Get Rid of Templates: A Chosen-Ciphertext Attack on ML-KEM with a DPA-Based Self-comparison Oracle
摘要
Binary plaintext-checking oracle-based chosen-ciphertext attacks have been suggested for retrieving the long-term private key of ML-KEM. Although previous works have shown efficiency, we found significant challenges while mounting attacks in real-world scenarios with substantial environmental noise. In this work, we introduce a Differential Power Analysis-based self-comparison oracle to address the difficulties of creating a near-perfect binary plaintext-checking oracle under such conditions. We validate our approach on a real-world PCB, demonstrating that it simplifies the requirements for executing the chosen-ciphertext attack and offers a more straightforward and effective method for targeting an unknown real-world ML-KEM device.