A Practical Implementation of Identity-Based Encryption Over NTRU Lattices

McCarthy, Sarah; Smyth, Neil; O’Sullivan, Elizabeth

doi:10.1007/978-3-319-71045-7_12

Cited by 22 publications

(7 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unlike classical public key cryptography, Ring-LWE parameter selection is a complex task because of the multitude of parameters involved and their varying effects on security, efficiency and correctness of the encryption scheme. Concrete parameters for the DLP-IBE scheme were proposed in [9], [10], [11] for 80-bit and 192-bit security. In this work, we target 128-bit security level, where n = 1024 and q ≈ 2 23 , as recommended in [9] and [10].…”

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

“…Concrete parameters for the DLP-IBE scheme were proposed in [9], [10], [11] for 80-bit and 192-bit security. In this work, we target 128-bit security level, where n = 1024 and q ≈ 2 23 , as recommended in [9] and [10]. To ensure that prime q allows efficient modular multiplication, we choose q = 8380417 = 2 23 − 2 13 + 1 which supports fast Barrett reduction due to its special structure [14].…”

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

“…There is slight reduction in security of the IBE scheme compared to using the uniform distribution, but it still remains well above our target 128-bit security level. Finally, we summarize the sizes of the master public key and the ciphertext for both CPA-secure and CCA-secure IBE schemes with our proposed parameters: where the ciphertext compression parameter is set to l = 18, similar to [10]. The size of the public key is n log 2 q bits, while the ciphertext is n (2 log 2 q − l) + mlen and n (2 log 2 q − l) + mlen + hlen bits long for the CPA-secure and CCA-secure IBE schemes respectively, with mlen = 1024 bits and hlen = 256 bits.…”

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

See 2 more Smart Citations

Efficient Post-Quantum TLS Handshakes using Identity-Based Key Exchange from Lattices

Banerjee

Chandrakasan

2020

ICC 2020 - 2020 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Identity-Based Encryption (IBE) is considered an alternative to traditional certificate-based public key cryptography to reduce communication overheads in wireless sensor networks. In this work, we build on the well-known latticebased DLP-IBE scheme to construct an ID-based certificateless authenticated key exchange for post-quantum Transport Layer Security (TLS) handshakes. We also propose concrete parameters for the underlying lattice computations and provide detailed implementation results. Finally, we compare the combined computation and communication cost of our ID-based certificate-less handshake with the traditional certificate-based handshake, both using lattice-based algorithms at similar postquantum security levels, and show that our ID-based handshake is 3.7× more energy-efficient, thus highlighting the advantage of ID-based key exchange for post-quantum TLS.

show abstract

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

Section: Selection Of Efficient and Secure Parametersmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Post-Quantum TLS Handshakes using Identity-Based Key Exchange from Lattices

Banerjee

Chandrakasan

2020

ICC 2020 - 2020 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

show abstract

“…Aside from the original implementations of DLP and Falcon, which are the focus of this paper, several others have appeared in the literature. However, they usually do not aim for side-channel security [36,41] or only make the base discrete Gaussian sampler (with fixed standard deviation) constant time [29], but do not eliminate the leakage of the varying standard deviations. As a result, those implementations are also vulnerable to the attacks of this paper.…”

Section: Related Workmentioning

confidence: 99%

Key Recovery from Gram–Schmidt Norm Leakage in Hash-and-Sign Signatures over NTRU Lattices

Fouque

Kirchner

Tibouchi

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we initiate the study of side-channel leakage in hash-and-sign lattice-based signatures, with particular emphasis on the two efficient implementations of the original GPV lattice-trapdoor paradigm for signatures, namely NIST second-round candidate Falcon and its simpler predecessor DLP. Both of these schemes implement the GPV signature scheme over NTRU lattices, achieving great speed-ups over the general lattice case. Our results are mainly threefold.First, we identify a specific source of side-channel leakage in most implementations of those schemes, namely, the one-dimensional Gaussian sampling steps within lattice Gaussian sampling. It turns out that the implementations of these steps often leak the Gram-Schmidt norms of the secret lattice basis.Second, we elucidate the link between this leakage and the secret key, by showing that the entire secret key can be efficiently reconstructed solely from those Gram-Schmidt norms. The result makes heavy use of the algebraic structure of the corresponding schemes, which work over a power-of-two cyclotomic field.Third, we concretely demonstrate the side-channel attack against DLP (but not Falcon due to the different structures of the two schemes). The challenge is that timing information only provides an approximation of the Gram-Schmidt norms, so our algebraic recovery technique needs to be combined with pruned tree search in order to apply it to approximate values. Experimentally, we show that around 2 35 DLP traces are enough to reconstruct the entire key with good probability.

show abstract

“…In their paper, they proposed AVX2 implementation and performance of CRYSTALS-Kyber. The McCarthy method [20] proposed a practical implementation of identity-based encryption over NTRU lattice-based cryptography on an Intel Core i7-6700 CPU. They optimized the DLP-IBE and Gaussian sampler for efficient implementation.…”

Section: Related Studies On Efficient Implementation Of Lattice-mentioning

confidence: 99%

Efficient Parallel Implementation of Matrix Multiplication for Lattice-Based Cryptography on Modern ARM Processor

Park

Seo

Kim³

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Recently, various types of postquantum cryptography algorithms have been proposed for the National Institute of Standards and Technology’s Postquantum Cryptography Standardization competition. Lattice-based cryptography, which is based on Learning with Errors, is based on matrix multiplication. A large-size matrix multiplication requires a long execution time for key generation, encryption, and decryption. In this paper, we propose an efficient parallel implementation of matrix multiplication and vector addition with matrix transpose using ARM NEON instructions on ARM Cortex-A platforms. The proposed method achieves performance enhancements of 36.93%, 6.95%, 32.92%, and 7.66%. The optimized method is applied to the Lizard. CCA key generation step enhances the performance by 7.04%, 3.66%, 7.57%, and 9.32% over previous state-of-the-art implementations.

show abstract

A Practical Implementation of Identity-Based Encryption Over NTRU Lattices

Cited by 22 publications

References 23 publications

Efficient Post-Quantum TLS Handshakes using Identity-Based Key Exchange from Lattices

Efficient Post-Quantum TLS Handshakes using Identity-Based Key Exchange from Lattices

Key Recovery from Gram–Schmidt Norm Leakage in Hash-and-Sign Signatures over NTRU Lattices

Efficient Parallel Implementation of Matrix Multiplication for Lattice-Based Cryptography on Modern ARM Processor

Contact Info

Product

Resources

About