On Constrained Implementation of Lattice-Based Cryptographic Primitives and Schemes on Smart Cards

Abstract

Abstract. Most lattice-based cryptographic schemes with a security proof suffer from large key sizes and heavy computations. This is also true for the simpler case of authentication protocols which are used on smart cards, as a very-constrained computing environment. Recent progress on ideal lattices has significantly improved the efficiency, and made it possible to implement practical lattice-based cryptography on constrained devices. However, to the best of our knowledge, no previous attempts were made to implement lattice-based schemes on smart cards. In this paper, we provide the results of our implementation of several state-of-the-art lattice-based authentication protocols on smart cards and a microcontroller widely used in smart cards. Our results show that only a few of the proposed lattice-based authentication protocols can be implemented using limited resources of such constrained devices, however, cutting-edge ones are suitably efficient to be used practically on smart cards. Moreover, we have implemented fast Fourier transform (FFT) and discrete Gaussian sampling with different typical parameter sets, as well as versatile lattice-based public-key encryptions. These results have noticeable points which help to design or optimize lattice-based schemes for constrained devices.

Efficient implementation of ideal lattice-based cryptography

“…In Chapter 5 we discuss decryption errors and two hardware designs optimized for performance and area, respectively. Implementations of RLWEenc on the 8-bit ATxmega and ATmega family of microcontrollers have been proposed in [BSJ14,BJ14] and an implementation on a Cortex-M4F device is given in [dCRVV15] …”

“…However, a straightforward implementation using the C %-operator with a constant modulus is quite expensive and requires around 600 cycles in our own experiments due to the generic libc modular reduction (call __udivmodsi4). As a consequence, the software of the authors of [BSJ14] still consumes approx. Another approach is a subtract-and-shift algorithm which loads the shifted modulus as constant and the input into a temporary register.…”

“…11. A comparison between our implementation of BLISS-I and the implementations of [BSJ14] and [BJ14] is difficult since the authors implemented the signature as authentication protocol. Therefore, they only provide the runtime of a complete protocol run that corresponds to one signing operation and one verification in our results, but without the expensive hashing as the sparse polynomial c is not obtained from a random oracle but randomly generated by the other protocol party.…”

“…However, our implementations of BLISS sign and BLISS verify still require less cycles than their implementation. The biggest improvement stems from the usage of the CDT using convolutions and Kullback-Leibler divergence (see Section 2.5.4) which is superior (1,140,600 cycles per poly-nomial) compared to the Bernoulli approach (13,151,929 cycles per polynomial [BSJ14]) and the straight-forward CDT approach used in [BJ14]. As our implementation of BLISS-I needs 18,802 bytes of flash memory, it is also smaller than the implementation of [BJ14] that requires 66.5 kB of flash memory and the implementation of [BSJ14] that needs 25.1 kB of flash memory.…”

“…Many operations on small coefficients of size less than 16 bits can presumably be easier processed on an 8-bit architecture than the multiprecision arithmetic required for RSA and ECC. However, so far only few works like [BSJ14,BJ14] cover the implementation of lattice-based cryptography on constrained 8-bit architectures. It is also worth mentioning that current works dealing with high performance implementation of ideal lattice-based cryptography usually rely on the straightforward Cooley-Tukey (CT) radix-2 decimation-in-time (DIT) NTT algorithm (e.g., [PDG14a, BSJ14, RVM + 14, dCRVV15]).…”