Compact domain-specific co-processor for accelerating module lattice-based KEM

Abstract

We present a domain-specific co-processor to speed up Saber, a post-quantum key encapsulation mechanism competing on the NIST Post-Quantum Cryptography standardization process. Contrary to most lattice-based schemes, Saber doesn't use NTT-based polynomial multiplication. We follow a hardwaresoftware co-design approach: the execution is performed on an ARM core and only the most computationally expensive operation, i.e., polynomial multiplication, is offloaded to the coprocessor to obtain a compact design. We exploit the idea of distributed computing at micro-architectural level together with novel algorithmic optimizations to achieve approximately a 6 times speedup with respect to optimized software at a small area cost.

A Unified Cryptoprocessor for Lattice-Based Signature and Key-Exchange

“…We consume 2× more area compared to [21] and deliver 3.5× better performance. Our unified cryptoprocessor outperforms [8], [9] and shows a similar performance compared to the architectures in [6], [7].…”

“…Our implementation is 2× slower but consumes 1.5× less area and provides the flexibility to do the operations in parallel or sequentially. Comparisons with Saber-only implementations: There are several works in the literature implementing Saber in hardware, e.g., [5], [6], [7], [8], [9], [24] on FPGA and [10], [11], [21], [23] on ASIC platforms. Their area and performance results along with our work are presented in Table 6.…”

“…Various works exist in the literature ( [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21]) that present optimized implementations of either a PKE/KEM or a signature scheme. While such works show how to implement a given PQC algorithm optimally, they do not take real-world applications (i.e., both PKE/KEM and signature) into consideration.…”

Hardware Design and Implementation of a Lightweight Saber Algorithm Based on DRC Method

“…A comparison of the time and power consumption of the back-end design completed using the TSMC 65 nm process with other post-quantum cryptographic algorithm hardware implementations is shown in Table 4. Study [10], study [11], and the current design all involve software/hardware implementations of the Saber algorithm. With the same flow of the algorithm, the comparison focuses on the power consumption and area of the algorithm implementation.…”

“…To further optimize the Saber algorithm, Sujoy et al [9] used vector processing instructions to process the algorithm operations in parallel, resulting in a nearly 1.5-fold increase in throughput, while increasing the latency of individual operations by a factor of about 3. In terms of hardware-software co-design, Mera et al [10] and Dang et al [11] used a hardware-software co-design strategy to allocate hardware-software resources for cryptographic algorithms through software algorithms, which can achieve high-speed and flexible cryptographic algorithms. Although hardware-software co-design has obvious advantages in terms of flexibility in algorithm implementation, there are still shortcomings in terms of latency and throughput, so hardware implementation of algorithms has become a research trend.…”