget 14 -Conversion arithmetic to Boolean masking (A q B) Data: Arithmetic masking (x i ) 0≤i≤d modulo q of an integer x; the bit size w of the returned masks (with For each iteration of the loop, this process can be repeated. At the very first iteration, several shares of z may be necessary to simulate the set of observations. However, there are all initialized to 0, nothing is added to S.

At the end we can conclude that the full algorithm can be simulated using the set S of input shares. Furthermore we have |S| ≤ |I R j | (since a j is added in S only if I R j is not empty), so we can conclude that |S| ≤ |I A j | + |I R j | which concludes the proof. The security of A q B (Gadget 14) is the same. The only difference is that we generalize it for d being arbitrary (i.e. non power of two). This still keeps the d-SNI property.

The reverse mask conversion

Reverse Mask conversion: This gadget denoted B A q converts an input (x i ) 0≤i≤d in a Boolean masked form to (z i ) 0≤i≤d in mod q arithmetic masked form such that ( i z i mod q) = ( i x i ). It is described in Gadget 15.

With both algorithms sec +q and A q B in hand, we can easily build the B A q algorithm by mimicking [CGV14, Algorithm 6]. To convert the Boolean masking (x i ) 0≤i≤d of x to a mod-q arithmetic masking, we first generate random integer shares z i ∈ [0, q), 1 ≤ i ≤ d, uniformly at random. We then define a i = -z i mod q = q -z i for 1 ≤ i ≤ d and a 0 = 0. The tuple (a i ) 0≤i≤d is thus a mod-q arithmetic masking of the sum a = -1≤i≤d z i mod q. Using A q B, we convert this arithmetic masking to a Boolean masking (y i ) 0≤i≤d , so that d i=0 y i = a . Now, let (a i ) 0≤i≤d = sec +q (x i ) 0≤i≤d , (y i ) 0≤i≤d ; this is a Boolean masking of:

We then securely unmask this value using the Full⊕ procedure, and set z 0 = a mod q. Then, we have:

Gadget 15 -Conversion Boolean to arithmetic masking (B A q ) Data: Boolean masking (x i ) 0≤i≤d of an integer x; the modulus q Result: A arithmetic masking (z i ) 0≤i≤d of x 1 generate uniform integers

Lemma 24. Gadget B A q is d-SNI secure.

Proof: Full⊕ is d-NI secure and z 0 is not revealed after its execution. All the δ 0 ≤ d observations made by the attacker of this last instance of Full⊕ can be perfectly We build the proof classically from right to left. By linearity for Boolean masking, the final ⊕ and ∧ step is d-NI. It is also an affine gadget. In other words, each observation can be simulated with either one share of x or one share of mask. Thus, all the observations from its call can be simulated with at most δ 4 shares among all the shares of x and mask. Then it can be simulated with at most x 1 shares of x and x 2 shares of mask with x 1 + x 2 = δ 4 .The gadget sec + is d-NI then all the observations from its call can be simulated with at most x 1 + δ 3 shares of mask and x . Identically, the shift is d-NI (by linearity), so the observations from its call can be simulated with at most

Finally, all the observations during the computations of sec|.| can be simulated with at most δ 1 + δ 2 + δ 3 + δ 4 ≤ δ shares of x.

Uniform Rejection Sampling

In many lattice-based Fiat-Shamir with aborts signature schemes, there is a rejection sampling step. Let us consider a uniform one. This check consists in knowing if an arithmetically masked element in x ∈ Z/qZ is in the interval [-param, param]. Again, carrying out this check using mod-q arithmetic masking seems difficult, so we again resort to Boolean masking using A q B. RS Uniform Rejection Sampling: This gadget denoted RS-Coeff in its coefficient version and RS in its polynomial version takes an arithmetic mod q input (x i ) 0≤i≤d and an unmasked value param and outputs 1 iff | i x i mod q| ≤ param, 0 otherwise. It is presented in Gadget 17 and Gadget 18.

In [START_REF] Barthe | Masking the GLP Lattice-Based Signature Scheme at Any Order[END_REF], we designed a gadget verifying that the centered representative of a masked integer is greater than -param and applied it to both x and -x. In [START_REF] Vincent Migliore | Masking Dilithium -Efficient Implementation and Side-Channel Evaluation[END_REF], a less computationally intensive approach was taken: their rejection sampling gadget takes as input an arithmetic masking of a coefficient x ∈ Z/qZ identified by its canonical representative and checks directly that either xparam is negative or x -q + param is positive. This can be easily done using precomputed constants (-param -1, 0, . . . , 0) and (-q + param, 0, . . . , 0). The last approach we introduced (in [GR19]) is similar but we first compute the absolute value of x and perform the masked test |x| ≤ param. This saves the need for a masked operation to aggregate both tests.

Gadget 17 -Rejection sampling for integers (RS-Coeff)

Data: The shared element (x i ) 0≤i≤d to check in mod-q arithmetic masked representation; param Result: The bit rs equal to 1 iff |x| ≤ param, and 0 otherwise.

Proof: The rejection sampling is a succession of gadgets without cycle. Thus, for proving its d-NI security, it remains to prove the d-NIo or d-NI security of each of its gadgets: A q B, sec|.|, sec +q , and Full⊕. As seen before, A q B (Lemma 23), sec|.| (Lemma 25), Full⊕ (Lemma 11) and sec + (Lemma 14) are d-NI. The is linear for Boolean masking, so it is d-NI. Thus, rejection sampling is d-NI.

The Rejection sampling gadget can be generalized for polynomials in R q (defined in Eq. (1.3)) by applying RS to each of the coefficient. The values rs (j) correspond to the conditions of rejection, and more precisely, the positions of the coefficients of the polynomial that do not pass the rejections. Such a knowledge does not impact the security of the scheme because the rejection probability does not depend on the position of the coefficients and their number.

Gadget 18 -Rejection sampling (RS)

Data: A shared polynomial (x i ) 0≤i≤d to check in mod-q arithmetic masked representation, param Result: The bit rs equal to 1 if all the coefficients, denoted x (i) of x satisfy |x (i) | ≤ param, and 0 otherwise.

Then, from Remark 5 and Lemma 26, we can make the following corollary.

Corollary 3. Gadget RS is d-NIo secure with public outputs rs (j) .

Masked rounding

In certain schemes, a compression technique [START_REF] Bai | An Improved Compression Technique for Signatures Based on Learning with Errors[END_REF] is introduced to reduce the size of the signature. It implies rounding coefficients of a polynomial and keeping the k most significant bits. In many cases, revealing the polynomial before rounding would allow an adversary to get extra information on secret values and thus, this operation has to be done on the masked polynomial.

Rnd

Rounding: This gadget denoted Rnd-Coeff in its coefficient version and Rnd in its polynomial version in R q takes an arithmetic mod q input (x i ) 0≤i≤d and an unmasked value Tail and outputs z = i x i mod q Mst where • Mst means dropping Tail least significant bits. It is presented in Gadget 19 and Gadget 20. The first step is to compute the centered representative of x, i.e. subtract q from x if x ≥ q/2. The second step is the computation of (x -x Lst )/2 Tail (where • Lst defines keeping the Tail least significant bits). We used a small trick here. Subtracting the centered representative modulo 2 Tail is actually equivalent to the application of a rounding to the closest multiple of 2 Tail with ties rounded down. Hence we first computed x+2 Tail-1 -1 and dropped the Tail least significant bits. This is analogous to computing x = x + 0.499 . . . to find the closest integer to a real value.

Gadget 19 -Masked rounding for integers -(Rnd-Coeff)

Data: An arithmetic masking (x i ) 0≤i≤d of some integer x, Tail the number of most significant bits that are kept Result: An integer z corresponding to the modular rounding of x, i.e. z = x Mst where • Mst denotes dropping the Tail least significant bits

Gadget 20 -Masked rounding (Rnd) Data: A shared polynomial (x i ) 0≤i≤d , in mod-q arithmetic masked representation, Tail the number of least significant bits to drop Result: The polynomial z corresponding to the modular rounding of x of observations made by the attacker. Our goal is to prove that all these δ observations can be perfectly simulated with at most δ shares of (x i ) 0≤i≤d . In the following, a distribution of the attacker's δ observations is considered as follows: δ 1 observed during A q B calculations producing shares of (x i ) 0≤i≤d , δ 2 observed during sec + calculations producing (b i ) 0≤i≤d , δ 3 observed during the switch and shift stages, δ 4 observed during the ⊕ operation, δ 5 observed during sec + calculations producing (x i ) 0≤i≤d , δ 6 observed during the final shift stage, and δ 7 observed during the final Full⊕ stage. Finally, we have 7 i=1 δ i ≤ δ.

We build the proof from right to left. The algorithm Full⊕ is d-NI. As a consequence, all the observations from its call can be perfectly simulated with at most δ 7 ≤ δ shares of x . The shift algorithm is a linear operation and thus it is d-NI secure. Thus, all observations from its call can be perfectly simulated with at most δ 6 + δ 7 ≤ δ shares of x . The algorithm sec + is d-NI secure and similarly, all the observations from its call can be simulated with at most δ 5 + δ 6 + δ 7 ≤ δ shares of x and CON ST (but the latter is a public constant). The ⊕ operation is also linear, so it is d-NI. Then, all the observations made from its call can be simulated with at most δ 4 + δ 5 + δ 6 + δ 7 ≤ δ shares of x and b, and with the knowledge of u. Actually, we remark that ⊕ is also a affine gadget. Thus, all the observations can be exactly simulated with at most v 1 shares of x and v 2 shares of b such that v 1 + v 2 = δ 4 + δ 5 + δ 6 + δ 7 . Let us consider now the switch and shift operations. They are linear so d-NI secure and thus all observations made from its call can be simulated with at most δ 3 +v 2 ≤ δ observations on b. Considering the first instance of sec + , its d -NI security implies that all the observations from its call can be simulated with at most δ 2 + δ 3 + v 2 ≤ δ shares of x and MINUS_Q_HALF (but the latter is a public constant). Finally, we consider the algorithm A q B which is d-NI secure. There are at most v 1 + (δ 2 + δ 3 + v 2 ) = 7 i=2 δ i observations made on the outputs and δ 1 made locally. Thus, all the observations during Gadget 20 can be simulated with at most 8 i=1 δ i ≤ δ ≤ d shares of the input x.

From Remark 5 and Lemma 27, we can make the following corollary.

Corollary 4. Gadget Rnd is d-NI secure, thus d-NIo secure with public outputs z (j) .

Masked well-rounded

In Bai-Galbraith signatures [START_REF] Bai | An Improved Compression Technique for Signatures Based on Learning with Errors[END_REF], the signature scheme can fail the verification and may have to be restarted even if the rejection sampling test has been successful. This results from the fact that the signature acts as a proof of knowledge only on the s part of the private key and not on the error e. Nonetheless, thanks to the rounding, the verifier will be to give a correct input to the hash function if the commitment is 'wellrounded'. Since not well-rounded signatures would leak information on the private key, this verification has to be performed in masked form.

WRnd

Check the Rounding: This gadget denoted WRnd-Coeff in its coefficient version and WRnd in its polynomial version takes an arithmetic mod q input (x i ) 0≤i≤d and 3 unmasked values param 1 , param 2 and Tail and outputs 1 iff | i x i mod q| < param 1 and | i x i mod q Lst | < param 2 where • Lst denotes keeping the Tail least significant bits. It is presented in Gadget 21 and Gadget 22.

While the cost of this rather simple operation is negligible compared to polynomial multiplication in the unprotected signature, this test is fairly expensive in masked form. Indeed, it requires four comparisons in addition to the extraction of the low bits of x. The techniques are inspired from RS and Rnd gadgets. After trying the four comparisons method, we realized that the best strategy was actually to compute both absolute values with the sec|.| gadget. While comparisons only require one sec + and one shift, which is less than sec|.|, the cost of all sec& operations between the results of those comparisons makes our approach of computing the absolute value slightly better.

Gadget 21 -Masked well-rounded for integers (WRnd-Coeff)

and Tail the number of least significant bits that are kept. of observations made by the attacker. Our goal is to prove that all these δ observations can be perfectly simulated with at most δ shares of (x i ) 0≤i≤d .

In the following, we consider the following distribution of the attacker's δ observations: δ 1 observed during the computation of A q B that produces shares of (x i ) 0≤i≤d , δ 2 observed during the computation of the upper sec|.| that produces the shares of (a i ) 0≤i≤d , δ 3 observed during the Refresh, δ 4 observed during the computations of the ∧ and sec|.| that produces the shares of (y i ) 0≤i≤d , δ 5 observed during the sec + that produces (a i ) 0≤i≤d , δ 6 observed during the sec + that produces Finally, we consider the algorithm A q B which is d-NI secure. There are at most δ 3 + (δ 2 + δ 5 + δ 7 + δ 9 + δ 10 ) ≤ δ observations made on the outputs and δ 1 made locally. Thus, all the observations during WRnd-Coeff can be simulated with at most δ 1 + δ 2 + δ 3 + δ 5 + δ 7 + δ 9 + δ 10 ≤ δ ≤ d shares of the input x.

Gadget 22 -Masked well-rounded (WRnd)

Data: A shared polynomial (x i ) 0≤i≤d , in mod-q arithmetic masked representation, param 1 , param 2 and Tail the number of least significant bits that are kept. Result: The bit wr equal to 1 if all the coefficients, denoted

As with the previous large gadgets, the WRnd gadget can be generalized for polynomials in Z/qZ by applying WRnd-Coeff to each of the coefficients. The values wr (j) correspond to the conditions of the well rounding, and more precisely, the positions of the coefficients of the polynomial that do not pass the condition. From Remark 5 and Lemma 28, we can make the following corollary.

Corollary 5. Gadget WRnd is d-NIo secure with public outputs wr (j) .

Masked Checking

The purpose of this gadget is to check that the sum of the h most significant coefficients of its inputs is not too large. To recover the most significant coefficients, this algorithm uses a straightforwardly masked bubble sort by doing h passes on the list of coefficients. The bubble sort uses a masked exchange subroutine where the bit 0 or 1, representing the need for an exchange or not, is also masked. It finishes with a masked comparison with a precomputed bound.

MChk

Masked checking: This gadget denoted MChk takes an arithmetic mod q input (x i ) 0≤i≤d , an unmasked integer h and a an unmasked bound S. It outputs a bit ms such that ms = 1 iff the sum of the h largest coefficients of x is larger than S, ms = 0 otherwise. It is presented in Gadget 23.

Lemma 29. Assuming that the bubble sort in step 2 is a d-NI subgadget, the gadget MaskedCheck in Gadget 23 is d-NI secure.

Proof: Gadget 23 is a succession of non interfering gadgets with no cycles and the last gadget is d-NI. Thus, the whole algorithm is d-NI secure.

Gadget 23 -Masked Check (MChk)

Data: An arithmetic masking of a polynomial (x i ) 0≤i≤d , an integer h and a bound S Result: ms := 1 if the sum of its h largest coefficients is larger than the bound S and 0 otherwise 1 (BOUND i ) 0≤i≤d := (-S, 0, . . . , 0) 2 Find the h largest coefficients ((c

RADIX -1) 6 return ms := Full⊕(δ) ABSTRACT Lattice-based cryptography is considered as a quantum-safe alternative for the replacement of currently deployed schemes based on RSA and discrete logarithm on prime fields or elliptic curves. It offers strong theoretical security guarantees, a large array of achievable primitives, and a competitive level of efficiency. Nowadays, in the context of the NIST post-quantum standardization process, future standards may ultimately be chosen and several new lattice-based schemes are high-profile candidates. The cryptographic research has been encouraged to analyze lattice-based cryptosystems, with a particular focus on practical aspects. This thesis is rooted in this effort. In addition to black-box cryptanalysis with classical computing resources, we investigate the extended security of these new lattice-based cryptosystems, employing a broad spectrum of attack models e.g. quantum, misuse, timing or physical attacks. Accounting that these models have already been applied to a large variety of pre-quantum asymmetric and symmetric schemes before, we concentrate our efforts on leveraging and addressing the new features introduced by lattice structures. Our contribution is twofold: defensive, i.e. countermeasures for implementations of lattice-based schemes and offensive, i.e. cryptanalysis. On the defensive side, in view of the numerous recent timing and physical attacks, we wear our designer's hat and investigate algorithmic protections. We introduce some new algorithmic and mathematical tools to construct provable algorithmic countermeasures in order to systematically prevent all timing and physical attacks. We thus participate in the actual provable protection of the GLP, BLISS, qTesla and Falcon lattice-based signatures schemes. On the offensive side, we estimate the applicability and complexity of novel attacks leveraging the lack of perfect correctness introduced in certain lattice-based encryption schemes to improve their performance. We show that such a compromise may enable decryption failures attacks in a misuse or quantum model. We finally introduce an algorithmic cryptanalysis tool that assesses the security of the mathematical problem underlying lattice-based schemes when partial knowledge of the secret is available. The usefulness of this new framework is demonstrated with the improvement and automation of several known classical, decryption-failure, and side-channel attacks.

MOTS CLÉS

Cryptographie

Cryptanalyse Réseaux euclidiens RÉSUMÉ La cryptographie fondée sur les réseaux euclidiens représente une alternative prometteuse à la cryptographie asymétrique utilisée actuellement, en raison de sa résistance présumée à un ordinateur quantique universel. Cette nouvelle famille de schémas asymétriques dispose de plusieurs atouts parmi lesquels de fortes garanties théoriques de sécurité, un large choix de primitives et, pour certains de ses représentants, des performances comparables aux standards actuels. Une campagne de standardisation post-quantique organisée par le NIST est en cours et plusieurs schémas utilisant des réseaux euclidiens font partie des favoris. La communauté scientifique a été encouragée à les analyser car ils pourraient à l'avenir être implantés dans tous nos systèmes. L'objectif de cette thèse est de contribuer à cet effort. Nous étudions la sécurité de ces nouveaux cryptosystèmes non seulement au sens de leur résistance à la cryptanalyse en ''boîte noire'' à l'aide de moyens de calcul classiques, mais aussi selon un spectre plus large de modèles de sécurité, comme les attaques quantiques, les attaques supposant des failles d'