Optimized and Scalable Co-Processor for McEliece with Binary Goppa Codes

Abstract

Asymmetric cryptographic primitives are essential to enable secure communications in public networks or public mediums. Such primitives can be deployed as software libraries or hardware co-processors, the latter being more commonly employed in systems on chip (SoC) scenarios, embedded devices, or application-specific servers. Unfortunately, the most commonly available solutions, based on RSA or elliptic curve cryptography (ECC), are highly processing intensive due to the underlying extended-precision modular arithmetic. Consequently, they are not available on highly constrained platforms. Aiming to tackle this issue, we here investigate an alternative asymmetric encryption scheme that relies on lightweight arithmetic: McEliece. This scheme is especially appealing because, being based on error correction codes, it displays a simpler arithmetic and leads to better performance when compared to RSA or ECC. To evaluate the implementation of this scheme in hardware, we propose and analyze a flexible architecture whose security level and time versus area usage characteristics can be reconfigured as desired. The proposed architecture is suitable to all usual security levels, ranging from 80 to 256 bits. It is also very efficient, being able to perform data decryption with binary Goppa codes in 56µs with 3,402 slices on a Xilinx Spartan-3AN FPGA, whereas the best-known result in the literature for the same FPGA is 115µs with 7,331 slices. Alternatively, the architecture can operate with quasi-dyadic Goppa (QD-Goppa) codes, which involves smaller keys than traditional binary Goppa codes. In the latter case, for an 80-bit security level, the decryption operation can take from 1.1ms with 1,129 slices to 68µs with 8,268 sices. By choosing a more hardware-friendly decoding algorithm, focusing hardware resources on most bottleneck operations and sharing hardware resource for two different algorithms, better results than the those in the literature were obtained.

Code-Based Cryptography With Generalized Concatenated Codes for Restricted Error Values

“…A comparison to the QC-MDPC decoder from [23] showed that the proposed GC decoder is three times faster and requires less than 1% of the logic of the QC-MDPC decoder for the same security category. Similarly, the GC decoder outperforms the decoder for binary Goppa codes from [24] for the same security level. In [24], several implementations were proposed, where the one with the lowest area requirements needs about 2.5 times more logic and the number of clock cycles is about 8 times higher compared to the GC decoder.…”

“…Similarly, the GC decoder outperforms the decoder for binary Goppa codes from [24] for the same security level. In [24], several implementations were proposed, where the one with the lowest area requirements needs about 2.5 times more logic and the number of clock cycles is about 8 times higher compared to the GC decoder.…”

“…Depending on the application, this may be undesirable. Furthermore, the complexity of LDPC decoders [23] is significantly higher than for comparable decoders for binary Goppa codes [24].…”

Efficient ASIC Architecture for Low Latency Classic McEliece Decoding

“…Various algorithms are available for solving the key equation of binary Goppa codes. Since Goppa codes are a sub-class of alternant codes, algorithms designed for alternant codes can be utilized in the decoding process of Goppa codes [MBR15]. However, when applying algorithms, which were not specifically designed for Goppa codes, only t/2 errors can be corrected directly, while the Classic McEliece KEM requires a correction capability of t errors.…”

“…Note, that the combined double-sized syndrome computation and polynomial evaluation approach was developed independently from another implementation, which also combines these two operations[MBR15]. However, the implementation of Massolino et al employs a different dataflow and does not consider interleaving of syndrome and error-locator polynomial computations.…”