Search

As the global migration to post-quantum cryptography (PQC) continues to progress actively, in Korea, the Post-Quantum Cryptography Research Center has been established to acquire PQC technology, leading the KpqC Competition. In February 2022, the KpqC Competition issued a call for proposals for PQC algorithms. By November 2022, 16 candidates were selected for the first round (7 KEMs and 9 DSAs). Currently, Round 1 submissions are being evaluated with respect to security, efficiency, and scalability in various environments. At the current stage, evaluating the software through an analysis to improve the software quality of the first-round submissions is judged appropriately. In this paper, we present analysis results regarding performance and implementation security on based dependency-free approach of external libraries. Namely, we configure extensive tests for an analysis with no dependencies by replacing external libraries that can complicate the build process with hard coding. From the performance perspective, we provide analysis results of performance profiling, execution time, and memory usage for each of the KpqC candidates. From the implementation security perspective, we examine bugs and errors in the actual implementations using Valgrind software, a Metamorphic Testing methodology that can include wide test coverage and constant-time implementation against the timing attack. Until the KpqC standard algorithm is announced, we argue that continuous integration of extensive tests will lead to a high-level clean code of KpqC candidates.

Falcon is one of the promising digital-signature algorithms in NIST’s ongoing Post-Quantum Cryptography (PQC) standardization finalist. Computational efficiency regarding software and hardware is also the main criteria for PQC standardization. In this paper, we present an efficient Falcon software implementation on ARMv8 environment. Until now, most of the software optimization on PQC algorithms have been conducted on 32-bit ARM (Cortex-M4) and typical CPUs (Intel and AMD CPUs). However, ARMv8 including Cortex-A30, 50, and 70 series have been widely used for various IoT (Internet of Things) applications, Edge computing devices, and OBUs (On Board Units) in autonomous driving cars. For optimizing the performance of Falcon, we take full advantage of NEON engine which is a kind of parallel processing unit in ARMv8 MCU. The main computation in Falcon belongs to polynomial multiplications in Complex number domain and Integer domain. Typically, FFT (Fast Fourier Transformation)-based multiplication method and NTT (Number Theoriteic Transform)-based multiplication method have been widely used for efficient polynomial multiplications in Complex number domain and Integer domain, respectively. Thus, in order to enhance the overall performance of Falcon, we improve the FFT-based multiplication method and NTT-based multiplication method by utilizing NEON engine in ARMv8. Specifically, we parallelize the overall process (FFT/NTT transformation, pointwise multiplication, and inverse FFT/NTT transformation) of FFT-based polynomial multiplication method and NTT-based polynomial multiplication method with strategically utilizing the NEON engine and vector instructions. Furthermore, we minimize the number of redundant memory accesses during FFT/NTT-based polynomial multiplication by making the most of available registers in NEON engine. Through the proposed parallel FFT/NTT-based polynomial multiplications, the proposed Falcon software provides 15.1% (resp. 18.1%), 16.5% (resp. 17.1%), and 65.4% (resp. 69.4%) of performance improvement in keypair generation, signing, and verification at security level 1 (resp. 5) compared with the reference Falcon implementation submitted to the final round of NIST PQC competition. Furthermore, as far as we know, this is the first optimized implementation of Falcon on ARMv8 environment.

In ICISC’20 conference, PIPO (Plug-In and Plug-Out) was proposed as an efficient block cipher for secure communication in IoT (Internet of Things) environment. Although PIPO equips easily high-order masking implementation because of small non-linear operations and short rounds, PIPO is still vulnerable to fault attack. For resisting the fault attack, block cipher implementation should be applied to the fault attack countermeasure. However, these techniques make the performance of computationally-intensive cryptographic algorithms slower in constrained devices. To improve this, we propose the first fast and secure software of PIPO block cipher co-designed with ARM/NEON processor for high-speed secure communication. For accelerating the performance, we present an optimal implementation of PIPO block cipher in ARM/NEON processor, respectively, and design the Interleaved way utilizing two cores. With the proposed optimal techniques, we provide the high-speed secure software. In addition, we present an interleaving random-shuffling technique, which optimizes random-shuffling by utilizing two cores. For ensuring the resistance of fault attacks, we validated the fault resistance with the computation and instruction fault model. We utilize the intra-instruction-redundancy and known ciphertext to detect them. Through the proposed contributions, the fast software for PIPO block cipher achieves the fastest performance than previous related studies. The secure software with the fault countermeasures is nearly 3 times faster than the reference implementation without any fault attack countermeasures. In addition, our secure software achieved performance improvement of 301% and 463% compared to the existing best work (HIGHT and revised CHAM). As a result, our fast and secure software for PIPO block cipher achieved the fastest performance by co-designing with two cores compared to previous work that is utilized only one core. Our software can be utilized for high-speed encrypted communication and CTR-DRBG in ARMv8-based IoT devices.

In Internet of Things services, various types of embedded devices are employed. Among them, ARM-based devices have been widely used as clients. Since these devices communicate with each other in wirelessly, transmitted data needs to be protected with secure block ciphers. Recently, several Add-Rotate-XOR (ARX)-based block ciphers, such as HIGHT and revised CHAM, have been developed for efficient encryption on embedded devices. In this paper, we present secure and fast implementations of ARX-based block ciphers HIGHT and revised CHAM in ARMv8 platforms. For performance efficiency, we basically apply task and data parallel processing mechanism by fully utilizing NEON architecture embedded in ARMv8 platforms. Typically, it is required to duplicate round key in NEON register to utilize the NEON architecture to process multiple data blocks simultaneously. In our implementations, we propose an optimal approach minimizing the cost of round key duplication and efficient key scheduling for task parallelism. For secure implementation, we develop efficient software countermeasures against realistic fault attack models. Thus, we present efficient software countermeasure based on intra-instruction redundancy. Especially, we propose enhanced random shuffling method which is the core operation for the proposed countermeasure. With the proposed random shuffling method, we can significantly reduce the overhead for preventing fault attacks. We present two versions of the software: a version providing highly fast (HF) performance without fault attack countermeasures and a version providing highly secure (HS) against fault attacks. Compared with referenced software, HF with HIGHT, revised CHAM-64/128, CHAM-128/128, and CHAM-128/256 provides about 8 times, 38 times, 13 times and 13 times of enhanced performance, respectively. Compared with previous best results having fault attack countermeasure, HS with HIGHT, revised CHAM-64/128, CHAM-128/128, and CHAM-128/256 provides about 50%, 30%, 80%, and 70% of enhanced performance, respectively. Both our HS and HF achieve better performance and higher security compared with related works.

With the advancement of 5G mobile telecommunication, various IoT (Internet of Things) devices communicate massive amounts of data by being connected to wireless networks. Since this wireless communication is vulnerable to hackers via data leakage during communication, the transmitted data should be encrypted through block ciphers to protect the data during communication. In addition, in order to encrypt the massive amounts of data securely, it is essential to apply one of secure mode of operation. Among them, CTR (CounTeR) mode is the most widely used in industrial applications. However, these IoT devices have limited resources of computing and memory compared to typical computers, so that it is challenging to process cryptographic algorithms that have computation-intensive tasks in IoT devices at high speed. Thus, it is required that cryptographic algorithms are optimized in IoT devices. In other words, optimizing cryptographic operations on these IoT devices is not only basic but also an essential effort in order to build secure IoT-based service systems. For efficient encryption on IoT devices, even though several ARX (Add-Rotate-XOR)-based ciphers have been proposed, it still necessary to improve the performance of encryption for smooth and secure IoT services. In this article, we propose the first parallel implementations of CTR mode of ARX-based ciphers: LEA (Lightweight Encryption Algorithm), HIGHT (high security and light weight), and revised CHAM on the ARMv8 platform, a popular microcontroller in various IoT applications. For the parallel implementation, we propose an efficient data parallelism technique and register scheduling, which maximizes the usage of vector registers. Through proposed techniques, we process the maximum amount of encryption simultaneously by utilizing all vector registers. Namely, in the case of HIGHT and revised CHAM-64/128 (resp. LEA, revised CHAM-128/128, and CHAM-128/256), we can execute 48 (resp. 24) encryptions simultaneously. In addition, we optimize the process of CTR mode by pre-computing and using the intermediate value of some initial rounds by utilizing the property that the nonce part of CTR mode input is fixed during encryptions. Through the pre-computation table, CTR mode is optimized up until round 4 in LEA, round 5 in HIGHT, and round 7 in revised CHAM. With the proposed parallel processing technique, our software provides 3.09%, 5.26%, and 9.52% of improved performance in LEA, HIGHT, and revised CHAM-64/128, respectively, compared to the existing parallel works in ARM-based MCU. Furthermore, with the proposed CTR mode optimization technique, our software provides the most improved performance with 8.76%, 8.62%, and 15.87% in LEA-CTR, HIGHT-CTR, and revised CHAM-CTR, respectively. This work is the fastest implementation of CTR mode on ARMv8 architecture to the best of our knowledge.