Abstract
Recent progress in quantum computing has increased interest in the question of how well the existing proposals for post-quantum cryptosystems are suited to replace RSA and ECC. While some aspects of this question have already been researched in detail (e.g. the relative computational cost of pre- and post-quantum algorithms), very little is known about the RAM footprint of the proposals and what execution time they can reach when low memory consumption rather than speed is the main optimization goal. This question is particularly important in the context of the Internet of Things (IoT) since many IoT devices are extremely constrained and possess only a few kB of RAM. We aim to contribute to answering this question by exploring the software design space of the lattice-based key-encapsulation scheme ThreeBears on an 8-bit AVR microcontroller. More concretely, we provide new techniques for the optimization of the ring arithmetic of ThreeBears (which is, in essence, a 3120-bit modular multiplication) to achieve either high speed or low RAM footprint, and we analyze in detail the trade-offs between these two metrics. A low-memory implementation of BabyBear that is secure against Chosen Plaintext Attacks (CPA) needs just about 1.7 kB RAM, which is significantly below the RAM footprint of other lattice-based cryptosystems reported in the literature. Yet, the encapsulation time of this RAM-optimized BabyBear version is below 12.5 million cycles, which is less than the execution time of scalar multiplication on Curve25519. The decapsulation is more than four times faster and takes roughly 3.4 million cycles on an ATmega1284 microcontroller.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Bertoni, G., Daemen, J., Peeters, M., Van Assche, G.: Keccak. In: Johansson, T., Nguyen, P.Q. (eds.) EUROCRYPT 2013. LNCS, vol. 7881, pp. 313–314. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38348-9_19
Cheng, H., Dinu, D., Großschädl, J., Rønne, P.B., Ryan, P.Y.A.: A lightweight implementation of NTRU prime for the post-quantum internet of things. In: Laurent, M., Giannetsos, T. (eds.) WISTP 2019. LNCS, vol. 12024, pp. 103–119. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-41702-4_7
Crossbow Technology, Inc.: MICAz Wireless Measurement System. Data sheet, January 2006. http://www.xbow.com/Products/Product_pdf_files/Wireless_pdf/MICAz_Datasheet.pdf
Düll, M., Haase, B., Hinterwälder, G., Hutter, M., Paar, C., Sánchez, A.H., Schwabe, P.: High-speed Curve25519 on 8-bit, 16-bit and 32-bit microcontrollers. Designs Codes Crypt. 77(2–3), 493–514 (2015)
Gu, C.: Integer version of Ring-LWE and its applications. Cryptology ePrint Archive, Report 2017/641 (2017). http://eprint.iacr.org/2017/641
Gura, N., Patel, A., Wander, A., Eberle, H., Shantz, S.C.: Comparing elliptic curve cryptography and RSA on 8-bit CPUs. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 119–132. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-28632-5_9
Hamburg, M.: Ed448-Goldilocks, a new elliptic curve. Cryptology ePrint Archive, Report 2015/625 (2015). https://eprint.iacr.org/2015/625
Hamburg, M.: ThreeBears: Round 2 specification (2019). http://csrc.nist.gov/projects/post-quantum-cryptography/round-2-submissions
Hutter, M., Schwabe, P.: Multiprecision multiplication on AVR revisited. J. Crypt. Eng. 5(3), 201–214 (2015). https://doi.org/10.1007/s13389-015-0093-2
Kannwischer, M.J., Rijneveld, J., Schwabe, P., Stoffelen, K.: pqm4: testing and benchmarking NIST PQC on ARM Cortex-M4. Cryptology ePrint Archive, Report 2019/844 (2019). http://eprint.iacr.org
Karatsuba, A.A., Ofman, Y.P.: Multiplication of multidigit numbers on automata. Doklady Akademii Nauk SSSR 145(2), 293–294 (1962)
Kelsey, J.M., Chang, S.-J.H., Perlner, R.A.: SHA-3 derived functions: cSHAKE, KMAC, TupleHash and ParallelHash. NIST Special Publication 800–185 (2016). http://doi.org/10.6028/NIST.SP.800-185
Liu, Z., Seo, H., Großschädl, J., Kim, H.: Reverse product-scanning multiplication and squaring on 8-Bit AVR processors. In: Hui, L.C.K., Qing, S.H., Shi, E., Yiu, S.M. (eds.) ICICS 2014. LNCS, vol. 8958, pp. 158–175. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-21966-0_12
National Institute of Standards and Technology (NIST): Submission requirements and evaluation criteria for the post-quantum cryptography standardization process (2016). http://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/call-for-proposals-final-dec-2016.pdf
National Institute of Standards and Technology (NIST): NIST reveals 26 algorithms advancing to the post-quantum crypto ‘semifinals’. Press release (2019). http://www.nist.gov/news-events/news/2019/01/nist-reveals-26-algorithms-advancing-post-quantum-crypto-semifinals
Acknowledgements
This work was supported by the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 779391 (FutureTPM).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Cheng, H., Großschädl, J., Rønne, P.B., Ryan, P.Y.A. (2021). Lightweight Post-quantum Key Encapsulation for 8-bit AVR Microcontrollers. In: Liardet, PY., Mentens, N. (eds) Smart Card Research and Advanced Applications. CARDIS 2020. Lecture Notes in Computer Science(), vol 12609. Springer, Cham. https://doi.org/10.1007/978-3-030-68487-7_2
Download citation
DOI: https://doi.org/10.1007/978-3-030-68487-7_2
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-68486-0
Online ISBN: 978-3-030-68487-7
eBook Packages: Computer ScienceComputer Science (R0)