NewHope for ARM Cortex-M
|
|
|
- Anne Evans
- 5 years ago
- Views:
Transcription
1 for ARM Cortex-M Erdem Alkim 1, Philipp Jakubeit 2, Peter Schwabe 2 erdemalkim@gmail.com, phil.jakubeit@gmail.com, peter@cryptojedi.org 1 Ege University, Izmir, Turkey 2 Radboud University, Nijmegen, The Netherlands SPACE 2016
2 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
3 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
4 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
5 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
6 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alternatives: Problems which are not broken by quantum algorithms (yet) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
7 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alternatives: Problems which are not broken by quantum algorithms (yet) Lattice based cryptography Ring-learning-with-errors problem Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
8 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alternatives: Problems which are not broken by quantum algorithms (yet) Lattice based cryptography Ring-learning-with-errors problem Steps taken: Tor considering (ECC+RLWE) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
9 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alternatives: Problems which are not broken by quantum algorithms (yet) Lattice based cryptography Ring-learning-with-errors problem Steps taken: Tor considering (ECC+RLWE) Google experimented (ECC+RLWE) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
10 Post-Quantum Cryptography Shor s algorithm in 1994: Factorization problem polynomial time Discrete logarithm problem polynomial time Quantum computers are in reach: IBM estimates 15 years Threat: Record encrypted messages today Break encryption with quantum computers Alternatives: Problems which are not broken by quantum algorithms (yet) Lattice based cryptography Ring-learning-with-errors problem Steps taken: Tor considering (ECC+RLWE) Google experimented (ECC+RLWE) Slowest 5% increased by 20ms Slowest 1% increased by 150ms Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 2 / 16
11 Ring-Learning-With-Errors Problem R q = Z q [X ]/(X n + 1), Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 3 / 16
12 Ring-Learning-With-Errors Problem R q = Z q [X ]/(X n + 1), χ an error distribution on R q Search version: $ Given: (a i, b i ) for a i R q and b i = s a i + e i for e i χ Wanted: s Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 3 / 16
13 Ring-Learning-With-Errors Problem R q = Z q [X ]/(X n + 1), χ an error distribution on R q Search version: $ Given: (a i, b i ) for a i R q and b i = s a i + e i for e i χ Wanted: s a 1 R q, b 1 =s a 1 + e 1 a 2 R q, b 2 =s a 2 + e 2. Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 3 / 16
14 Post-Quantum Key Exchange Use encryption scheme to send a chosen key Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
15 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
16 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
17 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
18 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
19 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange 2010 Gaborit: Noisy Diffie-Hellman Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
20 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange 2010 Gaborit: Noisy Diffie-Hellman 2011 Linder, Peikert: (Approximate) Key Agreement Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
21 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange 2010 Gaborit: Noisy Diffie-Hellman 2011 Linder, Peikert: (Approximate) Key Agreement 2012 Ding: Reconciliation-based Key Exchange Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
22 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange 2010 Gaborit: Noisy Diffie-Hellman 2011 Linder, Peikert: (Approximate) Key Agreement 2012 Ding: Reconciliation-based Key Exchange 2014 Peikert: Tweak to obtain unbiased keys Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
23 Post-Quantum Key Exchange Use encryption scheme to send a chosen key 1998 Hoffstein, Pipher, Silverman: NTRU cryptosystem 2005 Regev: LWE 2010 Lyubashevsky, Peikert, Regev: RLWE Lattice based key exchange 2010 Gaborit: Noisy Diffie-Hellman 2011 Linder, Peikert: (Approximate) Key Agreement 2012 Ding: Reconciliation-based Key Exchange 2014 Peikert: Tweak to obtain unbiased keys 2015 Bos, Costello, Naehrig, Stebila: Instantiate, Implement, and integrate into OpenSSL Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 4 / 16
24 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
25 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
26 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
27 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
28 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
29 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
30 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
31 NewHope The Protocol Parameters: q = < 2 14, n = 1024 Error distribution: ψ16 n Alice (server) Bob (client) seed $ {0,..., 255} 32 a Parse(SHAKE-128(seed)) s, e $ ψ16 n s, e, e $ ψ16 n b as + e (seed,b) 1824 Bytes a Parse(SHAKE-128(seed)) u as + e v bs + e v us (u,r) r $ HelpRec(v) 2048 Bytes ν Rec(v, r) ν Rec(v, r) µ SHA3-256(ν) µ SHA3-256(ν) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 5 / 16
32 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
33 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
34 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
35 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Fast polynomial multiplication Number theoretic transform (NTT) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
36 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Fast polynomial multiplication Number theoretic transform (NTT) c = a b Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
37 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Fast polynomial multiplication Number theoretic transform (NTT) c = a b Evaluate NTT(a) and NTT(b) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
38 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Fast polynomial multiplication Number theoretic transform (NTT) c = a b Evaluate NTT(a) and NTT(b) Multiply evaluations NTT(a) NTT(b) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
39 Relevant Building Blocks Error Distribution Centered, binomial distribution ψ16 µ = 0 and σ 2 = 8 32-byte seed ChaCha20 Stream cipher RNG (internal) Fast polynomial multiplication Number theoretic transform (NTT) c = a b Evaluate NTT(a) and NTT(b) Multiply evaluations NTT(a) NTT(b) Deevaluate NTT 1 (NTT(a) NTT(b)) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 6 / 16
40 Number Theoretic Transform (NTT) Fast Fourier Transform defined over finite fields b i = n 1 j=0 ωij a j for 0 i n 1, and ω being a primitive n-th root of unity. Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 7 / 16
41 Number Theoretic Transform (NTT) Fast Fourier Transform defined over finite fields b i = n 1 j=0 ωij a j for 0 i n 1, and ω being a primitive n-th root of unity. Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 7 / 16
42 Number Theoretic Transform (NTT) Fast Fourier Transform defined over finite fields bi = n 1 j=0 ωij a j for 0 i n 1, and ω being a primitive n-th root of unity. log n level Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 7 / 16
43 Number Theoretic Transform (NTT) Fast Fourier Transform defined over finite fields b i = n 1 j=0 ωij a j for 0 i n 1, and ω being a primitive n-th root of unity. log n level n 2 butterfly operations per level Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 7 / 16
44 Butterfly Operations x j (xj + x j+d ) x j+d (xj x j+d )ω j W = omega[( j)/(2*dist)]; tmp = x[j]; X[j] = Barrett((tmp + x[j + dist])); X[j + dist] = Montgomery(W * (tmp - x[j + dist])); Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 8 / 16
45 Butterfly Operations x j (xj + x j+d ) x j+d (xj x j+d )ω j W = omega[( j)/(2*dist)]; tmp = x[j]; X[j] = Barrett((tmp + x[j + dist])); X[j + dist] = Montgomery(W * (tmp - x[j + dist])); r = x mod m Barrett Reduction: Precompute µ = b2k m Replaces division by multiplication Reduces 16-bit Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 8 / 16
46 Butterfly Operations x j (xj + x j+d ) x j+d (xj x j+d )ω j W = omega[( j)/(2*dist)]; tmp = x[j]; X[j] = Barrett((tmp + x[j + dist])); X[j + dist] = Montgomery(W * (tmp - x[j + dist])); r = x mod m Barrett Reduction: Precompute µ = b2k m Replaces division by multiplication Reduces 16-bit Montgomery Reduction: T mod m R > m, gcd(m, R) = 1 TR 1 mod m Reduces 32-bit Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 8 / 16
47 Algorithmic Optimization Techniques Using Montgomery arithmetic Using short Barrett reductions Montgomery reduction (R = 2 18 ) montgomery_reduce,rm: MUL rt, rm, #12287 // inv(q) AND rt, rt, # // R-1 MUL rt, rt, #12289 // q ADD rm, rm, rt SHR rm, rm, #18 Short Barrett reduction barrett_reduce,rb: MUL rt, rb, #5 SHR rt, rt, #16 MUL rt, rt, #12289 SUB rb, rb, rt Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 9 / 16
48 Algorithmic Optimization Techniques Using Montgomery arithmetic Using short Barrett reductions Lazy reduction W = omega[( j)/(2*dist)]; tmp = x[j]; X[j] = Barrett((tmp + x[j + dist])); X[j + dist] = Montgomery(W * (tmp - x[j + dist])); Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 9 / 16
49 Algorithmic Optimization Techniques Using Montgomery arithmetic Using short Barrett reductions Lazy reduction Negative-wrapped convolution c = (nψ) 1 NTT 1 (NTT(ψa) NTT(ψb)) a, b, c Rq ψ = { ω 0,..., ω n 1 } Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 9 / 16
50 Algorithmic Optimization Techniques Using Montgomery arithmetic Using short Barrett reductions Lazy reduction Negative-wrapped convolution Precomputed constants c = (nψ) 1 NTT 1 (NTT(ψa) NTT(ψb)) ω = {ω 0, ω 1 n 1,..., ω 2 } ψ = {ω 0, ω 0 n 1 n 1 ψ,..., ω 2, ω 2 ψ}, for ψ = 7 Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 9 / 16
51 Cortex-M Family Cortex-M0 Cortex-M4 STM32F0 Discovery board 8KB RAM 64KB Flash 32-bit word size Thumb + subset Thumb 2 8 General-purpose registers 5 High registers 3 Reserved registers (SP,LR,PC) STM32F4 Discovery board 192KB RAM 1MB Flash 32-bit word size Full Thumb 2 13 General-purpose registers 3 Reserved registers (SP,LR,PC) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 10 / 16
52 Architecture Specific Optimization Techniques Unrolled NTT Code size increases Cycle counts decreases Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 11 / 16
53 Architecture Specific Optimization Techniques Unrolled NTT Code size increases Cycle counts decreases Adapted to word size Coefficients: 14-Bit Word size: 32-Bit Load/Store 2 coefficients per memory operation NTT, Addition, Multiplication Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 11 / 16
54 Architecture Specific Optimization Techniques Unrolled NTT Code size increases Cycle counts decreases Adapted to word size Coefficients: 14-Bit Word size: 32-Bit Load/Store 2 coefficients per memory operation NTT, Addition, Multiplication Merged levels 2 Level on the Cortex-M0 3(4) level on the Cortex-M4 Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 11 / 16
55 Architecture Specific Optimization Techniques Unrolled NTT Code size increases Cycle counts decreases Adapted to word size Coefficients: 14-Bit Word size: 32-Bit Load/Store 2 coefficients per memory operation NTT, Addition, Multiplication Merged levels 2 Level on the Cortex-M0 3(4) level on the Cortex-M4 Minimized register reordering Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 11 / 16
56 Results: Comparison Lattice-based cryptography on Cortex-M4F: 1 Efficient software implementation of ring-lwe encryption. (de Clercq, Roy, Vercauteren, and Verbauwhede) 2 Beyond ECDSA and RSA: Lattice-based digital signatures on constrained devices. (Oder, Pöppelmann, and Güneysu) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 12 / 16
57 Results: Comparison Lattice-based cryptography on Cortex-M4F: 1 Efficient software implementation of ring-lwe encryption. (de Clercq, Roy, Vercauteren, and Verbauwhede) 2 Beyond ECDSA and RSA: Lattice-based digital signatures on constrained devices. (Oder, Pöppelmann, and Güneysu) Relevant subroutines: Sampling noise NTT Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 12 / 16
58 Results: Comparison Lattice-based cryptography on Cortex-M4F: 1 Efficient software implementation of ring-lwe encryption. (de Clercq, Roy, Vercauteren, and Verbauwhede) 2 Beyond ECDSA and RSA: Lattice-based digital signatures on constrained devices. (Oder, Pöppelmann, and Güneysu) Relevant subroutines: Sampling noise NTT scale by Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 12 / 16
59 NewHope Results: Comparison 105 Cortex-M0 1.02x Cortex-M4 RNG 5 Cortex-M4F Cycle counts x x x x 1.83x T T N N T T N oi M se ul ti Sa pl m pl ic at io in g n 0 Efficient software implementation of ring-lwe encryption. (de Clercq, Roy, Vercauteren, and Verbauwhede) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 13 / 16
60 NewHope Results: Comparison Cortex-M4 (ours) Cortex-M0 (ours) Cortex-M4F Cycle counts x x 0.11x 0.55x 0.32x 0.03x T T N N T T N oi M se ul tip Sa lic m at pl in io n g 0 Lattice-based digital signatures on constrained devices. (Oder, Po ppelmann, and Gu neysu) Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 14 / 16
61 Overview NewHope Operation Cycle Counts 48 MHz NTT on M ms NTT on M ms Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 15 / 16
62 Overview NewHope Operation Cycle Counts 48 MHz NTT on M ms NTT on M ms Operation Cycle Counts 48 MHz NewHope on M ms Curve25519 on M ms NewHope on M ms Curve25519 on M ms Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 15 / 16
63 Alkim, Jakubeit, Schwabe 2016 A new hope on ARM Cortex-M 16 / 16
From NewHope to Kyber. Peter Schwabe April 7, 2017
From NewHope to Kyber Peter Schwabe peter@cryptojedi.org https://cryptojedi.org April 7, 2017 In the past, people have said, maybe it s 50 years away, it s a dream, maybe it ll happen sometime. I used
Post-quantum key exchange for the Internet based on lattices
Post-quantum key exchange for the Internet based on lattices Craig Costello Talk at MSR India Bangalore, India December 21, 2016 Based on J. Bos, C. Costello, M. Naehrig, D. Stebila Post-Quantum Key Exchange
A Lattice-based AKE on ARM Cortex-M4
A Lattice-based AKE on ARM Cortex-M4 Julian Speith 1, Tobias Oder 1, Marcel Kneib 2, and Tim Güneysu 1,3 1 Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany {julian.speith,tobias.oder,tim.gueneysu}@rub.de
Compact Ring LWE Cryptoprocessor
1 Compact Ring LWE Cryptoprocessor CHES 2014 Sujoy Sinha Roy 1, Frederik Vercauteren 1, Nele Mentens 1, Donald Donglong Chen 2 and Ingrid Verbauwhede 1 1 ESAT/COSIC and iminds, KU Leuven 2 Electronic Engineering,
CRYSTALS Kyber and Dilithium. Peter Schwabe February 7, 2018
CRYSTALS Kyber and Dilithium Peter Schwabe peter@cryptojedi.org https://cryptojedi.org February 7, 2018 Crypto today 5 building blocks for a secure channel Symmetric crypto Block or stream cipher (e.g.,
Post-quantum key exchange based on Lattices
Post-quantum key exchange based on Lattices Joppe W. Bos Romanian Cryptology Days Conference Cybersecurity in a Post-quantum World September 20, 2017, Bucharest 1. NXP Semiconductors Operations in > 35
Ring-LWE: Applications to cryptography and their efficient realization
Ring-LWE: Applications to cryptography and their efficient realization Sujoy Sinha Roy, Angshuman Karmakar, and Ingrid Verbauwhede ESAT/COSIC and iminds, KU Leuven Kasteelpark Arenberg 10, B-3001 Leuven-Heverlee,
Practical, Quantum-Secure Key Exchange from LWE
Practical, Quantum-Secure Key Exchange from LWE Douglas Stebila 4 th ETSI/IQC Workshop on Quantum-Safe Cryptography September 21, 2016 Acknowledgements Collaborators Joppe Bos Craig Costello and Michael
Practical CCA2-Secure and Masked Ring-LWE Implementation
Practical CCA2-Secure and Masked Ring-LWE Implementation Tobias Oder 1, Tobias Schneider 2, Thomas Pöppelmann 3, Tim Güneysu 1,4 1 Ruhr-University Bochum, 2 Université Catholique de Louvain, 3 Infineon
Improved Parameters for the Ring-TESLA Digital Signature Scheme
Improved Parameters for the Ring-TESLA Digital Signature Scheme Arjun Chopra Abstract Akleylek et al. have proposed Ring-TESLA, a practical and efficient digital signature scheme based on the Ring Learning
Part 2 LWE-based cryptography
Part 2 LWE-based cryptography Douglas Stebila SAC Summer School Université d'ottawa August 14, 2017 https://www.douglas.stebila.ca/research/presentations Funding acknowledgements: SAC Summer School 2017-08-14
Leakage of Signal function with reused keys in RLWE key exchange
Leakage of Signal function with reused keys in RLWE key exchange Jintai Ding 1, Saed Alsayigh 1, Saraswathy RV 1, Scott Fluhrer 2, and Xiaodong Lin 3 1 University of Cincinnati 2 Cisco Systems 3 Rutgers
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
Lattice-Based Cryptography. Chris Peikert University of Michigan. QCrypt 2016
Lattice-Based Cryptography Chris Peikert University of Michigan QCrypt 2016 1 / 24 Agenda 1 Foundations: lattice problems, SIS/LWE and their applications 2 Ring-Based Crypto: NTRU, Ring-SIS/LWE and ideal
Lattice-Based Cryptography
Liljana Babinkostova Department of Mathematics Computing Colloquium Series Detecting Sensor-hijack Attacks in Wearable Medical Systems Krishna Venkatasubramanian Worcester Polytechnic Institute Quantum
Jintai Ding*, Saraswathy RV. Lin Li, Jiqiang Liu
Comparison analysis and efficient implementation of reconciliation-based RLWE key exchange protocol Xinwei Gao Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong
Post-Quantum Cryptography
Post-Quantum Cryptography Sebastian Schmittner Institute for Theoretical Physics University of Cologne 2015-10-26 Talk @ U23 @ CCC Cologne This work is licensed under a Creative Commons Attribution-ShareAlike
HOMOMORPHIC ENCRYPTION AND LATTICE BASED CRYPTOGRAPHY 1 / 51
HOMOMORPHIC ENCRYPTION AND LATTICE BASED CRYPTOGRAPHY Abderrahmane Nitaj Laboratoire de Mathe matiques Nicolas Oresme Universite de Caen Normandie, France Nouakchott, February 15-26, 2016 Abderrahmane
Analysis of Error-Correcting Codes for Lattice-Based Key Exchange
Analysis of Error-Correcting Codes for Lattice-Based Key Exchange Tim Fritzmann 1, Thomas Pöppelmann 2, and Johanna Sepulveda 1 1 Technische Universität München, Germany {tim.fritzmann,johanna.sepulveda}@tum.de
Weaknesses in Ring-LWE
Weaknesses in Ring-LWE joint with (Yara Elias, Kristin E. Lauter, and Ekin Ozman) and (Hao Chen and Kristin E. Lauter) ECC, September 29th, 2015 Lattice-Based Cryptography Post-quantum cryptography Ajtai-Dwork:
MATH 158 FINAL EXAM 20 DECEMBER 2016
MATH 158 FINAL EXAM 20 DECEMBER 2016 Name : The exam is double-sided. Make sure to read both sides of each page. The time limit is three hours. No calculators are permitted. You are permitted one page
Markku-Juhani O. Saarinen
Shorter Messages and Faster Post-Quantum Encryption with Round5 on Cortex M Markku-Juhani O. Saarinen S. Bhattacharya 1 O. Garcia-Morchon 1 R. Rietman 1 L. Tolhuizen 1 Z. Zhang 2 (1)
Report on Learning with Errors over Rings-based HILA5 and its CCA Security
Report on Learning with Errors over Rings-based HILA5 and its CCA Security Jesús Antonio Soto Velázquez January 24, 2018 Abstract HILA5 is a cryptographic primitive based on lattices that was submitted
Lattice Based Crypto: Answering Questions You Don't Understand
Lattice Based Crypto: Answering Questions You Don't Understand Vadim Lyubashevsky INRIA / ENS, Paris Cryptography Secure communication in the presence of adversaries Symmetric-Key Cryptography Secret key
Outline Proxy Re-Encryption NTRU NTRUReEncrypt PS-NTRUReEncrypt Experimental results Conclusions. NTRUReEncrypt
NTRUReEncrypt An Efficient Proxy Re-Encryption Scheme based on NTRU David Nuñez, Isaac Agudo, and Javier Lopez Network, Information and Computer Security Laboratory (NICS Lab) Universidad de Málaga, Spain
The quantum threat to cryptography
The quantum threat to cryptography Ashley Montanaro School of Mathematics, University of Bristol 20 October 2016 Quantum computers University of Bristol IBM UCSB / Google University of Oxford Experimental
Discrete Logarithm Problem
Discrete Logarithm Problem Finite Fields The finite field GF(q) exists iff q = p e for some prime p. Example: GF(9) GF(9) = {a + bi a, b Z 3, i 2 = i + 1} = {0, 1, 2, i, 1+i, 2+i, 2i, 1+2i, 2+2i} Addition:
High Performance Post-Quantum Key Exchange on FPGAs
High Performance Post-Quantum Key Exchange on FPGAs Po-Chun Kuo 1,2a, Wen-Ding Li 2a, Yu-Wei Chen 1b, Yuan-Che Hsu 1b, Bo-Yuan Peng 2a, Chen-Mou Cheng 1a, and Bo-Yin Yang 2a 1 Department of Electrical
Efficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography
Efficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography Angshuman Karmakar 1 Sujoy Sinha Roy 1 Frederik Vercauteren 1,2 Ingrid Verbauwhede 1 1 COSIC, ESAT KU Leuven and iminds
Noisy Diffie-Hellman protocols
Noisy Diffie-Hellman protocols Carlos Aguilar 1, Philippe Gaborit 1, Patrick Lacharme 1, Julien Schrek 1 and Gilles Zémor 2 1 University of Limoges, France, 2 University of Bordeaux, France. Classical
Logic gates. Quantum logic gates. α β 0 1 X = 1 0. Quantum NOT gate (X gate) Classical NOT gate NOT A. Matrix form representation
Quantum logic gates Logic gates Classical NOT gate Quantum NOT gate (X gate) A NOT A α 0 + β 1 X α 1 + β 0 A N O T A 0 1 1 0 Matrix form representation 0 1 X = 1 0 The only non-trivial single bit gate
McBits: Fast code-based cryptography
McBits: Fast code-based cryptography Peter Schwabe Radboud University Nijmegen, The Netherlands Joint work with Daniel Bernstein, Tung Chou December 17, 2013 IMA International Conference on Cryptography
2. Cryptography 2.5. ElGamal cryptosystems and Discrete logarithms
CRYPTOGRAPHY 19 Cryptography 5 ElGamal cryptosystems and Discrete logarithms Definition Let G be a cyclic group of order n and let α be a generator of G For each A G there exists an uniue 0 a n 1 such
NTRU Cryptosystem and Its Analysis
NTRU Cryptosystem and Its Analysis Overview 1. Introduction to NTRU Cryptosystem 2. A Brief History 3. How the NTRU Cryptosystem works? Examples 4. Why the Decryption Works? 5. The Advantages of NTRU 6.
In Praise of Twisted Canonical Embedding
In Praise of Twisted Canonical Embedding Jheyne N. Ortiz 1, Robson R. de Araujo 2, Ricardo Dahab 1, Diego F. Aranha 1, and Sueli I. R. Costa 2 1 Institute of Computing, University of Campinas, Brazil jheyne.ortiz@ic.unicamp.br
Short Stickelberger Class Relations and application to Ideal-SVP
Short Stickelberger Class Relations and application to Ideal-SVP Ronald Cramer Léo Ducas Benjamin Wesolowski Leiden University, The Netherlands CWI, Amsterdam, The Netherlands EPFL, Lausanne, Switzerland
Number Theory: Applications. Number Theory Applications. Hash Functions II. Hash Functions III. Pseudorandom Numbers
Number Theory: Applications Number Theory Applications Computer Science & Engineering 235: Discrete Mathematics Christopher M. Bourke cbourke@cse.unl.edu Results from Number Theory have many applications
Post-Quantum Cryptography & Privacy. Andreas Hülsing
Post-Quantum Cryptography & Privacy Andreas Hülsing Privacy? Too abstract? How to achieve privacy? Under the hood... Asymmetric Crypto ECC RSA DSA Symmetric Crypto AES SHA2 SHA1... Combination of both
My brief introduction to cryptography
My brief introduction to cryptography David Thomson dthomson@math.carleton.ca Carleton University September 7, 2013 introduction to cryptography September 7, 2013 1 / 28 Outline 1 The general framework
On error distributions in ring-based LWE
On error distributions in ring-based LWE Wouter Castryck 1,2, Ilia Iliashenko 1, Frederik Vercauteren 1,3 1 COSIC, KU Leuven 2 Ghent University 3 Open Security Research ANTS-XII, Kaiserslautern, August
Lattices. A Lattice is a discrete subgroup of the additive group of n-dimensional space R n.
Lattices A Lattice is a discrete subgroup of the additive group of n-dimensional space R n. Lattices have many uses in cryptography. They may be used to define cryptosystems and to break other ciphers.
NTRU Prime. Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange, and Christine van Vredendaal. Technische Universiteit Eindhoven
NTRU Prime Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange, and Christine van Vredendaal Technische Universiteit Eindhoven 25 August 2016 Tanja Lange NTRU Prime https://eprint.iacr.org/2016/461
Message Authentication Codes (MACs)
Message Authentication Codes (MACs) Tung Chou Technische Universiteit Eindhoven, The Netherlands October 8, 2015 1 / 22 About Me 2 / 22 About Me Tung Chou (Tony) 2 / 22 About Me Tung Chou (Tony) Ph.D.
Final Exam Math 105: Topics in Mathematics Cryptology, the Science of Secret Writing Rhodes College Tuesday, 30 April :30 11:00 a.m.
Final Exam Math 10: Topics in Mathematics Cryptology, the Science of Secret Writing Rhodes College Tuesday, 0 April 2002 :0 11:00 a.m. Instructions: Please be as neat as possible (use a pencil), and show
Univ.-Prof. Dr. rer. nat. Rudolf Mathar. Written Examination. Cryptography. Tuesday, August 29, 2017, 01:30 p.m.
Cryptography Univ.-Prof. Dr. rer. nat. Rudolf Mathar 1 2 3 4 15 15 15 15 60 Written Examination Cryptography Tuesday, August 29, 2017, 01:30 p.m. Name: Matr.-No.: Field of study: Please pay attention to
Implementing Ring-LWE cryptosystems
Implementing Ring-LWE cryptosystems Tore Vincent Carstens December 16, 2016 Contents 1 Introduction 1 1.1 Motivation............................................ 1 2 Lattice Based Crypto 2 2.1 General Idea...........................................
CIS 6930/4930 Computer and Network Security. Topic 5.2 Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.2 Public Key Cryptography 1 Diffie-Hellman Key Exchange 2 Diffie-Hellman Protocol For negotiating a shared secret key using only public communication
Public Key Cryptography
Public Key Cryptography Introduction Public Key Cryptography Unlike symmetric key, there is no need for Alice and Bob to share a common secret Alice can convey her public key to Bob in a public communication:
High-speed key encapsulation from NTRU
High-speed key encapsulation from NTRU Andreas Hülsing 1, Joost Rijneveld 2, John Schanck 3,4, Peter Schwabe 2 1 Eindhoven University of Technology, The Netherlands 2 Radboud University, Nijmegen, The
The Elliptic Curve in https
The Elliptic Curve in https Marco Streng Universiteit Leiden 25 November 2014 Marco Streng (Universiteit Leiden) The Elliptic Curve in https 25-11-2014 1 The s in https:// HyperText Transfer Protocol
https://www.microsoft.com/en-us/research/people/plonga/ Outline Motivation recap Isogeny-based cryptography The SIDH key exchange protocol The SIKE protocol Authenticated key exchange from supersingular
L7. Diffie-Hellman (Key Exchange) Protocol. Rocky K. C. Chang, 5 March 2015
L7. Diffie-Hellman (Key Exchange) Protocol Rocky K. C. Chang, 5 March 2015 1 Outline The basic foundation: multiplicative group modulo prime The basic Diffie-Hellman (DH) protocol The discrete logarithm
Open problems in lattice-based cryptography
University of Auckland, New Zealand Plan Goal: Highlight some hot topics in cryptography, and good targets for mathematical cryptanalysis. Approximate GCD Homomorphic encryption NTRU and Ring-LWE Multi-linear
Fundamentals of Modern Cryptography
Fundamentals of Modern Cryptography BRUCE MOMJIAN This presentation explains the fundamentals of modern cryptographic methods. Creative Commons Attribution License http://momjian.us/presentations Last
Introduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
Overview. Background / Context. CSC 580 Cryptography and Computer Security. March 21, 2017
CSC 580 Cryptography and Computer Security Math for Public Key Crypto, RSA, and Diffie-Hellman (Sections 2.4-2.6, 2.8, 9.2, 10.1-10.2) March 21, 2017 Overview Today: Math needed for basic public-key crypto
Public Key 9/17/2018. Symmetric Cryptography Review. Symmetric Cryptography: Shortcomings (1) Symmetric Cryptography: Analogy
Symmetric Cryptography Review Alice Bob Public Key x e K (x) y d K (y) x K K Instructor: Dr. Wei (Lisa) Li Department of Computer Science, GSU Two properties of symmetric (secret-key) crypto-systems: The
POST-QUANTUM CRYPTOGRAPHY HOW WILL WE ENCRYPT TOMORROW?
POST-QUANTUM CRYPTOGRAPHY HOW WILL WE ENCRYPT TOMORROW? Hanno Böck https://hboeck.de 1 INTRODUCTION Hanno Böck, freelance journalist and hacker. Writing for Golem.de and others. Fuzzing Project, funded
Threshold Cryptography
Threshold Cryptography Cloud Security Mechanisms Björn Groneberg - Summer Term 2013 09.07.2013 Threshold Cryptography 1 ? 09.07.2013 Threshold Cryptography 2 Threshold Cryptography Sharing Secrets Treasure
CRYPTANALYSIS OF COMPACT-LWE
SESSION ID: CRYP-T10 CRYPTANALYSIS OF COMPACT-LWE Jonathan Bootle, Mehdi Tibouchi, Keita Xagawa Background Information Lattice-based cryptographic assumption Based on the learning-with-errors (LWE) assumption
Lossy Trapdoor Functions and Their Applications
1 / 15 Lossy Trapdoor Functions and Their Applications Chris Peikert Brent Waters SRI International On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information 2 / 15 On Losing Information
Lecture 11: Key Agreement
Introduction to Cryptography 02/22/2018 Lecture 11: Key Agreement Instructor: Vipul Goyal Scribe: Francisco Maturana 1 Hardness Assumptions In order to prove the security of cryptographic primitives, we
during transmission safeguard information Cryptography: used to CRYPTOGRAPHY BACKGROUND OF THE MATHEMATICAL
THE MATHEMATICAL BACKGROUND OF CRYPTOGRAPHY Cryptography: used to safeguard information during transmission (e.g., credit card number for internet shopping) as opposed to Coding Theory: used to transmit
Definition: For a positive integer n, if 0<a<n and gcd(a,n)=1, a is relatively prime to n. Ahmet Burak Can Hacettepe University
Number Theory, Public Key Cryptography, RSA Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr The Euler Phi Function For a positive integer n, if 0
Chapter 8 Public-key Cryptography and Digital Signatures
Chapter 8 Public-key Cryptography and Digital Signatures v 1. Introduction to Public-key Cryptography 2. Example of Public-key Algorithm: Diffie- Hellman Key Exchange Scheme 3. RSA Encryption and Digital
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 11 February 21, 2013 CPSC 467b, Lecture 11 1/27 Discrete Logarithm Diffie-Hellman Key Exchange ElGamal Key Agreement Primitive Roots
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
9 Knapsack Cryptography
9 Knapsack Cryptography In the past four weeks, we ve discussed public-key encryption systems that depend on various problems that we believe to be hard: prime factorization, the discrete logarithm, and
ECS 189A Final Cryptography Spring 2011
ECS 127: Cryptography Handout F UC Davis Phillip Rogaway June 9, 2011 ECS 189A Final Cryptography Spring 2011 Hints for success: Good luck on the exam. I don t think it s all that hard (I do believe I
An Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations
An Algebraic Approach to NTRU (q = 2 n ) via Witt Vectors and Overdetermined Systems of Nonlinear Equations J.H. Silverman 1, N.P. Smart 2, and F. Vercauteren 2 1 Mathematics Department, Box 1917, Brown
Quantum-resistant cryptography
Quantum-resistant cryptography Background: In quantum computers, states are represented as vectors in a Hilbert space. Quantum gates act on the space and allow us to manipulate quantum states with combination
A gentle introduction to isogeny-based cryptography
A gentle introduction to isogeny-based cryptography Craig Costello Tutorial at SPACE 2016 December 15, 2016 CRRao AIMSCS, Hyderabad, India Part 1: Motivation Part 2: Preliminaries Part 3: Brief SIDH sketch
Roll No. :... Invigilator's Signature :.. CS/B.TECH(ECE)/SEM-7/EC-703/ CODING & INFORMATION THEORY. Time Allotted : 3 Hours Full Marks : 70
Name : Roll No. :.... Invigilator's Signature :.. CS/B.TECH(ECE)/SEM-7/EC-703/2011-12 2011 CODING & INFORMATION THEORY Time Allotted : 3 Hours Full Marks : 70 The figures in the margin indicate full marks
What are we talking about when we talk about post-quantum cryptography?
PQC Asia Forum Seoul, 2016 What are we talking about when we talk about post-quantum cryptography? Fang Song Portland State University PQC Asia Forum Seoul, 2016 A personal view on postquantum cryptography
An introduction to supersingular isogeny-based cryptography
An introduction to supersingular isogeny-based cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 8, 2017 Šibenik, Croatia Towards quantum-resistant cryptosystems from supersingular
Information Security
SE 4472 / ECE 9064 Information Security Week 12: Random Number Generators and Picking Appropriate Key Lengths Fall 2015 Prof. Aleksander Essex Random Number Generation Where do keys come from? So far we
Polynomial Interpolation in the Elliptic Curve Cryptosystem
Journal of Mathematics and Statistics 7 (4): 326-331, 2011 ISSN 1549-3644 2011 Science Publications Polynomial Interpolation in the Elliptic Curve Cryptosystem Liew Khang Jie and Hailiza Kamarulhaili School
Elliptic Curves. Giulia Mauri. Politecnico di Milano website:
Elliptic Curves Giulia Mauri Politecnico di Milano email: giulia.mauri@polimi.it website: http://home.deib.polimi.it/gmauri May 13, 2015 Giulia Mauri (DEIB) Exercises May 13, 2015 1 / 34 Overview 1 Elliptic
Parameter selection in Ring-LWE-based cryptography
Parameter selection in Ring-LWE-based cryptography Rachel Player Information Security Group, Royal Holloway, University of London based on joint works with Martin R. Albrecht, Hao Chen, Kim Laine, and
Lecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
Fast Lattice-Based Encryption: Stretching SPRING
Fast Lattice-Based Encryption: Stretching SPRING Charles Bouillaguet 1 Claire Delaplace 1,2 Pierre-Alain Fouque 2 Paul Kirchner 3 1 CFHP team, CRIStAL, Université de Lille, France 2 EMSEC team, IRISA,
Cryptography in the Quantum Era. Tomas Rosa and Jiri Pavlu Cryptology and Biometrics Competence Centre, Raiffeisen BANK International
Cryptography in the Quantum Era Tomas Rosa and Jiri Pavlu Cryptology and Biometrics Competence Centre, Raiffeisen BANK International Postulate #1: Qubit state belongs to Hilbert space of dimension 2 ψ
Peculiar Properties of Lattice-Based Encryption. Chris Peikert Georgia Institute of Technology
1 / 19 Peculiar Properties of Lattice-Based Encryption Chris Peikert Georgia Institute of Technology Public Key Cryptography and the Geometry of Numbers 7 May 2010 2 / 19 Talk Agenda Encryption schemes
Arithmétique et Cryptographie Asymétrique
Arithmétique et Cryptographie Asymétrique Laurent Imbert CNRS, LIRMM, Université Montpellier 2 Journée d inauguration groupe Sécurité 23 mars 2010 This talk is about public-key cryptography Why did mathematicians
Notes for Lecture 17
U.C. Berkeley CS276: Cryptography Handout N17 Luca Trevisan March 17, 2009 Notes for Lecture 17 Scribed by Matt Finifter, posted April 8, 2009 Summary Today we begin to talk about public-key cryptography,
Post-Quantum Cryptography & Privacy. Andreas Hülsing
Post-Quantum Cryptography & Privacy Andreas Hülsing Privacy? Too abstract? How to achieve privacy? Under the hood... Public-key crypto ECC RSA DSA Secret-key crypto AES SHA2 SHA1... Combination of both
Saber on ARM. CCA-secure module lattice-based key encapsulation on ARM
Saber on ARM CCA-secure module lattice-based key encapsulation on ARM Angshuman Karmakar, Jose Maria Bermudo Mera, Sujoy Sinha Roy and Ingrid Verbauwhede imec-cosic, KU Leuven Kasteelpark Arenberg 10,
Towards Efficient Arithmetic for Lattice-Based Cryptography on Reconfigurable Hardware
Towards Efficient Arithmetic for Lattice-Based Cryptography on Reconfigurable Hardware Thomas Pöppelmann and Tim Güneysu Horst Görtz Institute for IT-Security, Ruhr-University Bochum, Germany Abstract.
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction
HILA5 Pindakaas: On the CCA security of lattice-based encryption with error correction Daniel J. Bernstein 1 Leon Groot Bruinderink 2 Tanja Lange 2 Lorenz Panny 2 1 University of Illinois at Chicago 2
CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S. Ant nine J aux
CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S Ant nine J aux (g) CRC Press Taylor 8* Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor &
Hardware implementations of ECC
Hardware implementations of ECC The University of Electro- Communications Introduction Public- key Cryptography (PKC) The most famous PKC is RSA and ECC Used for key agreement (Diffie- Hellman), digital
Post-Quantum Cryptography from Lattices
Post-Quantum Cryptography from Lattices Léo Ducas 1 CWI, Amsterdam, The Netherlands CWI Scientific Meeting, November 2016. 1 Funded by a PPP Grant, between NXP and CWI. Cryptography Cryptography in everyday
problem which is much easier the ring strikes back
Lattice-based cryptography: 1 reduced to a special closest vector 2 Episode V: problem which is much easier the ring strikes back than the general problem. As an Daniel J. Bernstein University of Illinois
Ideal Lattices and Ring-LWE: Overview and Open Problems. Chris Peikert Georgia Institute of Technology. ICERM 23 April 2015
Ideal Lattices and Ring-LWE: Overview and Open Problems Chris Peikert Georgia Institute of Technology ICERM 23 April 2015 1 / 16 Agenda 1 Ring-LWE and its hardness from ideal lattices 2 Open questions
Public Key Cryptography. All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other.
Public Key Cryptography All secret key algorithms & hash algorithms do the same thing but public key algorithms look very different from each other. The thing that is common among all of them is that each
Introduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
RSA. Ramki Thurimella
RSA Ramki Thurimella Public-Key Cryptography Symmetric cryptography: same key is used for encryption and decryption. Asymmetric cryptography: different keys used for encryption and decryption. Public-Key
Number "Not" Used Once - Key Recovery Fault Attacks on LWE Based Lattice Cryptographic Schemes
Number "Not" Used Once - Key Recovery Fault Attacks on LWE Based Lattice Cryptographic Schemes Prasanna Ravi 1, Shivam Bhasin 1, and Anupam Chattopadhyay 2 1 Temasek Laboratories, Nanyang Technological
Side-channel analysis in code-based cryptography
1 Side-channel analysis in code-based cryptography Tania RICHMOND IMATH Laboratory University of Toulon SoSySec Seminar Rennes, April 5, 2017 Outline McEliece cryptosystem Timing Attack Power consumption