Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols
<jats:p>Public key cryptography protocols, such as RSA and elliptic curve cryptography, will be rendered insecure by Shor’s algorithm when large-scale quantum computers are built. Cryptographers are working on quantum-resistant algorithms, and lattice-based cryptography has emerged as a prime...
| Main Authors: | , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
Universitatsbibliothek der Ruhr-Universitat Bochum
2022
|
| Online Access: | https://hdl.handle.net/1721.1/142901 |
| _version_ | 1826206809377996800 |
|---|---|
| author | Banerjee, Utsav Ukyab, Tenzin S Chandrakasan, Anantha P |
| author2 | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science |
| author_facet | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Banerjee, Utsav Ukyab, Tenzin S Chandrakasan, Anantha P |
| author_sort | Banerjee, Utsav |
| collection | MIT |
| description | <jats:p>Public key cryptography protocols, such as RSA and elliptic curve cryptography, will be rendered insecure by Shor’s algorithm when large-scale quantum computers are built. Cryptographers are working on quantum-resistant algorithms, and lattice-based cryptography has emerged as a prime candidate. However, high computational complexity of these algorithms makes it challenging to implement lattice-based protocols on low-power embedded devices. To address this challenge, we present Sapphire – a lattice cryptography processor with configurable parameters. Efficient sampling, with a SHA-3-based PRNG, provides two orders of magnitude energy savings; a single-port RAM-based number theoretic transform memory architecture is proposed, which provides 124k-gate area savings; while a low-power modular arithmetic unit accelerates polynomial computations. Our test chip was fabricated in TSMC 40nm low-power CMOS process, with the Sapphire cryptographic core occupying 0.28 mm2 area consisting of 106k logic gates and 40.25 KB SRAM. Sapphire can be programmed with custom instructions for polynomial arithmetic and sampling, and it is coupled with a low-power RISC-V micro-processor to demonstrate NIST Round 2 lattice-based CCA-secure key encapsulation and signature protocols Frodo, NewHope, qTESLA, CRYSTALS-Kyber and CRYSTALS-Dilithium, achieving up to an order of magnitude improvement in performance and energy-efficiency compared to state-of-the-art hardware implementations. All key building blocks of Sapphire are constant-time and secure against timing and simple power analysis side-channel attacks. We also discuss how masking-based DPA countermeasures can be implemented on the Sapphire core without any changes to the hardware.</jats:p> |
| first_indexed | 2024-09-23T13:38:35Z |
| format | Article |
| id | mit-1721.1/142901 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T13:38:35Z |
| publishDate | 2022 |
| publisher | Universitatsbibliothek der Ruhr-Universitat Bochum |
| record_format | dspace |
| spelling | mit-1721.1/1429012023-07-21T20:22:28Z Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols Banerjee, Utsav Ukyab, Tenzin S Chandrakasan, Anantha P Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science <jats:p>Public key cryptography protocols, such as RSA and elliptic curve cryptography, will be rendered insecure by Shor’s algorithm when large-scale quantum computers are built. Cryptographers are working on quantum-resistant algorithms, and lattice-based cryptography has emerged as a prime candidate. However, high computational complexity of these algorithms makes it challenging to implement lattice-based protocols on low-power embedded devices. To address this challenge, we present Sapphire – a lattice cryptography processor with configurable parameters. Efficient sampling, with a SHA-3-based PRNG, provides two orders of magnitude energy savings; a single-port RAM-based number theoretic transform memory architecture is proposed, which provides 124k-gate area savings; while a low-power modular arithmetic unit accelerates polynomial computations. Our test chip was fabricated in TSMC 40nm low-power CMOS process, with the Sapphire cryptographic core occupying 0.28 mm2 area consisting of 106k logic gates and 40.25 KB SRAM. Sapphire can be programmed with custom instructions for polynomial arithmetic and sampling, and it is coupled with a low-power RISC-V micro-processor to demonstrate NIST Round 2 lattice-based CCA-secure key encapsulation and signature protocols Frodo, NewHope, qTESLA, CRYSTALS-Kyber and CRYSTALS-Dilithium, achieving up to an order of magnitude improvement in performance and energy-efficiency compared to state-of-the-art hardware implementations. All key building blocks of Sapphire are constant-time and secure against timing and simple power analysis side-channel attacks. We also discuss how masking-based DPA countermeasures can be implemented on the Sapphire core without any changes to the hardware.</jats:p> 2022-06-07T15:33:41Z 2022-06-07T15:33:41Z 2019 2022-06-07T15:25:09Z Article http://purl.org/eprint/type/JournalArticle https://hdl.handle.net/1721.1/142901 Banerjee, Utsav, Ukyab, Tenzin S and Chandrakasan, Anantha P. 2019. "Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols." IACR Transactions on Cryptographic Hardware and Embedded Systems. en 10.46586/TCHES.V2019.I4.17-61 IACR Transactions on Cryptographic Hardware and Embedded Systems Creative Commons Attribution 4.0 International License https://creativecommons.org/licenses/by/4.0 application/pdf Universitatsbibliothek der Ruhr-Universitat Bochum Universitatsbibliothek der Ruhr-Universitat Bochum |
| spellingShingle | Banerjee, Utsav Ukyab, Tenzin S Chandrakasan, Anantha P Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title | Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title_full | Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title_fullStr | Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title_full_unstemmed | Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title_short | Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols |
| title_sort | sapphire a configurable crypto processor for post quantum lattice based protocols |
| url | https://hdl.handle.net/1721.1/142901 |
| work_keys_str_mv | AT banerjeeutsav sapphireaconfigurablecryptoprocessorforpostquantumlatticebasedprotocols AT ukyabtenzins sapphireaconfigurablecryptoprocessorforpostquantumlatticebasedprotocols AT chandrakasanananthap sapphireaconfigurablecryptoprocessorforpostquantumlatticebasedprotocols |