 Hello everyone, I'm going to present our work, QD covering from Gramsci with no leakage in Hashen's life signature over control ledges. This is a joint work with Diana Hoop, Paul Kirchner, MediDeBooch, and Alec Sambolwale, I am Yang Yu. This is a quick analysis work. Our targets are two ledges signature scheme, Becken and BLP. Becken is a runner to validate in the list of EGC competition, and BLP is the ancestor of Becken. In this work, we first identify a sort of set channel leakage in some implementations of Becken and BLP, then reading the list set channel leakage and the secret P. Based on that, we show some evidence of a weakness of the original Becken implementation. Also, we present an experimentally validated attack against BLP. In recent years, there emerged a lot of ledges with the assistance of grid performance. Some of them have been used in real-world applications. For practical schemes, its security should be not only in terms of the algorithm itself, but also of the concrete implementation. The security of all reasons is usually estimated by ledges attack, algebraic attack, combinatorial attack, and so on. And for implementation security, we often consider set channel attack that includes time attack, overanalysis attack, and so on. When it comes to set channel attack, ledges signature is an important subject. There are two main paradigms for ledges based on signatures. The first one is hashed side. The earliest ledges signatures, GGH, and entry-side are in this family. But these two schemes were broken by a statistical learning attack. Later, the famous GPV paper proposed a secure framework for ledges hashed side scheme. And then, the GPV scheme is developed as some practical installations, such as backend and DOP. The other paradigms for ledges signature is B.H.A. In this family, there are also many efficient proposals, like this, Elysium, Qutosa. Nowadays, there have been many set channel work for ledges signature. However, most of this work is got B.H.A. signature scheme. Actually, the signing algorithm of a B.H.A. scheme usually relies on basic arithmetic operations mostly. And the secret key is used in direct and linear way. By contrast, in the hashed side scheme, the signing algorithm often relies on ledges Gaussian sampling. So, the secret key is used in a rather opaque way. As a result, it may be more complicated to analyze the set channel leakage in the implementation of a hashed side. Also, it may be harder to understand the relation between the set channel leakage and the hashed side secret key. In this work, we initiate a study of the channel security for ledges hashed side scheme. We focus on backend and DOP. They are two most practical hashed side schemes currently. backend is a strong candidate. In the list of EQC competition, it is the only hashed side scheme among three run-through ledges signature. Also, it is the most compact one. And the DOP is the ancestor of backend. It was proposed by Duker, Rubenshoff, B.H.A. plan. Both backend and DOP are the instantiations of GPV scheme over intro-ledges. And on the basis of DOP, backend may be used to improve the Gaussian sampler called a better Fourier sampler. Intrude is one of the most important ledges cryptosystems. It is defined over polynomial ring. And the secret key of intrude is a pair of short polynomial, f and g. And the public key is their ratio. The underlying ledges is called intro-ledges defined at least. From the intro-secret key, we can complete an intro basis by solving the intro equation. And in backend and DOP, this basis is used as the trapdoor. It is used for ledges Gaussian sampling. So four elements inside are short polynomial. In the GPV framework, signing consists in ledges Gaussian sampling. And in backend and DOP, the ledges Gaussian sampling is accomplished by the KGPV sampler or its FFT variant. In which the high-dimensional ledges Gaussian sampling is decomposed into many one-dimensional integer Gaussian sampling. And the standard deviations of those integer Gaussians are inversely but proportional to the Gram-Schind norm of the sampling basis. Also, the Gaussian centers vary as per the message and the intermediate samples. So, to deal with different integer Gaussian parameters, both FFT and DOP are used rejection sampling. That is a generic technique to produce varying Gaussian from a fixed distribution. Rejection sampling will lead to some entropy loss. And intuitively, the loss is made in determined by the standard deviation of the target Gaussian. And in the implementations of FFT and DOP, we show that the average number of loop repetition is proportional to the corresponding Gram-Schind norm of the sampling basis. So, from a timing channel, we can measure the number of loop repetition during each signing. This allows us to approximate the Gram-Schind norm by maximum likelihood estimate from the FFT menu signature. So, we call this a channel leakage, Gram-Schind norm leakage. Indeed, the Gram-Schind norm leakage is dangerous. We show that there is a polynomial time algorithm that can recover the intrusive key from the Gram-Schind norm of the intrusive basis. Our algorithm consists of two steps. As a first step, we compute a polynomial ff bar plus gg bar from the Gram-Schind norm. Here, Debar denotes the complex conjugation. And this step is our main technical result. And once we know ff bar plus gg bar, then we can use the change theory algorithm to recover the intrusive key f and g in polynomial time. In next talk, we will focus on the details of the first step. The goal of this step is to recover a polynomial u that is ff bar plus gg bar from the Gram-Schind norm of the matrix form of g and a. And our method depends on the used matrix form. Actually, there are two common matrix forms. The first one is identifying a as an anti-circuit matrix. And the first row is the coefficient vector of a. This matrix form corresponds to power basis. And it is used in DLP. And the second matrix form is built recursively. It identifies f as a two by two block matrix. And each block corresponds to a subfield element. And this matrix form actually corresponds to a power basis in a bit reverse order. And it is well compatible with fft and the tower of ring structure. It is reduced by a second. For these two matrix forms, we have some common facts. The matrix form of u is a Gram-matrix B-e-transpole. Second, the product of first k-squared Gram-Schind norm equals the determinant of the k-sliding block of the matrix form of u. Next, let's discuss the recovery problem for a and a f-matrix form respective. For the case of a-matrix form, we note that the leading block of a-u is actually a symmetric top-late matrix. So, by sure complement, we can build a quadratic equation of the coefficient ui plus one. And this implies that once we know the coefficient u0 to ui, together with the norm of bi plus one star, then we can solve the next coefficient ui plus one by solving this quadratic equation. And this gives us a recovery algorithm for complexity to be obtained. And the case of a-matrix form is more complicated. We need some algebraic knowledge. Let sigma be the field of automorphism back in C to minus C. And the trace of u is the sum of u and the sigma u. And the norm of u is the product of u and f-u. Both trace and norm map a field element to a subfield one. And in the matrix f-u, we can see the subfield elements ui and u0 actually are the trace of field elements u and u over C. Also, it is easy to see the first half of Gram-Schmidt norm actually determine the subfield element ui, because ui is the first leading block. And we also found that the second half of Gram-Schmidt norm corresponds to another subfield element, u0. And u0 equals two times the norm of u over the trace of u. So the recovery problems can be projected into the subfield since these two elements are subfield elements. And assume we can solve the recovery problem in the subfield and we compute ui into u0. And from these two subfield elements, we can compute the trace and norm of u. Now the remaining work becomes to recover u from its trace and norm. We note that u and sigma u are two roots of this quadratic equation over field. So the computation of u boils down to computing a square root over a cyclotomic field. We propose an algorithm to do that. Our idea is you're projecting the computing onto the subfield repeatedly. Actually, we note that the norm of t is the square root of the norm of a. And once we know the norm of t, then we can compute the square of the trace of t and the square of the trace of t over C. And from these two traces, we can construct the field element t itself. And we show that our square root algorithm runs in a quadratic path. Okay, now we have seen how to project the recovery problem onto the subfield and how to leave the back. And then the whole recovery can be viewed as the reconstruction of the factoring tree from its leaf to its root. Actually, the leaf in the factoring tree corresponds to the Gram-Schmidt-Nor, and the root is the polynomial a5 bar plus gg bar. And we show that the complexity of the whole recovery is also cubic of n. But that is the same as the case of a matrix form. So far, we have seen the recovery algorithm for two different matrix forms. But there is still some difference between the theoretical algorithm and a practical set-channel attack. Actually, in previous algorithms, we assume the exact Gram-Schmidt-Nor are provided. However, in practice, we must take into account the major errors on the Gram-Schmidt-Nor linkage. Actually, to achieve a precision over 2 to the minus p, we need at least a 2 to the 2p sample. So a natural question here is that, can we adapt the previous algorithms to noisy input? The answer is, for DLP, we can do that indeed. But for backend, we have not yet the solution. Okay, let's see the details of our experimental validation. For the case of DLP, the implementation we worked with is proposed by Thomas Plath and written in C++. And the parameter set we considered is claimed for 100 and 19 qubit of security, in which n equals 2 to the 9 and the module of Q supports 2 to the 10. And to measure the number of loop repetitions, we simply had some instrumentation in the code. And this step can be replaced by some standard channel attacks like cache-time attacks. And to cope with the noisy and Gram-Schmidt-Nor, we combine the previous algorithms with tree-search. Now, at each step, we will compute all possible candidates for the next coefficient. And if there is no candidate, we just prove the current prefix. And our experimental result shows that, given about 2 to the 35 ELP signatures, we can indeed break some concrete instances in practice. Unfortunately, the case of effectant is much more challenging. That is because to deal with the noisy and Gram-Schmidt-Nor, we have to compute all cyclotomic integers whose square is in a set, is in some set. But we have no idea to solve this problem. Okay, to conclude, in this work, we study the set channel security for 2-may-practical hush-and-set-in pattern and ELP. And we show that in some implementations of pattern and ELP, the Gram-Schmidt-Nor of the secret entry-basis leads through our timing. And we also show that this leakage is dangerous indeed. We first propose an efficient algorithm to compute the entry-p from the Gram-Schmidt-Nor of the entry-basis. Based on that, we propose an experimentally-validated attack against the ELP. Also, our theoretical algorithm can be viewed as an evidence of a structural weakness of the original effectant implementation. At last, we should highlight that the updated version of the set has already captured the Gram-Schmidt-Nor leakage. They make use of more careful rejection sampling. So the entry-basis is made independent of the secret Gram-Schmidt-Nor. This kind of measure indeed leads to some efficiency loss. Our result shows that it is important for security. Okay, that is my talk. Thank you.