On Using RSA/ECC Coprocessor for Ideal Lattice-Based Key Exchange

Abstract

Polynomial multiplication is one of the most costly operations of ideal lattice-based cryptosystems. In this work, we study its optimizations when one of the operands has coefficients close to 0. We focus on this structure since it is at the core of lattice-based Key Encapsulation Mechanisms submitted to the NIST call for post-quantum cryptography. In particular, we propose optimization of this operation for embedded devices by using a RSA/ECC coprocessor that provides efficient and secure large-integer arithmetic. In this context, we compare Kronecker Substitution, already studied in [AHH + 19], with two specific algorithms that we introduce: KSV, a variant of this substitution, and an adaptation of the schoolbook multiplication, denoted Shift&Add. All these algorithms rely on the transformation of polynomial multiplication to large-integer arithmetic. Then, thanks to these algorithms, existing secure coprocessors dedicated to large-integer can be re-purposed in order to speed-up post-quantum schemes. The efficiency of these algorithms depends on the component specifications and the cryptosystem parameters set. Thus, we establish a methodology to determine which algorithm to use, for a given component, by only implementing basic large-integer operations. Moreover, the three algorithms are assessed on a chip ensuring that the theoretical methodology matches with practical results.

Kavach: Lightweight masking techniques for polynomial arithmetic in lattice-based cryptography

“…Since these are widely deployed, they are an attractive target for implementing PQC (especially when retrofitting PQC into existing systems). Non-masked implementations for Saber and Kyber have been proposed in [GMR21], using the Kronecker substitution method, and the most efficient variants exploit the property that one of the polynomials involved in the product always has small coefficients, both for NTT-friendly and unfriendly rings. Our hybrid gadgets (e.g.…”

“…Our hybrid gadgets (e.g. HybridLinV or HybridPolMul) could therefore be used, and they can simply use the algorithms of [GMR21] for the polynomial multiplication. For the MskMux (Algorithm 5) part of these gadgets, many possible software implementations depend on the available instructions: the most natural solution is the use of a conditional move instruction, but arithmetic solutions are also possible (using 0/1 multiplications, then additions), or even using the bitwise logical operations (emulating our hardware implementation).…”

Post‐quantum cryptography techniques for secure communication in resource‐constrained Internet of Things devices: A comprehensive survey

“…The proposed post-quantum lattice-based RSA (LB-RSA) was developed for IoT applications and validated in 60 dimensions. A new optimization approach for the polynomial multiplication of ideal lattice-based cryptosystems is proposed by Greuet et al 102 The RSA/ECC coprocessor is used to optimize the costly polynomial multiplication operation for embedded devices to provide security for larger integer arithmetic. In order to improve information security, a new crypto-Stegano architecture is presented by Kurniawan and Satrya.…”