Review Reports

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

The manuscript investigates the power side-channel leakage of the MAYO secret linear map on a Cortex-M4 platform and evaluates a first-order side-channel countermeasure based on masking and row shuffling. The topic is closely related to the implementation security of post-quantum signature schemes, and the combination of leakage assessment, CPA analysis, and countermeasure evaluation provides useful experimental evidence for related research.However, the manuscript still requires further improvement in its current form. 
1. Please clarify the applicability of the conclusions drawn from the reduced implementation to the complete MAYO signing implementation. As noted in Sections 5.2(223–228) and 9.3(482–486), the current evaluation considers only the isolated secret linear map and excludes key-expansion memory traffic present in the full signing process. Therefore, the leakage characteristics of the complete implementation may differ. Please explicitly state this limitation and the scope of the current conclusions in Section 10.
2. In Section 6.4 (279 292), the decision rule “report 1 when the plain maximum is g=1 and the partial peak falls below 0.30” is adopted. However, the rationale for the 0.30 threshold and whether it was derived from independent data are not adequately explained. The authors are recommended to justify this threshold and add a sensitivity analysis to demonstrate the impact of varying threshold values on the results.
3. Please recheck and standardise the statistical decision criteria for the protected implementation. Section 7.1(322–323) gives a χ² threshold of approximately 20, whereas Section 8.3 reports a protected peak of 27. Similarly, one same-secret control reaches |t| = 4.52, slightly exceeding the adopted TVLA threshold of 4.5. In addition, Section 8.3(405–406) reports protected |t| values of 3.6–4.6, while the caption of Figure 5 states that they remain below 4.5. Please clarify the χ² and TVLA decision criteria and revise the inconsistent statements accordingly.
4. Please distinguish clearly between measured and extrapolated results when discussing full-key recovery complexity. In Section 7.3(348–363), the approximately 2^2089 complexity is derived from measurements across all 78 rows, whereas the approximately 2^1617 value is extrapolated from limited per-row calibrated measurements. Given the periodic structure of the fixed test key, the leakage behaviour observed for row 0 may not necessarily generalise to other independent rows. Please maintain this distinction consistently throughout the manuscript and, if possible, provide additional validation using more rows or independent random keys.
5. Sections 6.5 (299–311) and 8.3 (409–414) both state that the experiments were independently repeated, but the manuscript does not clearly report the number of independent runs or the variation across repeated experiments. It is recommended that the authors provide the number of independent runs for each experiment and report the mean, standard deviation, or range of the relevant metrics, thereby strengthening the reliability of the experimental results and reducing concerns about possible randomness in individual runs.
6. Please revise the description of the experimental setting in the abstract. The abstract states that the experiments were “performed in a real-world deployment on an STM32F303”. However, the study actually conducts a laboratory side-channel evaluation of the reduced secret linear map using a ChipWhisperer-Lite and an STM32F303 platform, rather than deploying the complete MAYO signing implementation in a real-world application environment.
7. Section 6.1 (241–257) provides the main hardware platform, target device, and basic firmware configuration. However, the exact version of arm-none-eabi-gcc, the complete set of key compilation options, and the relevant versions of the ChipWhisperer software/firmware are not clearly specified. It is recommended to provide these details to further improve the reproducibility of the experiments.
8. Please reorganize the contribution statement in Section 1.1. The manuscript currently lists five contributions covering too many different aspects. It is recommended to appropriately merge closely related items and further highlight the core methodological contributions of the work.

Author Response

Please clarify the applicability of the conclusions drawn from the reduced implementation to the complete MAYO signing implementation, and explicitly state this limitation and the scope of the current conclusions in Section 10.

Answer:

A scope paragraph has been added to Section 10. It states that every result reported concerns the isolated map, and that the reduced target reproduces the reference GF(16) arithmetic verbatim but not the key-expansion memory traffic, the vinegar sampling, or the surrounding control flow of a complete signing call.

Three specific mechanisms by which a full implementation may differ are named: (i) additional operations may leak on their own account; (ii) the surrounding traffic may raise the algorithmic noise floor and thereby reduce the signal-to-noise ratio of the map itself; and (iii) the vinegar addition supplies a further share that may interact with the masking. Accordingly, the reported figures are framed as characterising the isolated primitive, in terms of a lower bound on the attack surface and an upper bound on the achievable protection of that primitive, rather than as measurements of full MAYO signing.

 

The rationale for the 0.30 threshold in the decision rule of Section 6.4 is not adequately explained. Please justify this threshold and add a sensitivity analysis demonstrating the impact of varying it.

Answer:

A sensitivity analysis has been added (Section 5.4).

The threshold is not tuned. It is the midpoint of an empty interval in the observed statistic, and the outcome is invariant to it across a wide range. Across the eight nibbles the partial peaks are 0.562, 0.576, 0.151, 0.631, 0.601, 0.610, 0.678 and 0.476, so the single rule-eligible nibble is separated from all others by the gap (0.151, 0.476).

Any threshold chosen inside that interval produces byte-for-byte identical output. The adopted value of 0.30 sits 0.149 above the lower edge and 0.176 below the upper one.

The rule therefore carries no effective free parameter on this data set. Additionally, the effect of disabling it entirely is now quantified, in order to bound its contribution: 360 candidates instead of 24 (see Reviewer 2, comment 1).

 

Please recheck and standardise the statistical decision criteria for the protected implementation, and revise the inconsistent statements regarding the chi-squared threshold, the same-secret control at |t| = 4.52, and the protected |t| range against the caption of Figure 5.

Answer:

This was a genuine inconsistency, and it is resolved by stating the null behaviour of both criteria explicitly. A new Section 5.6, Decision Criteria and Their Null Behaviour, has been added.

The chi-squared criterion. The customary figure of 20 is an uncorrected, single-sample critical value (p = 0.010), and it is the wrong criterion for a 24,000-point sweep. Applying a Bonferroni correction at family-wise alpha = 0.05 over 24,000 samples gives a critical value of 41.0, while the expected maximum over that many independent samples is 33.9. Against the corrected criterion the protected peak of 27 passes, whereas the unprotected peak of 975 fails it by more than two hundred orders of magnitude in p-value. All chi-squared statements in the manuscript now reference 41.0.

The TVLA criterion. Simulation of the null distribution over a 24,000-sample window gives an expected maximum |t| of 4.22, standard deviation 0.28, a 95th percentile of 4.75, and a probability of 0.15 that the maximum exceeds 4.5. Three consequences follow, and all three are now stated in the manuscript:

the same-secret controls at |t| = 4.12 and |t| = 4.52 are consistent with the null, and the latter marginally exceeding 4.5 is the expected behaviour of a windowed maximum rather than an anomaly;

the 3.6 to 4.6 band is the null band of that maximum, and not residual leakage;

the caption of Figure 5 was incorrect and has been amended. The curve includes |t| = 4.56 at N = 100, which does exceed 4.5. The caption now states the null band and makes explicit that the discriminating evidence is the flat trend together with the zero failing-point count, rather than any single peak.

 

Please distinguish clearly between measured and extrapolated results when discussing full-key recovery complexity, maintain this distinction throughout the manuscript, and if possible provide additional validation using more rows or independent random keys.

Answer:

Section 7.3 has been rewritten in order to define the two quantities separately, and they are labelled (a) and (b) consistently throughout:

Quantity	Value	Basis
(a) Measured residual enumeration cost	2^374	Direct measurement over the 39 rows carrying exploitable leakage (even rows). Mean per-nibble rank 3.43/16, 40.4% top-1, 78.8% top-4, 126/312 exact, p = 1.5e-67. The submitted 2^2089 was a cadence-fit artefact and is withdrawn.
(b) Extrapolated full-matrix cost	~2^749	Per-row residual 9.60 +/- 2.97 bits extended to all 78 rows. Not a measurement of the full matrix; assumes the 39 valid rows are representative and presupposes a re-acquisition with an acknowledgement-synchronised loader.

 

The text now states explicitly that (b) assumes transfer to the remaining 72 rows, that the periodic structure of the fixed test key makes the calibrated rows mutually dependent, that the per-row retriggered campaign has not been performed, and that no claim of a recovered MAYO key is made anywhere in the manuscript.

Update since the first revision: the full-key figures are corrected as above. Measurement (a) is 2^374 over the 39 rows with valid data (per-row 9.60 bits, 40.4% top-1); the full-matrix (b) is an extrapolation ~2^749, pending a re-acquisition with the acknowledgement-synchronised loader so every row carries a non-zero secret. No key recovery is claimed.

A related correction: the submitted 2^2089 (and the 880/407-bit reductions quoted against it) are withdrawn as a cadence-fit artefact. The corrected full-key figures are the measured 2^374 (39 valid rows) and the extrapolated ~2^749; see the (a)/(b) table above.

On evaluation with additional random keys, the experiment has now been performed on the bench. Twenty independent uniformly random secret matrices were captured at 1000 traces each under the row-0 acquisition configuration. The outcome is reported in full under Reviewer 2, comment 1, and in the new Table 5. In summary, the attack holds on random keys, at a mean rank of 3.21 against a chance expectation of 8.50 and a median of 287 candidates, while the structured test key proves favourable by 5.47 standard errors, so the headline figure has been changed to the random-key distribution. Evaluation across additional rows remains outstanding and still requires the per-row retriggered campaign described above.

 

Sections 6.5 and 8.3 state that experiments were independently repeated, but the number of independent runs and the variation across them are not reported. Please provide the number of runs and the mean, standard deviation or range of the relevant metrics.

Answer:

Measurements have been added (Sections 5.6 and 8.3).

We partitioned the block-interleaved capture into four disjoint sub-acquisitions of 200 traces per class and assessed each independently:

Sub-acquisition	1	2	3	4	mean	sd	pooled (800/class)
peak |t|	3.95	4.18	4.38	5.49	4.50	0.68	3.62

 

These figures are reported openly, including the fact that one sub-acquisition exceeds 4.5. That value is the predicted null behaviour of a windowed maximum at reduced trace count, where the expected maximum is 4.22 over 24,000 samples, which is precisely why the verdict rests on the pooled estimate, the failing-point count and the absence of growth in N, rather than on any individual peak.

Additionally, Section 5.5 now records the trace budget and repetition structure behind every reported figure, so that the basis of each number is explicit.

 

Please revise the description of the experimental setting in the abstract, which states that the experiments were performed in a real-world deployment, whereas the study is a laboratory side-channel evaluation of the reduced secret linear map.

Answer:

The abstract now states that the evaluation is a laboratory assessment of the isolated secret linear map, performed on an STM32F303 (ARM Cortex-M4) measured with a ChipWhisperer-Lite, and that it does not exercise complete MAYO signing.

 

The exact version of arm-none-eabi-gcc, the complete set of key compilation options, and the relevant ChipWhisperer software and firmware versions are not specified. Please provide these details in order to improve reproducibility.

Answer:

Section 6.1 now specifies the exact environment: arm-none-eabi-gcc 10.3.1 (20210621); the build invocation make PLATFORM=CW308_STM32F3 CRYPTO_TARGET=NONE SS_VER=SS_VER_1_1 at the framework default -O2; a host running Ubuntu 22.04.5 LTS (kernel 6.8.0-124) with Python 3.10.12, chipwhisperer 6.0.0, NumPy 1.26.4, SciPy 1.15.3 and Matplotlib 3.10.9; and capture hardware comprising a ChipWhisperer-Lite CW1173 (USB 2b3e:ace2), a CW308 UFO baseboard and an STM32F303RCT6 target module. The optimisation level is recorded because it is the reason the compiler memory barriers are required.

 

Please reorganise the contribution statement in Section 1.1, merging closely related items and highlighting the core methodological contributions.

Answer:

The five contributions have been merged into three, organised by methodological role rather than by artefact. These are: (i) the non-profiled, first-order leakage baseline; (ii) the distinguisher that resolves the linear-map confounds, together with its assumptions, its statistical significance and its key dependence made explicit; and (iii) the evaluated countermeasure together with the near-threshold assessment methodology. Reproducibility is folded into the third item rather than standing as a separate claim.

 

Reviewer 2 Report

Comments and Suggestions for Authors

This manuscript uses ChipWhispererLite to conduct TVLA leakage assessment and non-contouring CPA attacks, designs and implements masking + row scrambling first-order countermeasures. All experiments are reproducible. The research work belongs to the PQNEXT EU project and is aimed at verifying the security of post-quantum cryptography for resource-constrained embedded devices. The main contributions include: completing the simplification of the MAYO secret linear mapping isolation goal, and experimentally demonstrating that without protection, there is a serious side-channel leakage; proposing a first-order protection scheme combining masking and round-by-round row scrambling; fully opening the firmware, scripts, and original trace data, establishing a reproducible evaluation baseline, and filling the research gap in the measured protection scheme for MAYO secret GF (16) mapping.
1. The experiments use a fixed test key. It is necessary to supplement and discuss whether this specific key will bring potential bias to the CPA recovery effect.
2. The drift control experiment only focuses on the protection implementation. It is recommended to briefly explain whether the unprotected implementation also has the problem of acquisition drift interference.
3. In the CPA part, there is a model saturation phenomenon, and some nibbles cannot be top1 recovered. This is attributed to the incomplete matching between the Hamming weight leakage model and the actual hardware bit leakage. It is recommended to add a section to quantitatively discuss the degree of model mismatch, such as analyzing the distribution of correlation coefficient differences, explaining that the increase in trace quantity cannot eliminate this deviation, distinguishing between measurement noise and model mismatch as two different failure sources, and enhancing the analysis rigor.
4. In the paper, 4.5 is used as the TVLA threshold. It is recommended to supplement the statistical probability of false positives corresponding to this threshold briefly.
5. The conclusion is relatively broad in describing future work. It is recommended to give brief technical difficulty explanations for the three future directions separately to help subsequent researchers grasp the key obstacles that need to be solved in further research.
6. The full key recovery cost simultaneously provides direct measurement values 2089 and extrapolation 21617. The meanings of these two values are easily confused. It is recommended to clearly define two indicators: the former is the residual enumeration cost of all 78 rows under a wide window single acquisition, and the latter is obtained by extrapolation based on a single row calibration window; clearly indicate that the row-by-row re-triggering experiment has not been executed, and this extrapolation cannot be equivalent to the actual attack experiment results, to prevent readers from misinterpreting it as the complete key having been cracked.
7. Regarding the reproducibility contribution, it is recommended to briefly mention the limitations of the public artifacts, such as the firmware for the CW308 board, which needs to be modified when to other hardware, to avoid readers mistakenly believing that the artifacts are ready for any CortexM4 device.

Author Response

The experiments use a fixed test key. Please supplement and discuss whether this specific key introduces potential bias into the CPA recovery result.

Answer:

The authors have added a new subsection in Section 7.2 and Table 5. Two separable questions arise. First, is the reduction beyond chance? Under the null hypothesis of no exploitable leakage the eight per-nibble ranks are independent and uniform, giving an expected mean rank of 8.50 and an expected log2 candidate count of 22.12 bits. The observed mean rank of 1.75 occurs with probability 5e-07 under that null, and the observed product of 24 was not reached once in 2,000,000 null draws.

Second, how far does the outcome depend on this particular key? Rather than estimate this, we performed the experiment. Twenty independent, uniformly random secret matrices were captured on the same bench under an acquisition configuration identical to that of the row-0 set, namely 1000 traces each, a 5000-sample window, and the same clock, gain and trigger. The same distinguisher, including the identity rule, was applied to each.

Metric	Random keys (n = 20)	Structured test key
Exact top-1 nibbles	3.90 / 8 (range 1 to 6)	5 / 8
Mean true-key rank	3.21 +/- 1.20 (chance 8.50)	1.75
Residual candidates	median 287 (min 24, max 336,000)	24
log2 candidates	8.65 +/- 3.48	4.58

 

Two conclusions follow, and the less comfortable of the two is reported plainly.

The attack is a property of the leakage, not an artefact of the test key. On random keys the mean rank is 3.21 against a chance expectation of 8.50, and the median residual search space is 287 candidates out of 4,294,967,296.

The structured key is nonetheless favourable, by 5.47 standard errors. Only 3 of the 20 random keys reach the 24-candidate figure, and the median is an order of magnitude higher. Two mechanisms contribute. The identity rule applies only to nibbles whose value is 1; nine of the twenty random rows contained at least one such nibble, and those rows averaged 887 candidates against 31,838 for rows without one. Furthermore, the per-key spread is intrinsically wide, at 3.48 bits, so any single row constitutes a high-variance draw.

The headline claim of the presented study has therefore been changed. The abstract, the contribution statement, Section 7.2 and the Limitations now report the random-key distribution as the representative figure, and present 24 candidates as a favourable case. This is a weaker claim than the submitted manuscript made, and it is the correct one.

 

The drift control experiment addresses only the protected implementation. Please explain briefly whether the unprotected implementation also suffers from acquisition drift interference.

Answer:

We applied the same-secret control of the protected implementation to the unprotected capture as well: splitting each unprotected class against itself gives same-secret peaks of |t| = 9.93 and |t| = 12.27.

Drift is therefore present in the unprotected capture as well, at a level comparable to the sequential-capture artefact of the protected implementation. However, it remains smaller than the secret-dependent signal of 195.66 by a factor of approximately 16, so the unprotected verdict is unaffected. The manuscript now makes the general point explicit: drift control matters only when the effect size approaches the decision threshold, which is precisely the protected case treated in Section 8.3.

 

Please add a section quantitatively discussing the degree of model mismatch in the CPA, distinguishing measurement noise from model mismatch as two different failure sources.

Answer:

A quantitative treatment has been added (Section 9.1). Defining the competitor gap as the difference between the top-ranked partial correlation and that of the true value, so that a positive gap marks a nibble that is not recovered, the measurement across trace counts is:

Nibble	True value	N = 250	N = 1000	Change
j = 0	0x3	+0.023	+0.018	-20 %
j = 2	0x1	+0.196	+0.151	-23 %
j = 4	0xF	+0.127	+0.097	-24 %
j = 6	0xD	+0.178	+0.156	-12 %
j = 1, 3, 5, 7	-	0	0	recovered

 

A noise-limited gap falls with the inverse square root of N and would therefore halve across this range, whereas the observed gaps fall by only 12 to 24 per cent. This separates the two failure sources: measurement noise is already subdominant at N = 250, and what remains is a systematic mismatch between the Hamming-weight model and the true bit-level leakage of a single GF(16) multiply. Increasing the trace budget cannot remove it, which is the reason the upgrades identified in Section 9.1 change the model rather than the sample size.

 

The threshold 4.5 is used for TVLA. Please supplement briefly the statistical false-positive probability corresponding to this threshold.

Answer:

In  (Section 5.6), under the null hypothesis, a single sample exceeds |t| = 4.5 with probability 6.8e-06, or approximately one in 147,000. Over a window this becomes a multiple-comparison problem:

Window (samples)	Expected false positives	Probability of at least one
5,000	0.034	3.3 %
20,000	0.136	12.7 %
24,000	0.163	15.1 %

 

The value 4.5 is chosen so that a full window yields substantially fewer than one expected false positive, which is the reason a count of failing sample points is reported throughout, rather than a peak alone.

 

The description of future work is relatively broad. Please give brief technical difficulty explanations for the three future directions separately.

Answer:

Each direction now carries its principal obstacle. These are: (i) for higher-order masking, the randomness budget and the refresh schedule on a part with no hardware entropy source, where naive refreshing reintroduces the recombination that the temporal separation was designed to prevent; (ii) for integration into full signing, a memory rather than a cryptographic obstacle, since roughly 144 KB of expanded key is required against the approximately 48 KB available, so the step needs either a larger-SRAM target or a streaming key expansion whose own leakage must then be assessed; and (iii) for the retriggered campaign, acquisition cost and alignment, as each of the 78 rows requires its own trigger placement and trace budget, and the per-row captures must be drift-controlled against one another before their residual ranks may be multiplied.

 

The full-key recovery cost provides both a direct measurement and an extrapolation, and the meanings are easily confused. Please define the two indicators clearly and indicate that the row-by-row retriggering experiment has not been executed.

Answer:

The treatment is given under Reviewer 1, comment 4. Both quantities are now defined explicitly and labelled (a) measured and (b) extrapolated. The measured figure is the residual enumeration cost of all 78 rows under a wide-window single acquisition; the extrapolated figure is obtained from a single-row calibrated window and multiplied across the matrix. The manuscript states explicitly that the row-by-row retriggering experiment has not been executed, that the extrapolation cannot be equated with an actual attack result, and that no key recovery is claimed anywhere.

Update: (a) is the measured residual 2^374 over the 39 rows carrying exploitable leakage (per-row 9.60 bits, 40.4% top-1, p = 1.5e-67); (b) is the extrapolated full-matrix cost ~2^749. The submitted 2^2089 is withdrawn as a cadence-fit artefact. The odd-row acquisition bug is disclosed; no key recovery is claimed.

 

Regarding the reproducibility contribution, please mention briefly the limitations of the public artifacts, such as the firmware being specific to the CW308 board.

Answer:

The Data Availability Statement now records that the firmware targets the CW308_STM32F3 module through the ChipWhisperer simpleserial framework, and that porting it to another Cortex-M4 part requires at minimum a new hardware abstraction layer, a replacement for the CW308 GPIO trigger, and re-calibration of the points-of-interest cadence, since both the sample-per-cycle ratio and the instruction scheduling differ between parts. The analysis scripts are device-independent and run on the released traces without hardware, whereas the capture scripts assume a ChipWhisperer-Lite. Overall, the presented artifact constitutes a reproduction package for this platform and a starting point for others, rather than a turnkey evaluation suite for arbitrary Cortex-M4 devices.

Round 2

Reviewer 1 Report

Comments and Suggestions for Authors

Having carefully reviewed the full manuscript, I recommend acceptance of this paper.