A Compact Hardware Implementation of CCA-Secure Key Exchange Mechanism CRYSTALS-KYBER on FPGA

Xing, Yufei; Li, Shuguo

doi:10.46586/tches.v2021.i2.328-356

Cited by 121 publications

(76 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…At the submission time of this paper, our architectures generated using HLS lead to comparable, and sometimes better, results compared to the best references from the state of the art using HDL (such as [20], [19], [31], [25]) but probably for a much smaller design effort. Recent HDL based solutions (such as [36], [35]) are faster and smaller than ours. We showed how HLS can be used effectively to parallelize implementations.…”

Section: Discussionmentioning

confidence: 83%

See 1 more Smart Citation

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

Zijlstra¹,

Bigou²,

Tisserand³

2021

IEEE Trans. Comput.

View full text Add to dashboard Cite

This paper deals with hardware implementations for lattice-based cryptography. Various CPA and CCA secure algorithms for LWE, RLWE and MLWE problems have been studied, parallelized, implemented and compared on FPGA using high-level synthesis. The impact of PRNG choices on the implementations performances and costs is also evaluated. HLS allows us to compare various sets of algorithms, architectures and parameters with a reduced design effort. Our results are often similar to state-of-the-art for various speed and cost trade-offs. Sometimes we obtain better results thanks to the exploration of numerous architecture and algorithm optimizations.

show abstract

Section: Discussionmentioning

confidence: 83%

“…For MLWE-1024 on Artix-7 FPGAs, our solution is slower (116µs vs. 67.9µs) and larger (factor 5) than [35] (published after our initial submission). Using the same HLS code, we are able to get a much faster solution on a more efficient FPGA (UltraScale+).…”

Section: Comparison With Other Workmentioning

confidence: 91%

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

Zijlstra¹,

Bigou²,

Tisserand³

2021

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…It reduces the computation complexity by merging the 2N -th primitive roots of unity and scale factor into every stage. [XL21] and [POG15] avoid the bit-reversed cost by changing the loop structure of decimation in time (DIT) and decimation in frequency (DIF) radix-2 NTT. This method is also adopted by the reference software implementation of Kyber published by NIST.…”

Section: Related Workmentioning

confidence: 99%

“…end for 15: end for 16: return A further removed by rearranging the loop structure [XL21]. The complete bit-reversed-free radix-2 iterative NTT with low complexity is presented in algorithm 1, where the twiddle factors ω can be precomputed and stored in the ROM.…”

Section: Ntt-based Multiplication Algorithmmentioning

confidence: 99%

CFNTT: Scalable Radix-2/4 NTT Multiplication Architecture with an Efficient Conflict-free Memory Mapping Scheme

Chen

Yang

Yin

et al. 2021

TCHES

View full text Add to dashboard Cite

Number theoretic transform (NTT) is widely utilized to speed up polynomial multiplication, which is the critical computation bottleneck in a lot of cryptographic algorithms like lattice-based post-quantum cryptography (PQC) and homomorphic encryption (HE). One of the tendency for NTT hardware architecture is to support diverse security parameters and meet resource constraints on different computing platforms. Thus flexibility and Area-Time Product (ATP) become two crucial metrics in NTT hardware design. The flexibility of NTT in terms of different vector sizes and moduli can be obtained directly. Whereas the varying strides in memory access of in-place NTT render the design for different radix and number of parallel butterfly units a tough problem. This paper proposes an efficient conflict-free memory mapping scheme that supports the configuration for both multiple parallel butterfly units and arbitrary radix of NTT. Compared to other approaches, this scheme owns broader applicability and facilitates the parallelization of non-radix-2 NTT hardware design. Based on this scheme, we propose a scalable radix-2 and radix-4 NTT multiplication architecture by algorithm-hardware co-design. A dedicated schedule method is leveraged to reduce the number of modular additions/subtractions and modular multiplications in radix-4 butterfly unit by 20% and 33%, respectively. To avoid the bit-reversed cost and save memory footprint in arbitrary radix NTT/INTT, we put forward a general method by rearranging the loop structure and reusing the twiddle factors. The hardware-level optimization is achieved by excavating the symmetric operators in radix-4 butterfly unit, which saves almost 50% hardware resources compared to a straightforward implementation. Through experimental results and theoretical analysis, we point out that the radix-4 NTT with the same number of parallel butterfly units outperforms the radix-2 NTT in terms of area-time performance in the interleaved memory system. This advantage is enlarged when increasing the number of parallel butterfly units. For example, when processing 1024 14-bit points NTT with 8 parallel butterfly units, the ATP of LUT/FF/DSP/BRAM n radix-4 NTT core is approximately 2.2 × /1.2 × /1.1 × /1.9 × less than that of the radix-2 NTT core on a similar FPGA platform.

show abstract

“…3. Although altering q allowed other parametrizations, ring arithmetic over R q consistently represents a significant fraction of the effort involved in providing embedded implementations of Kyber [5,59]. Keeping the same ring R q as Kyber helps make Ilum512 fast and easy to deploy.…”

Section: New Parametrizationsmentioning

confidence: 99%

A Concrete Treatment of Efficient Continuous Group Key Agreement via Multi-Recipient PKEs

Hashimoto

Katsumata²,

Postlethwaite

et al. 2021

Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Continuous group key agreements (CGKAs) are a class of protocols that can provide strong security guarantees to secure group messaging protocols such as Signal and MLS. Protection against device compromise is provided by commit messages: at a regular rate, each group member may refresh their key material by uploading a commit message, which is then downloaded and processed by all the other members. In practice, propagating commit messages dominates the bandwidth consumption of existing CGKAs.We propose Chained CmPKE, a CGKA with an asymmetric bandwidth cost: in a group of N members, a commit message costs O(N ) to upload and O(1) to download, for a total bandwidth cost of O(N ). In contrast, TreeKEM [14,19,52] costs Ω(log N ) in both directions, for a total cost Ω(N log N ). Our protocol relies on generic primitives, and is therefore readily post-quantum.We go one step further and propose post-quantum primitives that are tailored to Chained CmPKE, which allows us to cut the growth rate of uploaded commit messages by two or three orders of magnitude compared to naive instantiations. Finally, we realize a software implementation of Chained CmPKE. Our experiments show that even for groups with a size as large as N = 2 10 , commit messages can be computed and processed in less than 100 ms.

show abstract

A Compact Hardware Implementation of CCA-Secure Key Exchange Mechanism CRYSTALS-KYBER on FPGA

Cited by 121 publications

References 11 publications

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

CFNTT: Scalable Radix-2/4 NTT Multiplication Architecture with an Efficient Conflict-free Memory Mapping Scheme

A Concrete Treatment of Efficient Continuous Group Key Agreement via Multi-Recipient PKEs

Contact Info

Product

Resources

About