Abstract
This paper presents an analysis of the two lattice-based digital signature schemes, Dilithium and Falcon, which have been chosen by NIST for standardisation, on the ARM Cortex M7 using the STM32F767ZI NUCLEO-144 development board. This research is motivated by the ARM Cortex M7 device being the only processor in the Cortex-M family to offer a double precision (i.e., 64-bit) floating-point unit, making Falcon’s implementations, requiring 53 bits of double precision, able to fully run native floating-point operations without any emulation. When benchmarking natively, Falcon shows significant speed-ups between 6.2–8.3x in clock cycles, 6.2-11.8x in runtime, and Dilithium does not show much improvement other than those gained by the slightly faster processor. We then present profiling results of the two schemes on the ARM Cortex M7 to show their respective bottlenecks and operations where the improvements are and can be made. This demonstrates, for example, that some operations in Falcon’s procedures observe speed-ups by an order of magnitude. Finally, since Falcon’s use of floating points is so rare in cryptography, we test the native FPU instructions on 4 different STM32 development boards with the ARM Cortex M7 and also a Raspberry Pi 3 which is used in some of Falcon’s official benchmarking results. We find constant-time irregularities in all of these devices, which makes Falcon insecure on these devices for applications where signature generation can be timed by an attacker.
B. Westerbaan–The research in this paper was carried out while employed at PQShield.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
- 2.
See the NIST PQC forum: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/cJxMq0_90gU/m/qbGEs3TXGwAJ.
- 3.
- 4.
- 5.
For example, see the ARM Cortex-M4 Technical Reference Manual https://developer.arm.com/documentation/ddi0439/b/BEHJADED.
- 6.
- 7.
- 8.
References
Alagic, G., et al.: Status report on the first round of the NIST post-quantum cryptography standardization process. US Department of Commerce, National Institute of Standards and Technology (2019)
Alagic, G., et al.: Status report on the third round of the NIST post-quantum cryptography standardization process. Technical report, National Institute of Standards and Technology Gaithersburg, MD (2022)
Alagic, G., et al.: status report on the second round of the NIST post-quantum cryptography standardization process. In: NIST, Technical report (2020)
ARM. Arm cortex-m7 processor: Technical reference manual. Revision r1p2 (2018). https://developer.arm.com/documentation/ddi0489/f/programmers-model/instruction-set-summary/binary-compatibility-with-other-cortex-processors
Banerjee, U., Ukyab, T.S., Chandrakasan, A.P.: Sapphire: a configurable crypto-processor for post-quantum lattice-based protocols. IACR TCHES, 2019(4), 17–61, (2019). ISSN: 2569-2925. https://tches.iacr.org/index.php/TCHES/article/view/8344, https://doi.org/10.13154/tches.v2019.i4.17-61
Greconici, D.O.C., Kannwischer, M.J., Sprenkels, A.: Compact dilithium implementations on cortex-M3 and cortex-M4. Cryptology ePrint Archive, Report 2020/1278 (2020). https://eprint.iacr.org/2020/1278
Hulsing, H., et al.: SPHINCS+. Technical report. National Institute of Standards and Technology (2020). https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions
Howe, J., et al.: Exploring parallelism to improve the performance of FrodoKEM in hardware. J. Cryptographic Eng. 11(4), 317–327 (2021). https://doi.org/10.1007/s13389-021-00258-7
Howe, J., et al.: Standard lattice-based key encapsulation on embedded devices. IACR TCHES 2018(3), 372–393 (2018). https://tches.iacr.org/index.php/TCHES/article/view/7279
Paquin, C., Stebila, D., Tamvada, G.: Benchmarking post-quantum cryptography in TLS. In: Ding, J., Tillich, J.-P. (eds.) PQCrypto 2020. LNCS, vol. 12100, pp. 72–91. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-44223-1_5
Kales, D., Ramacher, S., Rechberger, C., Walch, R., Werner, M.: Efficient FPGA implementations of LowMC and picnic. In: Jarecki, S. (ed.) CT-RSA 2020. LNCS, vol. 12006, pp. 417–441. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-40186-3_18
Lyubashevsky, V., et al.: CRYSTALS-DILITHIUM. Technical report. National Institute of Standards and Technology (2020). https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions
Liboqs: C library for prototyping and experimenting with quantum-resistant cryptography. https://github.com/open-quantum-safe/liboqs
Marotzke, A.: A constant time full hardware implementation of streamlined NTRU prime. In: Liardet, P.-Y., Mentens, N. (eds.) CARDIS 2020. LNCS, vol. 12609, pp. 3–17. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-68487-7_1
NIST. Post-quantum cryptography (2015). https://csrc.nist.gov/projects/post-quantum-cryptography. Accessed 26 June 2023
NIST. Submission requirements and evaluation criteria for the post-quantum cryptography standardization process (2016). https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/call-for-proposals-final-dec-2016.pdf
Prest, T., et al.: FALCON. Technical report. National Institute of Standards and Technology (2020). https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions
Pornin, T.: New efficient, constant-time implementations of Falcon. Cryptology ePrint Archive, Report 2019/893, 2019. https://eprint.iacr.org/2019/893 (2019)
PQClean: clean, portable, tested implementations of post-quantum cryptography. https://github.com/PQClean/PQClean
PQM4: Post-quantum crypto library for the ARM Cortex-M4. https://github.com/mupq/pqm4
Roy, S.S., Basso, A.: High-speed instruction-set coprocessor for lattice-based key encapsulation mechanism: saber in hardware. In: IACR TCHES 2020(4), 443–466 (2020). ISSN: 2569-2925, https://tches.iacr.org/index.php/TCHES/article/view/8690
Jan Richter-Brockmann and Tim Güneysu. Folding BIKE: Scalable Hardware Implementation for Reconfigurable Devices. Cryptology ePrint Archive, Report 2020/897. https://eprint.iacr.org/2020/897 (2020)
Ricci, S., et al.: Implementing crystals-dilithium signature scheme on fpgas. Cryptology ePrint Archive, Report 2021/108 (2021)
Schwabe, P., et al.: CRYSTALS-KYBER. Technical report. National Institute of Standards and Technology (2020). https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions
SUPERCOP: system for unified performance evaluation related to cryptographic operations and primitives. https://bench.cr.yp.to/supercop.html
Xing, Y., Li, S.: A compact hardware implementation of CCA-secure key exchange mechanism CRYSTALS-KYBER on FPGA. IACR Trans. Cryptographic Hardw. Embed. Syst. 2021(2), 328–356 (2021)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendices
A The Dilithium Signature Scheme
The Dilithium signature scheme is provided in Algorithm 1. The algorithms inside these procedures have been omitted for space, but the reader can refer to the specifications for more details [LDK+20].
B The Falcon Signature Scheme
The Falcon signature scheme is provided in Algorithm 2. The algorithms inside these procedures have been omitted for space, but the reader can refer to the specifications for more details [PFH+20].
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Howe, J., Westerbaan, B. (2023). Benchmarking and Analysing the NIST PQC Lattice-Based Signature Schemes Standards on the ARM Cortex M7. In: El Mrabet, N., De Feo, L., Duquesne, S. (eds) Progress in Cryptology - AFRICACRYPT 2023. AFRICACRYPT 2023. Lecture Notes in Computer Science, vol 14064. Springer, Cham. https://doi.org/10.1007/978-3-031-37679-5_19
Download citation
DOI: https://doi.org/10.1007/978-3-031-37679-5_19
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-37678-8
Online ISBN: 978-3-031-37679-5
eBook Packages: Computer ScienceComputer Science (R0)