# kyber_length_leak.py - Leaks secret key bit based on ciphertext length
import random
# Simulate encapsulation: ciphertext length depends on message bit
def encapsulate(pk, bit):
# In a flawed implementation, the ciphertext size varies based on a secret bit
if bit:
return b'\x00' * 800 # long ciphertext
else:
return b'\x00' * 768 # short ciphertext
# Attacker observes lengths
lengths = []
for _ in range(100):
ct = encapsulate(None, random.randint(0,1))
lengths.append(len(ct))
# Histogram reveals two clusters -> secret bit leakage
print("Ciphertext lengths leak secret bit.")
Kyber 密钥封装机制的一个有缺陷的实现会产生长度不同的密文，具体取决于共享秘密中的一个秘密比特。攻击者测量多个密文的长度，即可通过统计分析恢复该比特。
运行模拟：
python kyber_length_leak.py
观察两个不同的长度簇。