Software Toolkit for HFE-based Multivariate Schemes

Abstract

In 2017, NIST shook the cryptographic world by starting a process for standardizing post-quantum cryptography. Sixty-four submissions have been considered for the first round of the on-going NIST Post-Quantum Cryptography (PQC) process. Multivariate cryptography is a classical post-quantum candidate that turns to be the most represented in the signature category. At this stage of the process, it is of primary importance to investigate efficient implementations of the candidates. This article presents {\tt MQsoft}, an efficient library which permits to implement {\tt HFE}-based multivariate schemes submitted to the NIST PQC process such as {\sf G{\it e}MSS}, {\tt Gui} and {\sf DualModeMS}. The library is implemented in \verb|C| targeting Intel 64-bit processors and using \verb|avx2| set instructions. We present performance results for our library and its application to {\sf G{\it e}MSS}, {\tt Gui} and {\sf DualModeMS}. In particular, we optimize several crucial parts for these schemes. These include root finding for {\tt HFE} polynomials and evaluation of multivariate quadratic systems in $\mathbb{F}_2$. We propose a new method which accelerates root finding for specific {\tt HFE} polynomials by a factor of two. For {\sf G{\it e}MSS} and {\tt Gui}, we obtain a speed-up of a factor between $2$ and $19$ for the keypair generation, between $1.2$ and $2.5$ for the signature generation, and between $1.6$ and $2$ for the verifying process. We have also improved the arithmetic in $\mathbb{F}_{2^n}$ by a factor of $4$ compared to the \verb|NTL| library. Moreover, a large part of our implementation is protected against timing attacks.