Efficient Cryptography on the RISC-V Architecture

Stoffelen, Ko

doi:10.1007/978-3-030-30530-7_16

Cited by 27 publications

(27 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This choice was mainly motivated to make our implementations malleable in the sense that they can be easily adapted to match any mode of operation. On the other hand, the results reported in [SS16,Sto19] that we use for comparative purposes were obtained by averaging on the processing of 4 096 bytes in CTR mode. While our benchmarks do not measure the small overhead due to the CTR mode (which consists in loading the plaintext, performing an XOR with the keystream and storing the result back), the average over 256 blocks cancels the function call overhead (which includes the cycles required to store/restore the context at the beginning and the end of the function) because their AES implementation is fully inlined in the CTR encryption function.…”

Section: Implementation Resultsmentioning

confidence: 99%

“…On 32-bit platforms, the most efficient bitsliced AES implementation reported in the literature is the one from Schwabe and Stoffelen [SS16] allowing to reach 101 cpb on ARM Cortex-M3. It was also ported to the 32-bit RISC-V architecture and results in 124 cpb on E31 processors [Sto19]. Their implementation heavily relies on [KS09] by adapting it to 32-bit registers instead of 128-bit ones as depicted in Figure 4.…”

Section: Bitslicing the Aesmentioning

confidence: 99%

“…To the best of our knowledge, there is no result reported in the literature for a 32-bit implementation of the AES key schedule in a truly bitsliced manner. Actually, the results reported in [SS16,Sto19] are obtained by computing the AES key schedule using a lookup table (LUT) for the SubBytes before packing the round keys to match the bitsliced representation, resulting in key-dependent memory accesses. However, mounting a cache-timing attack against the key schedule seems unpractical since it is often computed only once per key and such attacks require the key-related index to interact with known variable data over multiple samples.…”

Section: Application To the Key Expansionmentioning

confidence: 99%

“…To date, the fastest constant-time AES implementation on 32-bit reduced instruction set computer (RISC) is is the one from Schwabe and Stoffelen [SS16] that runs at 101 cycles per byte (cpb) on ARM Cortex-M3 by processing 2 blocks in parallel. It was also ported to the 32-bit RISC-V architecture and results in 124 cpb on this platform [Sto19]. This implementation, which relies on bitslicing, also serves as a basis for some of the current best results reported in the literature when integrating countermeasures against power/electromagnetic side-channel attacks [GSDM + 19].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Fixslicing AES-like Ciphers

Adomnicai

Peyrin

2020

TCHES

View full text Add to dashboard Cite

The fixslicing implementation strategy was originally introduced as a new representation for the hardware-oriented GIFT block cipher to achieve very efficient software constant-time implementations. In this article, we show that the fundamental idea underlying the fixslicing technique is not of interest only for GIFT, but can be applied to other ciphers as well. Especially, we study the benefits of fixslicing in the case of AES and show that it allows to reduce by 52% the amount of operations required by the linear layer when compared to the current fastest bitsliced implementation on 32-bit platforms. Overall, we report that fixsliced AES-128 allows to reach 80 and 91 cycles per byte on ARM Cortex-M and E31 RISC-V processors respectively (assuming pre-computed round keys), improving the previous records on those platforms by 21% and 26%. In order to highlight that our work also directly improves masked implementations that rely on bitslicing, we report implementation results when integrating first-order masking that outperform by 12% the fastest results reported in the literature on ARM Cortex-M4. Finally, we demonstrate the genericity of the fixslicing technique for AES-like designs by applying it to the Skinny-128 tweakable block ciphers.

show abstract

Section: Implementation Resultsmentioning

confidence: 99%

Section: Bitslicing the Aesmentioning

confidence: 99%

Section: Application To the Key Expansionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Fixslicing AES-like Ciphers

Adomnicai

Peyrin

2020

TCHES

View full text Add to dashboard Cite

show abstract

“…This is due to the timedominating role of the hash functions used in Kyber and NewHope, e.g., of the Keccak permutation used as a PRF and KDF. This problem is aggravated since the only optimized implementation of the Keccak permutation for RISC-V uses a bit interleaved representation of the state [Sto19]. Therefore, it requires additional bit manipulation operations that would be very costly in RISC-V. To alleviate this, we evaluated the ciphers with a simple unrolled assembly implementation of the Keccak permutation.…”

Section: Discussionmentioning

confidence: 99%

ISA Extensions for Finite Field Arithmetic

Alkım

Evkan

Lahr

et al. 2020

TCHES

View full text Add to dashboard Cite

We present and evaluate a custom extension to the RISC-V instruction set for finite field arithmetic. The result serves as a very compact approach to software-hardware co-design of PQC implementations in the context of small embedded processors such as smartcards. The extension provides instructions that implement finite field operations with subsequent reduction of the result. As small finite fields are used in various PQC schemes, such instructions can provide a considerable speedup for an otherwise software-based implementation. Furthermore, we create a prototype implementation of the presented instructions for the extendable VexRiscv core, integrate the result into a chip design, and evaluate the design on two different FPGA platforms. The effectiveness of the extension is evaluated by using the instructions to optimize the Kyber and NewHope key-encapsulation schemes. To that end, we also present an optimized software implementation for the standard RISC-V instruction set for the polynomial arithmetic underlying those schemes, which serves as basis for comparison. Both variants are tuned on an assembler level to optimally use the processor pipelines of contemporary RISC-V CPUs. The result shows a speedup for the polynomial arithmetic of up to 85% over the basic software implementation. Using the custom instructions drastically reduces the code and data size of the implementation without introducing runtime-performance penalties at a small cost in circuit size. When used in the selected schemes, the custom instructions can be used to replace a full general purpose multiplier to achieve very compact implementations.

show abstract

Tornado: Automatic Generation of Probing-Secure Masked Bitsliced Implementations

Belaïd

Dagand

Mercadier

et al. 2020

Advances in Cryptology – EUROCRYPT 2020

View full text Add to dashboard Cite

Cryptographic implementations deployed in real world devices often aim at (provable) security against the powerful class of side-channel attacks while keeping reasonable performances. Last year at Asiacrypt, a new formal verification tool named tightPROVE was put forward to exactly determine whether a masked implementation is secure in the well-deployed probing security model for any given security order t. Also recently, a compiler named Usuba was proposed to automatically generate bitsliced implementations of cryptographic primitives. This paper goes one step further in the security and performances achievements with a new automatic tool named Tornado. In a nutshell, from the high-level description of a cryptographic primitive, Tornado produces a functionally equivalent bitsliced masked implementation at any desired order proven secure in the probing model, but additionally in the so-called register probing model which much better fits the reality of software implementations. This framework is obtained by the integration of Usuba with tightPROVE + , which extends tightPROVE with the ability to verify the security of implementations in the register probing model and to fix them with inserting refresh gadgets at carefully chosen locations accordingly. We demonstrate Tornado on the lightweight cryptographic primitives selected to the second round of the NIST competition and which somehow claimed to be masking friendly. It advantageously displays performances of the resulting masked implementations for several masking orders and proves their security in the register probing model.

show abstract

Efficient Cryptography on the RISC-V Architecture

Cited by 27 publications

References 15 publications

Fixslicing AES-like Ciphers

Fixslicing AES-like Ciphers

ISA Extensions for Finite Field Arithmetic

Tornado: Automatic Generation of Probing-Secure Masked Bitsliced Implementations

Contact Info

Product

Resources

About