Efficient Implementations of MQPKS Peter Czypek,Stefan Heyse, Enrico - - PowerPoint PPT Presentation

▶
efficient implementations of mqpks
SMART_READER_LITE
LIVE PREVIEW

Efficient Implementations of MQPKS Peter Czypek,Stefan Heyse, Enrico - - PowerPoint PPT Presentation

Oct 22, 2023 542 likes •966 views

Efficient Implementations of MQPKS on Constrained Devices Efficient Implementations of MQPKS Peter Czypek,Stefan Heyse, Enrico Thomae on Constrained Devices Peter Czypek, Stefan Heyse, Enrico Thomae CHES2012 11.09.2012 Ruhr-University Bochum |

slide-1
SLIDE 1

1 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Efficient Implementations of MQPKS

  • n Constrained Devices

Peter Czypek, Stefan Heyse, Enrico Thomae

CHES2012

11.09.2012

slide-2
SLIDE 2

2 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Motivation

  • Quantum computers can solve Discrete Logarithm problem and

Factorization problem

  • Alternatives must be found
  • MQ based cryptography is one solution
  • Many MQ schemes were partially or fully broken in the past
  • Few implementations exist of the remaining schemes
  • Fair comparison of schemes was only possible theoretically
slide-3
SLIDE 3

3 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Goals

  • Implement
  • all currently secure schemes
  • with the same security level
  • configurable code
  • including all currently known optimizations
  • Show that MQ schemes are a good alternative to current schemes?
slide-4
SLIDE 4

4 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

MQ Signature Schemes - Basics

  • sign() maps the message to signature with the secret key
  • verify() maps the signature to message with the public key
  • If the verification result is not the original message, the signature is invalid
  • sign and verify are inverses of each other
  • verify(sign(message)) = message
slide-5
SLIDE 5

5 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

MQ Signature Schemes - Basics

  • Four maps exist in a general MQ scheme: P, S, F, and T
  • P is the composition of S, F, and T and is the public key, P = T ○ F ○ S
  • S, F, and T are the secret key

sign

Inversion ¡of ¡P ¡is ¡hard ¡because ¡P ¡is ¡a ¡large ¡MQ ¡system ¡

verify

slide-6
SLIDE 6

6 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Schemes

UOV Invert F Invert S Rainbow Invert T Invert F Invert S enTTS Invert T Invert F Invert S

slide-7
SLIDE 7

7 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Linear Maps

  • Maps or transformations can also be seen as functions
  • There exist two types of maps in MQ schemes: linear and MQ maps
  • Linear maps mix variables and therefore “hide” existing structure
slide-8
SLIDE 8

8 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Linear Maps

  • S and T can be inverted by matrix inversion
  • Matrix inversion can be done by Gaussian elimination algorithm for each

column of identity matrix

  • Inversion of a linear map is matrix vector multiplication with the inverse

T -1

slide-9
SLIDE 9

9 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Schemes

UOV Invert F Invert S Rainbow Invert T Invert F Invert S enTTS Invert T Invert F Invert S

slide-10
SLIDE 10

10 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

MQ Maps

  • F and P are MQ maps
  • P has no special structure and is large, therefore hard to invert
  • A special structure in F is necessary to allow easy inversion
  • This special structure is hidden by S and T

3 x1x1 + 8 x1x2 + 5x1x3 + 8 x2x2 + 6x2x3 + 2x3x3 = m1 1 x1x1 + 7 x1x2 + 9x1x3 + 3 x2x2 + 7x2x3 + 2x3x3 = m2

slide-11
SLIDE 11

11 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - UOV

  • Two variable groups: Oil & Vinegar
  • Fix vinegar variables to make

system linear

  • A quadratic linear equation

system remains after fixing

  • Apply Gaussian elimination

to get a solution for the oil variables

slide-12
SLIDE 12

12 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Schemes

UOV Invert F Invert S Rainbow Invert T Invert F Invert S enTTS Invert T Invert F Invert S

slide-13
SLIDE 13

13 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - Rainbow

  • Two or more layers (like a Rainbow)
  • Solve first layer as normal UOV instance
  • In next layer fix vinegar variables

not randomly but with solution from previous layer

  • Solve layer again with

Gaussian elimination

Rainbow(3,2,4) : x1 x2 x3 x4 x5 x6 x7 x8 x9

slide-14
SLIDE 14

14 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Schemes

UOV Invert F Invert S Rainbow Invert T Invert F Invert S enTTS Invert T Invert F Invert S

slide-15
SLIDE 15

15 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - enTTS

slide-16
SLIDE 16

16 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps – enTTS

slide-17
SLIDE 17

17 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - enTTS

  • enTTS Layer 1:
  • Fix x1 to x7 randomly
  • Multiply with coefficients to get a LES
  • Solve with Gaussian elimination

enTTS(20,28) : x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24 x25 x26 x27

slide-18
SLIDE 18

18 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - enTTS

  • enTTS Layer 2:
  • Can be solved directly

enTTS(20,28) : x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24 x25 x26 x27

slide-19
SLIDE 19

19 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Inverting Central Maps - enTTS

  • enTTS Layer 3:
  • Fix x0 randomly
  • Multiply already known values with coefficients to get a LES
  • Solve LES

enTTS(20,28) : x0 x1 x2 x3 x4 x5 x6 x7 x8 x9 x10 x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24 x25 x26 x27

slide-20
SLIDE 20

20 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Schemes

UOV Invert F Invert S Rainbow Invert T Invert F Invert S enTTS Invert T Invert F Invert S

slide-21
SLIDE 21

21 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Optimizations - Reduced Polynomials

  • Leaving out linear and constant terms in polynomials saves time and space
  • Can be applied to UOV and Rainbow
  • In the linear transformations the constant parts are also left out
slide-22
SLIDE 22

22 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Optimizations - Self Invertible Linear Maps

  • In case of UOV and Rainbow S can be chosen of the form:
  • S is self invertible S-1 = S ,so no inversion is necessary.
  • Multiplications in UOV signature generation are reduced from n·n to o·v
  • Private key is smaller
slide-23
SLIDE 23

23 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Optimizations - 0/1 UOV

  • 0/1 UOV is an optimization for UOV
  • Petzold, Thomae, Wolf et. al

showed that large parts of the public key can be chosen randomly fixed

  • This part can be treated as a system

parameter and is not part of the public key anymore

  • Faster verification is possible because the

arithmetic in GF(2) is easier: 1= copy or 0 = not

  • An additional check is necessary if an

element is from GF(2) or GF(28)

  • Key generation: First choose P and then calculate F
slide-24
SLIDE 24

24 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Implementation - Central Map Memory Mapping

  • Keys are saved without zeros
  • Serial read out using pointer++
slide-25
SLIDE 25

25 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Implementation – Exponential Representation

  • GF(28) arithmetic with table look up
  • Multiplication is addition in exponent mod (2m-1)
  • Saving memory access by keeping temporary results in exponential

representation when next operation is a multiplication

  • Keys are saved in exponential representation, too.

mul(a,b) = exp(log(a)+log(b) mod (2m-1)) 3 pgm_read()

mul( mul(a,b) , c ) = exp( log[ exp(log(a)+log(b) mod (2m-1)) ]+log[c] mod (2m-1)) 6 pgm_read() mul( mul(a,b) , c ) = exp( (log(a)+log(b) mod (2m-1)) +log[c] mod (2m-1)) 4 pgm_read()

slide-26
SLIDE 26

26 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Implementation – Generic Code

  • Heavy use of #define
  • Code generator for enTTS
  • Increasing parameters is

very easy

slide-27
SLIDE 27

27 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Comparison – Parameter Choice

  • Due to the 8bit micro controller GF(28) was chosen as the field
  • To be able to compare the schemes on equal conditions parameters for

equal security levels are necessary

  • For every scheme exist different attacks
slide-28
SLIDE 28

28 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Comparison - Sign

slide-29
SLIDE 29

29 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Comparison - Verify

slide-30
SLIDE 30

30 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Comparison – Other Schemes

  • Our implementations:
  • enTTS(5,20,28) [security < 264] sign in 4.79 ms / verify 35.22 ms
  • enTTS(9,36,52) [280] sign in 19.03 ms / verify in 208.07 ms
  • Rainbow(18,13,17) [280] sign in 54.38 ms / verify in 69.19 ms
  • Other schemes:
slide-31
SLIDE 31

31 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Conclusion

enTTS Signature time Secret key size Rainbow Verification time Public key size UOV & 0/1 UOV Code size (Public key size)

slide-32
SLIDE 32

32 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Future aspects

  • 0/1 UOV could be improved by using a generated or cyclic system parameter

instead a fixed one

  • 0/1 UOV could save 8 elements in one byte instead of saving 1 bit in a byte
  • The focus of this work was on fast schemes, the code size / time trade-off

could be investigated further

  • Assembler implementations could speed up the schemes even more
slide-33
SLIDE 33

33 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Thank you for your attention. Any Questions?

slide-34
SLIDE 34

34 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

Optimizations - 0/1 UOV

  • To prevent a reduction of the key to

elements only from GF(2), a special monomial ordering is necessary

  • Elements must be combined in a way that

even when many GF(28) elements are fixed the key has still elements from GF(28)

slide-35
SLIDE 35

35 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Complementary Turań Graph

slide-36
SLIDE 36

36 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Choosing S

slide-37
SLIDE 37

37 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Choosing B from GF2

slide-38
SLIDE 38

38 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Calculating A

slide-39
SLIDE 39

39 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Inverting A

slide-40
SLIDE 40

40 Efficient Implementations of MQPKS on Constrained Devices Peter Czypek,Stefan Heyse, Enrico Thomae Ruhr-University Bochum | Embedded Security

0/1 UOV Key Gen – Calculating F and P