The irreducible binary Goppa codes are widely used in code-based cryptography, like in the McEliece cryptosystem. The aim of this work is to design an effi cient and secure hardware implementation of a Goppa decoder. We will show how to adapt a common step of all decoding algorithms to obtain a "leakage resistant" variant

Cayrel, Pierre-Louis

Fischer, Viktor

Richmond, Tania

Véron, Pascal

HAL-UJM

Towards a Secure Goppa Decoder in HardwareImplementationTania Richmond, Pierre-Louis Cayrel, Viktor Fischer, Pascal Ve´ronTo cite this version:Tania Richmond, Pierre-Louis Cayrel, Viktor Fischer, Pascal Ve´ron. Towards a Secure GoppaDecoder in Hardware Implementation. Information Hiding and interactions with Codes andCryptography Days (JC2S2013), Nov 2013, paris, France. p4-9. <ujm-00933421>HAL Id: ujm-00933421https://hal-ujm.archives-ouvertes.fr/ujm-00933421Submitted on 20 Jan 2014HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestine´e au de´poˆt et a` la diffusion de documentsscientifiques de niveau recherche, publie´s ou non,e´manant des e´tablissements d’enseignement et derecherche franc¸ais ou e´trangers, des laboratoirespublics ou prive´s.Towards a Secure Goppa Decoder in HardwareImplementationTania RICHMOND1, Pierre-Louis CAYREL1, Viktor FISCHER1, PascalVE´RON21 Laboratoire Hubert CURIEN,Rue du Prof. Benoit LAURAS, 18,42000, Saint-E´tienne, France.{tania.richmond,pierre.louis.cayrel,fischer}@univ-st-etienne.fr2 Institut de Mathe´matiquesB.P. 20132,83957, La Garde, France.veron@univ-tln.frAbstractThe irreducible binary Goppa codes are widely used in code-based cryptography, likein the McEliece cryptosystem. The aim of this work is to design an efficient and securehardware implementation of a Goppa decoder. We will show how to adapt a common stepof all decoding algorithms to obtain a ”leakage resistant” variant.1 IntroductionThere exists several domains in cryptography. Code-based cryptography has interesting pro-perties: Fast computations, a well theorical complexity and no quantum algorithm in polynomialtime breaks the underlying NP-hard problem [4].The first public-key cryptosystem (PKC) based on error-correcting codes was proposed byMcEliece in 1978 in [11]. In his paper, he proposed to use the family of Goppa codes. Per-muted Goppa codes present some advantages: they look like random codes, have at least oneefficient decoding algorithm, and it is a dense family of codes. Goppa decoder can be used asa trapdoor in code-based cryptography, both for encryption scheme (like McEliece public-keyencryption scheme [11]) and signature scheme (like CFS signature scheme [5]).It is in this context that takes place our work. We are interested in the way that Goppa de-coding algorithms are translated into circuits in hardware. Furthermore, we propose a partialhardware implementation of them.The remainder of this paper is organized as follows. In Section 2, we will recall some prelimi-naries about the McEliece PKC and the Goppa codes. In Section 3, we will briefly present theprinciple of side-channel attacks. In Section 4, we will explain our hardware implementation ofa partial Goppa decoder. Finally, we will conclude this paper in Section 5.2 McEliece PKC with Goppa codesThe reader who wants more explanations about the McEliece PKC or the Goppa codes can findthem in Sections 3 and 4 in [7] or directly in [11, 6, 3].12.1 McEliece PKCThe McEliece PKC is composed of the three following algorithms.Key generation: In inputs of this algorithm, we have two integers m and t, respectively forextension degree of Galois field and Goppa polynomial degree. The steps are:1. Choose a t-error correcting Goppa code C with parameters [n, k] (cf. Subsection 2.2).2. Compute a k × n generator matrix G of C.3. Randomly choose a non-singular binary k × k matrix S and a n× n permutation matrixP and compute the generator matrix G˜ = S ·G ·P and the inverse matrices S−1 and P−1.4. Return the public key pk = (G˜,m, t) and the secret key sk = (C, S−1, P−1).Encryption: In inputs of this algorithm, we have the public key pk = (G˜,m, t) and amessage M . In output, this algorithm returns the ciphertext C. The steps are:1. Randomly choose an error-vector E of weight t.2. Compute C = M · G˜⊕ E.3. Return C.Decryption: In inputs of this algorithm, we have the secret key sk = (C, S−1, P−1) and aciphertext C. In output, this algorithm returns the plaintext M . The steps are:1. Compute C˜ = C · P−1.2. Decode C˜ with a Goppa decoder to obtain M˜ = M · S.3. Compute M = M˜ · S−1.4. Return M .2.2 Goppa codesDefinition: In this paper, we are only interested in irreducible binary Goppa codes. A Goppa codeC is a linear code generated by the Goppa polynomial g and the support L. g is a monic irreduciblepolynomial of degree t. L = {α1, . . . , αn} is a subset of n elements of the Galois field F2m with g(αi) 6= 0∀i ∈ J1, nK. C is the set of words c of length n which verify the following equivalence:−n∑i=1cig(αi)× g(x)−g(αi)x−αi ≡ 0 mod g(x).Decoding: The aim of a Goppa decoder is to solve the key equation as follows: Find the so-callederror locator polynomial σ such that SC(x) × σ(x) = σ′(x) mod g(x). All σ roots correspond to allerror positions. That is why, to decode a codeword C into a message M , there are the three followingsteps:1. Compute the syndrome polynomial: SC(x) = −n∑i=1Cig(αi)× g(x)−g(αi)x−αi .2. Solve the key equation to obtain the error locator polynomial: σ(x).3. Find the roots βi ∈ L of the error locator polynomial: σ(x) =t∏i=1(x− βi).The second step can be executed by extended Euclidean algorithm, Berlekamp-Massey algorithm [10]or Patterson algorithm [13].3 Side-channel attacksPrinciple. The principle of side-channel attacks appeared only in 1996 [9]. A side-channel attackis an attack which exploits the laws of the physics to obtain some information contained in channelsassociated to an implementation, a circuit. The purpose is to extract secrets manipulated by smartcards or cryptographic components. The side-channel does not aim at transmitting voluntarily someinformation. It leaks information that an observer can interpret. On the other hand, algorithmic orphysic countermeasures can be proposed to stop such a leakage. Implementation of a cryptosystemis a tradeoff between security and efficiency. That is why cryptanalysis and implementation must besimultaneously considered.2Examples. The main side-channel attacks are: timing attack and power consumption attack. Thefirst one exploits variations of processing time of a program, which depends on the size of the data;the second one the power consumption of the whole system in an immediate way, which depends ontreatments made on the data.Study of the McEliece cryptosystem resistance against this type of attacks began only five years ago[17]. There exists several side-channel attacks and associated countermeasures [2, 12, 14, 15, 16, 17],we want to provide an implementation secure faces all those attacks. In order to reach this goal, weimplemented the most critical step in a Goppa decoder (the root-finding step). Our aim is to find newvulnerabilities, namely those related to information leakages via power consumption.4 Hardware implementation of a vulnerable part of theMcEliece decryption algorithmAs explained above, our final objective is to implement cryptographic protocols based on error-correcting codes on various supports and then to analyze the behavior of these implementations againstside-channel attacks.First of all, we needed to localize the part of the McEliece algorithm, which could be interesting forthe attacker. We believe that one of the most important in the McEliece PKC is the decryption, inwhich the hardware manipulates secret key. We therefore concentrated our effort to this part of theMcEliece PKC, which can be implemented in three ways: using the Patterson [13], Berlekamp-Massey[10] or extended Euclidean algorithm. We selected the so-called error locator polynomial, which is usedduring the Goppa code decoding, as the most security critical operation.Our next task was to implement it in hardware, in order to be able to observe later dynamically itspower consumption, which is related to confidential data being processed. Once the informationleakage point will be found, our next objective will be to propose an efficient countermeasure on eitheralgorithmic or implementation level or both.4.1 Implementation of Galois field multiplier in hardwareThe main component of all decryption algorithms is the Galois field multiplier. Therefore, we startedour work by designing an efficient architecture of the multiplier block.Algorithm of multiplication in Galois fields:We decided to use the next Horner’s scheme [8] of multiplication algorithm.Description: Multiplication of two elements α and β of a finite field F2m = F2[X]/Qm(X). Theproduct denoted r by Galois Multiplier (GM) is in F2m .Parameters: m the degree of the polynomial,Qm(X) =∑mi=0 qiXi a polynomial of degree m on F2 (Version 2).Inputs: Two elements of F2m represented by two polynomials of degree m− 1:α(X) =∑m−1i=0 αiXi and β(X) =∑m−1i=0 βiXi, where αi, βi ∈ {0, 1},Qm(X) =∑mi=0 qiXi a polynomial of degree m on F2 (Version 1)Output: Product of the inputs seen as a polynomial of degree m− 1: r(X) =∑m−1i=0 riXi.3We can represent all polynomials as vectors, as fol-lows:α =m−1∑i=0αiXi⇒ α = (αm−1, . . . , α0).GM:r(X)← αm−1β(X)For i from m− 1 downto 1 dor(X)← r(X)X + αi−1β(X) + rm−1Qm(X)End forReturn rExample: m = 5Qm(X) = x5 + x3 + x2 + x+ 1α(x) = x4 + x2 + x and β(x) = x4 + xx5 x4 x3 x2 x 1Qm 1 0 1 1 1 1α 1 0 1 1 0β 1 0 0 1 0r 1 0 0 1 0(i = 4) 1 0 0 1 0 00 0 0 0 01 0 1 1 1 1r 0 0 1 0 1 1(i = 3)...Implementation of a parameterized Galois field multiplier:We implemented two versions of the Galois field multiplier algorithm from the preceding section inVHDL. The size of the multiplier is very flexible, since m is given as a parameter. Version 1 of themultiplier block has the polynomial given as an input (a binary vector specifying coefficients of thepolynomial) and the second version (which is less flexible, but also less expensive) has the polynomialgiven as a second parameter. We implemented both versions on the Evariste II FPGA [1] modulefeaturing Altera Cyclone III device EP3C25F256-C8. Implementation results obtained using AlteraQuartus II version 9.1 software are presented in Table 1 in term of logic Altera cells (LCELLs) andfrequency (freq). As it can be seen (and expected), the flexible solution using polynomial as an input(Version 1) is always slower and larger. It is therefore important to evaluate if the selected decryptionalgorithm needs such flexibility or not.Version 1 (with variable Qm) Version 2 (with fixed Qm)m LCELLs freq (MHz) m LCELLs freq (MHz)5 35 348 5 21 4536 54 275 6 29 4057 68 207 7 37 4558 90 175 8 56 3559 117 172 9 59 41410 140 135 10 83 32111 178 140 11 87 41112 209 118 12 123 276Table 1: Implementation results for Version 1 (with variable Qm) vs Version 2 (with fixed Qm)4.2 Implementation of error locator polynomial in hardwareWe implemented two versions of architectures for error vector computation. The first one computesthe polynomial σ from right to left [R2L] and the second one from left to right [L2R] (according to theHorner algorithm [8]). The polynomial has the following forms:σ(X) = σtXt + σt−1Xt−1 + . . .+ σ1X + σ0 [R2L]σ(X) = (((σtX + σt−1)X + . . .)X + σ1)X + σ0 [L2R]Implementation of the module computing error locator polynomial from right to left:The first architecture of the module computing error locator polynomial from right to left [R2L] ispresented in Figure 1 and the implementation results are presented in Table 2. As it can be seen,4this version needs two GMs and two registers for saving intermediate results. Coefficients σi and errorvector are saved in separate embedded memory. The maximum frequency of this block is much lowerthan that of GM alone, because of memory accesses (coefficients σi are read from the memory on the fly).Figure 1: Architecture for [R2L] evaluationTable 2: Implementation results for [R2L] evaluationm t LCELLs freq (MHz) time (µs)5 3 287 120 1.076 5 311 118 3.257 10 341 95 14.8211 50 511 78 1339.08Implementation of the module computing error locator polynomial from left to right:The second architecture of the module computing error locator polynomial from left to right [L2R]according to Horner’s scheme is depicted in Figure 2 and the implementation results are presentedin Table 3. As it can be seen, this architecture needs only one GM and one register. Memories forcoefficients σi and error vector (the result) are the same as in the previous case.Of course, both architecture versions give the same error vector as a result. However, intermediateresults, which are saved in registers, are different. Therefore, both circuits will leak information differ-ently. We expect that this difference can be used for constructing some efficient countermeasure in thefuture.Table 3: Implementation results for [L2R] evaluationm t LCELLs freq (MHz) time (µs)5 3 274 110 1.166 5 293 110 3.497 10 311 107 13.1611 50 414 85 1228.805Figure 2: Architecture for [R2L] evaluation5 Conclusions and perspectivesGoppa codes are one of the most used family of codes in code-based cryptography. We implementeda part of the algorithm, which is the most expensive, vulnerable but necessary in all Goppa decodingalgorithms. Implementation results of both versions ([R2L] and [L2R]) are very similar. However,power traces will be certainly very different. Moreover, we can ask us if it will be possible to attackboth implementations. If not, which is more robust and the reasons, else we can implement bothmethods in parallel and select randomly the datapath. It will be necessary to determine which is thebest Goppa decoder between Patterson, Berlekamp-Massey or Extended Euclidean algorithms. Later,we could implement the complete Goppa decoder and the complete McEliece PKC in hardware in orderto evaluate side-channel attacks and countermeasures.References[1] Evariste II - A Modular Hardware System for Development and Evaluation of Crypto-graphic Functions and Random Number Generators. http://labh-curien.univ-st-etienne.fr/wiki-evariste-ii/.[2] R.M. Avanzi, S. Hoerder, D. Page, and M. Tunstall. Side-Channel Attacks on the McEliece andNiederreiter Public-Key Cryptosystems. 2010.[3] E. Berlekamp. Goppa codes. Information Theory, IEEE Transactions on, 19(5):590–592, 1973.[4] E. Berlekamp, R. McEliece, and H. van Tilborg. On the inherent intractability of certain codingproblems. IEEE Transactions on Information Theory, 24(3):384 – 386, may 1978.[5] N.T. Courtois, M. Finiasz, and N. Sendrier. How to Achieve a McEliece-Based Digital SignatureScheme. 2248:157–174, 2001.[6] V. D. Goppa. A new class of linear correcting codes. Problemy Peredachi Informatsii, 6(3):24–30,1970.[7] S. Heyse and T. Gu¨neysu. Code-based cryptography on reconfigurable hardware: tweaking nieder-reiter encryption for performance. Journal of Cryptographic Engineering, pages 1–15, 2013.[8] W. G. Horner. A new method of solving numerical equations of all orders, by continuous approx-imation. Philosophical Transactions of the Royal Society of London, 109:308–335, 1819.[9] P. Kocher. Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems.In Advances in Cryptology (CRYPTO’96), pages 104–113. Springer, 1996.[10] J. Massey. Shift-register synthesis and BCH decoding. Information Theory, IEEE Transactionson, 15(1):122–127, 1969.6[11] R.J. McEliece. A public-key cryptosystem based on algebraic coding theory. DSN progress report,42(44):114–116, 1978.[12] H. Molter, M. Sto¨ttinger, A. Shoufan, and F. Strenzke. A simple power analysis attack on aMcEliece cryptoprocessor. Journal of Cryptographic Engineering, 1(1):29–36, April 2011.[13] N. Patterson. The Algebraic Decoding of Goppa Codes. IEEE Transactions on InformationTheory, 21(2):203–207, 1975.[14] A. Shoufan, F. Strenzke, H. Molter, and M. Sto¨ttinger. A Timing Attack against PattersonAlgorithm in the McEliece PKC. Information, Security and Cryptology–ICISC 2009, 5984:161–175, 2010.[15] F. Strenzke. A Timing Attack against the secret Permutation in the McEliece PKC. Post-QuantumCryptography, 6061:95–107, 2010.[16] F. Strenzke. Timing Attacks against the Syndrome Inversion in Code-based Cryptosystems. 2011.[17] F. Strenzke, E. Tews, H. G. Molter, R. Overbeck, and A. Shoufan. Side Channels in the McEliecePKC. Post-Quantum Cryptography, 5299(5299/2008):216–229, October 2008.7

Towards a Secure Goppa Decoder in Hardware Implementation

https://hal-ujm.archives-ouvertes.fr/ujm-00933421

Towards a Secure Goppa Decoder in Hardware Implementation

Abstract

Similar works

Full text

Available Versions

HAL-UJM