Putting wings on SPHINCS PQCRYPTO Conference Stefan K olbl April - PowerPoint PPT Presentation

Putting wings on SPHINCS PQCRYPTO Conference Stefan K¨ olbl April 10th, 2018 Technical University of Denmark, Cybercrypt

SPHINCS SPHINCS • Hash-based signature scheme • Stateless • 128-bit post-quantum security • Sizes: • Public Key: 1KB • Secret Key: 1KB • Signature: 41KB https://sphincs.cr.yp.to/ 1

How to instantiate SPHINCS? 1

SPHINCS Main components: • One-time Signature (WOTS) • Few-time Signature (HORST) • Merkle-Tree 2

SPHINCS Level 1 . . . Level 2 32x Level 12 HORST Message 3

SPHINCS pk OTS sign . . . . . . . . . pk pk pk pk OTS sign 4

SPHINCS What is computed? • Many calls to a hash function... • ...but using short input only. f f f f 5

SPHINCS For one signature • ≈ 450.000 times F • ≈ 90.000 times H { 0 , 1 } 512 { 0 , 1 } 256 H { 0 , 1 } 256 { 0 , 1 } 256 F 6

Cryptographic Hash Functions Which hash function could we use? • Standards • SHA256 • SHA-3 • ChaCha12 permutation • Keccak • Haraka • Simpira 7

Cryptographic Hash Functions SHA-2 (FIPS PUB 180-4) • 512-bit Message Blocks • Padding... M 1 M 2 M n h 1 h n +1 f f f IV 8

Cryptographic Hash Functions SHA3-256 (FIPS PUB 202) • 1600-bit Permutation • 1088-bit Message Blocks h M 0 M 1 M 2 h 0 h 1 r 0 π π π π π c 0 9

Cryptographic Hash Functions Other Keccak variants: • Use 800-bit permutation? • Use less rounds (Kangaroo12 1 ). • Best preimage attack on 4 rounds 2 . 0 see https://eprint.iacr.org/2016/770 0 Linear Structures: Applications to Cryptanalysis of Round-Reduced Keccak, Asiacrypt 2016 10

Cryptographic Hash Functions ChaCha12 • Suggested in SPHINCS paper. • Use ChaCha12 permutation in sponge. • Great software performance with vectorization. 11

Cryptographic Hash Functions Haraka: A short-input hash function 3 • Permutation based on AES rounds. • SPN construction. • 256- and 512-bit permutation. trunc x H ( x ) π 3 https://eprint.iacr.org/2016/098 12

Cryptographic Hash Functions Simpira 4 • Permutation based on AES rounds. • Feistel construction. • 256- and 512-bit permutation. trunc x H ( x ) π 4 https://eprint.iacr.org/2016/122 13

Microarchitectures SPHINCS not well suited for small devices 5 • Signature size larger than RAM for some devices. • Computational costs for signing high... • ... but verification is cheap. Focus on highend platforms: • Intel Haswell/Skylake, AMD Ryzen • ARM Cortex A57/A72 5 see https://eprint.iacr.org/2015/1042 14

Microarchitectures How to get a fast implementation? • Vectorization (AVX2, NEON, AVX-512) • Hardware Support (AES, SHA-2, SHA-3) • Utilize pipeline 15

Microarchitectures Vector Instructions X 7 X 6 X 5 X 4 X 3 X 2 X 1 X 0 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ Y 7 Y 6 Y 5 Y 4 Y 3 Y 2 Y 1 Y 0 = = = = = = = = Z 7 Z 6 Z 5 Z 4 Z 3 Z 2 Z 1 Z 0 • Apply same operation on all elements of the vector. • Use independet inputs. 16

Microarchitectures Pipelining • Latency • Inverse Throughput Cycles aesenc aesenc aesenc L aesenc 17

Microarchitectures Pipelining • Latency • Inverse Throughput Cycles aesenc aesenc aesenc aesenc aesenc aesenc T − 1 aesenc 17

Microarchitectures Pipelining • Latency • Inverse Throughput Cycles aesenc aesenc aesenc aesenc aesenc aesenc aesenc aesenc aesenc T − 1 aesenc 17

Platforms Performance varies a lot depending on the platform Latency inv. Throughput Platform Instruction Skylake vectorized XOR 1 0.33 Ryzen vectorized XOR 1 0.5 Cortex A57 vectorized XOR 3 2 18

Implementations How to implement those functions efficiently? • SHA-2 • Keccak[ b = 800] • ChaCha12 • Haraka • Simpira 19

Implementations How to implement those functions efficiently? • SHA-2 • 32-bit word oriented • Vectorize • Hardware Support • Keccak[ b = 800] • ChaCha12 • Haraka • Simpira 19

Implementations How to implement those functions efficiently? • SHA-2 • Keccak[ b = 800] • 32-bit word oriented • Vectorize • ChaCha12 • Haraka • Simpira 19

Implementations How to implement those functions efficiently? • SHA-2 • Keccak[ b = 800] • ChaCha12 • 32-bit word oriented • Vectorize • Haraka • Simpira 19

Implementations How to implement those functions efficiently? • SHA-2 • Keccak[ b = 800] • ChaCha12 • Haraka • AES + permute • Simpira 19

Implementations How to implement those functions efficiently? • SHA-2 • Keccak[ b = 800] • ChaCha12 • Haraka • Simpira • AES 19

Tour de SPHINCS 19

Tour de SPHINCS Intel Skylake • AVX2 (256-bit vector) • AES-NI 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 • AVX2 (256-bit vector) Haraka • AES-NI Keccak SHA-256 Simpira 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 • AVX2 (256-bit vector) Haraka • AES-NI Keccak SHA-256 142.06 Simpira 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 • AVX2 (256-bit vector) Haraka • AES-NI Keccak 108.62 SHA-256 142.06 Simpira 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 43.49 • AVX2 (256-bit vector) Haraka • AES-NI Keccak 108.62 SHA-256 142.06 Simpira 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 43.49 • AVX2 (256-bit vector) Haraka • AES-NI Keccak 108.62 SHA-256 142.06 Simpira 28.40 20

Tour de SPHINCS Signing (million cycles) Design Skylake Intel Skylake ChaCha12 43.49 • AVX2 (256-bit vector) Haraka 20.78 • AES-NI Keccak 108.62 SHA-256 142.06 Simpira 28.40 20

Tour de SPHINCS AMD Ryzen • AVX2 (256-bit vector) • AES-NI (2 ports) • SHA256 instructions 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 • AES-NI (2 ports) Haraka Keccak • SHA256 instructions SHA-256 Simpira 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 • AES-NI (2 ports) Haraka Keccak 189.98 • SHA256 instructions SHA-256 Simpira 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 63.42 • AES-NI (2 ports) Haraka Keccak 189.98 • SHA256 instructions SHA-256 Simpira 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 63.42 • AES-NI (2 ports) Haraka Keccak 189.98 • SHA256 instructions SHA-256 53.33 Simpira 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 63.42 • AES-NI (2 ports) Haraka Keccak 189.98 • SHA256 instructions SHA-256 53.33 Simpira 20.43 21

Tour de SPHINCS Signing (million cycles) AMD Ryzen Design Ryzen • AVX2 (256-bit vector) ChaCha12 63.42 • AES-NI (2 ports) Haraka 15.54 Keccak 189.98 • SHA256 instructions SHA-256 53.33 Simpira 20.43 21

Tour de SPHINCS ARM Cortex A57 • NEON (128-bit vector) • AES • SHA256 support 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 • AES Haraka Keccak • SHA256 support SHA-256 Simpira 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 • AES Haraka Keccak 376.90 • SHA256 support SHA-256 Simpira 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 193.51 • AES Haraka Keccak 376.90 • SHA256 support SHA-256 Simpira 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 193.51 • AES Haraka Keccak 376.90 • SHA256 support SHA-256 92.08 Simpira 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 193.51 • AES Haraka Keccak 376.90 • SHA256 support SHA-256 92.08 Simpira 63.48 22

Tour de SPHINCS Signing (million cycles) ARM Cortex A57 Design Cortex A57 • NEON (128-bit vector) ChaCha12 193.51 • AES Haraka 47.10 Keccak 376.90 • SHA256 support SHA-256 92.08 Simpira 63.48 22

Formula SPHINCS Hash Performance for F 20 16.71 ChaCha 18 Haraka 16 Keccak Cycles per Byte 14 SHA256 12 Simpira 10 6.94 7.3 5.52 8 4.11 3.91 6 2.73 2.44 1.85 1.71 4 1.08 0.94 0.63 0.39 0.49 2 0 Skylake Ryzen Cortex-A57 23

Formula SPHINCS Hash Performance for H 11 8.68 ChaCha 10 Haraka 7.15 9 Keccak Cycles per Byte 8 SHA256 7 Simpira 6 3.55 5 2.73 2.58 2.20 4 1.82 1.71 1.44 1.51 1.13 3 0.94 0.72 0.48 0.49 2 1 0 Skylake Ryzen Cortex-A57 24

NIST PQ Competition Two variants of SPHINCS in NIST PQ competition: • Gravity-SPHINCS • Results directly apply. • Already uses Haraka. • SPHINCS+ • Tweakable Hash. • Needs to process slightly larger inputs. 25

Putting wings on SPHINCS PQCRYPTO Conference Stefan K olbl April - PowerPoint PPT Presentation

Putting wings on SPHINCS PQCRYPTO Conference Stefan K olbl April 10th, 2018 Technical University of Denmark, Cybercrypt SPHINCS SPHINCS Hash-based signature scheme Stateless 128-bit post-quantum security Sizes: Public

Wings Demo Walkthrough For a brief overview of Wings, see

SMILES ON WINGS SMILES ON WINGS NEW BEGINNINGS D I N I N G F O R W O M E N - D E C E M B E R

Gravity-SPHINCS First PQC Standardization Conference Jean-Philippe Aumasson 1 , Guillaume

Characteris/cs of finite wings Flow around the wing @p

A Very Old Man with Enormous Wings Bellwork 2/15/2018 -Read A Very Old Man with Enormous

What are the 4Cs? About WINGS Global Mandate Network of almost 90 grantmaker associations and

A new submission to the SNAKE OIL CRYPTO competition Roberto Avanzi @FakeIACR (ad hodorem)

Transient Capability of a Multi-group Pin Homogenized SP 3 Code SPHINCS Hyun Ho Cho 1) , Junsu Kang

SCHEME SPHINCS-256 Dorian Amiet 1 , Andreas Curiger 2 and Paul Zbinden 1 1 HSR Hochschule fr

WINGS-SSA Collaboration Sally Balch Hurme, JD National Guardianship Association Board of

these wings must be inclined to the relative wind. The inclination of the body and wings is

Feature The 'Plight of the Monarch' and Wings of Change by Sandy Lindsay April 21, 2016

SPHINCS: practical stateless hash-based signatures Daniel J. Bernstein Daira Hopwood Andreas

SPHINCS: practical stateless hash-based signatures Daniel J. Bernstein Daira Hopwood Andreas H

Wings & Waves Interna.onal Cargo LLC OUR MISSION: Keep Our Customers Happy By Offering Service

Wings for Pegasus: A Semantic Approach for Creating Very Large Scientific Workflows Yolanda Gil

Putting out a HIT Putting out a HIT Crowdsourcing Malware Installs Stephen Checkoway Keaton

Unit 12: Putting it All Together: Briefly talk about system Digital Circuits Graphics

Relax Into Enlightenment W E L C O M E S H A U M B R A W O R L D W I D E Wings through the

BC Government & BCTF Putting the Students First BC Government & BCTF Putting the

Babylon Medea-Persia Greece Rome Lion with Lopsided Four- Monstrous Eagles Wings Bear

No 17 when the snow comes with an emergency landing across the moor and spreads its wings

Putting tec Putting tech h at the t the hear heart of t of an activ an active city e city

Giving Ireland Wings The Development of the Shannon Aviation &

Putting wings on SPHINCS PQCRYPTO Conference Stefan K olbl April - PowerPoint PPT Presentation

Putting wings on SPHINCS PQCRYPTO Conference Stefan K olbl April 10th, 2018 Technical University of Denmark, Cybercrypt SPHINCS SPHINCS Hash-based signature scheme Stateless 128-bit post-quantum security Sizes: Public

Wings Demo Walkthrough For a brief overview of Wings, see

SMILES ON WINGS SMILES ON WINGS NEW BEGINNINGS D I N I N G F O R W O M E N - D E C E M B E R

Gravity-SPHINCS First PQC Standardization Conference Jean-Philippe Aumasson 1 , Guillaume

Characteris/cs of finite wings Flow around the wing @p

A Very Old Man with Enormous Wings Bellwork 2/15/2018 -Read A Very Old Man with Enormous

What are the 4Cs? About WINGS Global Mandate Network of almost 90 grantmaker associations and

A new submission to the SNAKE OIL CRYPTO competition Roberto Avanzi @FakeIACR (ad hodorem)

Transient Capability of a Multi-group Pin Homogenized SP 3 Code SPHINCS Hyun Ho Cho 1) , Junsu Kang

SCHEME SPHINCS-256 Dorian Amiet 1 , Andreas Curiger 2 and Paul Zbinden 1 1 HSR Hochschule fr

WINGS-SSA Collaboration Sally Balch Hurme, JD National Guardianship Association Board of

these wings must be inclined to the relative wind. The inclination of the body and wings is

Feature The 'Plight of the Monarch' and Wings of Change by Sandy Lindsay April 21, 2016

SPHINCS: practical stateless hash-based signatures Daniel J. Bernstein Daira Hopwood Andreas

SPHINCS: practical stateless hash-based signatures Daniel J. Bernstein Daira Hopwood Andreas H

Wings &amp; Waves Interna.onal Cargo LLC OUR MISSION: Keep Our Customers Happy By Offering Service

Wings for Pegasus: A Semantic Approach for Creating Very Large Scientific Workflows Yolanda Gil

Putting out a HIT Putting out a HIT Crowdsourcing Malware Installs Stephen Checkoway Keaton

Unit 12: Putting it All Together: Briefly talk about system Digital Circuits Graphics

Relax Into Enlightenment W E L C O M E S H A U M B R A W O R L D W I D E Wings through the

BC Government &amp; BCTF Putting the Students First BC Government &amp; BCTF Putting the

Babylon Medea-Persia Greece Rome Lion with Lopsided Four- Monstrous Eagles Wings Bear

No 17 when the snow comes with an emergency landing across the moor and spreads its wings

Putting tec Putting tech h at the t the hear heart of t of an activ an active city e city

Giving Ireland Wings The Development of the Shannon Aviation &amp;

Wings & Waves Interna.onal Cargo LLC OUR MISSION: Keep Our Customers Happy By Offering Service

BC Government & BCTF Putting the Students First BC Government & BCTF Putting the

Giving Ireland Wings The Development of the Shannon Aviation &