Implementing RLWE-based Schemes Using an RSA Co-Processor

Abstract

We repurpose existing RSA/ECC co-processors for (ideal) lattice-based cryptography by exploiting the availability of fast long integer multiplication. Such co-processors are deployed in smart cards in passports and identity cards, secured microcontrollers and hardware security modules (HSM). In particular, we demonstrate an implementation of a variant of the Module-LWE-based Kyber Key Encapsulation Mechanism (KEM) that is tailored for high performance on a commercially available smart card chip (SLE 78). To benefit from the RSA/ECC co-processor we use Kronecker substitution in combination with schoolbook and Karatsuba polynomial multiplication. Moreover, we speed-up symmetric operations in our Kyber variant using the AES co-processor to implement a PRNG and a SHA-256 co-processor to realise hash functions. This allows us to execute CCA-secure Kyber768 key generation in 79.6 ms, encapsulation in 102.4 ms and decapsulation in 132.7 ms.

A Survey of Polynomial Multiplication With RSA-ECC Coprocessors and Implementations of NIST PQC Round3 KEM Algorithms in Exynos2100

“…Algorithm 1 in Table 2, is pseudocode of the Kyber encryption algorithm. We refer to the algorithm that is based on Albrecht et al [7] without the NTT domain. χ n is a Centered Binomial Distribution (CBD) with an n-degree polynomial shape.…”

“…This section describes the research presented by Albrecht et al [7]. The main contribution of this paper is using KS combined with low-degree polynomials, using Karatsuba-based polynomial multiplication and KS1 and KS2 on SLE78 [24].…”

“…However, subtraction by Software can have very high-cost compared with that of a hardware coprocessor. Albrecht et al [7] use modular multiplication using an RSA coprocessor by evaluating 2 l of KS f (2 l ) × g(2 l ) mod (2 l×256 + 1).…”

“…Step (A) is regarded not to be an even operation, and Albrecht et al [7] calls step (B) SNORT, and step(D) SNEEZE. In a real-world implementation, the process in detail is as below, (A) Polynomial separation of k polynomials -Changing the order of polynomial coefficients using equation (6).…”

“…In a real-world implementation, the process in detail would be as shown below, (A) Evaluation by 2 l for KS -This is also considered evaluation by 2 l , but unlike DM [7], it needs t different type of evaluations. It is not neglect able time-consumption.…”