Code-Based Cryptography for FPGAs Dr. Ruben Niederhagen, February 8, - - PowerPoint PPT Presentation

▶
code based cryptography for fpgas
SMART_READER_LITE
LIVE PREVIEW

Code-Based Cryptography for FPGAs Dr. Ruben Niederhagen, February 8, - - PowerPoint PPT Presentation

May 18, 2023 290 likes •1.04k views

Code-Based Cryptography for FPGAs Dr. Ruben Niederhagen, February 8, 2018 Introduction Global Map public-key cryptography classic post-quantum lattice code multivariate hash isogenies . . . McEliece Niederreiter . . . GRS codes

slide-1
SLIDE 1

Code-Based Cryptography for FPGAs

  • Dr. Ruben Niederhagen, February 8, 2018
slide-2
SLIDE 2

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-3
SLIDE 3

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-4
SLIDE 4

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-5
SLIDE 5

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-6
SLIDE 6

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-7
SLIDE 7

Introduction

Global Map public-key cryptography classic post-quantum lattice code McEliece Niederreiter GRS codes Goppa codes

. . . . . .

multivariate hash isogenies

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 1 (25)

slide-8
SLIDE 8

Introduction

Motivation

Why code-based schemes in hardware?

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-9
SLIDE 9

Introduction

Motivation

Why code-based schemes in hardware?

Code-based schemes are well-understood: Long history of research. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-10
SLIDE 10

Introduction

Motivation

Why code-based schemes in hardware?

Code-based schemes are well-understood: Long history of research. Security parameters widely accepted. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-11
SLIDE 11

Introduction

Motivation

Why code-based schemes in hardware?

Code-based schemes are well-understood: Long history of research. Security parameters widely accepted. Code-based schemes are expensive: High-throughput scenario: web server... Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-12
SLIDE 12

Introduction

Motivation

Why code-based schemes in hardware?

Code-based schemes are well-understood: Long history of research. Security parameters widely accepted. Code-based schemes are expensive: High-throughput scenario: web server... Low-energy scenario:

embedded devices, SmartCards, ...

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-13
SLIDE 13

Introduction

Motivation

Why code-based schemes in hardware?

Code-based schemes are well-understood: Long history of research. Security parameters widely accepted. Code-based schemes are expensive: High-throughput scenario: web server... Low-energy scenario:

embedded devices, SmartCards, ...

= ⇒ Hardware implementation as accelerator and for efficiency.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 2 (25)

slide-14
SLIDE 14

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-15
SLIDE 15

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-16
SLIDE 16

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode 10010001011 transmitt

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-17
SLIDE 17

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode 10010001011 transmitt 10011001001 error correction

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-18
SLIDE 18

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode 10010001011 transmitt 10011001001 error correction 01101100 decode

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-19
SLIDE 19

Introduction

Error-Correcting Codes — McEliece and Niederreiter encryption decryption 01101100 10011001001 encode 10010001011 add errors 10011001001 error correction 01101100 decode plaintext ciphertext plaintext

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-20
SLIDE 20

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode 10010001011 transmitt 10011001001 error correction 01101100 decode

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-21
SLIDE 21

Introduction

Error-Correcting Codes — McEliece and Niederreiter 01101100 10011001001 encode 10010001011 transmitt 10011001001 01101100 decode syndrome parity check 00001000010 decoding syndrome

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-22
SLIDE 22

Introduction

Error-Correcting Codes — McEliece and Niederreiter encryption decryption 01101100 10011001001 encode 00001000010 transmitt 10011001001 01101100 decode syndrome parity check plaintext ciphertext 00001000010 decoding syndrome plaintext

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 3 (25)

slide-23
SLIDE 23

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-24
SLIDE 24

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-25
SLIDE 25

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-26
SLIDE 26

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-27
SLIDE 27

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-28
SLIDE 28

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Permute list of all 2m elements, pick the first n elements.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 4 (25)

slide-29
SLIDE 29

Niederreiter Cryptosystem Permute list of all 2m elements, pick the first n elements.

Option 1: Use Fisher-Yates shuffle. Biased if not well implemented, non-biased implementations need floating-point arithmetic

  • r are not constant time.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 5 (25)

slide-30
SLIDE 30

Niederreiter Cryptosystem Permute list of all 2m elements, pick the first n elements.

Option 1: Use Fisher-Yates shuffle. Biased if not well implemented, non-biased implementations need floating-point arithmetic

  • r are not constant time.

Option 2: Use a constant-time sorting algorithm.

Sample 2m random 32-bit values ri. Generate a list of tuples {(r0, 0), (ri, 1), . . . , (r2m−1, am−1 + am−2 · · · + a + 1)}. Sort list by the first element. Obtain the permutation by reading the second elements.

Expensive: more cycles, more logic. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 5 (25)

slide-31
SLIDE 31

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Permute list of all 2m elements, pick the first n elements.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 6 (25)

slide-32
SLIDE 32

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Generate an irreducible polynomial.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 6 (25)

slide-33
SLIDE 33

Niederreiter Cryptosystem Generate an irreducible polynomial of degree t.

Option 1: Randomly chose t + 1 coefficients,

check if obtained polynomial is irreducible.

Needs about t iterations

⇒ not constant time,

checking for irreducibility is expensive (extended Euclidean algorithm). Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 7 (25)

slide-34
SLIDE 34

Niederreiter Cryptosystem Generate an irreducible polynomial of degree t.

Option 1: Randomly chose t + 1 coefficients,

check if obtained polynomial is irreducible.

Needs about t iterations

⇒ not constant time,

checking for irreducibility is expensive (extended Euclidean algorithm). Option 2: Construct an irreducible polynomial. Idea: Compute minimal polynomial of an element r ∈ F(2m)[x]/f

with deg(f) = t.

Compute several powers in F(2m)[x]/f, solve a linear equation system over F(2m) of dimension t × t + 1. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 7 (25)

slide-35
SLIDE 35

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Generate an irreducible polynomial.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 8 (25)

slide-36
SLIDE 36

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Evaluate g at all 2m elements using additive FFT.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 8 (25)

slide-37
SLIDE 37

Niederreiter Cryptosystem

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Gaussian elimination.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 8 (25)

slide-38
SLIDE 38

Niederreiter Cryptosystem

Algorithm 2: Encryption algorithm for the Niederreiter cryptosystem. Input : Plaintext e, public key K. Output: Ciphertext c.

1 Compute c = [Imt|K] × e.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 9 (25)

slide-39
SLIDE 39

Niederreiter Cryptosystem

Algorithm 2: Encryption algorithm for the Niederreiter cryptosystem. Input : Plaintext e, public key K. Output: Ciphertext c.

1 Compute c = [Imt|K] × e. 2 Return the ciphertext c.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 9 (25)

slide-40
SLIDE 40

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-41
SLIDE 41

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2).

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-42
SLIDE 42

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0).

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-43
SLIDE 43

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0). 4 Compute the error-locator polynomial σ(x) from S(2).

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-44
SLIDE 44

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0). 4 Compute the error-locator polynomial σ(x) from S(2). 5 Evaluate the error-locator polynomial σ(x) at (α0, α1, . . . , αn−1).

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-45
SLIDE 45

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0). 4 Compute the error-locator polynomial σ(x) from S(2). 5 Evaluate the error-locator polynomial σ(x) at (α0, α1, . . . , αn−1).

Evaluate g and σ at all 2m elements using additive FFT.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-46
SLIDE 46

Niederreiter Cryptosystem

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0). 4 Compute the error-locator polynomial σ(x) from S(2). 5 Evaluate the error-locator polynomial σ(x) at (α0, α1, . . . , αn−1).

Efficient decoding algorithm.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 10 (25)

slide-47
SLIDE 47

Niederreiter Cryptosystem Efficient decoding algorithm:

Option 1: Patterson algorithm. Not constant time, side-channel attacks can be used to decode messages. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 11 (25)

slide-48
SLIDE 48

Niederreiter Cryptosystem Efficient decoding algorithm:

Option 1: Patterson algorithm. Not constant time, side-channel attacks can be used to decode messages. Option 2: Berlekamp-Massey algorithm. Constant time. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 11 (25)

slide-49
SLIDE 49

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-50
SLIDE 50

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Polynomial arithmetic in F(2m)[x]/f. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-51
SLIDE 51

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Polynomial arithmetic in F(2m)[x]/f. Merge-sort for generating a permutation. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-52
SLIDE 52

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Polynomial arithmetic in F(2m)[x]/f. Merge-sort for generating a permutation. Additive FFT for polynomial evaluation. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-53
SLIDE 53

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Polynomial arithmetic in F(2m)[x]/f. Merge-sort for generating a permutation. Additive FFT for polynomial evaluation. Gaussian elimination. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-54
SLIDE 54

Niederreiter Cryptosystem Required Modules:

Finite field arithmetic in F(2m). Polynomial arithmetic in F(2m)[x]/f. Merge-sort for generating a permutation. Additive FFT for polynomial evaluation. Gaussian elimination. Berlekamp Massey. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 12 (25)

slide-55
SLIDE 55

Design

Key Generation

H R R Generator PRNG GF(2m) Gaussian Systemizer

g-portion

g(x) Evaluation

(Additive FFT)

H Generator g_out P Generator

(Sort)

P P_out GF(2) Gaussian Systemizer K_out PRNG Permutation Gen. Goppa Polynomial Gen. Public Key K Gen.

K-portion

C D P' I I M

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 13 (25)

slide-56
SLIDE 56

Design

Key Generation

H R R Generator PRNG GF(2m) Gaussian Systemizer

g-portion

g(x) Evaluation

(Additive FFT)

H Generator g_out P Generator

(Sort)

P P_out GF(2) Gaussian Systemizer K_out PRNG Permutation Gen. Goppa Polynomial Gen. Public Key K Gen.

K-portion

C D P' I I M

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 13 (25)

slide-57
SLIDE 57

Design

Key Generation

H R R Generator PRNG GF(2m) Gaussian Systemizer

g-portion

g(x) Evaluation

(Additive FFT)

H Generator g_out P Generator

(Sort)

P P_out GF(2) Gaussian Systemizer K_out PRNG Permutation Gen. Goppa Polynomial Gen. Public Key K Gen.

K-portion

C D P' I I M

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 13 (25)

slide-58
SLIDE 58

Design

Algorithm 1: Key-generation algorithm for the Niederreiter cryptosystem. Input : System parameters: m, t, and n. Output: Private key (g(x), (α0, α1, . . . , αn−1)) and public key K.

1 Choose random sequence (α0, α1, . . . , αn−1) ∈ F(2m)n of distinct elements. 2 Choose a random irreducible polynomial g(x) of degree t. 3 Compute the t × n parity check matrix

H =      1/g(α0) 1/g(α1) · · · 1/g(αn−1) α0/g(α0) α1/g(α1) · · · αn−1/g(αn−1)

. . . . . . ... . . .

αt−1 /g(α0) αt−1

1

/g(α1) · · · αt−1

n−1/g(αn−1)

     .

4 Transform H to a mt × n binary parity check matrix H′. 5 Transform H′ into its systematic form [Imt|K].

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 14 (25)

slide-59
SLIDE 59

Design

Encryption

Plaintext PK_column

Ciphertext Encryption

(XOR) PK_column_valid

Algorithm 4: Encryption algorithm for the Niederreiter cryptosystem. Input : Plaintext e, public key K. Output: Ciphertext c.

1 Compute c = [Imt|K] × e. 2 Return the ciphertext c.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 15 (25)

slide-60
SLIDE 60

Design

Decryption

g(x) Evaluation

(Additive FFT)

C D Doubled Syndrome

SK_g(x) SK_P

Berlekamp Massey Error Locator

Ciphertext

Recovered Message I I M

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 16 (25)

slide-61
SLIDE 61

Design

Algorithm 3: Decryption algorithm for the Niederreiter cryptosystem. Input : Ciphertext c, secret key (g(x), (α0, α1, . . . , αn−1)). Output: Plaintext e.

1 Compute the double-size 2t × n parity check matrix

H(2) =      1/g2(α0) 1/g2(α1) · · · 1/g2(αn−1) α0/g2(α0) α1/g2(α1) · · · αn−1/g2(αn−1)

. . . . . . ... . . .

α2t−1 /g2(α0) α2t−1

1

/g2(α1) · · · α2t−1

n−1 /g2(αn−1)

     .

2 Transform H(2) to a 2mt × n binary parity check matrix H′(2). 3 Compute the double-size syndrome: S(2) = H′(2) × (c|0). 4 Compute the error-locator polynomial σ(x) from S(2). 5 Evaluate the error-locator polynomial σ(x) at (α0, α1, . . . , αn−1).

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 17 (25)

slide-62
SLIDE 62

Design

Decryption

g(x) Evaluation

(Additive FFT)

C D Doubled Syndrome

SK_g(x) SK_P

Berlekamp Massey Error Locator

Ciphertext

Recovered Message I I M

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 18 (25)

slide-63
SLIDE 63

Design

Setup UART State Machine Key Generation Encryption Decryption verification

  • f results

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 19 (25)

slide-64
SLIDE 64

Parameters Code generation and module parameters:

All system parameters (m, t, n) can be freely chosen. Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 20 (25)

slide-65
SLIDE 65

Parameters Code generation and module parameters:

All system parameters (m, t, n) can be freely chosen. Performance parameters for controlling parallelism: Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 20 (25)

slide-66
SLIDE 66

Parameters Code generation and module parameters:

All system parameters (m, t, n) can be freely chosen. Performance parameters for controlling parallelism: Compact, low-area design for SmartCards, embedded systems, ... Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 20 (25)

slide-67
SLIDE 67

Parameters Code generation and module parameters:

All system parameters (m, t, n) can be freely chosen. Performance parameters for controlling parallelism: Compact, low-area design for SmartCards, embedded systems, ... Large, high-performance design for server accelerator, ... Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 20 (25)

slide-68
SLIDE 68

Parameters Code generation and module parameters:

All system parameters (m, t, n) can be freely chosen. Performance parameters for controlling parallelism: Compact, low-area design for SmartCards, embedded systems, ... Large, high-performance design for server accelerator, ...

Recommended system parameters (for 266-bit security):

finite field 2m:

m = 13

number of errors:

t = 119

code length:

n = 6960

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 20 (25)

slide-69
SLIDE 69

Performance

Cycles Case Key-Gen Dec. Logic Mem. Reg. Fmax area

11,121,214 34,492 53,447 (23%) 907 (35%) 118,243 245 MHz

bal.

3,062,936 22,768 70,478 (30%) 915 (36%) 146,648 251 MHz

time

966,400 17,055 121,806 (52%) 961 (38%) 223,232 248 MHz

Table: Performance for the entire Niederreiter cryptosystem (i.e., key generation, encryption, and decryption) including the serial IO interface when synthesized for the Stratix V (5SGXEA7N) FPGA.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 21 (25)

slide-70
SLIDE 70

Performance

Comparison

Cycles Logic Freq. Mem. Time (ms) Gen. Dec. Enc. (MHz) Gen. Dec. Enc.

m = 11, t = 50, n = 2048, Virtex 5 LX110

Shoufan et al.

14,670,000 210,300 81,500 14,537 (84%) 163 75 90.00 1.29 0.50

This design

1,503,927 5,864 1,498 6,660 (38%) 180 68 8.35 0.03 0.01 m = 13, t = 128, n = 8192, Haswell vs. Stratix V

Chou

1,236,054,840 343,344 289,152

—

4,000

—

309.01 0.09 0.07

This design

1,173,750 17,140 6,528 129,059 (54%) 231 1,126 5.08 0.07 0.07 Table: Comparison with related work. Logic is given in “Slices” for Xilinx Virtex FPGAs and in “ALMs” for Altera Stratix FPGAs.

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 22 (25)

slide-71
SLIDE 71

Thank you for your attention!

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 23 (25)

slide-72
SLIDE 72

Image Credits

Title page: CC0 Creative Commons

https://pixabay.com/en/boy-device-headphones-63777/

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 24 (25)

slide-73
SLIDE 73

Contact Information

  • Dr. Ruben Niederhagen

Cyber-Physical System Security Fraunhofer-Institute for Secure Information Technology Address: Rheinstraße 75 64295 Darmstadt Germany Internet: http://www.sit.fraunhofer.de Phone: +49 6151 869-135 Fax: +49 6151 869-224 E-Mail: ruben.niederhagen@sit.fraunhofer.de

Code-Based Cryptography for FPGAs | Dr. Ruben Niederhagen | February 8, 2018 | 25 (25)