Implementing the NewHope-Simple Key Exchange on Low-Cost FPGAs

Transcription

1 Implementing the NewHope-Simple Key Exchange on Low-Cost FPGAs Tobias Oder and Tim Güneysu Ruhr-University Bochum Latincrypt

2 Public-Key Crypto and Long-Term Security 2

3 Lattice-Based Cryptography Five main branches of post-quantum crypto: Code-based Lattice-based Hash-based Multivariate-quadratic Supersingular elliptic curve isogenies 3

4 Standard Lattices vs Ideal Lattices Ring or ideal lattices smaller parameters faster implementations smaller implementations But less trust in security due to structure! Ideal: polynomial multiplication Standard: matrix-vector multiplication Module lattices somewhere inbetween 4

5 Learning with Errors Given A and b = As Task: Find s Easy to solve 5

6 Learning with Errors Given A and b = As Task: Find s Easy to solve Given A and b = As + e Task: Find s Hard problem 6

7 A New Hope - Simple Alkim, E., Ducas, L., Pöppelmann, T., Schwabe, P.: NewHope without reconciliation (2016), 7

8 A New Hope 8

9 Challenges for HW Implementation Implementation for Xilinx Aritx-7 FPGA NTT for polynomial multiplication in O(n log n) Binomial sampler to generate error polynomials SHAKE-128 for Parse Optimize for low-area footage, but maintain a decent performance 9

10 Our Design - Server 10

11 Our Design - Client 11

12 Sever-side Operations I 12

13 Client-side Operations 13

14 Sever-side Operations II 14

15 Comparison We compare our results with Thomas Pöppelmann and Tim Güneysu: Towards practical latticebased public-key encryption, SAC 2013 Sujoy Sinha Roy and Frederik Vercauteren and Nele Mentens and Donald Donglong Chen and Ingrid Verbauwhede: Compact Ring- LWE based cryptoprocessor, CHES 2014 Po-Chun Kuo and Wen-Ding Li and Yu-Wei Chen and Yuan-Che Hsu and Bo-Yuan Peng and Chen-Mou Cheng and Bo-Yin Yang: Post-Quantum Key Exchange on FPGAs, eprint,

16 Resource consumption Implementation Scheme LUTs FFs BRAMs DSPs Roy et al. R-LWE Encrypt 1, Pöppelmann et al. R-LWE Encrypt 5,595 4, Kuo et al. NewHope 12,340 6, Our (server) NewHope Simple 5,142 4, Our (client) NewHope Simple 4,498 4,

17 Resource consumption Implementation Scheme LUTs FFs BRAMs DSPs Roy et al. R-LWE Encrypt 1, Pöppelmann et al. R-LWE Encrypt 5,595 4, Kuo et al. NewHope 12,340 6, Our (server) NewHope Simple 5,142 4, Our (client) NewHope Simple 4,498 4,

18 Resource consumption Implementation Scheme LUTs FFs BRAMs DSPs Roy et al. R-LWE Encrypt 1, Pöppelmann et al. R-LWE Encrypt 5,595 4, Kuo et al. NewHope 12,340 6, Our (server) NewHope Simple 5,142 4, Our (client) NewHope Simple 4,498 4,

19 Resource consumption Implementation Scheme LUTs FFs BRAMs DSPs Roy et al. R-LWE Encrypt 1, Pöppelmann et al. R-LWE Encrypt 5,595 4, Kuo et al. NewHope 12,340 6, Our (server) NewHope Simple 5,142 4, Our (client) NewHope Simple 4,498 4,

20 Performance results Implementation Scheme Frequency Cycles µs/operation Roy et al. (Enc) R-LWE Encrypt 278 MHz 13, Roy et al. (Dec) R-LWE Encrypt 278 MHz 5, Pöppelmann et al. (Enc) R-LWE Encrypt 251 MHz 13, Pöppelmann et al. (Dec) R-LWE Encrypt 251 MHz 8, Kuo et al. (server) NewHope 114 MHz 11, Kuo et al. (client) NewHope 114 MHz 11, Our (server) NewHope Simple 125 MHz 171,124 1,369 Our (client) NewHope Simple 117 MHz 179,292 1,532 20

21 Performance results Implementation Scheme Frequency Cycles µs/operation Roy et al. (Enc) R-LWE Encrypt 278 MHz 13, Roy et al. (Dec) R-LWE Encrypt 278 MHz 5, Pöppelmann et al. (Enc) R-LWE Encrypt 251 MHz 13, Pöppelmann et al. (Dec) R-LWE Encrypt 251 MHz 8, Kuo et al. (server) NewHope 114 MHz 11, Kuo et al. (client) NewHope 114 MHz 11, Our (server) NewHope Simple 125 MHz 171,124 1,369 Our (client) NewHope Simple 117 MHz 179,292 1,532 21

22 Comparison What makes our numbers worse than those of R-LWE implementations? Parameter sizes More components Key generation On-the-fly generation of a Security level 22

23 Conclusions NewHope-Simple is well suited for implementations on constrained devices Low area footprint Practical performance VHDL source code will be made available for verification soon: Our implementation is constant time DPA-resistant implementation is future work 23

24 Thank You For Your Attention! Any Questions?