Evaluation of Lattice-Based Signature Schemes in Embedded Systems

Güneysu, Tim; Krausz, Markus; Oder, Tobias; Speith, Julian

doi:10.1109/icecs.2018.8617969

Cited by 13 publications

(13 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Related Work. Previous speed-records for Dilithium on the Cortex-M4 were set by Ravi, Gupta, Chattopadhyay, and Bhasin [RGCB19] and were built upon an implementation by Güneysu, Krausz, Oder, and Speith [GKOS18]. A masked implementation of a modified Dilithium on Cortex-M3 is presented in [MGTF19].…”

Section: Contributionmentioning

confidence: 99%

“…As a primary microcontroller optimization target, NIST recommends the use of the Cortex-M4 board with all options included. Consequently, previous work on microcontroller implementations of Dilithium [GKOS18,RGCB19] has primarily focused on the Cortex-M4. Particularly, it has been targeting the STM32F407 core which was popularized for post-quantum cryptography by the testing and benchmarking framework pqm4 [KRSS].…”

Section: Target Platforms: Cortex-m3 and Cortex-m4mentioning

confidence: 99%

“…Our Cortex-M4 implementation is based on the Dilithium implementation by Ravi, Gupta, Chattopadhyay, and Bhasin [RGCB19], which includes the NTT and NTT −1 assembly implementation of Güneysu, Krausz, Oder, and Speith [GKOS18].…”

Section: Improving the Performance On Cortex-m4mentioning

confidence: 99%

See 2 more Smart Citations

Compact Dilithium Implementations on Cortex-M3 and Cortex-M4

Greconici

Kannwischer

Sprenkels

2020

TCHES

View full text Add to dashboard Cite

We present implementations of the lattice-based digital signature scheme Dilithium for ARM Cortex-M3 and ARM Cortex-M4. Dilithium is one of the three signature finalists of the NIST post-quantum cryptography competition. As our Cortex-M4 target, we use the popular STM32F407-DISCOVERY development board. Compared to the previous speed records on the Cortex-M4 by Ravi, Gupta, Chattopadhyay, and Bhasin we speed up the key operations NTT and NTT−1 by 20% which together with other optimizations results in speedups of 7%, 15%, and 9% for Dilithium3 key generation, signing, and verification respectively. We also present the first constant-time Dilithium implementation on the Cortex-M3 and use the Arduino Due for benchmarks. For Dilithium3, we achieve on average 2 562 kilocycles for key generation, 10 667 kilocycles for signing, and 2 321 kilocycles for verification.Additionally, we present stack consumption optimizations applying to both our Cortex- M3 and Cortex-M4 implementation. Due to the iterative nature of the Dilithium signing algorithm, there is no optimal way to achieve the best speed and lowest stack consumption at the same time. We present three different strategies for the signing procedure which allow trading more stack and flash memory for faster speed or viceversa. Our implementation of Dilithium3 with the smallest memory footprint uses less than 12kB. As an additional output of this work, we present the first Cortex-M3 implementations of the key-encapsulation schemes NewHope and Kyber.

show abstract

Section: Contributionmentioning

confidence: 99%

Section: Target Platforms: Cortex-m3 and Cortex-m4mentioning

confidence: 99%

See 1 more Smart Citation

Compact Dilithium Implementations on Cortex-M3 and Cortex-M4

Greconici

Kannwischer

Sprenkels

2020

TCHES

View full text Add to dashboard Cite

show abstract

“…Hülsing et al implemented the SPHINCS signature scheme on an embedded microprocessor [21] and Howe et al also implemented a lattice-based standardization candidate on an FPGA and microcontroller devices [20]. In [17] the authors test and compare the lattice-based signature schemes GLP, BLISS, and Dilithium on ARM Cortex-M4 microcontrollers. The GLP scheme has been presented in an optimized AVX implementation in [18].…”

Section: Pqc On Embeddedmentioning

confidence: 99%

Post-Quantum TLS on Embedded Systems: Integrating and Evaluating Kyber and SPHINCS+ with mbed TLS

Bürstinghaus-Steinbach

Krauß

Niederhagen

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

We present our integration of post-quantum cryptography (PQC), more specifically of the post-quantum KEM scheme Kyber for key establishment and the post-quantum signature scheme SPHINCS + , into the embedded TLS library mbed TLS. We measure the performance of these post-quantum primitives on four different embedded platforms with three different ARM processors and an Xtensa LX6 processor. Furthermore, we compare the performance of our experimental PQC cipher suite to a classical TLS variant using elliptic curve cryptography (ECC). Post-quantum key establishment and signature schemes have been either integrated into TLS or ported to embedded devices before. However, to the best of our knowledge, we are the first to combine TLS, post-quantum schemes, and embedded systems and to measure and evaluate the performance of post-quantum TLS on embedded platforms. Our results show that post-quantum key establishment with Kyber performs well in TLS on embedded devices compared to ECC variants. The use of SPHINCS + signatures comes with certain challenges in terms of signature size and signing time, which mainly affects the use of embedded systems as PQC-TLS server but does not necessarily prevent embedded systems to act as PQC-TLS clients. CCS CONCEPTS • Security and privacy → Digital signatures; • Networks → Transport protocols; Security protocols; • Theory of computation → Cryptographic primitives; Cryptographic protocols.

show abstract

“…This results in a compact implementation, the performance for the level-1 and level-5 is shown in Table II. For CRYSTALS-Dilithium, the NTT of the reference implementation is optimized at assembly level by merging of two of the eight stages of the NTT to reduce memory accesses [19]. CRYSTALS-Dilithium takes the lead here in terms of better overall throughput performance compared to both qTESLA and Falcon while qTESLA reference implementation from [13] has smaller stack requirements.…”

Section: B Reported Implementations On Embedded Microprocessorsmentioning

confidence: 99%

Lattice-based Cryptography for IoT in A Quantum World: Are We Ready?

Khalid

McCarthy

O’Neill

et al. 2019

2019 IEEE 8th International Workshop on Advances in Sensors and Interfaces (IWASI)

View full text Add to dashboard Cite

The impending realization of scalable quantum computers has led to active research in Post Quantum Cryptography (PQC). The challenge is harder for embedded IoT (edge) devices, due to their pervasive diffusion in today's world as well as their stricter resources (tight area and energy budgets). Amongst various classes of quantum-resistant cryptography schemes, Latticebased Cryptography (LBC) is emerging as one of the most viable, almost half of the 'survivors' of second round of the NIST's PQC competition are lattice-based in construction. This paper surveys the practicality of deployment of these schemes. In this context, the state-of-the-art LBC implementations on the constrained devices (including low-power FPGAs and embedded microprocessors), leading in terms of low-power footprint, small area, compact bandwidth requirements and high performance is fairly evaluated and bench-marked. The work concludes by identifying a suite of some favorite LBC schemes in terms of various IoT critical performance benchmarks .

show abstract

Evaluation of Lattice-Based Signature Schemes in Embedded Systems

Cited by 13 publications

References 7 publications

Compact Dilithium Implementations on Cortex-M3 and Cortex-M4

Compact Dilithium Implementations on Cortex-M3 and Cortex-M4

Post-Quantum TLS on Embedded Systems: Integrating and Evaluating Kyber and SPHINCS+ with mbed TLS

Lattice-based Cryptography for IoT in A Quantum World: Are We Ready?

Contact Info

Product

Resources

About