Hunting for SCA/FI Vulnerabilities: A Red Team’s Guide to PQC Security (Q13b)
This talk details a Red Team’s guide to Post Quantum Cryptography Security, specifically focusing on finding Side-Channel Attack (SCA) and Fault Injection (FI) vulnerabilities in their implementations. It outlines the taxonomy of these implementation attacks and presents a comprehensive, mixed strategy for identifying them, incorporating manual reviews, simulation, and physical testing. The team addresses the challenges of a growing number of targets and remote work through significant automation, utilizing Gitlab CI for efficient and repeatable security verification. The current security testing infrastructure is highlighted, with a focus on a dedicated SCA setups and pre-silicon fault simulation, while also noting future plans to expand physical attack setups and simulation capabilities for both hardware and firmware.