An Instruction-configurable Post-quantum Cryptographic Processor towards NTRU

Modern cryptography pushed forward the need of having provable security. Whereas ancient cryptography was only relying on heuristic assumptions and the secrecy of the designs, nowadays researchers try to make the security of schemes to rely on mathematical problems which are believed hard to solve. When doing these proofs, the capabilities of potential adversaries are modeled formally. For instance, the black-box model assumes that an adversary does not learn anything from the inner-state of a construction. While this assumption makes sense in some practical scenarios, it was shown that one can sometimes learn some information by other means, e.g., by timing how long the computation take. In this thesis, we focus on two different areas of cryptography. In both parts, we take first a theoretical point of view to obtain a result. We try then to adapt our results so that they are easily usable for implementers and for researchers working in practical cryptography. In the first part of this thesis, we take a look at post-quantum cryptography, i.e., at cryptographic primitives that are believed secure even in the case (reasonably big) quantum computers are built. We introduce HELEN, a new public-key cryptosystem based on the hardness of the learning from parity with noise problem (LPN). To make our results more concrete, we suggest some practical instances which make the system easily implementable. As stated above, the design of cryptographic primitives usually relies on some well-studied hard problems. However, to suggest concrete parameters for these primitives, one needs to know the precise complexity of algorithms solving the underlying hard problem. In this thesis, we focus on two recent hard-problems that became very popular in post-quantum cryptography: the learning with error (LWE) and the learning with rounding problem (LWR). We introduce a new algorithm that solves both problems and provide a careful complexity analysis so that these problems can be used to construct practical cryptographic primitives. In the second part, we look at leakage-resilient cryptography which studies adversaries able to get some side-channel information from a cryptographic primitive. In the past, two main disjoint models were considered. The first one, the threshold probing model, assumes that the adversary can put a limited number of probes in a circuit. He then learns all the values going through these probes. This model was used mostly by theoreticians as it allows very elegant and convenient proofs. The second model, the noisy-leakage model, assumes that every component of the circuit leaks but that the observed signal is noisy. Typically, some Gaussian noise is added to it. According to experiments, this model depicts closely the real behaviour of circuits. Hence, this model is cherished by the practical cryptographic community. In this thesis, we show that making a proof in the first model implies a proof in the second model which unifies the two models and reconciles both communities. We then look at this result with a more practical point-of-view. We show how it can help in the process of evaluating the security of a chip based solely on the more standard mutual information metric.

Mobile devices now serve to pay for goods and services by means of the transmission of data, a system known as mobile payments. Mobile payment is receiving growing attention globally, from consumers to merchants, as an alternative to using cash, check, or credit cards. Most encryption techniques applied in mobile payment are based on traditional public key infrastructure. However, the traditional public key encryption algorithm has higher requirements for hardware, which is not suitable for mobile terminals of limited computing resources. In addition, these public key encryption algorithms are vulnerable to quantum computing attacks and the availability of practical quantum computer is approaching faster than previously believed. Since mobile payment is facing more and more security issues, how to complete the payment process effectively and securely becomes a problem urgently to be solved. In this paper, we firstly analyze the problem of the signature scheme for mobile payment and propose an improved signature scheme based on the Number Theory Research Unit (NTRU). The results of the experiment show that the proposed signature scheme is secure and efficient which can raise the speed and probability of generating reasonable signature value. Second, we introduce a new public key infrastructure NTRU-WPKI and design a third-party mobile payment model based on NTRU-WPKI to increase the efficiency and security. Finally, by doing the overall simulation, we prove that our model is highly effective and secure.

ElGamal system was introduced by Taher ElGamal in his landmark paper in 1985 [1]. ElGamal is an important asymmetric cryptosystem that is based on the discrete logarithm problem. In brief, this cryptosystem relies on the difficulty of computing discrete logarithms over finite fields [1]. Towards solving discrete logarithms, Shor demonstrated the existence of a polynomial algorithm that can solve these logarithms on quantum machines [2]. In this paper we propose the Convolution Power Cryptosystem (CPC-H2); an extension to the ElGamal cryptosystem that is based on a novel hard problem. CPC-H2 is designed to defend against a Chosen Ciphertext Attack. We show that CPC-H2 is less complicated and has a higher security level than the Number Theory Research Unit (NTRU).

The Electronic Medical Record (EMR) management system currently used by healthcare institutions has security concerns for data sharing and access control. To address these issues, we have proposed a security and privacy management scheme for blockchain-based EMR called GAC-PSPR (Granular Access Control supporting Privilege Separation and Property Revocation). The GAC-PSPR scheme uses a dual chain structure of private blockchain and consortium blockchain. The technology of permission separation and property revocation ensures that data cannot be arbitrarily modified, thus solving the security problem of access control. Protect data privacy by protecting against quantum attacks with Number Theory Research Unit (NTRU) encryption. Besides, we have proposed a ring signature solution based on the lattice to address the issue of too large signatures and the key lengths that secures the sharing of EMR data. We provide extensive security analysis and performance analysis to demonstrate that the GAC-PSPR scheme is effective and secure.

Fully Homomorphic Encryption (FHE) is a cryptosystem supporting arbitrary computations over encrypted data. Gentry is one of the foregoers to put forward the concept of full homomorphism who developed the first version of efficient FHE schemes. FHE provides important ideas and directions for the study of privacy-preserving. In my paper, we present a multi-key FHE scheme in virtue of NTRU (Number Theory Research Unit) to implement a neural network, which is capable of preventing the training data from revealing. Compared with the traditional schemes, the neural network of our system works over ciphertexts with semantic security. Meanwhile, the cryptosystem scheme is in the form of multi-keys, thus the data owned by different providers, model trainers, or servers can be independently encrypted but jointly computed. Thereafter, in contrast to federated learning, our scheme does not require any local training. To testify our method, we finally selected a set of commonly used parameters and designed a neural network based on NTRU encryption. And used the physical machine to make encryption predictions for encoding the MNIST dataset, the prediction accuracy of our privacy model is 80%.

Two ring signature schemes over number theory research unit (NTRU) lattices are presented. The first scheme constructed in the random oracle model is an extension of Ducas, Lyubashevsky, and Prest's identity‐based encryption scheme over NTRU lattices (in Asiacrypt 2014). Moreover, motivated by Boyen's lattice mixing and vanishing trapdoors (in PKC 2010), the second scheme in the standard model is achieved. Under the chosen‐message attack, our new constructions are proved strongly existentially unforgeable, and the security can be reduced to the hardness of NTRU lattices. Compared with the existing lattice‐based ring signatures, our schemes are more efficient and with shorter signature length. Copyright © 2016 John Wiley & Sons, Ltd.

The learning with errors (LWE) problem is considered as one of the most compelling candidates as the security base for the post-quantum cryptosystems. For the application of LWE based cryptographic schemes, the concrete parameters are necessary: the length n of secret vector, the moduli q and the deviation \(\sigma \). In the middle of 2016, Germany TU Darmstadt group initiated the LWE Challenge in order to assess the hardness of LWE problems. There are several approaches to solve the LWE problem via reducing LWE to other lattice problems. Xu et al.’s group solved some LWE Challenge instances using Liu and Nguyen’s adapted enumeration technique (reducing LWE to BDD problem) [14] and they published this result at ACNS 2017 [23]. In this paper, we study Kannan’s embedding technique (reducing LWE to unique SVP problem) to solve the LWE problem in the aspect of practice. The lattice reduction algorithm we use is the progressive BKZ [2, 3]. At first, from our experimental results we can intuitively observe that the embedding technique is more efficient with the embedding factor M closer to 1. Then especially for the cases of \(\sigma /q = 0.005\), we will give an preliminary analysis for the runtime and give an estimation for the proper size of parameters. Moreover, our experimental results show that for \(n\ge 55\) and the fixed \(\sigma /q = 0.005\), the embedding technique with progressive BKZ is more efficient than Xu et al.’s implementation of the enumeration algorithm in [21, 23]. Finally, by our parameter setting, we succeeded in solving the LWE Challenge over \((n,\sigma /q)=(70,0.005)\) using \(2^{16.8}\) s (32.73 single core hours).

The security of public-key cryptography relies on well-studied hard problems, problems for which we do not have efficient algorithms. Factorization and discrete logarithm are the two most known and used hard problems. Unfortunately, they can be easily solved on a quantum computer by Shor's algorithm. Also, the research area of cryptography demands for crypto-diversity which says that we should offer a range of hard problems for public-key cryptography. If one hard problem proves to be easy, we should be able to provide alternative solutions. Some of the candidates for post-quantum hard problems, i.e. problems which are believed to be hard even on a quantum computer, are the Learning Parity with Noise (LPN), the Learning with Errors (LWE) and the Shortest Vector Problem (SVP). A thorough study of these problems is needed in order to assess their hardness. In this thesis we focus on the algorithmic study of LPN. LPN is a hard problem that is attractive, as it is believed to be post-quantum resistant and suitable for lightweight devices. In practice, it has been employed in several encryption schemes and authentication protocols. At the beginning of this thesis, we take a look at the existing LPN solving algorithms. We provide the theoretical analysis that assesses their complexity. We compare the theoretical results with practice by implementing these algorithms. We study the efficiency of all LPN solving algorithms which allow us to provide secure parameters that can be used in practice. We push further the state of the art by improving the existing algorithms with the help of two new frameworks. In the first framework, we split an LPN solving algorithm into atomic steps. We study their complexity, how they impact the other steps and we construct an algorithm that optimises their use. Given an LPN instance that is characterized by the noise level and the secret size, our algorithm provides the steps to follow in order to solve the instance with optimal complexity. In this way, we can assess if an LPN instance provides the security we require and we show what are the secure instances for the applications that rely on LPN. The second framework handles problems that can be decomposed into steps of equal complexity. Here, we assume that we have an adversary that has access to a finite or infinite number of instances of the same problem. The goal of the adversary is to succeed in just one instance as soon as possible. Our framework provides the strategy that achieves this. We characterize an LPN solving algorithm in this framework and show that we can improve its complexity in the scenario where the adversary is restricted. We show that other problems, like password guessing, can be modeled in the same framework.

For post quantum cryptography lattice based systems are among the most widely used and safest systems. One of the difficult problems on lattice based systems are based Learning With Errors (LWE) problem. LWE based protocols, because of the definition of the LWE problem, it contains matrix vector product. These multiplications in the protocols take a lot of time. Because, size of matrices used are very large. Therefore, these multiplications need to be accelerated, optimized and made with an acceptable time. In this study, FrodoKEM, Lizard, Emblem, Lotus key encapsulation mechanisms using LWE problem and matrix vector product in FrodoKEM are focused. A efficient matrix vector product library was created based on the productions in the FrodoKEM protocol and applied to other protocols and the results were examined.

Quantum computing furnishes exponential speed up over classical computing in specific areas. For example, Shor’s algorithm can factor two numbers in a polynomial time complexity. Thus, many encryption algorithms that rely on large number factorization are potentially vulnerable to quantum computers. In order to address this, the National Institute of Standard and Test (NIST) has organized a competition to evaluate several post quantum cryptography (PQC) algorithms, that are secure from the attacks from quantum computers. Several of these lattice-based PQC encryption algorithms are based on Learning With Errors (LWE) computation. Conversely, LWE is the heaviest computation in a classical computer, which incurs significant portion of the latency overhead for the entire encryption algorithm. In this paper, we design an optimized quantum circuit for LWE computation. The proposed quantum circuit does not need any ancillary qubits and scales efficiently and easily if there are more qubits available on a higher qubit quantum computer.

The security of a number of modern cryptographic schemes relies on the computational hardness of the learning with errors (LWE) problem. In 2015, Laine and Lauter analyzed a key recovery (or decoding) attack against the search variant of LWE. Their analysis is based on a generalization of the Boneh-Venkatesan method for the hidden number problem to LWE. They adopted the LLL algorithm and Babai’s nearest plane method in the attack against LWE, and they also demonstrated a successful range of the attack by experiments for hundreds of LWE instances. In this paper, we give an alternative analysis of the key recovery attack. While Laine and Lauter’s analysis gives explicit information about the effective approximation factor in the LLL algorithm and Babai’s nearest plane method, our analysis is useful to estimate which LWE instances can be solved by the key recovery attack. Furthermore, our analysis enables one to determine a successful range of the attack with practical lattice reduction such as the BKZ algorithm.

The Learning with Errors (LWE) problem has been extensively studied in cryptography due to its strong hardness guarantees, efficiency and expressiveness in constructing advanced cryptographic primitives. In this work, we show that using polar codes in conjunction with LWE-based encryption yields several advantages. To begin, we demonstrate the obvious improvements in the efficiency or rate of information transmission in the LWE-based scheme by leveraging polar coding (with no change in the cryptographic security guarantee). Next, we integrate wiretap polar coding with LWE-based encryption to ensure provable semantic security over a wiretap channel in addition to cryptographic security based on the hardness of LWE. To the best of our knowledge this is the first wiretap code to have cryptographic security guarantees as well. Finally, we study the security of the private key used in LWE-based encryption with wiretap polar coding, and propose a key refresh method using random bits used in wiretap coding. Under a known-plaintext attack, we show that non-vanishing information-theoretic secrecy can be achieved for the key. We believe our approach is at least as interesting as our final results: our work combines cryptography and coding theory in a novel “non blackbox-way” which may be relevant to other scenarios as well.

At CRYPTO 2017, Roşca et al. introduce a new variant of the Learning With Errors (LWE) problem, called the Middle-Product LWE ( $${\mathrm {MP}\text {-}\mathrm{LWE}}$$ ). The hardness of this new assumption is based on the hardness of the Polynomial LWE (P-LWE) problem parameterized by a set of polynomials, making it more secure against the possible weakness of a single defining polynomial. As a cryptographic application, they also provide an encryption scheme based on the $${\mathrm {MP}\text {-}\mathrm{LWE}}$$ problem. In this paper, we propose a deterministic variant of their encryption scheme, which does not need Gaussian sampling and is thus simpler than the original one. Still, it has the same quasi-optimal asymptotic key and ciphertext sizes. The main ingredient for this purpose is the Learning With Rounding (LWR) problem which has already been used to derandomize LWE type encryption. The hardness of our scheme is based on a new assumption called Middle-Product Computational Learning With Rounding, an adaption of the computational LWR problem over rings, introduced by Chen et al. at ASIACRYPT 2018. We prove that this new assumption is as hard as the decisional version of MP-LWE and thus benefits from worst-case to average-case hardness guarantees.

The Module-Lattice-Based Key encapsulation Mechanism (ML-KEM) scheme, which is currently being standardised, is a quantum attack resistant KEM that is based on CRYSTALS-Kyber. CRYSTALS-Kyber is the only Public-key Encryption (PKE)/ KEM scheme selected in the first set of successful candidates as part of the NIST initiated Post-Quantum Cryptography (PQC) process. ML-KEM scheme includes three different security levels, namely security level 1, 3, and 5. In this research, we propose a highly area-time efficient hardware ML-KEM architecture. The architecture comprises three computational layers. The first layer comprises a hash and sampling module; the second layer includes a number theoretic transform (NTT), its inverse (INTT) and a point-wise multiplication (PWM) module; and the third layer comprises addition, compressing and encoding. Intra-layer pipelining and out-of-layer scheduling ensures that either layer 1 or layer 2 operate in the shortest time. In the reduction module, we propose a novel hybrid architecture to obtain the final result within 2 cycles with low area consumption. In the NTT module, the PWM pipelining method is modified and an optimised iterative FIFO access method is adopted to reduce the size of FIFO units by 55% over previous research. Look-up tables are also used to replace the first-stage of the NTT to reduce 8 cycles. Furthermore, the memory unit uses only FIFOs, the size are optimised based on the requirements of the most resource-intensive function in ML-KEM (ML-KEM.CPA.Dec). The results show that the proposed architecture has a 48.2%, 41.2%, and 78.1% reduction in computational time in comparison to previous work for security levels 1, 3, and 5, respectively. In addition, the area of proposed optimised ML-KEM designs is reduced by 73%, 70%, 76% and resulting in an improved area-time (AT) product of 15.8%, 10.7%, and 11.3%, for the Level 1, 3, and 5 security levels respectively, compared with state-of-the-art designs.

In post-quantum cryptography, Learning With Errors (LWE) is one of the dominant underlying mathematical problems. The dual attack is one of the main strategies for solving the LWE problem, and it has recently gathered significant attention within the research community. The attack strategy consists of a lattice reduction part and a distinguishing part. The latter includes an enumeration subroutine over a certain number of positions of the secret key. Our contribution consists of giving a precise and efficient approach for calculating the expected complexity of such an enumeration procedure, which was missing in the literature. This allows us to decrease the estimated cost of the whole dual attack, both classically and quantumly, on well-known protocols such as Kyber, Saber, and TFHE. In addition, we explore different enumeration strategies to investigate some potential further improvements. As our method of calculating the expected cost of enumeration is pretty general, it might be of independent interest in other areas of cryptanalysis or even in different research areas.