Compact and Simple RLWE Based Key Encapsulation Mechanism Erdem Alkm - PowerPoint PPT Presentation

Compact and Simple RLWE Based Key Encapsulation Mechanism Erdem Alkım 1 Yusuf Alper Bilgin 2,3 Murat Cenk 3 1 Department of Computer Engineering, Ondokuz Mayıs University, Turkey 2 Aselsan Inc., Turkey 3 Institude of Applied Mathematics, Middle East Technical University, Turkey � y.alperbilgin@gmail.com October 3, 2019 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 1 / 20

Overview Introduction 1 Implementation Details 2 Results 3 Future Works 4 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 2 / 20

NIST PQC Standardization Project Moody, PQC Workshop, 2019 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 3 / 20

RLWE based KEM - Newhope Alkim et al., ePrint 2016/1157 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 4 / 20

Multiplication Algorithms Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

Multiplication Algorithms Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT: • High performance Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

Multiplication Algorithms Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT: • High performance • Memory efficient Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

Multiplication Algorithms Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT: • High performance • Memory efficient • Randoms directly sampled in NTT domain Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

Multiplication Algorithms Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT: Disadvantages: • High performance • Limited parametrization • Memory efficient • Randoms directly sampled in NTT domain Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

NewHope-Compact • A smaller and faster instantiation of NewHope Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

NewHope-Compact • A smaller and faster instantiation of NewHope • Utilizing recent advances on NTT Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

NewHope-Compact • A smaller and faster instantiation of NewHope • Utilizing recent advances on NTT • Reduce parameter q (12289 → 3329) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

NewHope-Compact • A smaller and faster instantiation of NewHope • Utilizing recent advances on NTT • Reduce parameter q (12289 → 3329) • Hybrid polynomial multiplication (NTT + Karatsuba) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

NewHope-Compact • A smaller and faster instantiation of NewHope • Utilizing recent advances on NTT • Reduce parameter q (12289 → 3329) • Hybrid polynomial multiplication (NTT + Karatsuba) • Achieving a security level equivalent to Kyber768 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

Number Theoretic Transform a ∈ Z q [ X ] / ( X n + 1) n − 1 n − 1 � a i X i , where ˆ � a j ω ij NTT( a ) = ˆ a = ˆ a i = mod q i =0 j =0 n − 1 n − 1 NTT − 1 (ˆ � a i X i , where a i = n − 1 � a j ω − ij � � a ) = a = ˆ mod q i =0 j =0 where ω n = 1 mod q Yusuf Alper Bilgin NewHope-Compact October 3, 2019 7 / 20

Number Theoretic Transform a ∈ Z q [ X ] / ( X n + 1) n − 1 n − 1 � a i X i , where ˆ � a j ω ij NTT( a ) = ˆ a = ˆ a i = mod q i =0 j =0 n − 1 n − 1 NTT − 1 (ˆ � a i X i , where a i = n − 1 � a j ω − ij � � a ) = a = ˆ mod q i =0 j =0 where ω n = 1 mod q Polynomial Multiplication c = NTT − 1 (NTT ( a ) ◦ NTT ( b )) where a , b , c ∈ R q Yusuf Alper Bilgin NewHope-Compact October 3, 2019 7 / 20

Butterflies x (0) ˆ x (0) x (0) x (0) ˆ γ i γ i -1 -1 x (1) × ˆ x (1) x (1) × x (1) ˆ Figure: Cooley-Tukey Butterfly Figure: Gentleman-Sande Butterfly Yusuf Alper Bilgin NewHope-Compact October 3, 2019 8 / 20

CRT Map of NewHope512 Let γ 512 = − 1 mod 12289. Z 12289 / ( x 512 + 1) ∼ = Z 12289 / ( x − γ ) × · · · × Z 12289 / ( x − γ 511 ) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

CRT Map of NewHope512 Let γ 512 = − 1 mod 12289. Z 12289 / ( x 512 + 1) ∼ = Z 12289 / ( x − γ ) × · · · × Z 12289 / ( x − γ 511 ) Z 12289 / ( x 512 + 1) = Z q / ( x 512 − γ 512 ) Z 12289 / ( x 256 − γ 256 ) Z 12289 / ( x 256 + γ 256 ) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

CRT Map of NewHope512 Z 12289 / ( x 512 − γ 512 ) x 256 − γ 256 x 256 + γ 256 = x 256 − γ 768 x 128 − γ 128 x 128 + γ 128 x 128 − γ 768 x 128 + γ 768 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

CRT Map of NewHope512 Z 12289 / ( x 512 − γ 512 ) x 256 − γ 256 x 256 + γ 256 x 128 − γ 128 x 128 + γ 128 x 128 − γ 768 x 128 + γ 768 . . . . . . . . . . . . x 2 − γ 2 x 2 + γ 510 · · · x − γ x + γ · · · x − γ 511 x + γ 511 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

CRT Map of NewHope-Compact512 Let γ 128 = − 1 mod 3329. Z 3329 / ( x 512 + 1) ∼ = Z 3329 / ( x 4 − γ ) × · · · × Z 3329 / ( x 4 − γ 127 ) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

CRT Map of NewHope-Compact512 Let γ 128 = − 1 mod 3329. Z 3329 / ( x 512 + 1) ∼ = Z 3329 / ( x 4 − γ ) × · · · × Z 3329 / ( x 4 − γ 127 ) Z 3329 / ( x 512 + 1) = Z 3329 / ( x 512 − γ 128 ) Z 3329 / ( x 256 − γ 64 ) Z 3329 / ( x 256 + γ 64 ) Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

CRT Map of NewHope-Compact512 Z 3329 / ( x 512 − γ 128 ) x 256 − γ 64 x 256 + γ 64 = x 256 − γ 192 x 128 − γ 32 x 128 + γ 32 x 128 − γ 96 x 128 + γ 96 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

CRT Map of NewHope-Compact512 Z 3329 / ( x 512 − γ 128 ) x 256 − γ 64 x 256 + γ 64 x 128 − γ 32 x 128 + γ 32 x 128 − γ 96 x 128 + γ 96 . . . . . . . . . . . . x 8 − γ 2 x 8 + γ 126 · · · x 4 − γ x 4 + γ x 4 − γ 127 x 4 + γ 127 · · · Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

CRT Map of NewHope-Compact1024 Z 3329 / ( x 1024 − γ 128 ) x 512 − γ 64 x 512 + γ 64 x 256 − γ 32 x 256 + γ 32 x 256 − γ 96 x 256 + γ 96 . . . . . . . . . . . . x 16 − γ 2 x 16 + γ 126 · · · x 8 − γ x 8 + γ x 8 − γ 127 x 8 + γ 127 · · · Yusuf Alper Bilgin NewHope-Compact October 3, 2019 11 / 20

Karatsuba Multiplication with Reduction Let a , b and c ∈ Z q / ( X 4 − r ) where r = γ i . 1: function basemul( a , b ) d ← Apply One-Iteration Karatsuba 1 to get d = a · b where d is a 2: degree 6 polynomial c [0] ← d [0] + d [4] · r ⊲ + and · for modular reduction 3: c [1] ← d [1] + d [5] · r 4: c [2] ← d [2] + d [6] · r 5: c [3] ← d [3] 6: return c 7: 8: end function 1 Weimerskirch and Paar, ePrint 2006/224 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 12 / 20

Computation Costs of Polynomial Multiplications Z 3329 / ( x 512 + 1) ❛❛❛❛❛❛❛❛❛❛❛❛ Operations # of Multiplications # of Additions Multiplication Methods Hybrid NTT-Schoolbook 7808 12288 Multiplication Hybrid NTT-Karatsuba 7040 14592 Multiplication Yusuf Alper Bilgin NewHope-Compact October 3, 2019 13 / 20

Computation Costs of Polynomial Multiplications Z 3329 / ( x 512 + 1) ❛❛❛❛❛❛❛❛❛❛❛❛ Operations # of Multiplications # of Additions Multiplication Methods Hybrid NTT-Schoolbook 7808 12288 Multiplication Hybrid NTT-Karatsuba 7040 14592 Multiplication Cycle counts ( × 10 3 ) Method Schoolbook 21,7 Karatsuba 14,2 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 13 / 20

Parameter Sets Table: Parameters of n=512 Parameter Set Newhope512 NH-Compact512 Dimension n 512 512 Modulus q 12289 3329 Noise Parameter k 8 2 Table: Parameters of n=1024 Parameter Set Newhope1024 NH-Compact1024 Dimension n 1024 1024 Modulus q 12289 3329 Noise Parameter k 8 2 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 14 / 20

Sizes in bytes 512-CCA-KEM Parameter Set NewHope NewHope-Compact | pk | 928 800 | sk | 1888 1632 | ciphertext | 1120 992 1024-CCA-KEM Parameter Set NewHope NewHope-Compact | pk | 1824 1568 | sk | 3680 3168 | ciphertext | 2208 2080 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 15 / 20

Cycle counts ( × 10 3 ) of C reference (non-optimized) implementations CCA-KEM-512 Operations Kyber NewHope NewHope-Compact 121 . 6 119 . 2 89 . 3 Gen Encaps 164 180 . 2 147 197 . 5 203 . 4 176 . 1 Decaps Total 483 . 1 502 . 8 412 . 4 CCA-KEM-1024 Operations Kyber NewHope NewHope-Compact 324 . 6 237 . 8 186 . 4 Gen 381 . 4 365 . 2 321 . 8 Encaps Decaps 431 . 4 417 . 5 395 Total 1137 . 4 1020 . 5 902 . 2 Performed on Intel Skylake Core i7-6500U Yusuf Alper Bilgin NewHope-Compact October 3, 2019 16 / 20

NewHope-Compact768 Inspired by NTTRU 1 Z 3457 / ( X 768 − X 384 + 1) and let ζ 1 and ζ 2 are two primitive sixth root of unity. Z 3457 / ( X 768 − X 384 + 1) Z 3457 / ( x 384 − ζ 1 ) Z 3457 / ( x 384 − ζ 2 ) 1 Lyubashevsky and Seiler, CHES 2019 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 17 / 20