Short answer: Three papers report fault-injection attacks on lattice-based post-quantum schemes: a 2018 paper on nonce reuse in Dilithium and qTESLA signatures, a 2022 survey of side-channel and fault attacks on Kyber and Dilithium, and a 2025 paper that reports a random-seed-pointer weakness in ML-KEM and ML-DSA implementations. The attacks target implementations on microcontrollers, not the underlying mathematics.

Fault injection attacks (FIA) target structured lattice-based schemes by introducing errors during execution to reveal secret information. A systematic study of side-channel and fault-injection attacks focuses on Kyber Key Encapsulation Mechanism (KEM) and the Dilithium signature scheme. The survey calls these schemes leading candidates for standardization. The underlying similarities and differences between existing attacks allow researchers to classify them into different categories. Because of the wide variety of reported attacks, simultaneous protection against all of them requires customized protections or countermeasures for both Kyber and Dilithium. Generic countermeasures alone may not suffice, necessitating specific design choices to mitigate these threats.

What specific vulnerabilities exist in standardized implementations?

A critical implementation-level vulnerability exists in both ML-KEM and ML-DSA, centered on the random seed pointer used in polynomial sampling. The authors say that by corrupting this pointer an attacker can deterministically compromise the entire scheme, bypassing standard countermeasures. This weakness allows for practical fault-injection attacks that exploit the specific implementation style. The 2025 authors report verifying the presence of this vulnerable implementation style in widely used public libraries, including PQM4, LibOQS, PQClean, and WolfSSL. The authors say the theoretical foundations are robust but describe this as a single point of failure. The authors say they propose countermeasures.

How are differential fault attacks applied to deterministic signatures?

The 2018 paper extends differential fault attacks to lattice-based cryptography, targeting deterministic signature schemes like Dilithium and qTESLA. Single random faults can result in a nonce-reuse scenario, which allows for key recovery. The 2018 authors also expand this to fault-induced partial nonce-reuse attacks, which do not corrupt the validity of the computed signatures and are thus harder to detect. Using linear algebra and lattice-basis reduction techniques, an attacker can extract one of the secret key elements after a successful fault injection. While some parts of the key cannot be recovered, a tweaked signature algorithm can still successfully sign any message. The authors say a tweaked signature algorithm can still sign any message.

What experimental methods validate these attacks?

The 2018 authors report experimental verification by clock glitching on an ARM Cortex-M4 microcontroller. The 2025 authors report validating the seed-pointer attacks on an STM32H7 microcontroller using laser fault injection. They report full key and message recovery for ML-KEM and signature forgery for ML-DSA, with success rates up to 100%.

FAQ

Can generic countermeasures stop all fault injection attacks?

No, simultaneous protection against all reported attacks requires customized protections or countermeasures for both Kyber and Dilithium. The survey presents a range of customized countermeasures.

Which libraries contain the vulnerable random seed pointer implementation?

Researchers verified the vulnerable implementation style in widely used public libraries, including PQM4, LibOQS, PQClean, and WolfSSL. This vulnerability is centered on the random seed pointer used in polynomial sampling for ML-KEM and ML-DSA schemes.

What hardware was used to test differential fault attacks?

Experimental verification of differential fault attacks on Dilithium was performed using clock glitching on an ARM Cortex-M4 microcontroller. The 2018 authors report that single random faults can lead to nonce reuse and key recovery.

How effective are the proposed countermeasures for seed pointer faults?

The 2025 authors say they propose effective countermeasures. This post does not report their cost or effectiveness, because the paper's abstract does not give it.

Do these attacks apply to non-lattice post-quantum schemes?

The papers used here cover lattice-based schemes: Kyber (ML-KEM), Dilithium (ML-DSA) and qTESLA. They do not address other post-quantum families.