Lattice-Based Signatures: Optimization and Implementation on Reconﬁgurable Hardware

1 Lattice-Based Signatures: Optimization and Implementation on Reconfigurable Hardware Tim Guneysu,¨ Vadim Lyubashevsky, and Thomas Poppelmann¨ Abstract—Nearly all of the currently used signature schemes, such as RSA or DSA, are based either on the factoring assumption or the presumed intractability of the discrete logarithm problem. As a consequence, the appearance of quantum computers or algorithmic advances on these problems may lead to the unpleasant situation that a large number of today’s schemes will most likely need to be replaced with more secure alternatives. In this work we present such an alternative – an efficient signature scheme whose security is derived from the hardness of lattice problems. It is based on recent theoretical advances in lattice-based cryptography and is highly optimized for practicability and use in embedded systems. The public and secret keys are roughly 1:5 kB and 0:3 kB long, while the signature size is approximately 1:1 kB for a security level of around 80 bits. We provide implementation results on reconfigurable hardware (Spartan/Virtex-6) and demonstrate that the scheme is scalable, has low area consumption, and even outperforms classical schemes. Index Terms—Public key cryptosystems, reconfigurable hardware, signature scheme, ideal lattices, FPGA. F 1 INTRODUCTION and NTRUSign [33], broken due to flaws in the ad-hoc design approaches [19], [51]. This has changed since the It has been known, ever since Shor’s seminal result [58], introduction of cyclic and ideal lattices [46] and related that all asymmetric cryptosystems based on factoring computationally hard problems like RING-SIS [42], [44], and the (elliptic curve) discrete logarithm problem can [52] and RING-LWE [45]. These problems have enabled be broken in polynomial time on a quantum computer. construction of a great variety of theoretically elegant In recent years, there has been a big financial push, by and efficient cryptographic primitives. both governments and private enterprises (c.f. [39]), to In this work we try to further close the gap between construct a fully-functioning quantum computer which the advances in theoretical lattice-based cryptography would have the capability to immediately render virtu- and real-world implementation by constructing a digital ally all currently-used public-key cryptography obsolete. signature scheme based on ideal lattices that considers In addition, recent breakthroughs in classical cryptanal- the constraints on embedded systems. For efficiency ysis [7], [37] have cast further doubts on the hardness we use a variant of the Ring-LWE problem which is of the discrete log problem by demonstrating almost- connected to hard problems on ideal lattices and which polynomial time algorithms for the problem in small- may be of independent interest. Our optimizations for characteristic fields. These imminent threats have moti- practicability result in a scheme with moderate signa- vated the investigation of other fundamental problems ture and key sizes as well as performance suitable for upon which asymmetric cryptography can be based, embedded and hardware systems. We point out that and the proposal of several alternative cryptographic our instantiations do not use parameters that imply constructions as potential substitutes. any meaningful security guarantees via worst-case to A promising alternative to number-theoretic construc- average-case reductions of [42], [45], [49]. Like other tions are lattice-based cryptosystems. They possess se- practical constructions (e.g. [18], [44]), our schemes are curity proofs based on well-studied problems that cur- based on the hardness of average-case lattice problems. rently cannot be solved by quantum algorithms. For a Related Work. Digital signatures are arguably the long time, however, lattice constructions have only been most used public-key cryptographic primitive in prac- considered secure for inefficiently large parameters that tical applications, and a lot of effort has gone into trying are well beyond practicability1 or were, like GGH [27] to construct such schemes from lattice assumptions. Due to the success of the NTRU encryption scheme, it • Tim Güneysu and Thomas Pöppelmannare with the Horst GörtzInstitute was natural to try to design a signature scheme based for IT-Security, Ruhr University Bochum, Universitaetsstr 150, 44780 Bochum, Germany. on the same principles. Unlike the encryption scheme, E-mail: fTim.Gueneysu, [email protected]. however, the proposed NTRU signature scheme (and its • Vadim Lyubashevsky is with INRIA and ENS in Paris, France. subsequent modifications) [33], [35] has been completely E-mail: [email protected]. broken [19], [51]. Provably-secure digital signatures were finally constructed in 2008, by Gentry, Peikert, and 1. One notable exception is the NTRU public-key encryption scheme [34], which has essentially remained unbroken since its intro- Vaikuntanathan [26], and, using different techniques, by duction. Lyubashevsky and Micciancio [43]. The scheme in [26] 2 was rather inefficient in practice, with outputs and keys While the theoretical part of this work (i.e., the de- being megabytes long, while the scheme in [43] was only scription and optimization of the signature scheme) is a one-time signature that required the use of Merkle trees the same as in the conference version of the current to become a full signature scheme. The work of [43] was paper [30] we provide a vastly improved implementa- later extended in [18], [40], [41], which finally gave a tion. Especially, the usage of FFT techniques for polyno- construction of a full-fledged signature scheme whose mial multiplication and parallelization allow much faster keys and outputs are currently on the order of 5000 bits signing and verification with a reduced area footprint. each, for a 128-bit security level2. The work of [26] was There is also the newer BLISS signature scheme, given also extended by Micciancio and Peikert [47], where the in [18], which uses some ideas from our work but re- size of the signatures and keys is roughly 100; 000 bits. quires high-precision discrete Gaussian sampling. Works A software implementation of the improved signature like [11], [18], [20], [57] dealing with this problem have scheme has recently been presented by Bansarkhani appeared recently. However, currently it is still unknown and Buchmann [6]. A software implementation of the how to realize sampling for parameter sets as proposed signature scheme described in this paper can be found in [18]3 efficiently in an embedded system with low in [31]. memory requirements. As a consequence, our scheme A different way to construct signature schemes with- is still suited very well for hardware implementations. out known attacks by quantum computers is to use Moreover, the structure of BLISS is very similar to our hard decoding problems. In 2001 Courtois, Finiasz, and scheme and implementation issues like fast and flexible Sendrier [16] proposed the code-based CFS signature polynomial multiplication in hardware are already dealt scheme which has been improved by Finiasz in [23] (now with in our work. called Parallel-CFS). However, implementations in hard- Outline. We give a short overview of our hardness ware and software [8], [9] are still very slow and yield assumption in Section 2 and then introduce the highly extremely large key sizes and are thus unsuitable for em- efficient and practical signature scheme in Section 3. bedded devices. Another option are signature schemes Based on this description, we present our implementa- based on Multivariate Quadratic (MQ) equations which tion and the hardware architecture of the signing and are fast in hardware [5], [10] and software [14] but signature verification engine in Section 4 and analyze its suffer from large public key sizes. Hash-based signa- performance on different FPGAs in Section 5. In Section 6 tures are way more practical and implementations on we summarize our contribution and present an outlook smart cards and reconfigurable hardware are possible as for future work. shown in [22], [36]. Their biggest disadvantage is the requirement to keep a state and large signature sizes. A 2 PRELIMINARIES table comparing software performance and key sizes of 2.1 Notation selected signature schemes can be found in [31]. Our Contribution. The main contribution of this work Throughout the paper, we will assume that n is an inte- is the implementation of a digital signature scheme ger that is a power of 2, p is a prime number congruent to pn n based on the findings in [40], [41] which is optimized for 1 modulo 2n, and R is the ring p[x]=(x +1). Elements n Z embedded systems. In addition, we propose an improve- in Rp can be represented by polynomials of degree n−1 with coefficients in the range [−(p − 1)=2; (p − 1)=2], and ment to the above-mentioned scheme which preserves n p pn the security proof, while lowering the signature size by we will write Rk to be a subset of the ring R that approximately a factor of two (this improvement was consists of all polynomials with coefficients in the range $ subsequently used in the improved scheme of [18]). We [−k; k]. For a set S, we write s S to indicate that s is demonstrate the practicability of our scheme by evaluat- being chosen uniformly at random from S. ing an implementation on reconfigurable hardware. We provide one hardware unit which supports only verifi- 2.2 Hardness Assumption cation, one larger unit for signing and a combined unit for signing as well as verification. The implementation is In a particular version of the RING-SIS problem, one is pn pn fully functional, contains a Trivium-based PRNG as well given an ordered pair of polynomials (a; t) 2 R × R pn where a is chosen uniformly from R and t = as1 + as the lightweight hash QUARK and makes use of the pn extremely efficient Number Theoretic Transform (NTT).

Load more