Enhanced Lattice-Based Signatures on Reconfigurable Hardware

Abstract

Abstract. The recent Bimodal Lattice Signature Scheme (Bliss) showed that lattice-based constructions have evolved to practical alternatives to RSA or ECC. Besides reasonably small signatures with 5600 bits for a 128-bit level of security, Bliss enables extremely fast signing and signature verification in software. However, due to the complex sampling of Gaussian noise with high precision, it is not clear whether this scheme can be mapped efficiently to embedded devices. Even though the authors of Bliss also proposed a new sampling algorithm using Bernoulli variables this approach is more complex than previous methods using large precomputed tables. The clear disadvantage of using large tables for high performance is that they cannot be used on constrained computing environments, such as FPGAs, with limited memory. In this work we thus present techniques for an efficient Cumulative Distribution Table (CDT) based Gaussian sampler on reconfigurable hardware involving Peikert's convolution lemma and the Kullback-Leibler divergence. Based on our enhanced sampler design, we provide a first Bliss architecture for Xilinx Spartan-6 FPGAs that integrates fast FFT/NTT-based polynomial multiplication, sparse multiplication, and a Keccak hash function. Additionally, we compare the CDT with the Bernoulli approach and show that for the particular Bliss-I parameter set the improved CDT approach is faster with lower area consumption. Our core uses 2,431 slices, 7.5 BRAMs, and 6 DSPs and performs a signing operation in 126 µs on average. Verification takes even less with 70 µs.

Improved Security Proofs in Lattice-Based Cryptography: Using the Rényi Divergence Rather Than the Statistical Distance

“…These savings consequently lower the precomputed table storage for sampling discrete Gaussians with the method described in [DDLL13,PDG14].…”

“…In the BLISS signature scheme [DDLL13] (and similarly in earlier variants [Lyu12]), each signature requires the signing algorithm to sample O(n) independent integers from the 1-dimensional discrete In previous works, the precision was determined by an analysis either based on the statistical distance (SD) [DDLL13] or the Kullback-Leibler divergence (KLD) [PDG14]. In this section, we review and complete these methods, and we propose an RD-based analysis that leads to bigger savings, asymptotically and in practice (see Table 1).…”

“…In [PDG14], Pöppelman, Ducas and Güneysu replace the SD-based analysis by a KLD-based analysis (i.e., using the RD of order a = 1) to reduce the precision p needed in the precomputed table.…”

“…The framework for using RD in distinguishing problems was used in [LPSS14], in the context of the k-LWE problem (a variant of LWE in which the attacker is given extra information). In [PDG14], Pöpplemann, Ducas and Güneysu used the Kullback-Leibler divergence (which is the RD of order a = 1) to lower the storage requirement of [DDLL13]. Asymptotically, using the Kullback-Leibler divergence rather than SD only leads to a constant factor improvement.…”

Simple Lattice Trapdoor Sampling from a Broad Class of Distributions

“…If a little more processing power or storage capacity is available, we can change the distribution of s 1 to a discrete Gaussian over Z m , which will make the outputs slightly shorter but will require some additional resources for doing discrete Gaussian sampling over Z m (cf. [DDLL13,DG14,PDG14]) and for the rejection sampling step (see the second example in Section 3.1).…”