The expected advent of quantum computers that are strong enough to break current asymmetric encryption schemes triggered the development of PQC, which refers to cryptographic schemes that are thought to be resistant against quantum computers. After NIST standardized the first PQC algorithms as a result of a call for proposals, the diversity of mathematical problems used for signature algorithms turned out to be limited: all general purpose signature algorithms are based on structured lattices. Since no proof exists that such schemes are secure, the security relies on the assumption that they cannot be broken with state-of-the-art and even future knowledge. The limited experience with the new mathematical approaches used for PQC makes it reasonable to develop different schemes in case one or more of the underlying designs can be broken in the future. Thus, NIST requested more signature algorithms, mainly ones that are not based on lattices. CROSS is a such signature algorithm based on codes. In this work, we attempt to retrieve the secret key used in CROSS by performing a template attack. Those attacks are a variant of SCA. We find that the vector-matrix multiplication is vulnerable to side-channel analysis; critical values related to the key are processed repeatedly with known public-key values, and small values can be isolated for building hypotheses with a size that can be tested with reasonable computational effort. Using a Hamming weight leakage model, measurements with a simple setup reveal strong correlations between those values and correct hypotheses in a limited hypothesis space. This allows for the recovery of the key with a reasonable amount of effort, at least for some configurations of the CROSS algorithm.     «

The expected advent of quantum computers that are strong enough to break current asymmetric encryption schemes triggered the development of PQC, which refers to cryptographic schemes that are thought to be resistant against quantum computers. After NIST standardized the first PQC algorithms as a result of a call for proposals, the diversity of mathematical problems used for signature algorithms turned out to be limited: all general purpose signature algorithms are based on structured lattic...     »