Efficient FPGA Implementations of LowMC and Picnic

Kales, Daniel; Ramacher, Sebastian; Rechberger, Christian; Walch, Roman; Werner, Mario

doi:10.1007/978-3-030-40186-3_18

Cited by 11 publications

(6 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In Table 4, we compare results for our fastest unrolled architecture with the results for the optimized high-speed architecture reported in [13]. Since only the results for Kintex-7 are reported in [13], we regenerated our results targeting the same device of the same family. At the cost of allowing the use of 64 vs. 0 BRAMs, our architecture uses 4.5 times less LUTs, and 2.4 times fewer slices.…”

Section: Analysis Of Resultsmentioning

confidence: 99%

“…In [13], LowMC is used as an One-Way Function (OWF) within the post-quantum cryptography (PQC) digital signature scheme Picnic. Considering that three instances of LowMC are required to implement Picnic, it is quite important to reduce and balance the number of required FPGA resources.…”

Section: Analysis Of Resultsmentioning

confidence: 99%

“…To the best of our knowledge, two hardware implementations of the LowMC block cipher have been reported to date [13]. One of these implementations follows the cipher's specification directly.…”

Section: Previous Work 21 Hardware Implementations Of Lowmcmentioning

confidence: 99%

“…However, doing that would dramatically increase the number of LUTs required by the implementation. A similar approach, with some additional optimizations is reported in [13].…”

Section: Algorithm 2 Unrolled Lowmc Pseudocodementioning

confidence: 99%

“…LowMC is a good candidate for such a cipher due to its low multiplicative complexity, which translates to a small number of AND gates required to implement this cipher. For instance, for the security level of 128 bits, LowMC requires 861 AND gates for full security [13]. For comparison, Simon requires 4352 [3], Fantomas 2112 [11], and Kreyvium 1537 AND gates [5].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Lightweight Implementation of the LowMC Block Cipher Protected Against Side-Channel Attacks

Bahrami

Dang

Abdulgadir

et al. 2020

Proceedings of the 4th ACM Workshop on Attacks and Solutions in Hardware Security

View full text Add to dashboard Cite

LowMC is a parameterizable block cipher developed for use in Multi-Party Computation (MPC) and Fully Homomorphic Encryption (FHE). In these applications, linear operations are much less expensive in terms of resource utilization compared to the nonlinear operations due to their low multiplicative complexity. In this work, we implemented two versions of LowMC-unrolled and lightweight. Both implementations are realized using RTL VHDL. To the best of our knowledge, we report the first lightweight implementation of LowMC and the first implementation protected against side-channel analysis (SCA). For the SCA protection, we used a hybrid 2/3 shares Threshold Implementation (TI) approach, and for the evaluation, the Test Vector Leakage Assessment (TVLA) method, also known as the T-test. Our unprotected implementations show information leakage at 10K traces, and after protection, they could successfully pass the T-test for 1 million traces. The Xilinx Vivado is used for the synthesis, implementation, functional verification, timing analysis, and programming of the FPGA. The target FPGA family is Artix-7, selected due to its widespread use in multiple applications. Based on our results, the numbers of LUTs are 867 and 3,328 for the lightweight and the unrolled architecture with unrolling factor = 16, respectively. It takes 14.21 s for the lightweight architecture and 1.29 s for the unrolled design with = 16 to generate one 128-bit block of the ciphertext. The fully unrolled architecture beats the best previous implementation by Kales et al. in terms of the number of LUTs by a factor of 4.5. However, this advantage comes at the cost of having 2.9 higher latency.

show abstract

Section: Analysis Of Resultsmentioning

confidence: 99%

Section: Analysis Of Resultsmentioning

confidence: 99%

Section: Previous Work 21 Hardware Implementations Of Lowmcmentioning

confidence: 99%

“…However, doing that would dramatically increase the number of LUTs required by the implementation. A similar approach, with some additional optimizations is reported in [13].…”

Section: Algorithm 2 Unrolled Lowmc Pseudocodementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Lightweight Implementation of the LowMC Block Cipher Protected Against Side-Channel Attacks

Bahrami

Dang

Abdulgadir

et al. 2020

Proceedings of the 4th ACM Workshop on Attacks and Solutions in Hardware Security

View full text Add to dashboard Cite

show abstract

Hardware acceleration of number theoretic transform for zk‐SNARK

Zhao

Ding

Wang

et al. 2023

Engineering Reports

View full text Add to dashboard Cite

Zk‐SNARK unleashes the great potential of ZKP (zero‐knowledge proof) in the blockchain, distributed storage, and so forth. However, the proof‐generation of zk‐SNARK is excessively time intensive, making it a challenge to deploy a high‐performance zk‐SNARK in most real applications. As a result, NTT (Number Theoretic Transform), one of the most time‐consuming parts in proof‐generation, needs to be accelerated significantly. To address this issue, we propose a novel and efficient “data reordering" technique to enable a highly pipelined architecture, on which an FPGA‐based hardware accelerator is designed to support the large‐bitwidth and large‐scale NTT tasks in zk‐SNARK. This two‐level pipelined architecture can effectively reduce the data dependency and memory access requirements, meanwhile, can be flexibly scaled to different scales of FPGAs. To balance computing efficiency and flexibility, the OpenCL equipped with HLS is used to implement the heterogeneous acceleration system. We prototype the accelerator on the AMD‐Xilinx Alveo U50 card (UltraScale+ XCU50 FPGA). The evaluation results show that (1) our accelerator shows high scalability for different scales of FPGAs with a stable performance improvement; (2) it performs 1.95 faster than the one in PipeZK; (3) and it achieves 27.98 , 1.74 speedup and 6.9 , 6 energy efficiency improvement than AMD Ryzen 9 5900X single core and 12 cores respectively when integrated into the well‐known ZKP open‐source project, Bellman.

show abstract