Hybrid key encapsulation is in the process of becoming the de-facto standard for integration of post-quantum cryptography (PQC). Supporting two cryptographic primitives is a challenging task for constrained embedded systems. Both contemporary cryptography based on elliptic curves or RSA and PQC based on lattices require costly multiplications. Recent works have shown how to implement lattice-based cryptography on big-integer coprocessors. We propose a novel hardware design that natively supports the multiplication of polynomials and big integers, integrate it into a RISC-V core, and extend the RISC-V ISA accordingly. We provide an implementation of Saber and X25519 to demonstrate that both lattice- and elliptic-curve-based cryptography benefits from our extension. Our implementation requires only intermediate logic overhead, while significantly outperforming optimized ARM Cortex M4 implementations, other hardware/software codesigns, and designs that rely on contemporary accelerators.

A recent work of Sipasseuth, Plantard and Susilo proposed to accelerate lattice-based signature verifications and compress public key storage at the cost of a precomputation on a public key. This first approach, which focused on a restricted type of key, did not include most NIST candidates or most lattice representations in general. In this work, we first present a way to improve even further both their verification speed and their public key compression capability by using a generator of numbers that better suit the method needs. We then also generalize their framework to apply to q-ary lattice schemes as well as classical lattices using Hermite Normal Form, improving their security and applicable scope, thus exhibiting potential trade-offs to accelerate lattice-based signature verification in general and compression of the public key on the verifier side for unstructured lattices.

Efficient implementation of pairings is a fundamental ingredient in pairing-based cryptographic protocols. The Elliptic Net algorithm is an alternative method to Miller’s algorithm for computing the (Optimal) Ate pairing in polynomial time. In this paper, we utilize several tricks to speed up the Elliptic Net algorithm. Firstly, we eliminate the inversion in the improved Elliptic Net algorithm, which allows for further improvements under certain circumstances. Second, we apply lazy reduction to the Elliptic Net algorithm for a better performance. Finally, we propose a new derivation of the formulas for computing the (Optimal) Ate pairing on the twisted curves. In addition, we provide implementations of all versions of the Elliptic Net algorithm on personal computers based on RELIC toolkit. Our implementations indicate that on this research line the Elliptic Net algorithm is about \(80\%\) faster than the previous fastest ones on the twisted 381-bit BLS12 curve and \(71.5\%\) faster on the twisted 676-bit KSS18 curve on 64-bit platforms, respectively.