Constant Time Algorithms for ROLLO-I-128

Abstract

In this work, we propose different techniques that can be used to implement the rank-based key encapsulation methods and public key encryption schemes of the ROLLO, and partially RQC, family of algorithms in a standalone, efficient and constant time library. For simplicity, we focus our attention on one specific instance of this family, ROLLO-I-128. For each of these techniques, we present explicit code (including intrinsics), or pseudo-code and performance measures to show their impact. More precisely, we use a combination of original and known results and describe procedures for Gaussian reduction of binary matrices, generation of vectors of given rank, multiplication with lazy reduction and inversion of polynomials in a composite Galois field. We also carry out a global performance analysis to show the impact of these improvements on ROLLO-I-128. Through the SUPERCOP framework, we compare it to other 128-bit secure KEMs in the NIST competition. To our knowledge, this is the first optimized full constant time implementation of ROLLO-I-128.

Exploiting ROLLO’s constant-time implementations with a single-trace analysis

“…In [1], the authors restrain the definition of ideal LRPC (Low-Rank Parity Check) codes to (2, 1)-ideal LRPC codes that they used for all variants of ROLLO.…”

“…• (u, v) $ ← − l A denotes the operation of selecting randomly 2n linear combinations from the element A, then u, v ∈ F n q m and Supp(u, v) = A. • RSR denotes the Rank Support Recovery algorithm given in the specification of ROLLO [1] to decode LRPC codes.…”

“…We analyzed two constant-time implementations of Gaussian elimination and discovered two possible leakages through power consumption. The first one has been provided as Additionnal Implementations in April 2020 for the second round of NIST PQC standardization process, and is available on the ROLLO candidate webpage [1]. We refer to it as the reference implementation.…”

“…It uses the rbc library [3], which provides different functions to implement schemes Side-Channel Attack on ROLLO PQC scheme using rank metric codes. The second implementation has been published on GitHub [2]. We refer to it as the GitHub implementation.…”

“…Errorcorrecting codes in rank metric allow to reduce some drawbacks of Hamming metric, like the key-sizes. In the second round of this standardization process, there were two proposals in rank metric, namely ROLLO [1] and RQC [15]. Both were not selected for the third round due to some algebraic attacks [5,6].…”