Improving Software Quality in Cryptography Standardization Projects

Kannwischer, Matthias J.; Schwabe, Peter; Stebila, Douglas; Wiggers, Thom

doi:10.1109/eurospw55150.2022.00010

Cited by 21 publications

(11 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On Ice Lake, the same implementation benefits from the double AES-NI throughput and achieves 0.32 cpb. Since SHAKE256 performance has only a marginal impact in MAYO, we use a plain non-optimized C implementation derived from PQClean [KSSW22].…”

Section: Avx2 Performancementioning

confidence: 99%

Nibbling MAYO: Optimized Implementations for AVX2 and Cortex-M4

Beullens,

Campos,

Celi

et al. 2024

TCHES

View full text Add to dashboard Cite

MAYO is a popular high-calorie condiment as well as an auspicious candidate in the ongoing NIST competition for additional post-quantum signature schemes achieving competitive signature and public key sizes. In this work, we present high-speed implementations of MAYO using the AVX2 and Armv7E-M instruction sets targeting recent x86 platforms and the Arm Cortex-M4. Moreover, the main contribution of our work is showing that MAYO can be even faster when switching from a bitsliced representation of keys to a nibble-sliced representation. While the bitsliced representation was primarily motivated by faster arithmetic on microcontrollers, we show that it is not necessary for achieving high performance on Cortex-M4. On Cortex-M4, we instead propose to implement the large matrix multiplications of MAYO using the Method of the Four Russians (M4R), which allows us to achieve better performance than when using the bitsliced approach. This results in up to 21% faster signing. For AVX2, the change in representation allows us to implement the arithmetic much faster using shuffle instructions. Signing takes up to 3.2x fewer cycles and key generation and verification enjoy similar speedups. This shows that MAYO is competitive with lattice-based signature schemes on x86 CPUs, and a factor of 2-6 slower than lattice-based signature schemes on Cortex-M4 (which can still be considered competitive).

show abstract

Section: Avx2 Performancementioning

confidence: 99%

Nibbling MAYO: Optimized Implementations for AVX2 and Cortex-M4

Beullens,

Campos,

Celi

et al. 2024

TCHES

View full text Add to dashboard Cite

show abstract

“…are optimized with the proposed SIMD instructions whenever parallelism can be easily achieved. Our implementations are based on PQClean [KSSW22], where Power2round and Decompose are computed by additions, shiftings, and several logic operations. Operations that are difficult to parallelize are not optimized using the proposed SIMD instructions.…”

Section: Other Polynomial Operationsmentioning

confidence: 99%

A Highly-efficient Lattice-based Post-Quantum Cryptography Processor for IoT Applications

Ye,

Song,

Zhang

et al. 2024

TCHES

View full text Add to dashboard Cite

Lattice-Based Cryptography (LBC) schemes, like CRYSTALS-Kyber and CRYSTALS-Dilithium, have been selected to be standardized in the NIST Post-Quantum Cryptography standard. However, implementing these schemes in resourceconstrained Internet-of-Things (IoT) devices is challenging, considering efficiency, power consumption, area overhead, and flexibility to support various operations and parameter settings. Some existing ASIC designs that prioritize lower power and area can not achieve optimal performance efficiency, which are not practical for battery-powered devices. Custom hardware accelerators in prior co-processor and processor designs have limited applications and flexibility, incurring significant area and power overheads for IoT devices. To address these challenges, this paper presents an efficient lattice-based cryptography processor with customized Single-Instruction-Multiple-Data (SIMD) instruction. First, our proposed SIMD architecture supports efficient parallel execution of various polynomial operations in 256-bit mode and acceleration of Keccak in 320-bit mode, both utilizing efficiently reused resources. Additionally, we introduce data shuffling hardware units to resolve data dependencies within SIMD data. To further enhance performance, we design a dual-issue path for memory accesses and corresponding software design methodologies to reduce the impact of data load/store blocking. Through a hardware/software co-design approach, our proposed processor achieves high efficiency in supporting all operations in lattice-based cryptography schemes. Evaluations of Kyber and Dilithium show our proposed processor achieves over 10x speedup compared with the baseline RISC-V processor and over 5x speedup versus ARM Cortex M4 implementations, making it a promising solution for securing IoT communications and storage. Moreover, Silicon synthesis results show our design can run at 200 MHz with 2.01 mW for Kyber KEM 512 and 2.13 mW for Dilithium 2, which outperforms state-of-the-art works in terms of PPAP (Performance x Power x Area).

show abstract

“…Dilithium: Dilithium [62] is a post-quantum signature scheme and one of the selected algorithms in NIST's process of standardizing post-quantum cryptographic implementations. The reference implementation 12 of Dilithium from [63] provides the core functionality needed from a digital signature scheme, and needs a wrapper (c.f. Listing 1) to invoke the core functions within the library.…”

Section: B Characterizing Address Bus Faultsmentioning

confidence: 99%

Faults in Our Bus: Novel Bus Fault Attack to Break ARM TrustZone

Mishra,

Chakraborty,

Mukhopadhyay

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The ever-increasing growth of Internet-of-Things (IoT) has led to wide-scale deployment of high-frequency, highly complex Systems-on-a-Chip (SoCs), which are capable of running a full-fledged operating system (OS). The presence of OS and other software countermeasures make SoCs resilient against the traditional fault attacks that are relevant on FPGAs and microprocessors. In this work, we present the first practical implications of targeting an orthogonal aspect of SoC's architecture: the system bus. We inject electromagnetic pulses onto the system bus during the execution of instructions involving processor-memory interaction. We show how address bus faults compromise software implementations of masked implementations of ciphers, illustrated using implementations of state-of-theart post-quantum cryptography (PQC) schemes, leaking entire secret keys with a single fault. We also demonstrate that data bus faults can be controlled and exploited to launch Differential Fault Analysis (DFA) attacks on table-based implementation of the Advanced Encryption Standard (AES). Furthermore, we demonstrate that the impact of such bus faults can be farreaching and mislead the security guarantees of the popular and widely used ARM TrustZone. We use data-bus faults (along with loopholes in the GlobalPlatform API specification) to mislead the signature verification step to load a malicious Trusted Application (TA) inside the TrustZone. We follow this up with address bus faults to steal symmetric encryption keys of other benign TAs in the system, leading to complete breakdown of security on TrustZone. We note that since the attack relies upon loopholes in the GlobalPlatform API specification, it is portable to any TEE following this specification. To emphasize upon this portability of the attack, we demonstrate successful installation of malicious TAs on two TrustZone implementations (OP-TEE and MyTEE) on two different platforms (Raspberry Pi 3 and Raspberry Pi 4). Finally, we propose countermeasures that can be integrated into the SoC environment to defend against these attack vectors.

show abstract

Improving Software Quality in Cryptography Standardization Projects

Cited by 21 publications

References 30 publications

Nibbling MAYO: Optimized Implementations for AVX2 and Cortex-M4

Nibbling MAYO: Optimized Implementations for AVX2 and Cortex-M4

A Highly-efficient Lattice-based Post-Quantum Cryptography Processor for IoT Applications

Faults in Our Bus: Novel Bus Fault Attack to Break ARM TrustZone

Contact Info

Product

Resources

About