44
T. Oder et al.
Table 2.1 Cycle counts of our implementation on an ARM Cortex-M4F
Cycle counts
Operation
Unmasked
Masked
Key generation (RLWE.CPA gen
NTT )
2,669,559
–
CCA2-secured encryption (RLWE.CCA enc
NTT )
4,176,684
–
CCA2-secured decryption (RLWE.CCA dec
NTT )
4,416,918
25,334,493
CPA-RLWE encryption (RLWE.CPA enc
NTT )
3,910,871
19,315,432
CPA-RLWE decryption (RLWE.CPA dec
NTT )
163,887
550,038
Shake-128
87,738
201,997
NTT
83,906
–
INTT
104,010
–
Uniform sampling (TRNG)
60,014
–
SampleNoisePoly (PRNG)
1,142,448
6,031,463
PRNG (64 bytes)
88,778
202,454
Cycle counts for sampling are given for a whole polynomial. Our parameters are n = 1024, q =
12,289, and k = 8
performance of the scheme. An insecure approach with an unmasked re-encryption
would require around 2 million cycles only. However, as noted in Sect. 2.3.2 such
an implementation would not provide sufficient protection against a side-channel
adversary in a chosen-ciphertext scenario.
2.6.1 Comparison
Notice that the masked implementation in [43] is a hardware implementation and
that [45] does not provide performance numbers. Thus we cannot directly compare
our results to the existing work and decided to re-implement the previous proposals
in combination with a CCA2-conversion to allow a fair comparison. Our results
are given in Table 2.2. This also demonstrates the individual overhead of all
schemes independent of the performance of the NTT. According to our findings, our
CCA2-secured decryption needs one million cycles less than the masked decoder
approach from [43] and 3.5 million cycles less than additively homomorphic
masking [45]. It is also worth mentioning that encoding one message bit into four
coefficients is much more complex when using the masked decoder approach as
we no longer have 4 2 = 16 possible combinations of values to match quadrants
but 4 2·4 = 256 combinations. Thus, for the evaluation of the masked decoding
approach, we decode each coefficient separately and use masked majority voting
to combine them. The additively homomorphic masking inherently increases the
failure probability and may thus impact parameter choices and the acceptable noise
levels.
T. Oder et al.
Table 2.1 Cycle counts of our implementation on an ARM Cortex-M4F
Cycle counts
Operation
Unmasked
Masked
Key generation (RLWE.CPA gen
NTT )
2,669,559
–
CCA2-secured encryption (RLWE.CCA enc
NTT )
4,176,684
–
CCA2-secured decryption (RLWE.CCA dec
NTT )
4,416,918
25,334,493
CPA-RLWE encryption (RLWE.CPA enc
NTT )
3,910,871
19,315,432
CPA-RLWE decryption (RLWE.CPA dec
NTT )
163,887
550,038
Shake-128
87,738
201,997
NTT
83,906
–
INTT
104,010
–
Uniform sampling (TRNG)
60,014
–
SampleNoisePoly (PRNG)
1,142,448
6,031,463
PRNG (64 bytes)
88,778
202,454
Cycle counts for sampling are given for a whole polynomial. Our parameters are n = 1024, q =
12,289, and k = 8
performance of the scheme. An insecure approach with an unmasked re-encryption
would require around 2 million cycles only. However, as noted in Sect. 2.3.2 such
an implementation would not provide sufficient protection against a side-channel
adversary in a chosen-ciphertext scenario.
2.6.1 Comparison
Notice that the masked implementation in [43] is a hardware implementation and
that [45] does not provide performance numbers. Thus we cannot directly compare
our results to the existing work and decided to re-implement the previous proposals
in combination with a CCA2-conversion to allow a fair comparison. Our results
are given in Table 2.2. This also demonstrates the individual overhead of all
schemes independent of the performance of the NTT. According to our findings, our
CCA2-secured decryption needs one million cycles less than the masked decoder
approach from [43] and 3.5 million cycles less than additively homomorphic
masking [45]. It is also worth mentioning that encoding one message bit into four
coefficients is much more complex when using the masked decoder approach as
we no longer have 4 2 = 16 possible combinations of values to match quadrants
but 4 2·4 = 256 combinations. Thus, for the evaluation of the masked decoding
approach, we decode each coefficient separately and use masked majority voting
to combine them. The additively homomorphic masking inherently increases the
failure probability and may thus impact parameter choices and the acceptable noise
levels.