A Lightweight Implementation of NTRU Prime for the Post-Quantum Internet of Things

The dawning era of quantum computing has initiated various initiatives for the standardization of post-quantum cryptosystems with the goal of (eventually) replacing RSA and ECC. NTRU Prime is a variant of the classical NTRU cryptosystem that comes with a couple of tweaks to minimize the attack surface; most notably, it avoids rings with "worrisome" structure. This paper presents, to our knowledge, the first assembler-optimized implementation of Streamlined NTRU Prime for an 8-bit AVR microcontroller and shows that high-security lattice-based cryptography is feasible for small IoT devices. An encapsulation operation using parameters for 128-bit post-quantum security requires 8.2 million clock cycles when executed on an 8-bit ATmega1284 microcontroller. The decapsulation is approximately twice as costly and has an execution time of 15.6 million cycles. We achieved this performance through (i) new low-level software optimization techniques to accelerate Karatsuba-based polynomial multiplication on the 8-bit AVR platform and (ii) an efficient implementation of the coefficient modular reduction written in assembly language. The execution time of encapsulation and decapsulation is independent of secret data, which makes our software resistant against timing attacks. Finally, we assess the performance one could theoretically gain by using a so-called product-form polynomial as part of the secret key and discuss potential security implications

Reducing the Depth of Quantum FLT-Based Inversion Circuit

Works on quantum computing and cryptanalysis has increased significantly in the past few years. Various constructions of quantum arithmetic circuits, as one of the essential components in the field, has also been proposed. However, there has only been a few studies on finite field inversion despite its essential use in realizing quantum algorithms, such as in Shor's algorithm for Elliptic Curve Discrete Logarith Problem (ECDLP). In this study, we propose to reduce the depth of the existing quantum Fermat's Little Theorem (FLT)-based inversion circuit for binary finite field. In particular, we propose follow a complete waterfall approach to translate the Itoh-Tsujii's variant of FLT to the corresponding quantum circuit and remove the inverse squaring operations employed in the previous work by Banegas et al., lowering the number of CNOT gates (CNOT count), which contributes to reduced overall depth and gate count. Furthermore, compare the cost by firstly constructing our method and previous work's in Qiskit quantum computer simulator and perform the resource analysis. Our approach can serve as an alternative for a time-efficient implementation.Comment: version 0.

High-Speed and Unified ECC Processor for Generic Weierstrass Curves over GF(p) on FPGA

In this paper, we present a high-speed, unified elliptic curve cryptography (ECC) processor for arbitrary Weierstrass curves over GF(p), which to the best of our knowledge, outperforms other similar works in terms of execution time. Our approach employs the combination of the schoolbook long and Karatsuba multiplication algorithm for the elliptic curve point multiplication (ECPM) to achieve better parallelization while retaining low complexity. In the hardware implementation, the substantial gain in speed is also contributed by our n-bit pipelined Montgomery Modular Multiplier (pMMM), which is constructed from our n-bit pipelined multiplier-accumulators that utilizes digital signal processor (DSP) primitives as digit multipliers. Additionally, we also introduce our unified, pipelined modular adder-subtractor (pMAS) for the underlying field arithmetic, and leverage a more efficient yet compact scheduling of the Montgomery ladder algorithm. The implementation for 256-bit modulus size on the 7-series FPGA: Virtex-7, Kintex-7, and XC7Z020 yields 0.139, 0.138, and 0.206 ms of execution time, respectively. Furthermore, since our pMMM module is generic for any curve in Weierstrass form, we support multi-curve parameters, resulting in a unified ECC architecture. Lastly, our method also works in constant time, making it suitable for applications requiring high speed and SCA-resistant characteristics

Single-Trace Side-Channel Attacks on the Toom-Cook: The Case Study of Saber

The Toom-Cook method is a well-known strategy for building algorithms to multiply polynomials efficiently. Along with NTT-based polynomial multiplication, Toom-Cook-based or Karatsuba-based polynomial multiplication algorithms still have regained attention since the start of the NIST’s post-quantum standardization procedure. Compared to the comprehensive analysis done for NTT, the leakage characteristics of Toom-Cook have not been discussed. We analyze the vulnerabilities of Toom-Cook in the reference implementation of Saber, a third round finalist of NIST’s post-quantum standardization process. In this work, we present the first single-trace attack based on the soft-analytical side-channel attack (SASCA) targeting the Toom-Cook. The deep learning-based power analysis is combined with SASCA to decrease the number of templates since there are a large number of similar operations in the Toom-Cook. Moreover, we describe the optimized factor graph and improved belief propagation to make the attack more practical. The feasibility of the attack is verified by evaluation experiments. We also discuss the possible countermeasures to prevent the attack

Efficient Software Implementation of the SIKE Protocol Using a New Data Representation

Thanks to relatively small public and secret keys, the Supersingular Isogeny Key Encapsulation (SIKE) protocol made it into the third evaluation round of the post-quantum standardization project of the National Institute of Standards and Technology (NIST). Even though a large body of research has been devoted to the efficient implementation of SIKE, its latency is still undesirably long for many real-world applications. Most existing implementations of the SIKE protocol use the Montgomery representation for the underlying field arithmetic since the corresponding reduction algorithm is considered the fastest method for performing multiple-precision modular reduction. In this paper, we propose a new data representation for supersingular isogeny-based Elliptic-Curve Cryptography (ECC), of which SIKE is a sub-class. This new representation enables significantly faster implementations of modular reduction than the Montgomery reduction, and also other finite-field arithmetic operations used in ECC can benefit from our data representation. We implemented all arithmetic operations in C using the proposed representation such that they have constant execution time and integrated them to the latest version of the SIKE software library. Using four different parameters sets, we benchmarked our design and the optimized generic implementation on a 2.6 GHz Intel Xeon E5-2690 processor. Our results show that, for the prime of SIKEp751, the proposed reduction algorithm is approximately 2.61 times faster than the currently best implementation of Montgomery reduction, and our representation also enables significantly better timings for other finite-field operations. Due to these improvements, we were able to achieve a speed-up by a factor of about 1.65, 2.03, 1.61, and 1.48 for SIKEp751, SIKEp610, SIKEp503, and SIKEp434, respectively, compared to state-of-the-art generic implementations.IKEp751, SIKEp610, SIKEp503, and SIKEp434, respectively, compared to state-of-the-art generic implementations

On Efficient Polynomial Multiplication and Its Impact on Curve based Cryptosystems

Secure communication is critical to many applications. To this end, various security goals can be achieved using elliptic/hyperelliptic curve and pairing based cryptography. Polynomial multiplication is used in the underlying operations of these protocols. Therefore, as part of this thesis different recursive algorithms are studied; these algorithms include Karatsuba, Toom, and Bernstein. In this thesis, we investigate algorithms and implementation techniques to improve the performance of the cryptographic protocols. Common factors present in explicit formulae in elliptic curves operations are utilized such that two multiplications are replaced by a single multiplication in a higher field. Moreover, we utilize the idea based on common factor used in elliptic curves and generate new explicit formulae for hyperelliptic curves and pairing. In the case of hyperelliptic curves, the common factor method is applied to the fastest known even characteristic hyperelliptic curve operations, i.e. divisor addition and divisor doubling. Similarly, in pairing we observe the presence of common factors inside the Miller loop of Eta pairing and the theoretical results show significant improvement when applying the idea based on common factor method. This has a great advantage for applications that require higher speed

NTT Multiplication for NTT-unfriendly Rings

In this paper, we show how multiplication for polynomial rings used in the NIST PQC finalists Saber and NTRU can be efficiently implemented using the Number-theoretic transform (NTT). We obtain superior performance compared to the previous state of the art implementations using Toom–Cook multiplication on both NIST’s primary software optimization targets AVX2 and Cortex-M4. Interestingly, these two platforms require different approaches: On the Cortex-M4, we use 32-bit NTT-based polynomial multiplication, while on Intel we use two 16-bit NTT-based polynomial multiplications and combine the products using the Chinese Remainder Theorem (CRT). For Saber, the performance gain is particularly pronounced. On Cortex-M4, the Saber NTT-based matrix-vector multiplication is 61% faster than the Toom-Cook multiplication resulting in 22% fewer cycles for Saber encapsulation. For NTRU, the speed-up is less impressive, but still NTT-based multiplication performs better than Toom–Cook for all parameter sets on Cortex-M4. The NTT-based polynomial multiplication for NTRU-HRSS is 10% faster than Toom–Cook which results in a 6% cost reduction for encapsulation. On AVX2, we obtain speed-ups for three out of four NTRU parameter sets. As a further illustration, we also include code for AVX2 and Cortex-M4 for the Chinese Association for Cryptologic Research competition award winner LAC (also a NIST round 2 candidate) which outperforms existing code

Multiplication in Finite Fields and Elliptic Curves

La cryptographie à clef publique permet de s'échanger des clefs de façon distante, d'effectuer des signatures électroniques, de s'authentifier à distance, etc. Dans cette thèse d'HDR nous allons présenter quelques contributions concernant l'implantation sûre et efficace de protocoles cryptographiques basés sur les courbes elliptiques. L'opération de base effectuée dans ces protocoles est la multiplication scalaire d'un point de la courbe. Chaque multiplication scalaire nécessite plusieurs milliers d'opérations dans un corps fini.Dans la première partie du manuscrit nous nous intéressons à la multiplication dans les corps finis car c'est l'opération la plus coûteuse et la plus utilisée. Nous présentons d'abord des contributions sur les multiplieurs parallèles dans les corps binaires. Un premier résultat concerne l'approche sous-quadratique dans une base normale optimale de type 2. Plus précisément, nous améliorons un multiplieur basé sur un produit de matrice de Toeplitz avec un vecteur en utilisant une recombinaison des blocs qui supprime certains calculs redondants. Nous présentons aussi un multiplieur pous les corps binaires basé sur une extension d'une optimisation de la multiplication polynomiale de Karatsuba.Ensuite nous présentons des résultats concernant la multiplication dans un corps premier. Nous présentons en particulier une approche de type Montgomery pour la multiplication dans une base adaptée à l'arithmétique modulaire. Cette approche cible la multiplication modulo un premier aléatoire. Nous présentons alors une méthode pour la multiplication dans des corps utilisés dans la cryptographie sur les couplages : les extensions de petits degrés d'un corps premier aléatoire. Cette méthode utilise une base adaptée engendrée par une racine de l'unité facilitant la multiplication polynomiale basée sur la FFT. Dans la dernière partie de cette thèse d'HDR nous nous intéressons à des résultats qui concernent la multiplication scalaire sur les courbes elliptiques. Nous présentons une parallélisation de l'échelle binaire de Montgomery dans le cas de E(GF(2^n)). Nous survolons aussi quelques contributions sur des formules de division par 3 dans E(GF(3^n)) et une parallélisation de type (third,triple)-and-add. Dans le dernier chapitre nous développons quelques directions de recherches futures. Nous discutons d'abord de possibles extensions des travaux faits sur les corps binaires. Nous présentons aussi des axes de recherche liés à la randomisation de l'arithmétique qui permet une protection contre les attaques matérielles

Theoretical and practical efficiency aspects in cryptography

EThOS - Electronic Theses Online ServiceGBUnited Kingdo

Açık Anahtarlı Kriptografi için Verimli Algoritmaların Geliştirilmesi

TÜBİTAK EEEAG Proje01.06.2018Projenin genel amacı, kriptografide sıklıkla kullanılan modüler üst alma, polinom çarpması veeliptik egriler üzerindeki islemlerin karmasıklıgını iyilestirecek gelistirmelerin yapılması ve eldeedilecek yeni algoritmaların çesitli platformlar üzerinde gerçeklenmesidir. Bu çalısmalarsonucunda modüler üst alma, eliptik egri aritmetigi ve polinom çarpma islemlerindeiyilestirmeler elde edilmistir. Çalısmalar kapsamında P-521, E-521 ve Curve25519 egrileriüzerindeki islemler Toeplitz matris vektör çarpımları (TMVÇ) kullanılarak hızlandırılmıstır.Eliptik egrilerin üzerinde tanımlandıgı ve eleman sayıları 521 ve 255 bitlik asal sayılar olancisimlerde çarpma islemleri için yeni TMVÇ algoritmaları tasarlanmıs ve bu algoritmalarınsagladıgı iyilestirmeler teorik olarak gösterilmistir. Yapılan gerçeklemeler ile teorikçıkarımlardaki iyilestimeler pratikte de gözlemlenmistir. Diger taraftan polinom çarpmaisleminin iyilestirilmesi için arama algoritmalarının verimi üzerine çalısmalar yapılmıstır.Polinomun terim sayısı arttıkça arama uzayı oldukça büyüdügü için, çarpım polinomunun tümterimlerini hesaplamak yerine, n terimli iki polinomun çarpmının ilk n teriminin hesaplanmasıüzerine analizler yapılmıstır. Böylece arama uzayının boyutu düsürülmüs ve Çinli KalanTeoremi ile polinom çarpımı için algoritmalar elde edebilme olanagı saglanmıstır. Diger biryaklasım ise n terimli iki polinomum ilk l teriminin hesaplanmasıdır. Ayrıca, bu yaklasımdaarama uzayının boyutunun düsürülmesi için ikili dogrusal formların simetriklerinin alınması vebazı terimlerin elenmesi yöntemleri kullanılmıstır. Bu yaklasımlar arama uzayının boyutunubelirgin sekilde azaltmıstır. Ek olarak interpolasyon metodunda hesaplanacak noktalardikkatlice seçilerek, süper singüler izojen bazlı kuantum sonrası kriptografide kullanılan Fp2çarpma islemi ve büyük sayıların çarpımları hızlandırılmıstır. Proje kapsamında çalısılan digerbir konu olan modüler üst alma isleminin hızlandırılması için, literatürdeki küp sekeralgoritması incelenmistir. Bu algoritma, en küçük toplam zinciri ve karma üst alma metotları ilebirlikte kullanılmıstır. Ayrıca, sonuçların daha da hızlandırılması adına, n bitlik bir tamsayınınküp alma isleminden sonra 3n olan boyutunu indirgemek için kullanılan Barett metodudegistirilmis ve böylece teorik olarak islem karmasıklıgında iyilestirmeler yapılmıstır.The primary aim of this project is to develop algebraic techniques for improving the complexity ofthe operations that are widely used in cryptography such as modular exponentiation, polynomialmultiplication, arithmetic on elliptic curves and to implement these algorithms on various platforms.As a result of the studies, improvements on modular exponentiation, polynomial multiplication andelliptic curve arithmetic are obtained. Within the scope of studies, the arithmetic on the curvesP-521, E-521 and Curve25519 are accelarated by using Toeplitz matrix vector product (TMVP).For the multiplication in 521 and 255 bit prime fields on which the elliptic curves are defined, newTMVP algorithms are designed and the improvements that these algorithms provide are provedtheoretically. The implementations show that the improvements can also be observed in practice.On the other side, to improve the polynomial multiplication, studies are focused on the efficiencyof the search algorithms. As the number of the terms of the polynomials increases the size ofthe search space grows so instead of computing all the terms, computing first n terms of theproduct of two n term polynomials is analyzed. By this, the size of the search space decreasesand this makes it possible to develop new polynomial multiplication algorithms using the Chineseremainder theorem. Another approach is to compute the first ` terms of the product of two nterm polynomials. (n + 1 ? ` ? 2n ?? 1). Moreover, in this approach, to reduce the size of thesearch space, symmetric bilinear forms and elimination of some terms are used. These methodsdecrease the size of the search space significantly. In addition, by choosing the evaluation pointscarefully in the interpolation method, the multiplication over Fp2 that is used for supersingularisogeny based post quantum cryptography and large integer multiplicaitons are accelerated. Tospeed up modular exponentiation which is another subject studied in this project, the sugar cubealgorithm is examined. Sugar cube algorithm is combined with the addition chains and hybridexponentiation methods. Moreover, to speed up the operations more, the Barrett reduction methodfor reducing the 3n bit size of the cube of a n bit integer is modified and by this the computationalcomplexity is improved theoretically.Keywords: Cryptographic computations, polynomial multiplication, integer multiplicaiton, ellipticcurve cryptography, modular exponentiation, RS