Parameterized Hardware Accelerators for Lattice-Based Cryptography - PowerPoint PPT Presentation

Parameterized Hardware Accelerators for Lattice-Based Cryptography and Their Application to the HW/SW Co-Design of qTESLA Wen Wang , Shanquan Tian, Bernhard Jungk, Nina Bindel, Patrick Longa, and Jakub Szefer CHES 2020 – September 14, 2020

Outline • Yet another hardware design for a lattice-based scheme? • qTESLA • Hardware blocks • Binary-search CDT sampler • NTT-based polynomial multiplier • Software-hardware co-design on RISC-V • Evaluation 1

Yet another hardware design for a lattice-based scheme? 2

Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 3

Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 4

Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 5

Existing lattice-based hardware designs Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Flexible N/A co-design 6

Our new lattice-based hardware design Security architecture Lattice-based scheme Standard Hardware Existing designs Accelerated parameters IO Building blocks Partly Fixed Fixed Specific scheme N/A Specific scheme Full hardware design Fully Fixed Fixed N/A Software-hardware Specific scheme Partly Fixed Fixed N/A co-design Our new design Fully Flexible Tunable Universal applicability Portable 7

Our new lattice-based hardware design ü Full acceleration Accelerator config. ü Flexible security parameters 32/64-bit Accelerator AMBA Bus ü Tunable hardware architecture config. ü Universal applicability to lattice- Accelerator based schemes config. ü Portable among different platforms 8

qTESLA 9

qTESLA Round 2 Reference C submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 10

qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 11

qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ standardization liboqs library BouncyCastle library See qtesla.org 12

qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ ü Simple arithmetic operations standardization liboqs library BouncyCastle library See qtesla.org 13

qTESLA ü Secure against classical and quantum adversaries Round 2 Reference C ü Implementation security submission in implementation PQ ü Simple arithmetic operations standardization ü Provable-secure parameters liboqs library BouncyCastle Parameter set Public key size (in B) Signature size (in B) library qTESLA-p-I 14, 880 2, 592 qTESLA-p-III 38, 432 5, 664 See qtesla.org 14

qTESLA‘s sign and verify Signature generation Input: sk, m Output: signature z, c 15

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Output: signature z, c 16

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Output: signature z, c 17

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify Output: signature z, c 18

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify ü û Compute potential signature z = y + sc Output: signature z, c 19

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify ü û Compute potential signature z = y + sc Check to ensure security Output: signature z, c 20

qTESLA‘s sign and verify Signature generation Input: sk, m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c 21

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 22

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c - (pk, z, c, m) Hash c(sk, y, m) Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 23

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü Compute potential signature z = y + sc Check to ensure security û ü Output: signature z, c Output: or û ü 24

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü ü Compute potential signature z = y + sc Check to ensure security Check security property û ü Output: signature z, c Output: or û ü 25

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü ü Compute potential signature z = y + sc Check to ensure security Check security property û ü ü Output: signature z, c Output: or û ü 26

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Check c , = c ? Check to ensure acceptance during verify û ü û ü Compute potential signature z = y + sc Check to ensure security Check security property û û ü ü Output: signature z, c Output: or û ü 27

qTESLA‘s sign and verify Signature verification Signature generation Input: sk, m Input: pk, z, c , m Sample random y polynomial Hash c , (pk, z, c, m) Hash c(sk, y, m) Simple operations: • Sampling Check c , = c ? Check to ensure acceptance during verify • Hashing û ü • Comparison û ü Compute potential signature z = y + sc • Multiplication and addition Check to ensure security Check security property û û ü ü Output: signature z, c Output: or û ü 28

Hardware blocks for lattice-based schemes 29

Lattice-based hardware blocks qTESLA Key Signing Verification generation Gauss Hash Poly. Sparse poly. sampler function Multiplication multiplication (4.5%) (39.4%) (27.9%) (6.3%) Respective subroutines (% of runtime) 30

Lattice-based hardware blocks • A unified hardware core for both SHAKE-128/256 and cSHAKE-128/256 • A novel, parameterized binary-search CDT sampler in hardware • A novel, fully pipelined NTT-based polynomial multiplier • A parameterized sparse polynomial multiplier qTESLA • A lightweight Hmax-Sum module Key Signing Verification generation Gauss Hash Poly. Sparse poly. sampler function Multiplication multiplication (4.5%) (39.4%) (27.9%) (6.3%) Respective subroutines (% of runtime) 31

Lattice-based hardware blocks • A unified hardware core for both SHAKE-128/256 and cSHAKE-128/256 • A novel, parameterized binary-search CDT sampler in hardware • A novel, fully pipelined NTT-based polynomial multiplier • A parameterized sparse polynomial multiplier • A lightweight Hmax-Sum module 32