Fault Attacks on VOLEitH Signature Schemes

Ongoing efforts to transition to post-quantum public-key cryptosystems have created the need for algorithms with a variety of performance characteristics and security assumptions. Among the candidates in NIST’s post-quantum standardisation process for additional digital signatures are FAEST and SDitH, two Vector Oblivious Linear Evaluation in-the-Head (VOLEitH)-based schemes. The security of FAEST is based on the Advanced Encryption Standard (AES), while SDitH relies on the regular syndrome decoding problem. The VOLEitH paradigm enables competitive performance and signature sizes under conservative security assumptions. However, since it was introduced relatively recently, in 2023, its resistance to physical attacks has not yet been analysed. In this paper, we present the first security analysis of VOLEitH-based signature schemes in the context of fault injection attacks. We demonstrate two practical attacks on the reference implementations of the secondround variants of FAEST and SDitH in ARM Cortex-M4 capable of recovering the secret key from a single signature. These attacks exploit vulnerabilities of components specific to VOLEitH schemes, namely the batch all-but-one vector commitments and the VOLE generation. We also propose countermeasures to mitigate these attacks and enhance the physical security of VOLEitH-based digital signature schemes.