On Exploiting Message Leakage in (few) NIST PQC Candidates for Practical Message Recovery Attacks

Prasanna Ravi, Shivam Bhasin, Sujoy Sinha Roy, Anupam Chattopadhyay

Research output: Contribution to journalArticlepeer-review


In this work, we propose generic and practical side-channel attacks for message recovery in post-quantum lattice-based public key encryption (PKE) and key encapsulation mechanisms (KEM). The targeted schemes are based on the well known Learning With Errors (LWE) and Learning With Rounding (LWR) problem and include three finalists and six semi-finalist candidates of the ongoing NIST’s standardization process for post-quantum cryptography. Notably, we propose to exploit inherent ciphertext malleability properties of LWE/LWR-based PKEs as a powerful tool for side-channel assisted message recovery attacks. The use of ciphertext malleability widens the scope of previous attacks with the ability to target multiple operations for message recovery. Moreover, our attacks are adaptable to different implementation variants and are also applicable to implementations protected with concrete shuffling and masking side-channel countermeasures. Our work mainly highlights the presence of inherent algorithmic properties in LWE/LWR-based schemes that can aid side-channel attacks for message recovery, thereby stressing on the need for strong side-channel countermeasures against message recovery for LWE/LWR-based schemes.

Original languageEnglish
Pages (from-to)684-699
JournalIEEE Transactions on Information Forensics and Security
Publication statusPublished - 28 Dec 2021


  • Encryption
  • Feature extraction
  • NIST
  • Resistance
  • Side-channel attacks
  • Standards
  • Transforms

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications

Fields of Expertise

  • Information, Communication & Computing


Dive into the research topics of 'On Exploiting Message Leakage in (few) NIST PQC Candidates for Practical Message Recovery Attacks'. Together they form a unique fingerprint.

Cite this