Saber on ARM

Abstract

The CCA-secure lattice-based post-quantum key encapsulation scheme Saber is a candidate in the NIST’s post-quantum cryptography standardization process. In this paper, we study the implementation aspects of Saber in resourceconstrained microcontrollers from the ARM Cortex-M series which are very popular for realizing IoT applications. In this work, we carefully optimize various parts of Saber for speed and memory. We exploit digital signal processing instructions and efficient memory access for a fast implementation of polynomial multiplication. We also use memory efficient Karatsuba and just-in-time strategy for generating the public matrix of the module lattice to reduce the memory footprint. We also show that our optimizations can be combined with each other seamlessly to provide various speed-memory trade-offs. Our speed optimized software takes just 1,147K, 1,444K, and 1,543K clock cycles on a Cortex-M4 platform for key generation, encapsulation and decapsulation respectively. Our memory efficient software takes 4,786K, 6,328K, and 7,509K clock cycles on an ultra resource-constrained Cortex-M0 platform for key generation, encapsulation, and decapsulation respectively while consuming only 6.2 KB of memory at most. These results show that lattice-based key encapsulation schemes are perfectly practical for securing IoT devices from quantum computing attacks.

Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols

“…Since Module-LWE algorithms involve working with vectors or matrices of polynomials, it is particularly important to ensure that these polynomials fit inside the crypto-processor memory as much as possible (because reads and writes to the internal memory through software are not cheap). When multiplying the public matrix A with the secret vector s, the matrix A is generated through rejection sampling, one row at a time, following the just-in-time approach from [55]. This reduces memory footprint so that the entire computation can fit in the polynomial cache.…”

“…The init instruction is used to initialize a specified polynomial with all zero coefficients. The matrix A is generated one row at a time, following a just-in-time approach [55] instead of generating and storing all the rows together, to save memory, which becomes especially useful when dealing with larger matrices such as in CRYSTALS-Kyber-1024 and CRYSTALS-Dilithium-IV. We have written a Perl script to parse such plain-text programs and convert them into 32-bit binary instructions which can be decoded by the Sapphire crypto-processor.…”

Feasibility Study of Post Quantum Cryptography in TLS 1.3

“…In particular, Botros et al [10] and Alkim et al [11] developed ARM Cortex-M4 implementations of Kyber. Karmakar et al [12] reported results for Saber. Chung et al [13] proposed an NTT-based implementation for an NTT-unfriendly ring, targeting Cortex-M4 and AVX2.…”

Hardware Design and Implementation of a Lightweight Saber Algorithm Based on DRC Method

“…Roy et al [12] implemented a high-speed dot matrix Saber algorithm on FPGA, with a running time of 61.4 µs at a clock frequency of 250 MHz. To meet the requirements of the Saber algorithm in resource-constrained situations, and to reduce the running time and power consumption of the algorithm hardware [13][14][15][16][17], there is an urgent need to study lightweight cryptographic algorithms. Based on this, this design constructs the algorithm model based on the official documentation [18] of the algorithm, and thus completes the full hardware implementation of Saber's algorithm.…”