Skip to content

Standard Lattice-Based Key Encapsulation on Embedded Devices

Research output: Contribution to journalArticle

  • James Howe
  • Tobias Oder
  • Markus Krausz
  • Tim Güneysu
Original languageEnglish
JournalIACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES)
Volume2018
Issue number3
DOIs
DateAccepted/In press - 14 Jul 2018
DatePublished (current) - 16 Aug 2018

Abstract

Lattice-based cryptography is one of the most promising candidates being considered to replace current public-key systems in the era of quantum computing. In 2016, Bos et al. proposed the key exchange scheme FrodoCCS, that is also a submission to the NIST post-quantum standardization process, modified as a key encapsulation mechanism (FrodoKEM). The security of the scheme is based on standard lattices and the learning with errors problem. Due to the large parameters, standard latticebased schemes have long been considered impractical on embedded devices. The FrodoKEM proposal actually comes with parameters that bring standard lattice-based cryptography within reach of being feasible on constrained devices. In this work, we take the final step of efficiently implementing the scheme on a low-cost FPGA and microcontroller devices and thus making conservative post-quantum cryptography practical on small devices. Our FPGA implementation of the decapsulation (the computationally most expensive operation) needs 7,220 look-up tables (LUTs), 3,549 flip-flops (FFs), a single DSP, and only 16 block RAM modules. The maximum clock frequency is 162 MHz and it takes 20.7 ms for the execution of the decapsulation. Our microcontroller implementation has a 66% reduced peak stack usage in comparison to the reference implementation and needs 266 ms for key pair generation, 284 ms for encapsulation, and 286 ms for decapsulation. Our results contribute to the practical evaluation of a post-quantum standardization candidate.

Download statistics

No data available

Documents

Documents

  • Full-text PDF (final published version)

    Rights statement: This is the final published version of the article (version of record). It first appeared online via IACR Transactions on Cryptographic Hardware and Embedded Systems at https://doi.org/10.13154/tches.v2018.i3.372-393 . Please refer to any applicable erms of use of the publisher.

    Final published version, 951 KB, PDF document

    Licence: CC BY

Links

DOI

View research connections

Related faculties, schools or groups