Fan, Sailong

Howe, James

Khalid, Ayesha

Liu, Weiqiang

O'Neill, Maire

Lattice based cryptography (LBC) is one of the most promising post-quantum cryptographic candidates. Ringlearning with errors (R-LWE) is an encryption scheme of LBC. In this paper, a lightweight hardware implementation is presented including key generation, encryption, and decryption. The RLWE encryption scheme consists of a Gaussian sampler and polynomial multiplication. This paper uses cumulative distribution table (CDT) as the Gaussian sampler and schoolbook approach for the polynomial multiplication. The purpose of this architecture is to achieve small area consumption with high frequency. The hardware implementation results on the Xilinx Kintex-7 FPGA shows that the design consumes 808 slices and the frequency can be up to 288.35MHz

Queen's University Belfast Research Portal

Lightweight Hardware Implementation of R-LWE Lattice-BasedCryptographyFan, S., Liu, W., Howe, J., Khalid, A., & O'Neill, M. (2018). Lightweight Hardware Implementation of R-LWELattice-Based Cryptography. In IEEE Asia Pacific Conference on Circuits and Systems (APCCAS) 2018:Proceedings  IEEE .Published in:IEEE Asia Pacific Conference on Circuits and Systems (APCCAS) 2018: ProceedingsDocument Version:Peer reviewed versionQueen's University Belfast - Research Portal:Link to publication record in Queen's University Belfast Research PortalGeneral rightsCopyright for the publications made accessible via the Queen's University Belfast Research Portal is retained by the author(s) and / or othercopyright owners and it is a condition of accessing these publications that users recognise and abide by the legal requirements associatedwith these rights.Take down policyThe Research Portal is Queen's institutional repository that provides access to Queen's research output. Every effort has been made toensure that content in the Research Portal does not infringe any person's rights, or applicable UK laws. If you discover content in theResearch Portal that you believe breaches copyright or violates any law, please contact openaccess@qub.ac.uk.Download date:09. Sep. 2018Lightweight Hardware Implementation of R-LWELattice-Based CryptographySailong Fan∗, Weiqiang Liu∗, James Howe†, Ayesha Khalid‡ and Maire O’Neill‡∗Nanjing University of Aeronautics and Astronautics, Nanjing, China†University of Bristol, Bristol, UK‡Queen’s University Belfast, Belfast, UKE-mail:{fansl4g, liuweiqiang}@nuaa.edu.cn, james.howe@bristol.ac.uk, {a.khalid, m.oneill}@qub.ac.ukAbstract—Lattice based cryptography (LBC) is one of themost promising post-quantum cryptographic candidates. Ring-learning with errors (R-LWE) is an encryption scheme of LBC. Inthis paper, a lightweight hardware implementation is presentedincluding key generation, encryption, and decryption. The R-LWE encryption scheme consists of a Gaussian sampler andpolynomial multiplication. This paper uses cumulative distri-bution table (CDT) as the Gaussian sampler and schoolbookapproach for the polynomial multiplication. The purpose of thisarchitecture is to achieve small area consumption with highfrequency. The hardware implementation results on the XilinxKintex-7 FPGA shows that the design consumes 808 slices andthe frequency can be up to 288.35MHz.Index Terms—lattice-based cryptography; Ring-learning witherrors; cumulative distribution table; polynomial multiplication;FPGAI. INTRODUCTIONIn the increasingly prominent context of information secu-rity, higher security encryption algorithms are required to pro-tect personal information and privacy. With the breakthroughof quantum computer, especially the invention of quantumalgorithm represented by Shor [1] in 1994, existing public-keyencryption algorithms based on large number decompositionand discrete logarithm such as RSA [2] and elliptic curvecryptography (ECC) [3] will be no longer secure. In orderto resist the attacks of quantum computer, post-quantumcryptography (PQC) has been created. Amongst the potentialPQC algorithms, lattice-based cryptography (LBC) is one ofthe most promising candidates. LBC algorithms are based ahard problem of the short (or closest) vector problem (SVP orCVP) in a lattice. This hard problem in LBC is believed tobe difficult for classical and quantum computers. Therefore,even the practical quantum computer comes true, it can stillbe robust enough to withstand an attack.Ring-learning with errors (R-LWE) algorithm was proposedby Lyubashevsky et al. [4]. It operates on the ring Zq[x]/(f),where f is an irreducible polynomial and p is a prime. In mostcases, f = xn + 1 where n is a power of 2. R-LWE algorithmuses polynomial multiplication, which leads to large key sizesand signnificant hardware resources. However, compared toRSA and ECC, it is compact.In this paper, we aim to design a lightweight hardwareimplementation of R-LWE, which uses a small amount of re-sources but also guarantees security. For the Gaussian sampler,the cumulative distribution table (CDT) method is used dueto its simplicity and lightweight feature. This method doesnot use any RAM and has a fast speed. Before the Gaussiansampler, we use M-sequence as the random number generator.To implement the costly polynomial multiplication, we useschoolbook multiplication instead of the number theoretictransform (NTT). Rather than using the block RAM, theproposed design is implemented with distributed RAM (i.e.,LUTM), which can achieve high frequency and throughput.The lightweight designs include implementations of R-LWEfor key generation, encryption, and decryption. The parameterset used is (n, q, σ) = (256, 7681, 4.51) which is consistentwith [5] and attains the medium security levels.The paper is organized as follows. Section II presents thebackground of public-key scheme of R-LWE. Section IIIpresents the proposed hardware architecture for both of theencryption and decryption of the R-LWE public key scheme.Section IV gives the hardware results and compares withprevious designs. Section V concludes the paper.II. BACKGROUNDLattice-based cryptography has already been implementedin a number of different situations, with schemes based onthe hardness of the learning with errors problem (LWE) andthe Ring-LWE (R-LWE) problem. Compared with LWE, R-LWE algorithm improves the public and private key size andimproves efficiency. However, R-LWE algorithms also havesome disadvantages, such as complex operation of polynomialmultiplication. Po¨ppelmann and Gu¨neysu proposed an efficientpolynomial multiplication based on NTT [6], and later theyprovided the whole design of the R-LWE scheme with somepractical optimizations [7]. In addition, they investigate a low-cost scenario with very limited resources [8], using differentvalues of parameter sets and using the Bernoulli sampler.The R-LWE algorithm mainly consists of two operations,that is, the Gaussian sampler and multiplication. DiscreteGaussian distribution is considered over the integers withstandard deviation σ and mean µ = 0. In this work, theGaussian standard deviation σ = 4.51 is used. The Gaussianprobability distribution function is as follows:f(x) =1(√2piσ)exp(− (x− µ)22σ2)= 0.88457exp(−0.2458x2)(1)And the cumulative probability distribution equation isF (x) =∫ x∞ f(t)dt. According to the probability theory, wecan have the results.If X N(µ, σ2),F (x) = P{X ≤ x} = P{(X − µ)/σ ≤ (x− µ)/σ}= Φ((x− µ)/σ)then,F (1) = P{X ≤ 1} = Φ(1/σ) = 0.5871F (2) = P{X ≤ 2} = Φ(2/σ) = 0.6700F (3) = P{X ≤ 3} = Φ(3/σ) = 0.7486etc.Next, some uniform random numbers are needed to com-pose the discrete Gaussian distribution number. The maximumnumber of uniform random numbers determine the precisionof the Gaussian distribution.Another complex operation is polynomial multiplication.It’s the most time-consuming operation, resulting in slowcomputation. The schoolbook algorithm can be written asfollows:ab =n−1∑i=0n−1∑j=0aibjxi+jmod(xn + 1) (2)where a and b are the two inputs to the multiplier. Thiscalculation has a time complexity O(n2).The public key encryption scheme of R-LWE includesKey gen(), Enc(a,p,m) and Dec(c1, c2) and is defined asshown in Table I:TABLE ITHE PUBLIC KEY ENCRYPTION SCHEME OF R-LWEKey gen() Generate r1, r2 ∈ Dσ and a ∈ U . Let p =r1 − ar2. Then the public key is p and thesecret key is r2.Enc(a,p,m) Generate e1, e2, e3 ∈ Dσ . Let m¯ =ENCODE(m). Then the cipher text is c1 =ae1 + e2, c2 = pe1 + e3 + m¯Dec(c1, c2) The plaintext is DECODE(c = c1r2 + c2)III. THE PROPOSED LIGHTWEIGHT HARDWAREARCHITECTURE OF THE R-LWEIn this section, the proposed lightweight hardware architec-ture of R-LWE lattice-based encryption is presented. We usea fast and low-cost Gaussian sampler based on CDT methodand a pipelined schoolbook polynomial multiplier.A. Discrete Gaussian SamplingFor the discrete Gaussian sampler, the standard deviationσ = 4.51(s = 11.31) and the mean µ = 0 is used. In thisdesign, we use a precomputed table (3140 bits) to sample thedata. 40 random bits are generated to compare with the tableand calculate the rank of the data in which maximum numberis 31.The first step of the Gaussian sampler is generating therandom bits. Considering the good statistical properties ofM-sequence, we apply it to generate the required randomnumbers. Then we need to find the order of the number,comparing with those number in the precomputed data. In thisprocess, we can use method of bisection to increase the speedof calculation. However, the number generated through thismethod is too small and will be insecure. A better way tosolve this problem is to distribute the number to both sidesof x-axis and this covers both positive and negative sides ofthe distribution as it is symmetrical. The details is describedin Algorithm 1.Algorithm 1 Discrete Gaussian Sampling Based on CDTInput: seed : 40-bit unsigned, q = 7681 modulus,PMAT : precomputed gauss dataOutput: gdata : 13-bit unsigned1: rnd = m squence(seed);2: min = 0; cur = 16; jmp = 16;3: do4: cur = min + jmp;5: jmp = jmp  1;6: if(rnd ≥ PMAT(cur))7: min = cur;8: while(jmp == 0)9: if( rnd[0] )10: gdata = cur;11: else12: gdata = q - cur;13: return gdata;Fig. 1 shows the hardware structure of discrete Gaussiansampler. The primitive polynomial of M-sequence is f(x) =x40 + x5 + x4 + x3 + 1. The hardware circuit brings oneGaussian data per clock, hence a full Gaussian polynomialcan be produced after 256 clocks.B. Polynomial MultiplicationWe use schoolbook multiplication for the parameter set n =256 and q = 7681. It can be implemented with just a multiplierof 13 × 13 bits. The cost is much lower than NTT method.Algorithm 2 shows the process of a 13 × 13 bit multiplier,where addition and modular reduction are also required. It isnot easy to perform the modulo reduction. Barrett’s reductionalgorithm [9] can solve this problem, but this needs a smallmodification. In [10], an algorithm was proposed to fit theAVR micro controller. The variant of algorithm is shown inAlgorithm 2.Gauss[0]Gauss[1]Gauss[2]Gauss[3]Gauss[4]……Gauss[30]Gauss[31]40-bitM-SequenceRNGComparator40bitsGauss[X]40bitsR[0]q=7681X13bits 13bitsGauss_data13bitsMUXBisection MethodFig. 1. Hardware structure of the discrete Gaussian sampling.Algorithm 2 Barrett’s Reduction Variant AlgorithmInput: x : 26-bit unsigned, q = 7681 modulusOutput: y : 13-bit unsigned1: t = x[25:13] + x[25:17] + x[25:21];2: tq = (t13)+t-(t9); //tq = t×q;3: y = x - tq;4: if(y ≥ q)5: y = y - q;6: if(y ≥ q)7: y = y - q;8: if(y ≥ q9: y = y - q;10: return y;In this algorithm, x is the product of two numbers andy is number modulo q. In Step 2, we observe that 7681 =0x1e01 = 0x2000 − 0x0100 + 0x0001. Therefore, we cansimplify the multiplication of t × q to addition and shiftoperations. Then, if the obtained result is not totally reduced,additional subtractions are needed, where the maximum num-ber of subtractions is 3.Fig. 2 shows the hardware structure of modular reductionwith multiplication. It uses two additions, five subtractions andshift operations.x x[25:21]x[25:17]x[25:13]tyqqq2613t<<1326t<<9262626tq13Fig. 2. Hardware structure of the modular reduction.C. Hardware Architectures of R-LWEThe R-LWE algorithms include three parts, key generation,encryption, and decryption. In the key generation part, twoGaussian distributed polynomials r1, r2 and a uniformly dis-tributed polynomial a are produced. Polynomial a is sampleddirectly from M-sequence. Polynomial multiplication and sub-traction is used to obtain the public key p and the private keyr2. Polynomial subtraction can be performed by addition andusing a multiplexer. When the addition operation is finished,there is a simple modulus operation with a comparator usinga multiplexer. Fig. 3 is the hardware architecture of keygeneration part.D QCLK40 bitsm sequencemodulo×Multiplicationr1r2aPMATSampler?Subtraction+pKey GenerationFig. 3. Hardware architecture of key generation.For encryption, Gaussian noise polynomials e1, e2, e3 arerequired for the ciphertext calculation. Every addition needsanother multiplexer to ensure the result is below 7681. Mes-sage m is hidden by c2. The polynomial c1 does not containany information of the message and it is just an assistant duringthe decryption process. Fig. 4 shows the hardware architectureof the encryption.D QCLK40 bitsm sequence e1e2e3PMATSampler?modulo×MultiplicationapFlow ControlAddition+ae1pe1c2 c1Addition+mEncryptionAddition+Fig. 4. Hardware architecture of encryption.TABLE IIRESULT OF PERFORMANCE AND RESOURCE CONSUMPTIONK7 (256,7681,4.51)Resources Key gen Enc DecLUT 934 1098 609FF 356 407 318Slices 289 337 182LUTM 195 281 215BRAM 0 0 0DSP 1 1 1Freq. 288.35MHzCycles 66057 131604 65802Op./s 4365.17 2191.04 4382.09TABLE IIICOMPARISON WITH OTHER R-LWE CRYPTOGRAPHY (K-7: KINTEX-7,S-6: SPARTAN-6, V-6: VIRTEX-6, S-IV: STRATIX-IV).Designs Part LUT FF BRAM DSP Freq(MHz) OP/sThiswork(K-7)Key 934 356 0 1288.354365Enc 1098 407 0 1 2191Dec 609 318 0 1 4382[8](S-6)Enc 360 290 2 1 128 934Dec 162 136 1 1 179 2700[7](V-6) Tol 4549 3624 12 1 262 14162[11](S-IV)Enc 28977 29290 234 22 235.40 107181Dec 6761 7616 31 20 249.44 217864Lastly, in the decryption, there is no need to generateGaussian values, which only need to calculate c = c1r2+c2.Fig. 5 shows the hardware architecture of decryption.modulo×MultiplicationAddition+c1r2c2Fig. 5. Hardware architecture of decryption.IV. RESULTS AND COMPARISONWe have implemented the proposed R-LWE encryptionscheme on Xilinx Kintex-7 FPGA (using Vivado 2016.4)with parameter sets (256,7681,4.51). Table II presents theperformance and hardware cost. The design includes threeparts, which do not share any hardware, due to that thekey management, encryption and decryption core may not becontained in the same device. Pipelining has been applied toincrease the frequency of design with registers. In addition, weuse LUT RAM (LUTM) instead of block memory, which cansave the memory resources and achieve higher frequency, butcosts extra LUT resources. Table III presents the comparisonwith other R-LWE encryption implemented in hardware.[8] uses the different parameter sets (256,4093,3.33) andits frequency is not high but it is low-cost. [7] uses theNTT algorithm as polynomial multiplication and reuse thesame multiplication module. [11] is a high throughput designand high security with n = 512, which targets high speed.Comparing with these R-LWE designs, the proposed designdoes not use any RAM and has the highest frequency withrather low hardware cost.V. CONCLUSIONS AND FUTURE WORKSIn this work, a lightweight R-LWE hardware implemen-tation is presented. The proposed design uses CDT as theGaussian sampler and a schoolbook multiplier for polynomialmultiplication. The design achieves the highest frequency withrather low hardware cost, compared with previous works.Future work will consider to reduce the bit width of Gaussiansamples, which will further save hardware resources.REFERENCES[1] P. W. Shor, “Polynomial-time algorithms for prime factorization anddiscrete logarithms on a quantum computer,” SIAM J. Comput., vol. 26,no. 5, 1997, pp. 1484–1509.[2] E. O¨ksu¨zoglu and E. Savas, ”Parametric, Secure and Compact Im-plementation of RSA on FPGA,” 2008 International Conference onReconfigurable Computing and FPGAs, Cancun, 2008, pp. 391-396.[3] K. Sakiyama, M. Mentens, L. Batina, B. Preneel and I. Ver-bauwhede, “Reconfigurable modular arithmetic logic unit supportinghigh-performance RSA and ECC over GF(p),” International Journal ofElectronics, vol. 94, 2007, pp. 501-514.[4] V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices andlearning with errors over rings,” in Proc. 29th Annu. Int. Conf. TheoryAppl. Cryptogr. Techn. (EUROCRYPT), 2010, pp. 1–23.[5] R. Lindner and C. Peikert, “Better key sizes (and attacks) for LWE-basedencryption,” in Proc. Cryptogr. Track RSA Conf. (CT-RSA), 2011, pp.319–339.[6] T. Po¨ppelmann and T. Gu¨neysu, “Towards efficient arithmetic for lattice-based cryptography on reconfigurable hardware,” in Proc. 2nd Int. Conf.Cryptol. Inf. Secur. Latin Amer. (LATINCRYPT), 2012, pp. 139–158.[7] T. Po¨ppelmann and T. Gu¨neysu, “Towards practical lattice-based public-key encryption on reconfigurable hardware,” in Proc. 20th Int. Conf. Sel.Areas Cryptogr. (SAC), 2013, pp. 68–85[8] T. Po¨ppelmann and T. Gu¨neysu, ”Area optimization of lightweightlattice-based encryption on reconfigurable hardware,” 2014 IEEE In-ternational Symposium on Circuits and Systems (ISCAS), MelbourneVIC, 2014, pp. 2796-2799.[9] P. Barrett. ”Implementing the Rivest Shamir and Adleman public keyencryption algorithm on a standard digital signal processor.” Conferenceon the Theory and Application of Cryptographic Techniques Springer,1986, pp.:311-323.[10] Z. Liu, H. Seo, S S, Roy, J. Großscha¨dl, H. Kim and I. Verbauwhede,”Efficient Ring-LWE encryption on 8-Bit AVR processors,” in Proc. Int.Workshop Cryptographic Hardware and Embedded Systems (CHES),2015, pp. 663-682.[11] C. P. Renterı´a-Mejı´a and J. Velasco-Medina, ”High-Throughput Ring-LWE Cryptoprocessors,” in IEEE Transactions on Very Large ScaleIntegration (VLSI) Systems, vol. 25, no. 8, 2017, pp. 2332-2345.

Lightweight hardware implementation of R-LWE lattice-based cryptography

https://pure.qub.ac.uk/ws/files/157011948/APCCAS_2018_paper_264.pdf

Lightweight Hardware Implementation of R-LWE Lattice-Based Cryptography

Abstract

Similar works

Full text

Available Versions

Queen's University Belfast Research Portal