Belief Propagation Meets Lattice Reduction: Security Estimates for Error-Tolerant Key Recovery from Decryption Errors


  • Julius Hermelink Max Planck Institute for Security and Privacy, Bochum, Germany
  • Erik Mårtensson Selmer Center, Department of Informatics, University of Bergen, Bergen, Norway; Department of Electrical and Information Technology, Lund University, Lund, Sweden
  • Simona Samardjiska Digital Security Group, Radboud University, Nijmegen, The Netherlands
  • Peter Pessl Infineon Technologies AG, Munich, Germany
  • Gabi Dreo Rodosek Universität der Bundeswehr München, Munich, Germany



Kyber, LWE, Belief Propagation, Lattice Reduction, SVP, Implementation Attack


In LWE-based KEMs, observed decryption errors leak information about the secret key in the form of equations or inequalities. Several practical fault attacks have already exploited such leakage by either directly applying a fault or enabling a chosen-ciphertext attack using a fault. When the leaked information is in the form of inequalities, the recovery of the secret key is not trivial. Recent methods use either statistical or algebraic methods (but not both), with some being able to handle incorrect information. Having in mind that integration of the side-channel information is a crucial part of several classes of implementation attacks on LWEbased schemes, it is an important question whether statistically processed information can be successfully integrated in lattice reduction algorithms.
We answer this question positively by proposing an error-tolerant combination of statistical and algebraic methods that make use of the advantages of both approaches. The combination enables us to improve upon existing methods – we use both fewer inequalities and are more resistant to errors. We further provide precise security estimates based on the number of available inequalities.
Our recovery method applies to several types of implementation attacks in which decryption errors are used in a chosen-ciphertext attack. We practically demonstrate the improved performance of our approach in a key-recovery attack against Kyber with fault-induced decryption errors.




How to Cite

Hermelink, J., Mårtensson, E., Samardjiska, S., Pessl, P., & Dreo Rodosek, G. (2023). Belief Propagation Meets Lattice Reduction: Security Estimates for Error-Tolerant Key Recovery from Decryption Errors. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2023(4), 287–317.