Compact and Simple RLWE Based Key Encapsulation Mechanism Erdem Alkm - - PowerPoint PPT Presentation

▶
compact and simple rlwe based key encapsulation mechanism
SMART_READER_LITE
LIVE PREVIEW

Compact and Simple RLWE Based Key Encapsulation Mechanism Erdem Alkm - - PowerPoint PPT Presentation

Jan 10, 2024 23 likes •418 views

Compact and Simple RLWE Based Key Encapsulation Mechanism Erdem Alkm 1 Yusuf Alper Bilgin 2,3 Murat Cenk 3 1 Department of Computer Engineering, Ondokuz Mays University, Turkey 2 Aselsan Inc., Turkey 3 Institude of Applied Mathematics, Middle

slide-1
SLIDE 1

Compact and Simple RLWE Based Key Encapsulation Mechanism

Erdem Alkım1 Yusuf Alper Bilgin2,3 Murat Cenk3

1 Department of Computer Engineering, Ondokuz Mayıs University, Turkey 2 Aselsan Inc., Turkey 3 Institude of Applied Mathematics, Middle East Technical University, Turkey

y.alperbilgin@gmail.com

October 3, 2019

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 1 / 20

slide-2
SLIDE 2

Overview

1

Introduction

2

Implementation Details

3

Results

4

Future Works

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 2 / 20

slide-3
SLIDE 3

NIST PQC Standardization Project

Moody, PQC Workshop, 2019 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 3 / 20

slide-4
SLIDE 4

RLWE based KEM - Newhope

Alkim et al., ePrint 2016/1157 Yusuf Alper Bilgin NewHope-Compact October 3, 2019 4 / 20

slide-5
SLIDE 5

Multiplication Algorithms

Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

slide-6
SLIDE 6

Multiplication Algorithms

Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT:

  • High performance

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

slide-7
SLIDE 7

Multiplication Algorithms

Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT:

  • High performance
  • Memory efficient

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

slide-8
SLIDE 8

Multiplication Algorithms

Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT:

  • High performance
  • Memory efficient
  • Randoms directly sampled in

NTT domain

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

slide-9
SLIDE 9

Multiplication Algorithms

Fast multiplication algorithms: NTT, Karatsuba and Tom-Cook Advantages of NTT:

  • High performance
  • Memory efficient
  • Randoms directly sampled in

NTT domain Disadvantages:

  • Limited parametrization

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 5 / 20

slide-10
SLIDE 10

NewHope-Compact

  • A smaller and faster instantiation of NewHope

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

slide-11
SLIDE 11

NewHope-Compact

  • A smaller and faster instantiation of NewHope
  • Utilizing recent advances on NTT

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

slide-12
SLIDE 12

NewHope-Compact

  • A smaller and faster instantiation of NewHope
  • Utilizing recent advances on NTT
  • Reduce parameter q (12289 → 3329)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

slide-13
SLIDE 13

NewHope-Compact

  • A smaller and faster instantiation of NewHope
  • Utilizing recent advances on NTT
  • Reduce parameter q (12289 → 3329)
  • Hybrid polynomial multiplication (NTT + Karatsuba)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

slide-14
SLIDE 14

NewHope-Compact

  • A smaller and faster instantiation of NewHope
  • Utilizing recent advances on NTT
  • Reduce parameter q (12289 → 3329)
  • Hybrid polynomial multiplication (NTT + Karatsuba)
  • Achieving a security level equivalent to Kyber768

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 6 / 20

slide-15
SLIDE 15

Number Theoretic Transform

a ∈ Zq[X] /(X n + 1) NTT(a) = ˆ a =

n−1

  • i=0

ˆ aiX i, where ˆ ai =

n−1

  • j=0

ajωij mod q NTT−1(ˆ a) = a =

n−1

  • i=0

aiX i, where ai =

  • n−1

n−1

  • j=0

ˆ ajω−ij mod q where ωn = 1 mod q

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 7 / 20

slide-16
SLIDE 16

Number Theoretic Transform

a ∈ Zq[X] /(X n + 1) NTT(a) = ˆ a =

n−1

  • i=0

ˆ aiX i, where ˆ ai =

n−1

  • j=0

ajωij mod q NTT−1(ˆ a) = a =

n−1

  • i=0

aiX i, where ai =

  • n−1

n−1

  • j=0

ˆ ajω−ij mod q where ωn = 1 mod q

Polynomial Multiplication

c = NTT −1(NTT (a) ◦ NTT (b)) where a, b, c ∈ Rq

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 7 / 20

slide-17
SLIDE 17

Butterflies

x(0) x(1) ˆ x(0) ˆ x(1)

  • 1

× γi

Figure: Cooley-Tukey Butterfly

x(0) x(1) ˆ x(0) ˆ x(1)

  • 1

× γi

Figure: Gentleman-Sande Butterfly

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 8 / 20

slide-18
SLIDE 18

CRT Map of NewHope512

Let γ512 = −1 mod 12289. Z12289/(x512 + 1) ∼ = Z12289/(x − γ) × · · · × Z12289/(x − γ511)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

slide-19
SLIDE 19

CRT Map of NewHope512

Let γ512 = −1 mod 12289. Z12289/(x512 + 1) ∼ = Z12289/(x − γ) × · · · × Z12289/(x − γ511) Z12289/(x512 + 1) = Zq/(x512 − γ512) Z12289/(x256 − γ256) Z12289/(x256 + γ256)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

slide-20
SLIDE 20

CRT Map of NewHope512

Z12289/(x512 − γ512) x256 − γ256 x128 − γ128 x128 + γ128 x256 + γ256 = x256 − γ768 x128 − γ768 x128 + γ768

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

slide-21
SLIDE 21

CRT Map of NewHope512

Z12289/(x512 − γ512) x256 − γ256 x128 − γ128 . . . x2 − γ2 x − γ x + γ x128 + γ128 . . . x256 + γ256 x128 − γ768 . . . x128 + γ768 . . . x2 + γ510 x − γ511 x + γ511 · · · · · ·

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 9 / 20

slide-22
SLIDE 22

CRT Map of NewHope-Compact512

Let γ128 = −1 mod 3329. Z3329/(x512 + 1) ∼ = Z3329/(x4 − γ) × · · · × Z3329/(x4 − γ127)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

slide-23
SLIDE 23

CRT Map of NewHope-Compact512

Let γ128 = −1 mod 3329. Z3329/(x512 + 1) ∼ = Z3329/(x4 − γ) × · · · × Z3329/(x4 − γ127) Z3329/(x512 + 1) = Z3329/(x512 − γ128) Z3329/(x256 − γ64) Z3329/(x256 + γ64)

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

slide-24
SLIDE 24

CRT Map of NewHope-Compact512

Z3329/(x512 − γ128) x256 − γ64 x128 − γ32 x128 + γ32 x256 + γ64 = x256 − γ192 x128 − γ96 x128 + γ96

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

slide-25
SLIDE 25

CRT Map of NewHope-Compact512

Z3329/(x512 − γ128) x256 − γ64 x128 − γ32 . . . x8 − γ2 x4 − γ x4 + γ x128 + γ32 . . . x256 + γ64 x128 − γ96 . . . x128 + γ96 . . . x8 + γ126 x4 − γ127 x4 + γ127 · · · · · ·

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 10 / 20

slide-26
SLIDE 26

CRT Map of NewHope-Compact1024

Z3329/(x1024 − γ128) x512 − γ64 x256 − γ32 . . . x16 − γ2 x8 − γ x8 + γ x256 + γ32 . . . x512 + γ64 x256 − γ96 . . . x256 + γ96 . . . x16 + γ126 x8 − γ127 x8 + γ127 · · · · · ·

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 11 / 20

slide-27
SLIDE 27

Karatsuba Multiplication with Reduction

Let a, b and c ∈ Zq/(X 4 − r) where r = γi.

1: function basemul(a, b) 2:

d ← Apply One-Iteration Karatsuba1 to get d = a · b where d is a degree 6 polynomial

3:

c[0] ← d[0] + d[4] · r ⊲ + and · for modular reduction

4:

c[1] ← d[1] + d[5] · r

5:

c[2] ← d[2] + d[6] · r

6:

c[3] ← d[3]

7:

return c

8: end function

1 Weimerskirch and Paar, ePrint 2006/224

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 12 / 20

slide-28
SLIDE 28

Computation Costs of Polynomial Multiplications

Z3329/(x512 + 1) ❛❛❛❛❛❛❛❛❛❛❛❛

Multiplication Methods Operations

# of Multiplications # of Additions

Hybrid NTT-Schoolbook Multiplication

7808 12288

Hybrid NTT-Karatsuba Multiplication

7040 14592

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 13 / 20

slide-29
SLIDE 29

Computation Costs of Polynomial Multiplications

Z3329/(x512 + 1) ❛❛❛❛❛❛❛❛❛❛❛❛

Multiplication Methods Operations

# of Multiplications # of Additions

Hybrid NTT-Schoolbook Multiplication

7808 12288

Hybrid NTT-Karatsuba Multiplication

7040 14592 Method Cycle counts (×103) Schoolbook 21,7 Karatsuba 14,2

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 13 / 20

slide-30
SLIDE 30

Parameter Sets

Table: Parameters of n=512

Parameter Set Newhope512 NH-Compact512 Dimension n 512 512 Modulus q 12289 3329 Noise Parameter k 8 2

Table: Parameters of n=1024

Parameter Set Newhope1024 NH-Compact1024 Dimension n 1024 1024 Modulus q 12289 3329 Noise Parameter k 8 2

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 14 / 20

slide-31
SLIDE 31

Sizes in bytes

Parameter Set 512-CCA-KEM NewHope NewHope-Compact |pk| 928 800 |sk| 1888 1632 |ciphertext| 1120 992 Parameter Set 1024-CCA-KEM NewHope NewHope-Compact |pk| 1824 1568 |sk| 3680 3168 |ciphertext| 2208 2080

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 15 / 20

slide-32
SLIDE 32

Cycle counts (×103) of C reference (non-optimized) implementations

Operations CCA-KEM-512 Kyber NewHope NewHope-Compact Gen 121.6 119.2 89.3 Encaps 164 180.2 147 Decaps 197.5 203.4 176.1 Total 483.1 502.8 412.4 Operations CCA-KEM-1024 Kyber NewHope NewHope-Compact Gen 324.6 237.8 186.4 Encaps 381.4 365.2 321.8 Decaps 431.4 417.5 395 Total 1137.4 1020.5 902.2

Performed on Intel Skylake Core i7-6500U

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 16 / 20

slide-33
SLIDE 33

NewHope-Compact768

Inspired by NTTRU 1 Z3457/(X 768 − X 384 + 1) and let ζ1 and ζ2 are two primitive sixth root of unity. Z3457/(X 768 − X 384 + 1) Z3457/(x384 − ζ1) Z3457/(x384 − ζ2)

1 Lyubashevsky and Seiler, CHES 2019

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 17 / 20

slide-34
SLIDE 34

CRT Map of NewHope-Compact768

Let γ384 = 1 mod 3457. Then, ζ1 ≡ γ64 mod 3457 and ζ2 ≡ γ320 mod 3457

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 17 / 20

slide-35
SLIDE 35

CRT Map of NewHope-Compact768

Let γ384 = 1 mod 3457. Then, ζ1 ≡ γ64 mod 3457 and ζ2 ≡ γ320 mod 3457 ζ1 + ζ2 = 1 Z3457/(x768 − x384 + 1) x384 − γ64 x192 − γ32 x192 + γ32 x384 − γ320 = x384 + (γ64 − 1) x192 − γ160 x192 + γ160

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 17 / 20

slide-36
SLIDE 36

CRT Map of NewHope-Compact768

Z3457/(x768 − x384 + 1 x384 − γ64 x192 − γ32 . . . x12 − γ2 x6 − γ x6 + γ x192 + γ32 . . . x384 − γ320 x192 − γ160 . . . x192 + γ160 . . . x12 + γ190 x6 − γ191 x6 + γ191 · · · · · ·

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 17 / 20

slide-37
SLIDE 37

Cycle counts (×103) of C reference (non-optimized) implementations

Our ring is Z3457/(X 768 − X 384 + 1) Operations CCA-KEM-768 Kyber NewHope NewHope-Compact Gen 208.8

  • 137.9

Encaps 254.8

  • 228.9

Decaps 294.7

  • 277.8

Total 758.3

  • 644.6

Performed on Intel Skylake Core i7-6500U

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 18 / 20

slide-38
SLIDE 38

Future Works

  • AVX2 implementation
  • ARM Cortex-M4 implementation

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 19 / 20

slide-39
SLIDE 39

Thank you

Source code available online at www.github.com/erdemalkim/NewHopeCompact and www.github.com/alperbilgin/NewHopeCompact. y.alperbilgin@gmail.com

Yusuf Alper Bilgin NewHope-Compact October 3, 2019 20 / 20