Cryptology ePrint Archive: Report 2020/434

High-speed Instruction-set Coprocessor for Lattice-based Key Encapsulation Mechanism: Saber in Hardware

Sujoy Sinha Roy and Andrea Basso

Abstract: In this paper, we present an instruction set coprocessor architecture lattice-based cryptography and implement the module lattice-based post-quantum key encapsulation (KEM) scheme Saber as a case study. To achieve fast computation time, the architecture is fully implemented in hardware, including CCA transformations. Since polynomial multiplication plays a performance-critical role in the module and ideal lattice-based public-key cryptography, a parallel polynomial multiplier architecture is proposed that overcomes memory access bottlenecks and results in a highly parallel yet simple and easy-to-scale design. Such multiplier can compute a full multiplication in 256 cycles, but is designed to target any area/performance trade-off. Besides optimizing polynomial multiplication, we make important design decisions and perform architectural optimizations to reduce the overall cycle counts as well as improve resource utilization.

For the module dimension 3 (security comparable to AES-192), the coprocessor computes CCA key generation, encapsulation, and decapsulation in only 5,453, 6,618 and 8,034 cycles respectively, making it the fastest hardware implementation of Saber. On a Xilinx UltraScale+ XCZU9EG-2FFVB1156 FPGA, the entire instruction set coprocessor architecture runs at 250 MHz clock frequency and consumes 23,708 LUTs, 9764 FFs, and 2 BRAM tiles (including 5124 LUTs and 3070 FFs for the Keccak core).

Category / Keywords: public-key cryptography / Lattice-based Cryptography, Post-Quantum Cryptography, Hardware Implementation, Saber KEM, High-speed Instruction-set Architecture

Date: received 15 Apr 2020, last revised 16 Apr 2020

Contact author: s sinharoy at cs bham ac uk,a basso@cs bham ac uk

Available format(s): PDF | BibTeX Citation

Version: 20200416:153336 (All versions of this report)

Short URL: ia.cr/2020/434


[ Cryptology ePrint archive ]