Ring-LWE on 8-Bit AVR Embedded Processor

Seo, Hwajeong; Kwon, Hyeokdong; Kwon, Yong-Been; Choi, Seungju; Kim, Hyun-Jun

doi:10.1007/978-3-030-39303-8_24

Cited by 1 publication

(2 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, we extended our previous work published in WISA'19 [31]. In the previous work, only Ring-LWE implementations for long term security level (256-bit) were investigated.…”

Section: Extended Version Of Wisa'19mentioning

confidence: 98%

See 1 more Smart Citation

Fast Number Theoretic Transform for Ring-LWE on 8-bit AVR Embedded Processor

Seo

Kwon

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

In this paper, we optimized Number Theoretic Transform (NTT) and random sampling operations on low-end 8-bit AVR microcontrollers. We focused on the optimized modular multiplication with secure countermeasure (i.e., constant timing), which ensures high performance and prevents timing attack and simple power analysis. In particular, we presented combined Look-Up Table (LUT)-based fast reduction techniques in a regular fashion. This novel approach only requires two times of LUT access to perform the whole modular reduction routine. The implementation is carefully written in assembly language, which reduces the number of memory access and function call routines. With LUT-based optimization techniques, proposed NTT implementations outperform the previous best results by 9.0% and 14.6% for 128-bit security level and 256-bit security level, respectively. Furthermore, we adopted the most optimized AES software implementation to improve the performance of pseudo random number generation for random sampling operation. The encryption of AES-256 counter (CTR) mode used for random number generator requires only 3184 clock cycles for 128-bit data input, which is 9.5% faster than previous state-of-art results. Finally, proposed methods are applied to the whole process of Ring-LWE key scheduling and encryption operations, which require only 524,211 and 659,603 clock cycles for 128-bit security level, respectively. For the key generation of 256-bit security level, 1,325,171 and 1,775,475 clock cycles are required for H/W and S/W AES-based implementations, respectively. For the encryption of 256-bit security level, 1,430,601 and 2,042,474 clock cycles are required for H/W and S/W AES-based implementations, respectively.

show abstract

“…In this paper, we extended our previous work published in WISA'19 [31]. In the previous work, only Ring-LWE implementations for long term security level (256-bit) were investigated.…”

Section: Extended Version Of Wisa'19mentioning

confidence: 98%

“…This is the first approach to utilize the LUT for reduction. Recently, in WISA '19,Seo et al presented novel LUT-based modular reduction method [31]. Unlike the previous work in [30], this approach only requires two times of LUT access to perform the modular reduction by modifying the input value.…”

Section: Introductionmentioning

confidence: 99%