RNS Arithmetic Approach in Lattice-Based Cryptography: Accelerating the "Rounding-off" Core Procedure

Abstract

Residue Number Systems (RNS) are naturally considered as an interesting candidate to provide efficient arithmetic for implementations of cryptosystems such as RSA, ECC (Elliptic Curve Cryptography), pairings, etc. More recently, RNS have been used to accelerate fully homomorphic encryption as lattice-based cryptogaphy. In this paper, we present an RNS algorithm resolving the Closest Vector Problem (CVP). This algorithm is particularly efficient for a certain class of lattice basis. It provides a full RNS Babai round-off procedure without any costly conversion into alternative positional number system such as Mixed Radix System (MRS). An optimized Cox-Rower architecture adapted to the proposed algorithm is also presented. The main modifications reside in the Rower unit whose feature is to use only one multiplier. This allows to free two out of three multipliers from the Rower unit by reusing the same one with an overhead of 3 more cycles per inner reduction. An analysis of feasibility of implementation within FPGA is also given.

RNS Approach in Lattice-Based Cryptography

“…no multiple of M 0 should appear in the residues of the output in base M), the base M 0 has to be large enough to completely represent the result. In further parts, different approaches and their consequences will be discussed [4,5].…”

“…The pure RNS approach deals with the procedures FastRnsModRed and GamRnsBabaiRO depicted in Algorithms 6 and 7, which have been implemented on FPGA [5]. The complexity analysis is summarized in Table 13.2.…”

Hybrid Position-Residues Number System

“…The RNS representation, proposed in the late 50s in [3], [4], is increasingly used for large modular arithmetic computations and asymmetric cryptography implementations, see for instance [11], [12], [13], [9], [14], [10], [8].…”

A Full RNS Variant of FV Like Somewhat Homomorphic Encryption Schemes

“…Lemma 2 enables an e cient and correct RNS rounding as long as k( 1 2 kvck q ) 1 ⇠ has the size of a modulus [4]. Concretely, one computes (3) t , it su ces that v satisfies the following bound:…”

“…And the rounding operation involves comparisons which require to switch from RNS to another positional system anyway, should it be a classical binary system or a mixed-radix one [12]. To provide an e cient RNS variant of Dec FV , we use an idea of [4]. To this end, we introduce relevant RNS tools.…”