A Single-Trace Fault Injection Attack on Hedged Module Lattice Digital Signature Algorithm (ML-DSA)

Module Lattice Digital Signature Algorithm (MLDSA) is a post-quantum digital signature algorithm currently being standardised by the NIST. Devices making use of MLDSA are expected to soon become generally available in various environments. It is thus important to assess the resistance of ML-DSA implementations to physical attacks. This paper presents a fault injection attack on hedged ML-DSA in ARM Cortex-M4. First, voltage glitching is performed to skip computation of a seed during the generation of the signature. We identified settings that allowed us to consistently skip the necessary function without crashing the device. After the fault injection, the secret key vector $s_{1}$ is derived directly from the resulting faulty signature. The attack succeeds in recovering s<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf> from a single trace with a probability of around $53 \%$. We also propose countermeasures against the presented attack.