Practical CCA2-Secure and Masked Ring-LWE Implementation Tobias Oder 1 , Tobias Schneider 2 , Thomas Pöppelmann 3 , Tim Güneysu 1,4 1 Ruhr-University Bochum, 2 Université Catholique de Louvain, 3 Infineon Technologies AG, 4 DFKI 10.09.2018 CHES 2018
Motiviation CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 2
Ring-LWE • NIST post-quantum standardization project • Various NIST submissions are based on Ring-LWE including – NewHope – LIMA – (Kyber) – … CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 3
Ring-LWE • NIST post-quantum standardization project • Various NIST submissions are based on Ring-LWE including – NewHope – LIMA – (Kyber) – … Previous work – A masked ring-LWE implementation. O. Reparaz, S. Sinha Roy, F. Vercauteren, I. Verbauwhede. CHES 2015 – Additively homomorphic ring-LWE masking. O. Reparaz, S. Sinha Roy, R. de Clercq, F. Vercauteren, I. Verbauwhede. PQCrypto 2016 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 4
CCA2-Security • Plain Ring-LWE encryption is only secure against chosen- plaintext attackers (CPA) • Many use cases require security against chosen-ciphertext attackers (CCA) • Generic Fujisaki-Okamoto transform – Assumes negligible decryption error – Tweak by Targhi and Unruh for post-quantum security [TU16] – Expensive re-encryption in decryption [TU16] E. E. Targhi and D. Unruh. Post-quantum security of the Fujisaki-Okamoto and OAEP transforms . TCC 2016 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 5
CCA2-Security CCA2-secure Decryption CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 6
CCA2-Security CCA2-secure Decryption CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 7
CCA2-Security CCA2-secure Decryption CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 8
CCA2-Security CCA2-secure Decryption CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 9
Contribution CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 10
Embedded Implementation • Our contribution: CCA2-secure first-order masked Ring-LWE implementation CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 11
Embedded Implementation • Our contribution: CCA2-secure first-order masked Ring-LWE implementation • Target platform ARM Cortex-M4 – Constrained computing capabilities/memory CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 12
Embedded Implementation • Our contribution: CCA2-secure first-order masked Ring-LWE implementation • Target platform ARM Cortex-M4 – Constrained computing capabilities/memory • Secret-independent execution time as countermeasure against timing attacks • Masking as countermeasure against Differential Power Analysis – Boolean vs. arithmetic CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 13
Masking Ring-LWE Components to be masked in CCA2-secure Ring-LWE Ring-LWE CPA Encryption • PRNG/Hash 𝑏 x + 𝑑 1 BS BS BS • NTT 𝑞 𝑑 2 x + + – Polynomial multiplication 𝑛 𝑓𝑜𝑑𝑝𝑒𝑓 Ring-LWE CPA Decryption • Binomial sampler (BS) 𝑑 1 𝑒𝑓𝑑𝑝𝑒𝑓 𝑛 x + • Encoding/Decoding 𝑠 𝑑 2 1 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 14
Masking Ring-LWE Components to be masked in CCA2-secure Ring-LWE Ring-LWE CPA Encryption • PRNG/Hash [BDPVA10] 𝑏 x + 𝑑 1 BS BS BS 𝑞 𝑑 2 • NTT straight-forward x + + – Polynomial multiplication 𝑛 𝑓𝑜𝑑𝑝𝑒𝑓 Ring-LWE CPA Decryption • Binomial sampler (BS) 𝑑 1 𝑒𝑓𝑑𝑝𝑒𝑓 𝑛 x + • Encoding/Decoding 𝑠 𝑑 2 1 [BDPVA10] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche. Building power analysis resistant implementations of Keccak . Second SHA-3 candidate conference, 2010 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 15
Masking Ring-LWE Components to be masked in CCA2-secure Ring-LWE Ring-LWE CPA Encryption • PRNG/Hash [BDPVA10] 𝑏 x + 𝑑 1 BS BS BS 𝑞 𝑑 2 • NTT straight-forward x + + – Polynomial multiplication 𝑛 𝑓𝑜𝑑𝑝𝑒𝑓 Ring-LWE CPA Decryption • Binomial Sampler (BS) 𝑑 1 𝑒𝑓𝑑𝑝𝑒𝑓 𝑛 x + • Encoding/Decoding 𝑠 𝑑 2 1 [BDPVA10] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche. Building power analysis resistant implementations of Keccak . Second SHA-3 candidate conference, 2010 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 16
Encoding CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 17
Masked encoding • Encoding transforms a bit string into a polynomial – Without masking: 𝑑𝑝𝑓𝑔𝑔 = 𝑐𝑗𝑢 ⋅ ⌊𝑟 2⌋ CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 18
Masked encoding • Encoding transforms a bit string into a polynomial – Without masking: 𝑑𝑝𝑓𝑔𝑔 = 𝑐𝑗𝑢 ⋅ ⌊𝑟 2⌋ – W ith 𝑐𝑗𝑢 ′ ⊕ 𝑐𝑗𝑢′′ = 𝑐𝑗𝑢: 𝑑𝑝𝑓𝑔𝑔′ = 𝑐𝑗𝑢′ ⋅ ⌊𝑟 2 ⌋ 𝑑𝑝𝑓𝑔𝑔 ′′ = 𝑐𝑗𝑢 ′′ ⋅ 𝑟 2 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 19
Masked encoding • Encoding transforms a bit string into a polynomial – Without masking: 𝑑𝑝𝑓𝑔𝑔 = 𝑐𝑗𝑢 ⋅ ⌊𝑟 2⌋ – W ith 𝑐𝑗𝑢 ′ ⊕ 𝑐𝑗𝑢′′ = 𝑐𝑗𝑢: 𝑑𝑝𝑓𝑔𝑔′ = 𝑐𝑗𝑢′ ⋅ ⌊𝑟 2 ⌋ 𝑑𝑝𝑓𝑔𝑔 ′′ = 𝑐𝑗𝑢 ′′ ⋅ 𝑟 2 𝑟 𝑟 • q is a odd 2 + 2 ≠ 𝑟 Problem: Result is off by one if 𝑐𝑗𝑢 ′ = 1 and 𝑐𝑗𝑢 ′′ = 1 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 20
Masked encoding Solution: Add 𝑐𝑗𝑢 ′ ⋅ 𝑐𝑗𝑢′′ to the result • Compute 𝑐𝑗𝑢 ′ ⋅ 𝑐𝑗𝑢′′ by splitting into subshares 𝑐𝑗𝑢 ′ 1 + 𝑐𝑗𝑢 ′ 2 ⋅ (𝑐𝑗𝑢 ′′(1) + 𝑐𝑗𝑢 ′′ 2 ) = 𝑐𝑗𝑢 ′(1) ⋅ 𝑐𝑗𝑢 ′′ 1 + 𝑐𝑗𝑢 ′ 1 ⋅ 𝑐𝑗𝑢 ′′ 2 + 𝑐𝑗𝑢 ′(2) ⋅ 𝑐𝑗𝑢 ′′ 1 + 𝑐𝑗𝑢 ′(2) ⋅ 𝑐𝑗𝑢 ′′ 2 • Use fresh randomness to securely sum the cross-products CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 21
Decoding CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 22
Masked decoding Input: Coefficient ∈ [0, 𝑟 − 1] Output: Decoded bit Idea: • Shift distribution of coefficients • Apply arithmetic-to- Boolean conversion • Extract sign bit CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 23
Masked decoding Input: Coefficient ∈ [0, 𝑟 − 1] Output: Decoded bit Idea: • Shift distribution of coefficients • Apply arithmetic-to- Boolean conversion • Extract sign bit CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 24
Masked decoding Input: Coefficient ∈ [0, 𝑟 − 1] Output: Decoded bit Idea: • Shift distribution of coefficients • Apply arithmetic-to- Boolean conversion • Extract sign bit CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 25
Masked decoding Input: Coefficient ∈ [0, 𝑟 − 1] Output: Decoded bit Idea: • Shift distribution of coefficients • Apply arithmetic-to- Boolean conversion • Extract sign bit CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 26
Binomial Sampler CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 27
Masked sampler • Input : Boolean shares; Output : Arithmetic shares • Count Hamming weight as (𝑐𝑗𝑢 ′ 𝑗 ⊕ 𝑐𝑗𝑢 ′′ 𝑗 ) 7 σ 𝑗=0 𝑐𝑗𝑢 ′ 𝑗 + 𝑐𝑗𝑢 ′′ 𝑗 − 2𝑐𝑗𝑢 ′ (𝑗)𝑐𝑗𝑢′′(𝑗) 7 = σ 𝑗=0 • Compute 𝑐𝑗𝑢 ′ (𝑗) ⋅ 𝑐𝑗𝑢′′(𝑗) by splitting into subshares CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 28
Results CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 29
Side-Channel Evaluation T-test evaluation of the decoding (example) • Blue : first-order evaluation • Dashed red : second-order evaluation CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 30
Cortex-M4 Performance • Dimension n = 1024 • Modulus q = 12289 • Standard deviation ς = 2 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 31
Cortex-M4 Performance • Dimension n = 1024 • Modulus q = 12289 • Standard deviation ς = 2 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 32
Cortex-M4 Performance • Dimension n = 1024 • Modulus q = 12289 • Standard deviation ς = 2 CCA2-Secure and Masked Ring-LWE | Tobias Oder | Ruhr-University Bochum | 10.09.2018 33
Recommend
More recommend
