Black Hat USA 2025 | Bypassing PQC Signature Verification with Fault Injection

Post-quantum cryptographic (PQC) algorithms are being integrated into firmware, bootloaders, and other embedded systems as a replacement for RSA and ECC. While these schemes are designed to resist quantum attacks, their implementations remain vulnerable to classical fault injection techniques.

This talk presents practical voltage fault injection attacks on three major PQC signature schemes: Dilithium, XMSS, and SPHINCS+. By targeting signature verification logic — including challenge generation, bit shifts, and checksum validation — we demonstrate how to forge valid signatures without breaking the underlying cryptographic primitives.

All attacks are performed on real microcontroller hardware using open-source PQC libraries running on bare metal. We also show how shared components like WOTS+ introduce common vulnerabilities across XMSS and SPHINCS+, exposing a broader attack surface.

This work highlights how fault injection continues to be effective, even against modern cryptography, and the ever-present need for effective countermeasures for implementation-level threats.

By:
Fikret Garipay | Security Engineer, Keysight Device Security Testing

Presentation Materials Available at:
https://blackhat.com/us-25/briefings/schedule/?#bypassing-pqc-signature-verification-with-fault-injection-dilithium-xmss-sphincs-46362

Видео Black Hat USA 2025 | Bypassing PQC Signature Verification with Fault Injection канала Black Hat