HUMAN-DRIVEN EDGE COMPUTING AND COMMUNICATION Securing Edge Devices in the Post-Quantum Internet of Things Using Lattice-Based

Zhe Liu, Kim-Kwang Raymond Choo, and Johann Großschädl

The authors provide a Abstract This approach reduces the amount of data to be brief introduction to cryp- transmitted to the cloud and eliminates the round- tographic methods for In order to increase the security of edge com- trip delay associated with the transmission of data securing the post-quan- puting, all data transmitted to and from edge from the gateway to the cloud and the transmis- devices, as well as all data stored on edge devic- sion of results in the other direction. In addition, tum IoT, including hash- es, must be encrypted. Especially when the trans- edge computing has the potential to alleviate cer- based digital signature mitted or stored data contains sensitive personal tain privacy issues by ensuring that all sensitive schemes, code-based information, long-term protection over periods data is either kept on the edge device or only sent cryptography, multivariate of ten or more years may be required, which to the cloud after anonymization. public key cryptography, can only be achieved with post-quantum cryp- As edge devices may process and store sen- tography. This article first gives a brief overview sitive personal information about their owners or and lattice-based cryp- of post-quantum public-key cryptosystems based users, they require effective protection against tography. In particular, on hard mathematical problems related to hash many kinds of attacks. An edge device can be they focus on the imple- functions, error-correcting codes, multivariate attacked from two different directions, namely mentation aspects of quadratic systems, and lattices. Then the suitability through the Internet on one hand, and through lattice-based cryptography of lattice-based cryptosystems for resource-con- connected devices on the other hand, assuming strained devices is discussed and efficient imple- the attacker is able to inject one or more manip- for resource-constrained mentations for 8 and 32-bit microcontrollers are ulated devices into the network. These threats IoT devices, and practical outlined. call for a sophisticated security architecture, suggestions to choose which has to take the very specific constraints ntroduction appropriate implementa- I and requirements of the IoT into account. One tion techniques. The Internet of Things (IoT) can be defined as of the main challenges toward a secure IoT is a global network of physical objects (“things”) the fact that many IoT devices are highly con- that are equipped with computation and com- strained in terms of computational resources and munication capabilities, which enables them to network bandwidth. For example, a typical wire- be identified, monitored, and controlled over the less sensor node, like Memsic’s MICAz mote, is Internet. It is estimated that by the end of 2020, equipped with an 8-bit AVR microcontroller and somewhere between 20 and 50 billion smart has a few kilobytes of RAM and around 100 kB devices — including various kinds of sensors, of flash memory to store a primitive operating actuators, and other microsystems — will be con- system and application programs. More advanced nected to the Internet, outnumbering the world’s IoT devices often come with an ARM Cortex-M population by a factor of between 2.5 and 6.5. microcontroller and possess between 32 and 64 These billions of devices will collect unprecedent- kB RAM, as well as a few hundred kilobytes of ed amounts of data about the physical world in flash memory. Edge devices are, in general, much their environment, which needs to be transmitted more powerful than ordinary IoT devices since to a central resource (e.g., a server in the cloud) they have to perform local data processing. How- for analysis and storage. However, such a tradi- ever, when choosing cryptographic algorithms tional IoT model, in which the end devices are and protocols to be run on an edge device, the primarily used for data collection, while the infor- resource restrictions of the IoT devices with which mation extraction, post processing, and decision it needs to communicate securely must be taken making is primarily performed in the cloud, has into account. Regarding public key techniques, raised many concerns about bandwidth require- elliptic curve cryptosystems, such as Elliptic Curve ments, latency problems, as well as security and Digital Signature Algorithm (ECDSA) and Elliptic privacy issues. Edge computing, also known as Curve Diffie-Hellman (ECDH) have clear advan- fog computing, aims to mitigate said concerns by tages over their traditional counterparts such as performing some processing and analysis in the Rivest, Shamir, & Adleman (RSA) and DH due gateway that connects the IoT devices with the to the much shorter key lengths and associated Internet or on a dedicated device located at the savings in execution time, RAM requirements, and edge of the network, near the source of the data. transmission bandwidth.

Digital Object Identifier: Zhe Liu is with Nanjing University of Aeronautics and Astronautics and the University of Luxembourg; 10.1109/MCOM.2018.1700330 Kim-Kwang Raymond Choo is with The University of Texas at San Antonio; Johann Großschädl is with the University of Luxembourg.

158 0163-6804/18/$25.00 © 2018 IEEE IEEE Communications Magazine • February 2018 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply. The security of modern public key cryptosys- resistant against quantum computers. The clas- The focus of research tems relies on the hardness of well studied math- sical (MSS) is based ematical problems such as the integer factoring on a one-time signature (OTS) system and uses activities is currently problem (IFP), the problem a binary hash tree (nowadays called Merkle tree) directed toward four (DLP), or its elliptic curve variant, the ECDLP. It to obtain a “many-time” signature scheme. The 2n is widely acknowledged, however, that all these leaf nodes are hash values of the public keys of main categories: lat- problems could be effectively solved with a quan- 2n OTS key pairs, each of which can only be used tice-based cryptography, tum computer, which puts essentially every key to sign one message. Each inner node contains multivariate cryptog- exchange and digital signature scheme in use the hash of the concatenation of its two children, today at risk of being broken [1]. Estimates as to and the hash value at the root node is the public raphy, hash-based when the first powerful quantum computer will key of the scheme. The private key of the MSS cryptography, and code- be available vary significantly, but according to is the entire set of OTS key pairs, which can be some predictions it could happen before the end generated using a pseudo-random generator with based cryptography. of the next decade (i.e., in less than 15 years). For- a short seed to reduce storage requirements. An These four categories n n tunately, there are a few mathematical problems MSS with 2 OTS key pairs can be used to sign 2 differ greatly in terms that are intractable not only for classical comput- messages, whereby the signature of the ith mes- ers, but also when using a sophisticated quan- sage mi consists of the OTS signature on mi using of the underlying hard tum computer. The sub-area of cryptography that the ith OTS secret key (at the ith leaf), the ith OTS mathematical problem deals with the design, cryptanalysis, and imple- public key, and the so-called authentication path mentation of cryptographic algorithms supposed of the latter, which includes all n + 1 intermediate and also with respect to be able to withstand attacks by quantum com- nodes on the path from the ith leaf to the root. to performance, key puters is known as Post-Quantum Cryptography MSS only requires a secure hash function to guar- lengths, and the length (PQC) and has recently gained a lot of interest. antee the overall security of the scheme, but has Regarding public key cryptosystems, the focus the disadvantage of large signature sizes. Two of ciphertexts as well as of research activities is currently directed toward recent developments in this area of research are digital signatures. four main categories: lattice-based cryptography, an improved variant of MSS called XMSS and the multivariate cryptography, hash-based cryptogra- stateless signature scheme SPHINCS. phy, and code-based cryptography. These four Code-based cryptosystems use an error cor- categories differ greatly in terms of the under- recting code to construct a one-way function; lying hard mathematical problem and also with their security is based on the hardness of decod- respect to performance, key lengths, and the ing a message that contains random errors and length of ciphertexts as well as digital signatures. recovering the code structure. A well-known Lattice-based cryptography is often regarded as example is the McEliece public key encryption one of the best options for PQC in the IoT since scheme, which employs binary Goppa codes it combines high efficiency with reasonably short due to their high error correction capability. keys. The private key is a binary irreducible degree-t PQC has attracted the interest of standard- Goppa code chosen secretly by the receiver of ization bodies all over the world. In 2016, the the message, and the corresponding public key National Institute of Standards and Technology is a generator matrix G describing a scrambled (NIST) announced their intention to standardize and randomly permuted version of this code. To post-quantum cryptosystems and also released a encrypt a message, the sender first encodes it call for proposals. Interested organizations and using G and then adds t random errors. Only the individuals were invited to submit quantum-resis- legitimate receiver, who knows the hidden alge- tant public key encryption algorithms, key agree- braic structure of the Goppa code, can correct ment mechanisms, and digital signature schemes the errors and recover the message. Even though that could replace the currently used cryptosys- the McEliece scheme has been analyzed for 40 tems such as RSA. The deadline for the submis- years, no serious weaknesses are known, and this sion of proposals was November 2017, and it is is expected to remain so in the quantum-comput- estimated that a draft standard will be available ing era. The Niederreiter cryptosystem is a McE- after five to seven years (i.e., between 2023 and liece variant that can serve as the basis of both 2025), which includes a public analysis phase of encryption and signature schemes. Unfortunately, three to five years. As part of this effort, it will all McEliece variants have relatively large public be necessary to evaluate how well the proposals keys (up to 106 bits). for post-quantum cryptosystems can satisfy the Lattice-based cryptosystems are promising requirements of the IoT and its billions of devices PQC candidates because some of them com- with limited computing and communication capa- bine strong security guarantees in the form of a bilities. worst-to-average case reduction with high efficien- cy and small key and ciphertext/signature sizes. Post-Quantum Cryptography Examples of lattice-based cryptosystems include As stated before, there are four major directions the NTRU encryption scheme (whose security is for the realization of public key PQC, namely related to the shortest vector and closest vector hash-based cryptography, code-based cryptogra- problem in a special kind of lattices) as well as phy, multivariate cryptography, and lattice-based encryption, key exchange, and signature schemes cryptography. We briefly summarize their main built on the hardness of the Learning With Errors properties and present a few examples of each (LWE) problem and its ring variant, the RLWE category. problem [6]. The latter cryptosystems operate in a Hash-based digital signature schemes, original- polynomial ring Rq = Zq[x] f where f is an irre- ly introduced by Ralph Merkle in 1979, require ducible polynomial. RLWE-based key exchange fewer security assumptions than number-theo- protocols specify a set of public system param- retic signature schemes and are expected to be eters that define besides Rq also a fixed polyno-

IEEE Communications Magazine • February 2018 159 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply. Operation Type Algorithms and implementations Examples of the instructions are the 32-bit arith- metic/logical instructions such as addition (ADD), Symmetric encryption Block/stream ciphers AES-256, Salsa20 addition with carry (ADC), as well as memory instructions that perform a single-data loading/ Lattice-based [2, 3, 5] storing (LDR/STR) or multiple-data loading/stor- ing (LDM/STM). It also supports the powerful Public key encryption MPKC SimpleMatrix, ZHFE, PMI+, IPHFE+ single-cycle multiply and multiply-and-accumu- late instructions from the DSP extension, namely Code-based McEliece, Niederreiter UMUL, UMLAL, and UMAAL. These instructions BLISS ([4, 12, 13]), GPV, GLP [11], NTRUSign, execute a 32  32-bit computation resulting in Lattice-based ring-TESLA [14], Tesla] [15] a 64-bit value, plus a 64-bit accumulation with a single 64-bit value (UMLAL) or a 64-bit accumula- tion with two 32-bit values ( ). Public key signature MPKC UOV, Rainbow, TTS, HFEv-, GUI UMAAL Hash-based XMSS, SPHINCS-256, Lamport, Merkle Implementation of Lattice-Based

Code-based Niederreiter Cryptography on IoT Devices Ring-LWE Encryption Schemes Key exchange Lattice-based [6, 8, 9, 10] The first practical software implementation of Table 1. Major post-quantum cryptography primitive constructions: a compar- a public key cryptosystem based on the learn- ative summary. ing with errors (LWE) problem is reported by Göttert et al. [2]. They assessed the practicali- ty of ring-LWE encryption, and presented both mial a  Rq and the parameters for a discrete hardware and software implementations. In par- Gaussian distribution  used to sample polyno- ticular, for software implementation, they gave mials with “small” coefficients from Rq. Each of a comparison between a matrix and a poly- the two involved entities samples a secret poly- nomial-based variant of the LWE scheme. The nomial s and an error polynomial e from , com- authors employed the fast Fourier transform putes a public key b = as + e  Rq, and sends (FFT) to speed up multiplication in polynomial it to the other entity. Then each entity multiplies rings, which is the most critical operation in lat- the received public key b by its secret polynomial tice-based cryptography. s, similar as in Diffie-Hellman key exchange, to De Clercq et al. [3] provided an improved arrive at an approximate or “noisy” agreement on implementation of the ring-LWE encryption a shared secret (i.e., the coefficients of the poly- scheme on a 32-bit ARM processor. They intro- nomials obtained on both sides differ slightly due duced two optimization techniques. First, they to e. Finally, a reconciliation mechanism is applied used the Knuth-Yao sampling algorithm for a fast to ensure both entities reach an exact (i.e., identi- discrete Gaussian sampler. To generate the ran- cal) shared secret. dom numbers, the target ARM processor’s built-in Table 1 gives an overview of the four outlined true random number generator (TRNG) is exploit- approaches for PQC and provides references to ed. For high-speed sampling, Gaussian distribution implementations. is obtained from pre-computed look-up tables. Second, they used the negative-wrapped NTT and IoT Processors stored the multiple coefficients in each processor At the time of this research, many widely used word for efficient polynomial multiplication. Final- low-end IoT devices use an 8-bit AVR micro- ly, the implementation requires 121k clock cycles controller (e.g. Arduino UNO), and the latter per encryption and 43.3k cycles per decryption has an 8-bit RISC instruction set and a modi- at a medium-term security level, as well as 261k fied Harvard architecture that features 32 8-bit cycles per encryption and roughly 96.5k cycles general-purpose registers denoted by r0–r31. per decryption for long-term security. Their results From this pool of registers, the last three pairs, represent the current state of the art in efficient X (r27:r26), Y (r29:r28), and Z (r31:r30) implementation of ring LWE encryption on a are used as 16-bit address pointers to load and 32-bit processor. store data from memory. The AVR instruction Liu et al. [5] focused on efficient arithmetic set supports a total of 133 instructions, and each techniques for the ring variant of the LWE encryp- instruction has a fixed latency. For example, arith- tion scheme on 8-bit AVR. Their contributions metic/logical instructions, such as addition (ADD) include several optimizations for improving the and addition with carry (ADC), are executed in execution time of the number theoretic transform a single clock cycle. Unsigned multiplication (NTT) based on polynomial multiplication and (MUL) and load/store instructions take two clock the memory requirements of the coefficient. For cycles. The Cortex-M4 is part of the increasing- Gaussian sampling, the byte-wise scanning for the ly popular Cortex-M family, which includes a Knuth-Yao Gaussian distribution sampler is pro- wide range of 32-bit RISC ARM microcontrollers. posed to improve performance. In particular, for Cortex-M4 supports the ARMv7E-M instruction the 8-bit AVR processor, they proposed the MOV- set, comprising Thumb-2 instructions and addi- and-ADD technique for coefficient multiplication tional saturating/SIMD instructions, namely the and the shifting-addition-multiplication-subtrac- “DSP extension.” The Cortex-M4 architecture tion-subtraction (SAMS2) technique for modu- has a three-stage pipeline with branch specu- lar reduction, which optimizes the instruction lation, includes 16–32-bit registers (r0~r15), sets. Later, they extended the work on the 32-bit and supports a mix of 16- and 32-bit operations ARM-NEON processor, and the authors proposed corresponding to the Thumb-2 instruction set. a parallel NTT to reduce the execution time for

160 IEEE Communications Magazine • February 2018 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply. coefficient multiplication, which introduces four- ble backdoors in public parameters. A follow-up With the increasing way NTT computations over the SIMD architec- work implementation on an ARM Cortex-M0 ture. For fast modular reduction, a 32-bit-wise (ARMv6-M) processor was presented in [10]. prevalence of IoT devic- SAMS2 method is efficiently implemented. The es in consumer, busi- random number is efficiently generated through a Lattice-based Signature Scheme block-cipher-based pseudo random number gen- Güneysu et al. [11] presented a signature scheme ness, government and erator (PRNG). (GLP), whose security relies on the hardness of military applications, the lattice problems. Oder et al. [12] described an ability to reliably and Lattice-Based (Authenticated) efficient implementation of BLISS [13] on a 32-bit Key Exchange Protocols ARM Cortex-M4F microcontroller. They investi- securely transmit, store, Ding et al. [6] proposed the first LWE and RLWE- gated three different samplings, namely Bernoulli, and analyze sensitive based provably secure key exchange protocol. Knuth-Yao, and Ziggurat. For polynomial arithme- This work is the foundation of current LWE and tic, NTT and sparse multiplication methods were data in and between IoT RLWE key exchange protocols. The authors studied. They achieved execution times of 35.3 devices and architecture leverage the property of commutativity and the ms and 6 ms for signature generation and verifica- is important not only to notion of approximate equivalence to construct tion, respectively, at a medium-term security level. key exchange protocols over LWE and RLWE. BLISS-B, an improvement of BLISS, speeds up key businesses and users, They then design an error reconciliation mecha- generation by a factor of 5–10 and signing by a but also to our national nism and send signal from one side to the other factor 2–3, while maintaining the same security to reconcile error between two close values. In level as BLISS. Pöppelmann et al. [4] optimized security. order to reconcile errors with an overwhelm- the BLISS signature scheme on an 8-bit AVR archi- ing probability, the norm of difference is strictly tecture, where they merged certain multiplication bounded by choosing modulus q carefully. All operations and removed the expensive bit-re- reconciliation-based protocols follow the same versal step. The compact implementation only idea to construct variants of this work. Boorghany requires 329 ms and 88 ms for signature genera- et al. [7] implemented lattice-based authenticated tion and verification, respectively. key exchange (AKE) protocols on both 8-bit AVR In 2016, Akleylek et al. [14] proposed ring-TES- and 32-bit ARM processors, where they used FFT LA, the first provably secure lattice-based signature instead of NTT to optimize the number of trans- scheme with good performance. They provided a formations. tight security reduction for the new scheme from Zhang et al. [8] introduced the first practical the ring-LWE problem, which allows for a provably and provably secure two-pass AKE protocol from secure but efficient instantiation. The experimental ideal lattices. It is an RLWE variant of classical results from a software implementation demonstrat- HMQV protocol. The security is demonstrated ed that ring-TESLA performs comparably to both under the Bellare--Rogaway model with weak per- GLP and BLISS schemes. Also in the same year, Bar- fect forward secrecy. The authors also provided reto et al. [15] presented an improved scheme of a one-pass variant of their two-pass protocol for [14] — Tesla#. The latter is a digital signature scheme specific applications. Parameter choices between based on the RLWE assumption, which achieves 80- and 360-bit security are provided. The proof- much faster key pair generation, signing, and verifi- of-concept implementation demonstrated the cation. It also outperforms most (conventional and utility of the post-quantum RLWE-based AKE pro- lattice-based) signature schemes on modern pro- tocol. cessors. We will now summarize the performance Bos et al. [9] instantiated Peikert’s RLWE key of these three state-of-the-art implementations for exchange protocol with a 128-bit secure param- lattice-based encryption [5], signature [12], and key eter choice. Peikert’s key exchange is almost the exchange ([10] on ARM) schemes on IoT devices in same as the scheme reported in [6]. Bos et al. Table 2. All numbers reported in Table 2 are clock provided proof-of-concept implementation of cycles on the respective processors. It is clear that Peikert’s protocol and their parameter choice. implementations of lattice-based constructions on They further integrated the protocol into OpenS- IoT devices can be efficient, in the sense that it is SL and combined quantum-insecure digital sig- possible to implement post-quantum cryptograph- natures (ECDSA or RSA) as post-quantum TLS ic schemes on resource-constrained devices. Also, ciphersuites RLWE-ECDSA (RSA)-AES128- according to Table 4 of [5] and Table 3 of [4], the GCM-SHA256. They then proved the security of implementation of the respective scheme is even their ciphersuites in the authenticated and confi- faster than 1024-bit RSA on an Atmel ATmega128 dential channel establishment (ACCE) model. The processor at 8 MHz. authors also demonstrated that their implemen- Given the potential of lattice-based cryptogra- tation and post-quantum TLS ciphersuite are effi- phy in post-quantum systems, it is likely that we cient, which suggested the costs of transitioning will see more advanced implementation of lat- from quantum-insecure cryptographic primitives tice-based cryptography primitives and high-level to quantum-safe primitives is not too high, and applications in future IoT deployments. real-world post-quantum application for our digi- tized society is practical. Conclusions Alkim et al. [10] improved the scheme pre- With the increasing prevalence of IoT devices sented in [9], in the sense of using more com- in countless applications, ranging from home auto- pact parameter choices, adopting a different error mation over health care to traffic control, the abil- distribution that is less expensive to sample, pre- ity to securely collect and analyze data becomes senting a more comprehensive and strict secu- more and more important. Edge computing has rity analysis on their protocol, and proposing a the potential to alleviate some security and privacy new and more efficient error reconciliation mech- concerns associated with the IoT by distributing anism and a technique to defend against possi- data processing and decision making toward the

IEEE Communications Magazine • February 2018 161 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply. With continuing Usage Implementation Platform KeyGen Encryption Decryption Security

advances in quantum Encryption [3] ARM Cortex-M4F 116,772 121,166 43,324 128 computing, lattice-based [5] ATxmega128A1 589,900 671,628 275,646 128 cryptography will play an increasingly import- KeyGen Signing Verifying Security

ant role in (real-world) Signature [12] ARM Cortex-M4F 367,859,092 5,984,686 1,002,299 128 post-quantum applica- [4] ATxmega128A1 10,537,981 2,814,118 128 tions due to its versatil- ity, high efficiency, and Client Server Security relatively small key size Key exchange [10] ARM Cortex-M0 1,760,837 1,467,769 256 and communication Table 2. Implementations of lattice-based cryptography on IoT devices: a comparative summary. cost.

edge of the network rather than allocating these [6] J. Ding et al., “A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem”; tasks exclusively on a centralized cloud platform. https://eprint.iacr.org/2012/688, accessed 31 Aug., 2017. However, it is essential to encrypt the commu- [7] A. Boorghany et al., “On Constrained Implementation of Lat- nication between the IoT devices and the edge tice-Based Cryptographic Primitives and Schemes on Smart gateways, especially in human-driven edge com- Cards,” ACM Trans. Embedded Computing Sys., vol. 14, no. 3, 2015, Acticle 42. puting when personal devices such as smartphones [8] J. Zhang et al., “Authenticated Key Exchange from Ideal form part of the network or when the collected Lattices,” Annual Int’l. Conf. Theory and Applications of Cryp- data contains sensitive personal information. In tographic Techniques, Springer, pp. 719-751. certain cases (e.g., healthcare applications), long- [9] J. Bos et al., “Post-Quantum Key Exchange for the TLS Proto- col from the Ring Learning with Errors Problem,” 2015 IEEE term protection of the data for ten or more years Symp. Security and Privacy, 2015, pp. 553–70. is required, which is only possible with post-quan- [10] E. Alkim et al., “Post-Quantum Key Exchange — A New tum cryptosystems. Using classical algorithms such Hope,” USENIX Security Symp., 2016, pp. 327–43. as RSA, DH, and ECDH for key establishment [11] T. Güneysu et al. “Practical Lattice-Based Cryptography: A Signature Scheme for Embedded Systems,” Int’l. Wksp. bears the risk that an attacker with the capabili- Cryptographic Hardware and Embedded Systems, Springer, ty to eavesdrop on and store the communication 2012, pp. 530–47. between the devices will be able to break the [12] T. Oder et al., “Beyond ECDSA and RSA: Lattice-Based encryption in the not-so-distant future when large Digital Signatures on Constrained Devices,” Proc. 51st ACM Annual Design Automation Conf., 2014, pp. 1–6. quantum computers become available. [13] L. Ducas et al. “Lattice Signatures and Bimodal Gaussians,” We give a succinct overview of four important Advances in Cryptology, Springer, 2013, pp. 40–56. approaches for the design of post-quantum cryp- [14] S. Akleylek et al., “An Efficient Lattice-Based Signature tosystems and make the point that lattice-based Scheme with Provably Secure Instantiation,” Progress in Cryptology -- AFRICACRYPT 2016, Springer, 2016, pp. 44-60. cryptography provides a combination of desirable [15] P. S. Barreto et al., “Sharper Ring-LWE Signatures”; https:// properties. On one hand, some lattice-based cryp- eprint.iacr.org/2016/1026/20161101:020659, accessed 31 tosystems, including several primitives based on the Aug., 2017. LWE problem and its variants, come with strong security guarantees backed by a worst-case to aver- Biographies age-case security reduction. On the other hand, Zhe Liu ([email protected]) is a full professor in the College a number of RLWE-based cryptosystems are very of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics. He is also a research fellow in efficient, as our survey of recent implementation SnT, University of Luxembourg. He received his Ph.D degree papers shows, and provide (relatively) short keys as from the Applied Cryptography Group, University of Luxem- well as small ciphertext and signature sizes. There- bourg in 2015 and the prestigious FNR Outstanding Ph.D Thesis fore, it can be expected that RLWE-based crypto- Award in 2016. His research areas include computer arithmetic and cryptographic engineering for pre-quantum and post-quan- systems will play an essential role in post-quantum tum cryptography. edge computing and the post-quantum IoT. Kim-Kwang Raymond Choo [SM’15] holds the Cloud Tech- References nology Endowed Professorship at the University of Texas at San [1] C. Cheng et al., “Securing the Internet of Things in a Quan- Antonio. He is the recipient of the ESORICS 2015 Best Paper tum World,” IEEE Commun. Mag., vol. 55, no. 2, Feb. 2017, Award, was a member of the 2015 Winning Team of Germany’s pp. 116–20. University of Erlangen-Nuremberg Digital Forensics Research [2] N. Göttert et al., “On the Design of Hardware Building Challenge, and received the 2014 Australia New Zealand Polic- Blocks for Modern Lattice-Based Encryption Schemes,” Int’l. ing Advisory Agency’s Highly Commended Award, the 2010 Wksp. Cryptographic Hardware and Embedded Systems, Australian Capital Territory Pearcey Award, a Fulbright Scholar- Springer, 2012, pp. 512–29. ship, the 2008 Australia Day Achievement Medallion, and the [3] R. De Clercq et al., “Efficient Software Implementation of British Computer Society’s Wilkes Award. Ring-LWE Encryption,” Proc. 2015 Design, Automation & Test in Europe Conference & Exhibition, 2015, pp. 339–44. Johann Grossschädl is a member of research staff at LACS, [4] T. Pöppelmann et al., “High-Performance Ideal Lattice-Based University of Luxembourg. Before joining the University of Lux- Cryptography on 8-Bit ATxmega Microcontrollers,” Latin- embourg, he was a research scientist in the Computer Science crypt ’15, Springer, 2015. Department of the University of Bristol, United Kingdom. He [5] Z. Liu et al., “Efficient Implementation of Ring-LWE Encryp- has published more than 70 papers in international, peer-re- tion on 8-bit AVR Processors,” Int’l. Wksp. Cryptograph- viewed journals and conference proceedings, such as ACSAC ic Hardware and Embedded Systems, Springer, 2015, pp. and CHES, which are the flagship events in the field of applied 663–82. cryptography.

162 IEEE Communications Magazine • February 2018 Authorized licensed use limited to: George Mason University. Downloaded on October 04,2020 at 15:13:16 UTC from IEEE Xplore. Restrictions apply.