Cryptography for Embedded Devices Tobias Oder Ruhr-University - - PowerPoint PPT Presentation

▶
cryptography for embedded devices
SMART_READER_LITE
LIVE PREVIEW

Cryptography for Embedded Devices Tobias Oder Ruhr-University - - PowerPoint PPT Presentation

Mar 11, 2024 318 likes •607 views

Efficient Implementation of Lattice-based Cryptography for Embedded Devices Tobias Oder Ruhr-University Bochum Workshop on Cryptography for the 09.11.2017 Internet of Things and Cloud 2017 Lattice-based Cryptography Set of vectors in n

slide-1
SLIDE 1

09.11.2017

Efficient Implementation of Lattice-based Cryptography for Embedded Devices

Tobias Oder Ruhr-University Bochum

Workshop on Cryptography for the Internet of Things and Cloud 2017

slide-2
SLIDE 2

2 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Set of vectors in n-dimensional space define a basis

Lattice-based Cryptography

slide-3
SLIDE 3

3 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Efficiency
  • Scalability
  • Versatility

– Encryption – Digital signatures – Key exchange – Advanced constructions (IBE, FHE,…)

Lattice-based Cryptography

slide-4
SLIDE 4

4 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Given A and b = As Task: Find s ➢ Easy to solve

Learning with Errors

slide-5
SLIDE 5

5 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Given A and b = As Task: Find s ➢ Easy to solve Given A and b = As + e Task: Find s ➢ Hard problem

Learning with Errors

slide-6
SLIDE 6

6 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Standard or random lattices

  • Unstructured matrices
  • Main Operation: matrix-vector multiplication

Lattice Classes

slide-7
SLIDE 7

7 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Standard or random lattices

  • Unstructured matrices
  • Main Operation: matrix-vector multiplication

Ring or ideal lattices

  • Smaller parameters
  • Faster implementations
  • Smaller implementations
  • Main Operation: polynomial multiplication

But less trust in security due to structure!

Lattice Classes

slide-8
SLIDE 8

8 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Idea: Find a trade-off between the advantages of both classes Main operation: Matrix-vector multiplication

  • But matrix elements are polynomials!

Module Lattices

Efficiency Security

slide-9
SLIDE 9

9 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Non-exhaustive list

Schemes

Encryption Signature Key Exchange Standard Lattices LWE Encrypt TESLA Bai-Galbraith GPV Frodo Ideal Lattices Ring-LWE Encrypt NTRU Encrypt BLISS GLP Ring-TESLA „A new hope“ Module Lattices Kyber Dilithium Dilithium-G CCA2-secure Kyber

slide-10
SLIDE 10

10 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Non-exhaustive list

Schemes

Encryption Signature Key Exchange Standard Lattices LWE Encrypt TESLA Bai-Galbraith GPV Frodo Ideal Lattices Ring-LWE Encrypt NTRU Encrypt BLISS GLP Ring-TESLA „A new hope“ Module Lattices Kyber Dilithium Dilithium-G CCA2-secure Kyber

slide-11
SLIDE 11

11 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Non-exhaustive list

Schemes

Encryption Signature Key Exchange Standard Lattices LWE Encrypt TESLA Bai-Galbraith GPV Frodo Ideal Lattices Ring-LWE Encrypt NTRU Encrypt BLISS GLP Ring-TESLA „A new hope“ Module Lattices Kyber Dilithium Dilithium-G CCA2-secure Kyber

slide-12
SLIDE 12

12 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • What are the goals?

– Throughput/latency – Code size/area – Power/energy

Implementation on Embedded Devices

slide-13
SLIDE 13

13 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • What are the goals?

– Throughput/latency – Code size/area – Power/energy

  • Cross-disciplinary work and interaction between engineers and

cryptographers required

– Parameter selection and design decisions can make schemes more efficient but also weaker

Implementation on Embedded Devices

slide-14
SLIDE 14

14 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • What are the goals?

– Throughput/latency – Code size/area – Power/energy

  • Cross-disciplinary work and interaction between engineers and

cryptographers required

– Parameter selection and design decisions can make schemes more efficient but also weaker

  • Cover side-channels

– Timing, Cache, Simple Power Analysis – Differential Power Analysis, EM

Implementation on Embedded Devices

slide-15
SLIDE 15

15 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Polynomial multiplication is a major building block for ideal and

module lattice-based cryptography

  • NTT is a fast Fourier transform in integer rings

– Polynomial multiplication in O(n log n) instead of O(n²)

NTT

slide-16
SLIDE 16

16 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Polynomial multiplication is a major building block for ideal and

module lattice-based cryptography

  • NTT is a fast Fourier transform in integer rings

– Polynomial multiplication in O(n log n) instead of O(n²)

  • Powers of primitive root of unitiy ω („twiddle factors“) required

– Stored in tables – Computed on-the-fly

NTT

slide-17
SLIDE 17

17 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Polynomial multiplication is a major building block for ideal and

module lattice-based cryptography

  • NTT is a fast Fourier transform in integer rings

– Polynomial multiplication in O(n log n) instead of O(n²)

  • Powers of primitive root of unitiy ω („twiddle factors“) required

– Stored in tables – Computed on-the-fly

  • Core operation is a so-called „butterfly“

– Gentleman-Sande – Cooley-Tukey

NTT

slide-18
SLIDE 18

18 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

NTT

slide-19
SLIDE 19

19 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

NTT

slide-20
SLIDE 20

20 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Gaussian Sampling

Rejection Sampling Bernoulli Sampling Knuth-Yao Sampling Cumulative Distribution Table (CDT) Sampling

slide-21
SLIDE 21

21 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Plain Ring-LWE encryption is only secure against chosen-

plaintext attackers (CPA)

  • Many use cases require security against chosen-ciphertext

attackers (CCA)

– Attacker has access to a decryption oracle

  • Generic Fujisaki-Okamoto transform

– Tweak by Targhi and Unruh for post-quantum security – Expensive re-encryption in decryption

CCA2-Security

slide-22
SLIDE 22

22 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Components to be masked in CCA2-secure Ring-LWE

  • PRNG/Hash
  • NTT
  • Sampler
  • Encoding/Decoding

See our implementation: ia.cr/2016/1109 together with Tobias Schneider, Thomas Pöppelmann, and Tim Güneysu

Masking Ring-LWE

slide-23
SLIDE 23

23 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Demand for advanced security services (e.g., smart

environments)

  • Concept: Extend asymmetric encryption scheme based on public

identifier IDX (e.g., given name, MAC, e-mail address, etc.)

Identity-based Encryption (IBE)

Enc(PKM, IDB, msg) Master Authority PKM, SKM

Trusted Third Party (TTP)

PKM, SKA PKM, SKB Alice Bob

IDA IDB

slide-24
SLIDE 24

24 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Implementation of encryption and decryption of [DPL14] feasible
  • n embedded devices
  • Key generation memory-wise and computationally expensive

[DPL14] Efficient Identity-Based Encryption over NTRU Lattices, Léo Ducas, Thomas Prest, Vadim Lyubashevsky, ASIACRYPT 2014

IBE Implementation

slide-25
SLIDE 25

25 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

  • Implementation of encryption and decryption of [DPL14] feasible
  • n embedded devices
  • Key generation memory-wise and computationally expensive
  • Cortex-M4 microcontroller

– Enc/Dec: 6/2 ms

  • Spartan6 FPGA

– Enc/Dec: 80/54 µs

[DPL14] Efficient Identity-Based Encryption over NTRU Lattices, Léo Ducas, Thomas Prest, and Vadim Lyubashevsky, ASIACRYPT 2014

IBE Implementation

slide-26
SLIDE 26

26 Implementation of Lattice Crypto| Tobias Oder | Ruhr-University Bochum | 09.11.2017

Lattice-based cryptography is practical on embedded devices! Future Work

  • Side-channel security
  • Efficient IBE key generation
  • More cryptanalysis

Conclusion

slide-27
SLIDE 27

Thank You For Your Attention!