Parameterized Hardware Accelerators for Lattice-Based Cryptography and Their Application to the HW/SW Co-Design of qTESLA Wen Wang , Shanquan Tian, Bernhard Jungk, Nina Bindel, Patrick Longa, and Jakub Szefer CHES 2020 – September 14, 2020
Outline • Yet another hardware design for a lattice-based scheme? • qTESLA • Hardware blocks • Binary-search CDT sampler • NTT-based polynomial multiplier • Software-hardware co-design on RISC-V • Evaluation 1
Yet another hardware design for a lattice-based scheme? 2
Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 3
Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 4
Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 5
Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 6
Our new lattice-based hardware design Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Fixed N/A co-design Our new design Fully Flexible Tunable Universal applicability Portable 7
Our new lattice-based hardware design ü Full acceleration Accelerator config. ü Flexible security parameters 32/64-bit Accelerator AMBA Bus ü Tunable hardware architecture config. ü Universal applicability to lattice- Accelerator based schemes config. ü Portable among different platforms 8
qTESLA 9
qTESLA Round 2 Reference C submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 10
qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 11
qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 12
qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ ü Simple arithmetic operations standardization liboqs library BouncyCastle library See qtesla.org 13
qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ ü Simple arithmetic operations standardization ü Provable-secure parameters liboqs library BouncyCastle Parameter set Public key size (in B) Signature size (in B) library qTESLA-p-I 14, 880 2, 592 qTESLA-p-III 38, 432 5, 664 See qtesla.org 14
qTESLA‘s sign and verify Signature generation Input: sk, m Output: signature z, c 15
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Output: signature z, c 16
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Output: signature z, c 17
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify Output: signature z, c 18
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify ü û Compute potential signature z = y + sc Output: signature z, c 19
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify ü û Compute potential signature z = y + sc Check to ensure security Output: signature z, c 20
qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c 21
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 22
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c - (pk, z, c, m) Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 23
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 24
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü ü Compute potential signature z = y + sc Check to ensure security Check security property û ü Output: signature z, c Output: or û ü 25
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü ü Compute potential signature z = y + sc Check to ensure security Check security property û ü ü Output: signature z, c Output: or û ü 26
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü û ü Compute potential signature z = y + sc Check to ensure security Check security property û û ü ü Output: signature z, c Output: or û ü 27
qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Simple operations: • Sampling Check c , = c ? Check to ensure acceptance during verify • Hashing û ü • Comparison û ü Compute potential signature z = y + sc • Multiplication and addition Check to ensure security Check security property û û ü ü Output: signature z, c Output: or û ü 28
Hardware blocks for lattice-based schemes 29
Lattice-based hardware blocks qTESLA Key Signing Verification generation Gauss Hash Poly. Sparse poly. sampler function Multiplication multiplication (4.5%) (39.4%) (27.9%) (6.3%) Respective subroutines (% of runtime) 30
Lattice-based hardware blocks • A unified hardware core for both SHAKE-128/256 and cSHAKE-128/256 • A novel, parameterized binary-search CDT sampler in hardware • A novel, fully pipelined NTT-based polynomial multiplier • A parameterized sparse polynomial multiplier qTESLA • A lightweight Hmax-Sum module Key Signing Verification generation Gauss Hash Poly. Sparse poly. sampler function Multiplication multiplication (4.5%) (39.4%) (27.9%) (6.3%) Respective subroutines (% of runtime) 31
Lattice-based hardware blocks • A unified hardware core for both SHAKE-128/256 and cSHAKE-128/256 • A novel, parameterized binary-search CDT sampler in hardware • A novel, fully pipelined NTT-based polynomial multiplier • A parameterized sparse polynomial multiplier • A lightweight Hmax-Sum module 32
Recommend
More recommend
