Search papers, labs, and topics across Lattice.
This paper presents a novel side-channel attack on the Hamming Quasi-Cyclic (HQC) key encapsulation mechanism by exploiting load/store leakage in sparse secret vectors. By analyzing Cortex-M4 assembly code, the authors identify a leakage asymmetry in the 32-bit halves of 64-bit words, allowing them to classify secret vector words as zero or nonzero based on electromagnetic measurements. The attack significantly reduces the complexity of key recovery to approximately 2^46 operations for HQC-1, demonstrating the vulnerability of HQC to implementation attacks and highlighting the need for effective countermeasures.
A side-channel attack on HQC reveals that 88.7% of machine words can be classified as zero, drastically simplifying key recovery to just 2^46 operations.
Hamming Quasi-Cyclic (HQC) is a code-based key encapsulation mechanism selected by NIST for standardization, making its resistance to implementation attacks critically important. We present a side-channel attack that exploits load/store leakage in the manipulation of HQC's sparse secret vectors. Analysing Cortex-M4 assembly generated from the reference implementation, we identify a leakage surface in which the low and high 32-bit halves of each 64-bit word leak with different strengths, due to compiler-generated register spilling. We exploit this leakage to construct a simple zero-word distinguisher classifying machine words of the secret vector as zero or nonzero from electromagnetic measurements. The recovered zero positions are then translated into decoding hints, reducing HQC key recovery to a shortened syndrome-decoding problem. We analyse the resulting decoding complexity for all HQC parameter sets: at 32-bit granularity an expected 88.7% of the machine words of y are zero for HQC-1, cutting the decoding to $\approx$ 2 46 bit operations. Experiments on a Cortex-M4 validate the predicted low/high-half asymmetry-approximately 500 traces for the stronger low-half channel and 5,000 for the weaker high-half channeland recover the zero words of an HQC-1 key at 32-bit granularity. Finally, we discuss practical countermeasures that eliminate the sparsity exploited by the attack.
