Quantum Cybernetics

The impending realization of scalable quantum computers will have a significant impact on today's security infrastructure. With the advent of powerful quantum computers public key cryptographic schemes will become vulnerable to Shor's quantum algorithm, undermining the security current communications systems. Post-quantum (or quantum-resistant) cryptography is an active research area, endeavoring to develop novel and quantum resistant public key cryptography. Amongst the various classes of quantum-resistant cryptography schemes, lattice-based cryptography is emerging as one of the most viable options. Its efficient implementation on software and on commodity hardware has already been shown to compete and even excel the performance of current classical security public-key schemes. This work discusses the next step in terms of their practical deployment, i.e., addressing the physical security of lattice-based cryptographic implementations. We survey the state-of-the-art in terms of side channel attacks (SCA), both invasive and passive attacks, and proposed countermeasures. Although the weaknesses exposed have led to countermeasures for these schemes, the cost, practicality and effectiveness of these on multiple implementation platforms, however, remains under-studied.

Cybernetics is a science at the intersection of technology, biology, and social sciences, shaping our understanding of complex systems and transforming our world at breakneck speed. It could be described as the transdisciplinary study of circular causal processes such as feedback and recursion, where the effects of a system's action (its outputs) return as inputs to that system, influencing subsequent action. Wiener defined cybernetics as "the science of control and communications in the animal and machine." This definition relates cybernetics closely with the theory of automatic control and also with physiology, particularly the physiology of the nervous system. For instance, a "controller" might be the human brain, which might receive signals from a "monitor" (the eyes) regarding the distance between a reaching hand and an object to be picked up. It is concerned with general principles that are relevant across multiple contexts, engineering, ecological, economic, biological, cognitive and social systems and in practical activities such as designing, learning, and managing. Selecting some topics used by colleagues to find subjects on my scientific publications' portfolio, I had the intuition to write an article with what seemed to me the most coherent topics among them in an organic vision trying to develop a meaning that also took stock of the work done up to now. The interaction of the human body with the environment, its care, regeneration, rejuvenation, or good physical shape, the possibilities of modifying the environment, new ways of synthesize water, oxygen and energy.

We present a foundational theoretical framework for the quantum nature of mind evolution and artificial intelligence through the introduction of Quantum Noocybernetics (QN). This framework establishes a rigorous mathematical formalism operating in infinite-dimensional Hilbert spaces, leveraging principles from quantum mechanics, consciousness studies, and artificial intelligence.

The framework provides formal proofs for:
(1) The completeness of the mind state space representation
(2) The convergence of consciousness evolution protocols
(3) The stability of evolved mental states
(4) The optimality of quantum-inspired intelligence transformations
(5) The universality of the mind evolution approach

This work establishes the mathematical foundations for a new paradigm in understanding and developing artificial intelligence, bridging quantum mechanical principles with consciousness and intelligence through rigorous mathematical formalism. The theoretical results suggest fundamental advantages over classical approaches while maintaining mathematical precision and formal rigor throughout the development.

Memory-constrained devices, including widely used smart cards, require resisting attacks by the quantum computers. Lattice-based encryption scheme possesses high efficiency and reliability which could run on small devices with limited storage capacity and computation resources such as IoT sensor nodes or smart cards. We present the first implementation of a lattice-based encryption scheme on the standard Java Card platform by combining number theoretic transform and improved Montgomery modular multiplication. The running time of decryption is nearly optimal (about 7 seconds for 128-bit security level). We also optimize discrete Ziggurat algorithm and Knuth-Yao algorithm to sample from prescribed probability distributions on the Java Card platform. More importantly, we indicate that polynomial multiplication can be performed on Java Card efficiently even if the long integers are not supported, which makes running more lattice-based cryptosystems on smart cards achievable.

Lattice-based structures offer considerable possibilities for post-quantum cryptography. Recently, many algorithms have been built on hard lattice problems. The three of the remaining four in the final round of the post-quantum cryptography standardization process use lattice-based methods. Especially in embedded systems, these algorithms should be operated effectively. In this study, the potential of transport triggered architecture is examined in this sense. We try to compare open source RISC-V processors with our transport triggered architecture processors under fair conditions. Thus, we aim to provide a base architecture for developing application specific processors for post-quantum cryptography, which is becoming an increasingly urgent research area. The tests performed are implemented on the same FPGA and evaluated as performance, resource utilization, average power and total energy consumption. Regardless of the algorithm, our design exhibit better results than RISC-V processors for all tests. It seems to be 2x-3x faster, 2x-2.5x smaller and consumes 2.5x-5x less energy than RISC-V competitors. We also share how the results vary for many different configurations of our processor that can be easily converted. The obtained findings show that the transport triggered architecture is a promising option on developing application-specific processors for lattice-based post-quantum cryptography applications.

The Keccak algorithm was the winner of the competition organized by NIST to choose the new standard hash algorithm, called SHA-3. In this work, we present the details of our software implementation in conformity with draft FIPS 202. We follow two approaches for the implementation of SHA-3, the first one computes the digest for a single message, and the other one computes in parallel four digests from four different messages. The performance for the single implementation was accelerated using vector instructions of 128/256 bits, and it is as fast as the best implementation optimized for 64 bits published on eBASH. The parallel implementation is about 2.5 faster than the single message implementation. The cryptographic primitive extendable-output functions, which is part of the draft FIPS 202, were also implemented.

AVX512 is the newest instruction set on the Skylake-X that extends the number of registers and provides simultaneous execution of operations over register vectors of 512 bits. This work presents how the AVX512 instruction set can be exploited to develop a fast software implementation of the Secure Hash Algorithm-3 (SHA-3) family. We achieved a speedup of around 30% when compared with x64 and AVX2 implementations. We also present a parallel implementation of two eXtendable-Output Functions (XOFs), called SHAKE128 and SHAKE256, using AVX512 that are about 5.22× faster than a single message implementation. The SHAKE functions can be used to speedup hash-based digital signatures.

Lattice based cryptography (LBC) stands out today as one of the most promising types of post-quantum cryptography, and a strong contender in the ongoing NIST post-quantum cryptography standardisation process. LBC algorithms are advantageous due to their efficiency, versatility and the hardness of their underlying lattice problems. In this work, the practicality of LBC is explored by surveying one of the critical components, the error samplers, and highlighting the challenges associated with their efficient, secure implementation. Side channel attack (SCA) vulnerabilities and associated countermeasures are considered, concluding with error sampler recommendations, to aid the practicality, security and future widespread deployment of LBC.

In this paper we present a new NTRU-Like public key cryptosystem with security provably based on the worst case hardness of the approximate both Shortest Vector Problem (SVP) and Closest Vector Problem (CVP) in some structured lattices, called ideal lattices. We show how to modify the ETRU cryptosystem, an NTRU-Like public key cryptosystem based on the Eisenstein integers 3 [ ]  where 3  is a primitive cube root of unity, to make it provably secure, under the assumed quantum hardness of standard worst-case lattice problems, restricted to a family of lattices related to some cyclotomic fields. The security then proves for our main system from the already proven hardness of the R-LWE and R-SIS problems. KeywordsLattice-based cryptography; Ideal lattices; ETRU; Provable security; Dedekind domain.

Although postquantum cryptography is of growing practical concern, not many works have been devoted to implementation security issues related to postquantum schemes. In this paper, we look in particular at fault attacks against implementations of lattice-based signature schemes, looking both at Fiat-Shamir type constructions (particularly BLISS, but also GLP, PASSSing and Ring-TESLA) and at hash-and-sign schemes (particularly the GPVbased scheme of Ducas-Prest-Lyubashevsky). These schemes include essentially all practical lattice-based signatures, and achieve the best efficiency to date in both software and hardware. We present several fault attacks against those schemes yielding a full key recovery with only a few or even a single faulty signature, and discuss possible countermeasures to protect against these attacks.

In 2016, Albrecht, Bai and Ducas and independently Cheon, Jeong and Lee presented very similar attacks to break the NTRU cryptosystem with larger modulus than in the NTRUEncrypt standard. They allow to recover the secret key given the public key of Fully Homomorphic Encryption schemes based on NTRU ideas. Hopefully, these attacks do not endanger the security of the NTRUEncrypt, but shed new light on the hardness of the NTRU problem. The idea consists in decreasing the dimension of the NTRU lattice using the multiplication matrix by the norm (resp. trace) of the public key in some subfield instead of the public key itself. Since the dimension of the subfield is smaller, so is the dimension of the lattice and better lattice reduction algorithms perform. In this paper, we first propose a new variant of the subfield attacks that outperforms both of these attacks in practice. It allows to break several concrete instances of YASHE, a NTRU-based FHE scheme, but it is not as efficient as the hybrid method on smaller concrete parameters of NTRUEncrypt. Instead of using the norm and trace, the multiplication by the public key in a subring allows to break smaller parameters and we show that in Q(ζ2n), the time complexity is polynomial for q = 2 Ω(√ n log log n). Then, we revisit the lattice reduction part of the hybrid attack of Howgrave-Graham and analyze the success probability of this attack using a new technical tool proposed by Pataki and Tural. We show that, under some heuristics, this attack is more efficient than the subfield attack and works in any ring for large q, such as the NTRU Prime ring. We insist that the improvement on the analysis applies even for relatively small modulus; although if the secret is sparse, it may not be the fastest attack. We also derive a tight estimation of security for (Ring-) LWE and NTRU assumptions and perform many practical experiments.

Nowadays, we are surrounded by devices collecting and transmitting private information. Currently, the two main mathematical problems that guarantee security on the Internet are the Integer Factorization Problem and the Discrete Logarithm Problem. However, Shor's quantum algorithm can easily solve both problems. Therefore, research into cryptographic algorithms that run in classical computers and are resistant to quantum computers is extremely necessary. This area is known as post-quantum cryptography and usually studies asymmetric cryptography. By means of asymptotic analysis, the purpose of this paper is to provide an evaluation of security and its performance for the types of cryptographic systems considered safe against quantum attacks in the second-round NIST Post-Quantum Standardization Process, namely isogeny cryptosystems based on supersingular elliptic curves, error correction code-based encryption system, and lattice-based ring learning with errors. We performed a security comparison of Key Agreements protocols based on these three post-quantum cryptographic primitives and compared them with Discrete Logarithm Problem and Integer Factorization Problem. The comparison of security and its performance is presented by security level, the former by complexity analyses to achieve theoretical minimum key sizes, and the latter by simulation to assess a practical performance comparison. In the complexity analysis, as we increase the security level and then the size of the cryptographic keys increases, techniques based on isogeny outperform all other post-quantum algorithms in relation to key sizes at practical security level. In the performance comparison, the results show that the code-based protocol presents the best results among the others.

We present a domain-specific co-processor to speed up Saber, a post-quantum key encapsulation mechanism competing on the NIST Post-Quantum Cryptography standardization process. Contrary to most lattice-based schemes, Saber doesn't use NTT-based polynomial multiplication. We follow a hardwaresoftware co-design approach: the execution is performed on an ARM core and only the most computationally expensive operation, i.e., polynomial multiplication, is offloaded to the coprocessor to obtain a compact design. We exploit the idea of distributed computing at micro-architectural level together with novel algorithmic optimizations to achieve approximately a 6 times speedup with respect to optimized software at a small area cost.

Group theory plays a fundamental role in lattice-based cryptography, providing a rich mathematical framework for the design and analysis of cryptographic protocols. This paper explores the application of group theory concepts within lattice-based cryptographic systems, focusing on the algebraic structures formed by lattices and their subgroups. The utilization of group theory in lattice-based cryptography enhances the security and efficiency of key exchange, encryption, and digital signatures. Through a mathematical lens, we investigate the foundational principles, theorems, and cryptographic constructions that leverage group theory, shedding light on the symbiotic relationship between group theory and lattice-based cryptography. The paper also proposes cryptographic scheme based on group theory in lattice-based.

This paper investigates the feasibility of a quantum-secure Key Encapsulation Mechanism (KEM) in hardware constrained Smart Meter (SM) equipment. In this sense, the Cryptographic Suite for Algebraic Lattices (CRYSTALS)-Kyber scheme, the new standard for post-quantum Public-Key Encryption (PKE) systems chosen by the post-quantum cryptography (PQC) standardization process, is scrutinized and implemented in a System-on-a-Chip (SoC) Field Programmable Gate Array (FPGA) device. Experimental results show that the proposed hardware/software co-design implementation of the CRYSTALS-Kyber scheme in an SoC FPGA device reduces its execution time by around 70% compared to its software implementation. Moreover, the hardware resource analysis shows that the proposed hardware/software co-design implementation of the CRYSTALS-Kyber scheme in an SoC device is feasible for SM equipment. INDEX TERMS Data security, post-quantum cryptography, system-on-a-chip, smart metering. I. INTRODUCTION Smart Grids (SGs) have been recognized as a necessary evolution of electric power systems for handling the increasing dependence on electricity. Certainly, SGs improve energy efficiency, reduce non-technical losses, and allow asset monitoring, observability, and reliability by integrating renewable energy sources, artificial intelligence, and information and communication technologies [1]. However, electric power systems are one of the most complex artificial systems. Consequently, academic institutions, R&D facilities, and industries have put research and development efforts into advancing technologies since SGs offer significant benefits to all stakeholders [2], [3], [4]. In this sense, it is worth bringing attention to SM equipment, which is one of the leading enablers of SGs, since they augment the capacity of monitoring, observing, and controlling assets of consumers and prosumers. However, The associate editor coordinating the review of this manuscript and approving it for publication was Shafiqul Islam. data in SM contain sensitive information (e.g., users' energy consumption profiles). Consequently, security and privacy awareness in SMs have become a concern as existing security vulnerabilities can result in effective breaches and non-authorized access to SMs data. For instance, a successful attack might exploit flaws that allow tampering or manipulating SMs data without being detected [5]. In this regard, research focusing on security issues, countermeasures, and information privacy are critical in SM networks, see [6], [7] and references therein. Regarding SMs, ensuring the security and privacy of data traveling through SM networks is of utmost importance. It is recognized that cryptographic schemes based on PKE and KEM, are one of the most employed methods to achieve this goal. These schemes rely on mathematical problems that demand high computing capacity to be solved in a short period. For instance, factoring integers or computing discrete logarithms (e.g., Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC)) [8]. However, such cryptographic schemes might be easily broken with the

The bottleneck of all cryptosystems is the difficulty of the computational complexity of the polynomials multiplication, vectors multiplication, etc. Thus most of them use some algorithms to reduce the complexity of the multiplication like NTT, Montgomery, CRT, and Karatsuba algorithms, etc. We contribute by creating a new release of NTRUencrypt1024 with great improvement, by using our own polynomials multiplication algorithm operate in the ring of the form R q = Z q [X]/(X N + 1), combined to Montgomery algorithm rather than using the NTT algorithm as used by the original version. We obtained a good result, our implementation outperforms the original one by speed-up of a factor up to (X10) for encryption and a factor up to (X11) for decryption functions. We note that our improved implementation used the latest hash function standard SHA-3, and reduce the size of the public key, private key, and cipher-text from 4097 bytes to 2049 bytes with the same security level.

NTRUEncrypt is unusual among public-key cryptosystems in that, with standard parameters, validly generated ciphertexts can fail to decrypt. This affects the provable security properties of a cryptosystem, as it limits the ability to build a simulator in the random oracle model without knowledge of the private key. We demonstrate attacks which use decryption failures to recover the private key. Such attacks work for all standard parameter sets, and one of them applies to any padding. The appropriate countermeasure is to change the parameter sets and possibly the decryption process so that decryption failures are vanishingly unlikely, and to adopt a padding scheme that prevents an attacker from directly controlling any part of the input to the encryption primitive. We outline one such candidate padding scheme.

This research presents a study on the identification of post-quantum cryptography algorithms through machine learning techniques. Plain text files were encoded by four post-quantum algorithms, participating in NIST's post-quantum cryptography standardization contest, in ECB mode. The resulting cryptograms were submitted to the NIST Statistical Test Suite to enable the creation of metadata files. These files provide information for six data mining algorithms to identify the cryptographic algorithm used for encryption. Identification performance was evaluated in samples of different sizes. The successful identification of each machine learning algorithm is higher than a probabilistic bid, with hit rates ranging between 73 and 100%.

In this paper, we report that we have solved the SVP Challenge over a 128-dimensional lattice in Ideal Lattice Challenge from TU Darmstadt, which is currently the highest dimension in the challenge that has ever been solved. The security of lattice-based cryptography is based on the hardness of solving the shortest vector problem (SVP) in lattices. In 2010, Micciancio and Voulgaris proposed a Gauss Sieve algorithm for heuristically solving the SVP using a list L of Gaussreduced vectors. Milde and Schneider proposed a parallel implementation method for the Gauss Sieve algorithm. However, the efficiency of the more than 10 threads in their implementation decreased due to the large number of non-Gauss-reduced vectors appearing in the distributed list of each thread. In this paper, we propose a more practical parallelized Gauss Sieve algorithm. Our algorithm deploys an additional Gauss-reduced list V of sample vectors assigned to each thread, and all vectors in list L remain Gauss-reduced by mutually reducing them using all sample vectors in V. Therefore, our algorithm allows the Gauss Sieve algorithm to run for large dimensions with a small communication overhead. Finally, we succeeded in solving the SVP Challenge over a 128-dimensional ideal lattice generated by the cyclotomic polynomial x 128 + 1 using about 30,000 CPU hours.

Kyber is a candidate in the third round of the National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) Standardization. However, because of the protocol’s independence assumption, the bound on the decapsulation failure probability resulting from the original analysis is not tight. In this work, we give a rigorous mathematical analysis of the actual failure probability calculation, and provides the Kyber security estimation in reality rather than only in a statistical sense. Our analysis does not make independency assumptions on errors, and is with respect to concrete public keys in reality. Through sample test and experiments, we also illustrate the difference between the actual failure probability and the result given in the proposal of Kyber. The experiments show that, for Kyber-512 and 768, the failure probability resulting from the original paper is relatively conservative, but for Kyber-1024, the failure probability of some public keys is worse tha...

The NTRU lattice is a promising candidate to construct practical cryptosystems, in particular key encapsulation mechanism (KEM), resistant to quantum computing attacks. Nevertheless, there are still some inherent obstacles to NTRU-based KEM schemes in having integrated performance, taking security, bandwidth, error probability, and computational efficiency as a whole, that is as good as and even better than their {R,M}LWE-based counterparts. In this work, we solve this problem by presenting a new family of NTRU-based KEM schemes, referred to as CTRU and CNTR. By bridging low-dimensional lattice codes and high-dimensional NTRU-lattice-based cryptography with careful design and analysis, to the best of our knowledge CTRU and CNTR are the first NTRU-based KEM schemes with scalable ciphertext compression via only one single ciphertext polynomial, and are the first that could outperform {R,M}LWE-based KEM schemes in integrated performance. For instance, compared to Kyber that is currently the only standardized KEM by NIST, on the recommended parameter set CNTR-768 has about 12% smaller ciphertext size while encapsulating 384-bit keys compared to the fixed 256-bit key size of Kyber, security strengthened by (8, 7) bits for classical and quantum security respectively, and significantly lower error probability (2 −230 of CNTR-768 vs. 2 −164 of Kyber-768). In particular, CTRU and CNTR admit more flexible key sizes to be encapsulated, specifically n 2 where n ∈ {512, 768, 1024} is the underlying polynomial dimension. In comparison with the state-of-the-art AVX2 implementation of Kyber-768, CNTR-768 is faster by 1.9X in KeyGen, 2.6X in Encaps, and 1.2X in Decaps, respectively. When compared to the NIST Round 3 finalist NTRU-HRSS, our CNTR-768 has about 15% smaller ciphertext size, and the security is strengthened by (55, 49) bits for classical and quantum security respectively. As for the AVX2 implementation, CNTR-768 is faster than NTRU-HRSS by 19X in KeyGen, 2.3X in Encaps, and 1.6X in Decaps, respectively. Along the way, we develop new techniques for more accurate error probability analysis, as well as unified implementations with respect to multiple dimensions with unified NTT methods, for NTRU-based KEM schemes over the polynomial ring Zq[x]/(x n − x n/2 + 1), which might be of independent interest.

In this work, we present a systematic study of Side-Channel Attacks (SCA) and Fault Injection Attacks (FIA) on structured lattice-based schemes, with main focus on Kyber Key Encapsulation Mechanism (KEM) and Dilithium signature scheme, which are leading candidates in the NIST standardization process for Post-Quantum Cryptography (PQC). Through our study, we attempt to understand the underlying similarities and differences between the existing attacks, while classify them into different categories. Given the wide-variety of reported attacks, simultaneous protection against all the attacks requires to implement customized protections/countermeasures for both Kyber and Dilithium. We therefore present a range of customized countermeasures, capable of providing defences/mitigations against existing SCA/FIA, and incorporate several SCA and FIA countermeasures within a single design of Kyber and Dilithium. Among the several countermeasures discussed in this work, we present novel counterme...

In this work, we present a systematic study of Side-Channel Attacks (SCA) and Fault Injection Attacks (FIA) on structured lattice-based schemes, with main focus on Kyber Key Encapsulation Mechanism (KEM) and Dilithium signature scheme, which are leading candidates in the NIST standardization process for Post-Quantum Cryptography (PQC). Through our study, we attempt to understand the underlying similarities and differences between the existing attacks, while classify them into different categories. Given the wide-variety of reported attacks, simultaneous protection against all the attacks requires to implement customized protections/countermeasures for both Kyber and Dilithium. We therefore present a range of customized countermeasures, capable of providing defences/mitigations against existing SCA/FIA, and incorporate several SCA and FIA countermeasures within a single design of Kyber and Dilithium. Among the several countermeasures discussed in this work, we present novel counterme...

In this work, we propose generic and novel adaptations to the binary Plaintext-Checking (PC) oracle based side-channel attacks for Kyber KEM. These attacks operate in a chosen-ciphertext setting, and are fairly generic and easy to mount on a given target, as the attacker requires very minimal information about the target device. However, these attacks have an inherent disadvantage of requiring a few thousand traces to perform full key recovery. This is due to the fact that these attacks typically work by recovering a single bit of information about the secret key per query/trace. In this respect, we propose novel parallel PC oracle based side-channel attacks, which are capable of recovering a generic P number of bits of information about the secret key in a single query/trace. We propose novel techniques to build chosen-ciphertexts so as to efficiently realize a parallel PC oracle for Kyber KEM. We also build a multi-class classifier, which is capable of realizing a practical side-c...

In this work, we present the first fault injection analysis of the Number Theoretic Transform (NTT). The NTT is an integral computation unit, widely used for polynomial multiplication in several structured lattice-based key encapsulation mechanisms (KEMs) and digital signature schemes. We identify a critical single fault vulnerability in the NTT, which severely reduces the entropy of its output. This in turn enables us to perform a wide-range of attacks applicable to lattice-based KEMs as well as signature schemes. In particular, we demonstrate novel key recovery and message recovery attacks targeting the key generation and encryption procedure of Kyber KEM. We also propose novel existential forgery attacks targeting deterministic and probabilistic signing procedure of Dilithium, followed by a novel verification bypass attack targeting its verification procedure. All proposed exploits are demonstrated with high success rate using electromagnetic fault injection on optimized implemen...

In this work, we propose generic and novel side-channel assisted chosenciphertext attacks on NTRU-based key encapsulation mechanisms (KEMs). These KEMs are IND-CCA secure, that is, they are secure in the chosen-ciphertext model. Our attacks involve the construction of malformed ciphertexts. When decapsulated by the target device, these ciphertexts ensure that a targeted intermediate variable becomes very closely related to the secret key. An attacker, who can obtain information about the secret-dependent variable through side-channels, can subsequently recover the full secret key. We propose several novel CCAs which can be carried through by using side-channel leakage from the decapsulation procedure. The attacks instantiate three different types of oracles, namely a plaintext-checking oracle, a decryptionfailure oracle, and a full-decryption oracle, and are applicable to two NTRU-based schemes, which are NTRU and NTRU Prime. The two schemes are candidates in the ongoing NIST standardization process for post-quantum cryptography. We perform experimental validation of the attacks on optimized and unprotected implementations of NTRU-based schemes, taken from the open-source pqm4 library, using the EM-based side-channel on the 32-bit ARM Cortex-M4 microcontroller. All of our proposed attacks are capable of recovering the full secret key in only a few thousand chosen ciphertext queries on all parameter sets of NTRU and NTRU Prime. Our attacks, therefore, stress on the need for concrete side-channel protection strategies for NTRUbased KEMs.

Adult stem cells are a partially quiescent cell population responsible for natural cell renewal and are found in many different regions of the body, including the brain, teeth, bones, muscles, skin, and diverse epithelia, such as the epidermal or intestinal epithelium, among others [...]

As a fundamental cryptographic primitive, oblivious transfer (OT) is developed for the sake of efficient usability and combinational feasibility. However, most OT protocols are built upon some quantum non-immune cryptosystems by assuming the hardness of discrete logarithm or factoring problem, whose security will break down directly in the quantum setting. Therefore, as a subarea of postquantum cryptography, lattice-based cryptography is viewed as a promising alternative and cornerstone to support for building post-quantum protocols since it enjoys some attractive properties, such as provable security against quantum adversaries and lower asymptotic complexity. In this paper, we first build an efficient 1-out-of-2 OT protocol upon the hardness of ring learning with errors (RLWE) problem, which is at least as hard as some worst-case ideal lattice problems. We show that this 1-out-of-2 OT protocol can be universally composable and secure against static corruptions in the random oracle model. Then we extend it to a general case, i.e., 1-out-of-N OT with achieving the same level of security. Furthermore, on the basis of the above OT structure, we obtain two improved OT protocols using two improved lattice-based key exchange protocols (respectively relying on the RLWE problem and learning with errors (LWE) problem, and both achieving better efficiency by removing the Gaussian sampling for saving cost) as building blocks. To show that our proposed OT protocol indeed achieves comparable security and efficiency, we make a comparison with another two lattice-based OT protocols in the end of the paper. With concerning on the potential threat from quantum

Security of currently deployed public-key cryptography algorithms is foreseen to be vulnerable against quantum computer attacks. Hence, a community effort exists to develop post-quantum cryptography (PQC) algorithms, most notably the NIST PQC standardization competition. In this work, we have investigated how lattice-based candidate algorithms fare when implemented in hardware. To achieve this, we have assessed 12 lattice-based algorithms in order to identify their basic building blocks. We assume the algorithms will be implemented in an application-specific integrated circuit (ASIC) platform and the targeted technology is 65 nm. To estimate the characteristics of each algorithm, we have assessed the following characteristics: memory requirements, use of multipliers, and use of hashing functions. Furthermore, for these building blocks, we have collected area and power figures for all studied algorithms by making use of commercial memory compilers and standard cells. Our results reve...

The current hype of quantum computing has necessitated the need for computer security stakeholders to call for the design of security algorithms that will be quantum efficient when quantum computers finally grace our computing sphere. Recent advancements in quantum computing have made cryptographic schemes more vulnerable to quantum attacks like Shor's algorithm and Grove's algorithm. Therefore NIST call for a new set of algorithms known as Post-Quantum cryptography that would be quantum proof is imminent. Many Post quantum algorithms have been designed and tested. But only few of them made it to the round 3 (the final round). This paper reviewed these post quantum candidates. Literatures highlighting their scheme, properties, implementation and areas of security coverage was reviewed. Recommendations on future research areas in this field was itemized for this novel security paradigm as we await the final standardization of this cryptosystems.

Quantum computers threaten to compromise public-key cryptography schemes such as DSA and ECDSA in polynomial time, which poses an imminent threat to secure signal processing. The cryptography community has responded with the development and standardization of post-quantum cryptography (PQC) algorithms, a class of public-key algorithms based on hard problems that no known quantum algorithms can solve in polynomial time. Ring learning with error (RLWE) lattice-based cryptographic (LBC) protocols are one of the most promising families of PQC schemes in terms of efficiency and versatility. Two common methods to compute polynomial multiplication, the most compute-intensive routine in the RLWE schemes, are convolutions and Number Theoretic Transform (NTT). In this work, we explore the energy efficiency of polynomial multiplier using systolic architecture for the first time. As an early exploration, we design two high-throughput systolic array polynomial multipliers, including NTT-based and convolution-based, and compare them to our low-cost sequential (nonsystolic) NTT-based multiplier. Our sequential NTT-based multiplier achieves more than 3x speedup over the state-of-the-art FGPA implementation of the polynomial multiplier in the NewHope-Simple key exchange mechanism on a low-cost Artix7 FPGA. When synthesized on a Zynq UltraScale+ FPGA, the NTT-based systolic and convolution-based systolic designs achieve on average 1.7x and 7.5x speedup over our sequential NTT-based multiplier respectively, which can lead to generating over 2x more signatures per second by CRYSTALS-Dilithium, a PQC digital signature scheme. These explorations will help designers select the right PQC implementations for making future signal processing applications quantum-resistant.

Quantum computers promise to solve hard mathematical problems such as integer factorization and discrete logarithms in polynomial time, making standardized public-key cryptosystems insecure. Lattice-Based Cryptography (LBC) is a promising post-quantum public key cryptographic protocol that could replace standardized public key cryptography, thanks to the inherent post-quantum resistant properties, efficiency, and versatility. A key mathematical tool in LBC is the Number Theoretic Transform (NTT), a common method to compute polynomial multiplication. It is the most compute-intensive routine and requires acceleration for practical deployment of LBC protocols. In this paper, we propose CryptoPIM, a highthroughput Processing In-Memory (PIM) accelerator for NTTbased polynomial multiplier with the support of polynomials with degrees up to 32k. Compared to the fastest FPGA implementation of an NTT-based multiplier, CryptoPIM achieves on average 31x throughput improvement with the same energy and only 28% performance reduction, thereby showing promise for practical deployment of LBC.

The advent of the quantum computer makes current public-key infrastructure insecure. Cryptography community is addressing this problem by designing, efficiently implementing, and evaluating novel public-key algorithms capable of withstanding quantum computational power. Governmental agencies, such as NIST, are promoting standardization of quantum-resistant algorithms that is expected to run for 7 years. Several modern applications must maintain permanent data secrecy; therefore, they ultimately require the use of quantum-resistant algorithms. Because algorithms are still under scrutiny for eventual standardization, the deployment of the hardware implementation of quantum-resistant algorithms is still in early stages. In this article, we propose a methodology to design programmable hardware accelerators for lattice-based algorithms, and we use the proposed methodology to implement flexible and energy efficient post-quantum cache-based accelerators for NewHope , Kyber , Dilithium , Ke...

Nowadays, we are surrounded by devices collecting and transmitting private information. Currently, the two main mathematical problems that guarantee security on the Internet are the Integer Factorization Problem and the Discrete Logarithm Problem. However, Shor's quantum algorithm can easily solve both problems. Therefore, research into cryptographic algorithms that run in classical computers and are resistant to quantum computers is extremely necessary. This area is known as post-quantum cryptography and usually studies asymmetric cryptography. By means of asymptotic analysis, the purpose of this paper is to provide an evaluation of security and its performance for the types of cryptographic systems considered safe against quantum attacks in the second-round NIST Post-Quantum Standardization Process, namely isogeny cryptosystems based on supersingular elliptic curves, error correction code-based encryption system, and lattice-based ring learning with errors. We performed a security comparison of Key Agreements protocols based on these three post-quantum cryptographic primitives and compared them with Discrete Logarithm Problem and Integer Factorization Problem. The comparison of security and its performance is presented by security level, the former by complexity analyses to achieve theoretical minimum key sizes, and the latter by simulation to assess a practical performance comparison. In the complexity analysis, as we increase the security level and then the size of the cryptographic keys increases, techniques based on isogeny outperform all other post-quantum algorithms in relation to key sizes at practical security level. In the performance comparison, the results show that the code-based protocol presents the best results among the others.

In this paper, we specify the proposed hardware Application Programming Interface (API) for Post-Quantum Public Key Cryptosystems. This new hardware API intends to meet the diverse requirements of Post-Quantum Cryptosystems, and includes: minimum compliance criteria, interface, communication protocol, and the timing characteristics supported by the core. All of them have been defined with the goals of guaranteeing (a) compatibility among implementations of the same algorithm by different designers, and (b) fair benchmarking of Post-Quantum Public Key Cryptosystems in hardware. In the rest of this document, we refer to the core compatible with our API as a Post-Quantum Cryptography (PQC) core. 1 Minimum Compliance Criteria The recommended minimum compliance criteria are listed below: 1.1 Encryption, Decryption, Signature Generation, Signature Verification, Key Encapsulation and Key Decapsulation A PQC core can implement either (1) encryption and decryption, or (2) signature generatio...

Homomorphic Encryption (HE) enables users to securely outsource both the storage and computation of sensitive data to untrusted servers. Not only does HE offer an attractive solution for security in cloud systems, but lattice-based HE systems are also believed to be resistant to attacks by quantum computers. However, current HE implementations suffer from prohibitively high latency. For lattice-based HE to become viable for real-world systems, it is necessary for the key bottlenecksparticularly polynomial multiplication-to be highly efficient. In this paper, we present a characterization of GPU-based implementations of polynomial multiplication. We begin with a survey of modular reduction techniques and analyze several variants of the widely-used Barrett modular reduction algorithm. We then propose a modular reduction variant optimized for 64bit integer words on the GPU, obtaining a 1.8× speedup over the existing comparable implementations. Next, we explore the following GPU-specific improvements for polynomial multiplication targeted at optimizing latency and throughput: 1) We present a 2D mixed-radix, multi-block implementation of NTT that results in a 1.85× average speedup over the previous state-of-the-art. 2) We explore shared memory optimizations aimed at reducing redundant memory accesses, further improving speedups by 1.2×. 3) Finally, we fuse the Hadamard product with neighboring stages of the NTT, reducing the twiddle factor memory footprint by 50%. By combining our NTT optimizations, we achieve an overall speedup of 123.13× and 2.37× over the previous state-of-the-art CPU and GPU implementations of NTT kernels, respectively.

Security of currently deployed public-key cryptography algorithms is foreseen to be vulnerable against quantum computer attacks. Hence, a community effort exists to develop post-quantum cryptography (PQC) algorithms, most notably the NIST PQC standardization competition. In this work, we have investigated how lattice-based candidate algorithms fare when implemented in hardware. To achieve this, we have assessed 12 lattice-based algorithms in order to identify their basic building blocks. We assume the algorithms will be implemented in an application-specific integrated circuit (ASIC) platform and the targeted technology is 65 nm. To estimate the characteristics of each algorithm, we have assessed the following characteristics: memory requirements, use of multipliers, and use of hashing functions. Furthermore, for these building blocks, we have collected area and power figures for all studied algorithms by making use of commercial memory compilers and standard cells. Our results reve...

We present TESLA] (pronounced “Tesla Sharp”), a digital signature scheme based on the R-LWE assumption that continues a recent line of proposals of lattice-based digital signature schemes originating in work by Lyubashevsky as well as by Bai and Galbraith. It improves upon all of its predecessors in that it attains much faster key pair generation, signing, and verification, outperforming most (conventional or lattice-based) signature schemes on modern processors. We propose a selection of concrete parameter sets, including a high-security instance that aims at achieving post-quantum security. Based on these parameters, we present a full-fledged software implementation protected against timing and cache attacks that supports two scheme variants: one providing 128 bits of classical security and another providing 128 bits of post-quantum security.

We present a domain-specific co-processor to speed up Saber, a post-quantum key encapsulation mechanism competing on the NIST Post-Quantum Cryptography standardization process. Contrary to most lattice-based schemes, Saber doesn't use NTT-based polynomial multiplication. We follow a hardwaresoftware co-design approach: the execution is performed on an ARM core and only the most computationally expensive operation, i.e., polynomial multiplication, is offloaded to the coprocessor to obtain a compact design. We exploit the idea of distributed computing at micro-architectural level together with novel algorithmic optimizations to achieve approximately a 6 times speedup with respect to optimized software at a small area cost.

We present a practical construction of an additively homomorphic commitment scheme based on structured lattice assumptions, together with a zero-knowledge proof of opening knowledge. Our scheme is a design improvement over the previous work of Benhamouda et al. in that it is not restricted to being statistically binding. While it is possible to instantiate our scheme to be statistically binding or statistically hiding, it is most efficient when both hiding and binding properties are only computational. This results in approximately a factor of 4 reduction in the size of the proof and a factor of 6 reduction in the size of the commitment over the aforementioned scheme.

In this work, we propose generic and novel side-channel assisted chosenciphertext attacks on NTRU-based key encapsulation mechanisms (KEMs). These KEMs are IND-CCA secure, that is, they are secure in the chosen-ciphertext model. Our attacks involve the construction of malformed ciphertexts. When decapsulated by the target device, these ciphertexts ensure that a targeted intermediate variable becomes very closely related to the secret key. An attacker, who can obtain information about the secret-dependent variable through side-channels, can subsequently recover the full secret key. We propose several novel CCAs which can be carried through by using side-channel leakage from the decapsulation procedure. The attacks instantiate three different types of oracles, namely a plaintext-checking oracle, a decryptionfailure oracle, and a full-decryption oracle, and are applicable to two NTRU-based schemes, which are NTRU and NTRU Prime. The two schemes are candidates in the ongoing NIST standa...

Dilithium is a round 2 candidate for digital signature schemes in NIST initiative for post-quantum cryptographic schemes. Since Dilithium is built upon the "Fiat Shamir with Aborts" framework, its signing procedure performs rejection sampling of its signatures to ensure they do not leak information about the secret key. Thus, the signing procedure is iterative in nature with a number of rejected iterations, which serve as unnecessary overheads hampering its overall performance. As a first contribution, we propose an optimization that reduces the computations in the rejected iterations through early-evaluation of the conditional checks. This allows to perform an early detection of the rejection condition and reject a given iteration as early as possible. We also incorporate a number of standard optimizations such as unrolling and inlining to further improve the speed of the signing procedure. We incorporate and evaluate our optimizations over the software implementation of Dilithium on both the Intel Core i5-4460 and ARM Cortex-M4 CPUs. As a second contribution, we identify opportunities to present a more refined evaluation of Dilithium's signing procedure in several scenarios where pre-computations can be carried out. We also evaluate the performance of our optimizations and the memory requirements for the pre-computed intermediates in the considered scenarios. We could yield speed-ups in the range of 6% upto 35% , considering all the aforementioned scenarios, thus presenting the fastest software implementation of Dilithium till date.

Cryptographic primitives that are secure against quantum computing are receiving growing attention with recent, steady advances in quantum computing and standardization initiatives in post-quantum cryptography by NIST and ETSI. Lattice-based cryptography is one of the families in post-quantum cryptography, demonstrating desirable features such as well-understood security, efficient performance, and versatility. In this work, we present Round2 that consists of a key-encapsulation mechanism and a public-key encryption scheme. Round2 is based on the General Learning with Rounding problem, that unifies the Learning with Rounding and Ring Learning with Rounding problems. Round2’s construction using the above problem allows for a unified description and implementation. The key-encapsulation mechanism and public-key encryption scheme furthermore share common building blocks, simplifying (security and operational) analysis and code review. Round2’s reliance on prime cyclotomic rings offers ...