High-Performance Ideal Lattice-Based Cryptography on 8-Bit AVR Microcontrollers

Abstract

Over the last years lattice-based cryptography has received much attention due to versatile average-case problems like Ring-LWE or Ring-SIS that appear to be intractable by quantum computers. In this work we evaluate and compare implementations of Ring-LWE encryption and the bimodal lattice signature scheme (BLISS) on an 8-bit Atmel ATxmega128 microcontroller. Our implementation of Ring-LWE encryption provides comprehensive protection against timing side-channels and takes 24.9 ms for encryption and 6.7 ms for decryption. To compute a BLISS signature, our software takes 317 ms and 86 ms for verification. These results underline the feasibility of lattice-based cryptography on constrained devices.

Fast Number Theoretic Transform for Ring-LWE on 8-bit AVR Embedded Processor

“…In this paper, we optimized the modular reduction for the high-speed implementation of NTT computation. We chose q = 7681 and q = 12, 289 primes (i.e., 0x1E01 and 0x3001 in hexadecimal representation) for the target parameters, which are widely used in previous works [28][29][30].…”

“…The modular reduction can be implemented using the bit-shift and add technique (i.e., SAMS2) or Montgomery reduction covered in previous works [28,29]. These methods can be accelerated further by using the optimized Look-Up Table (LUT) access-based fast reduction technique for performing mod 7681 and mod 12, 289 operations in ICISC'17 [30].…”

“…However, the AES accelerator of the ATxmega128A1 can only support 128-bit key, which is not sufficient for long-term security, such as 192-bit and 256-bit security levels. However, previous works utilized the 128-bit AES hardware accelerator for 256-bit scheme in order to achieve high performance by sacrificing the security [27,29,30]. In [28], they only used the software AES from the AVR Crypto Lib for the long-term security level (i.e., 256-bit security level).…”

“…The previous work by Liu et al introduced the secure approach with tiny Montgomery reduction [29]. They perform the Montgomery reduction to reduce the 28/30-bit variables to 14/15-bit results.…”

“…They also presented the optimized sampling technique using AES accelerator for high speed random number generation. In [29], Liu et al presented the first secure Ring-LWE encryption and BLISS signature implementations against timing attacks and simple power analysis. NTT and sampling operations are implemented in constant timing to prevent timing attack and simple power analysis.…”