256-bit Security Levels Research Articles

A lightweight BRLWE-based post-quantum cryptosystem with side-channel resilience for IoT security

The rapid advancement of quantum computing poses a significant threat to conventional cryptographic systems, particularly in the context of Internet of Things (IoT) security. This paper introduces PQ-IoTCrypt, a lightweight post-quantum cryptosystem for resource-constrained IoT devices. PQ-IoTCrypt builds upon the binary ring learning with errors problem, incorporating optimizations for efficient implementation on 8-bit microcontrollers commonly found in IoT environments. We introduce a symmetric discrete uniform distribution and streamlined polynomial arithmetic to reduce computational overhead while maintaining a high-security level. Additionally, we present a comprehensive power side-channel analysis framework for lattice-based post-quantum cryptography, demonstrating PQ-IoTCrypt's resilience against various side-channel attacks, including advanced ciphertext selection criteria, IoT-optimized template creation, and a hierarchical chosen-ciphertext attack methodology tailored for IoT deployments. Experimental results show that PQ-IoTCrypt achieves a 9.9% reduction in total encryption time compared to the next best baseline at the 256-bit security level while requiring significantly fewer ciphertexts for successful attacks. PQ-IoTCrypt demonstrates superior performance in key generation, encryption, and decryption processes, with times reduced by 12.7 %, 9.1 %, and 9.2 %, respectively, compared to the closest competitor. This work contributes to the standardization efforts of post-quantum IoT security and offers valuable insights for real-world deployment of quantum-resistant cryptography in resource-limited settings.

Secure similar patients query with homomorphically evaluated thresholds

Patient-centric precision medicine requires the analysis of large volumes of genomic data to tailor treatments and medications based on individual-level characteristics. Because the amount of data held by a single institution is limited, researchers may want access to genomic data held by other institutions. Owing to the inherent privacy implications of genomic data, performing comparisons on encrypted data is preferable in certain settings. The Similar patient query (SPQ) is an application that enables a secure search across genomic databases for patients with similar genetic makeup. Query results can be used to draw meaningful conclusions regarding suitable therapies.However, existing protocols either reveal intermediate computations, such as similarity scores, which can lead to membership-inference attacks, or they realize the ideal Boolean output (similar/not similar) through multiple protocol rounds, requiring the database owners to stay online throughout.This paper introduces a two-party privacy-preserving approach to perform SPQs across encrypted genomic databases based on secure function extensions of additively homomorphic encryption. In contrast to related works, our scheme enables secure computation of genomic data similarity without an external party in a single round. This is achieved for more than 1000 positions of a genome in a single public key operation of 256-bit security level in the integer factorization setting.

RETRACTED ARTICLE: Efficient identity security authentication method based on improved R-LWE algorithm in IoT environment

In recent years, various smart devices based on IoT technology, such as smart homes, healthcare, detection, and logistics systems, have emerged. However, as the number of IoT-connected devices increases, securing the IoT is becoming increasingly challenging. To tackle the increasing security challenges caused by the proliferation of IoT devices, this research proposes an innovative method for IoT identity authentication. The method is based on an improved ring-learning with errors (R-LWE) algorithm, which encrypts and decrypts communication between devices and servers effectively using polynomial modular multiplication and modular addition operations. The main innovation of this study is the improvement of the traditional R-LWE algorithm, enhancing its efficiency and security. Experimental results demonstrated that, when compared to number theory-based algorithms and elliptic curve cryptography algorithms at a 256-bit security level, the enhanced algorithm achieves significant advantages. The improved algorithm encrypted 20 data points with an average runtime of only 3.6 ms, compared to 7.3 ms and 7.7 ms for the other algorithms. Similarly, decrypting the same amount of data had an average runtime of 2.9 ms, as opposed to 7.3 ms and 8 ms for the other algorithms. Additionally, the improved R-LWE algorithm had significant advantages in terms of communication and storage costs. Compared to the number theory-based algorithm, the R-LWE algorithm reduced communication and storage costs by 3 °C each, and compared to elliptic curve cryptography, it reduced them by 4 °C each. This achievement not only enhances the efficiency of encryption and decryption but also lowers the overall operational costs of the algorithm. The research has made significant strides in improving the security and efficiency of IoT device identity authentication by enhancing the R-LWE algorithm. This study provides theoretical and practical foundations for the development and application of related technologies, as well as new solutions for IoT security.

New code-based cryptosystems via the IKKR framework

One main construct for code-based public key cryptosystems is the McEliece framework that hedges upon the hardness of decoding arbitrary linear codes. Based on Goppa codes, the original McEliece cryptosystem however, suffers from having very large public keys. To alleviate this problem, we define a new IKKR problem that is NP-complete and use this assumption of the intractability of the decisional IKKR problem to construct a IND-CCA2-secure code-based public key encryption scheme. We consider generalized Reed–Solomon codes in our public-key cryptosystem and show that it resists Sidelnikov and Shestakov’s key recovery attack. Our generalized Reed–Solomon code encryption scheme achieves optimal public key size when compared with other PKE or key encapsulation mechanisms with deterministic decryption or decapsulation, as it requires only 88.1 kilobytes to store public key for schemes achieving 128-bit security level and 399.69 kilobytes to store public key for schemes achieving 256-bit security level. A public key size reduction of nearly 92% is obtained as compared to the classic McEliece PKE, and nearly 53% compared to the Reed–Solomon code-based PKE.

Compact Implementation of ARIA on 16-Bit MSP430 and 32-Bit ARM Cortex-M3 Microcontrollers

In this paper, we propose the first ARIA block cipher on both MSP430 and Advanced RISC Machines (ARM) microcontrollers. To achieve the optimized ARIA implementation on target embedded processors, core operations of ARIA, such as substitute and diffusion layers, are carefully re-designed for both MSP430 (Texas Instruments, Dallas, TX, USA) and ARM Cortex-M3 microcontrollers (STMicroelectronics, Geneva, Switzerland). In particular, two bytes of input data in ARIA block cipher are concatenated to re-construct the 16-bit wise word. The 16-bit word-wise operation is executed at once with the 16-bit instruction to improve the performance for the 16-bit MSP430 microcontroller. This approach also optimizes the number of required registers, memory accesses, and operations to half numbers rather than 8-bit word wise implementations. For the ARM Cortex-M3 microcontroller, the 8×32 look-up table based ARIA block cipher implementation is further optimized with the novel memory access. The memory access is finely scheduled to fully utilize the 3-stage pipeline architecture of ARM Cortex-M3 microcontrollers. Furthermore, the counter (CTR) mode of operation is more optimized through pre-computation techniques than the electronic code book (ECB) mode of operation. Finally, proposed ARIA implementations on both low-end target microcontrollers (MSP430 and ARM Cortex-M3) achieved (209 and 96 for 128-bit security level, respectively), (241 and 111 for 192-bit security level, respectively), and (274 and 126 for 256-bit security level, respectively). Compared with previous works, the running timing on low-end target microcontrollers (MSP430 and ARM Cortex-M3) is improved by (92.20% and 10.09% for 128-bit security level, respectively), (92.26% and 10.87% for 192-bit security level, respectively), and (92.28% and 10.62% for 256-bit security level, respectively). The proposed ARIA–CTR implementation improved the performance by 6.6% and 4.0% compared to the proposed ARIA–ECB implementations for MSP430 and ARM Cortex-M3 microcontrollers, respectively.

Efficient Implementation of AES and CTR_DRBG on 8-Bit AVR-Based Sensor Nodes

Since Rijndael algorithm was selected as the Advanced Encryption Standard (AES) by NIST, optimization research for the AES has been actively conducted on various IoT-based processors. In an 8-bit AVR environment, LIGHT version of Fast AES CTR-mode Encryption (FACE-LIGHT) was proposed at ICISC'2019 conference. However, in a Wireless Sensor Network environment, where sessions are frequently changed, FACE-LIGHT seems not efficient in terms of available memory and generating a pre-computation table. In this article, we present a new column-wise fashion implementation. Unlike previous best AES implementations, our proposed implementation in an 8-bit AVR microcontroller combines SubBytes, ShiftRows, and MixColums operations and optimizes the operation speed through efficient register scheduling. Our constant-time implementation uses a significantly less table than FACE-LIGHT in an 8-bit AVR microcontroller, achieving 2,251, 2,706, and 3,160 clock cycles when encrypting 128-bit data for each of three security levels. In particular, our 256-bit security level AES implementation is the fastest AES implementation as far as we know in 8-bit AVR microcontroller. Finally, we apply our implementation in CounTeR-mode_Deterministic Random Bit Generator (CTR_DRBG), one of the upper algorithms of a symmetric-key algorithm, to prove the generality of our optimization technology in various operating modes of AES.

Efficient elliptic curve Diffie‐Hellman computation at the 256‐bit security level

In this study, the authors introduce new Montgomery and Edwards form elliptic curves targeted at the 256-bit security level. To this end, they work with three primes, namely $p_1:= 2^{506} - 45$p 1 :=2506-45, $p_2:= 2^{510} - 75$p 2 :=2510-75 and $p_3:= 2^{521} - 1$p 3 :=2521-1. While $p_3$p 3 has been considered earlier in the literature, $p_1$p 1 and $p_2$p 2 are new. They define a pair of birationally equivalent Montgomery and Edwards form curves over all the three primes. Efficient 64-bit assembly implementations targeted at Skylake and later generation Intel processors have been made for the shared secret computation phase of the Diffie-Hellman key agreement protocol for the new Montgomery curves. Curve448 of the Transport Layer Security, Version 1.3 is a Montgomery curve which provides security at the 224-bit security level. Compared to the best publicly available 64-bit implementation of Curve448, the new Montgomery curve over $p_1$p 1 leads to a 3-4% slowdown and the new Montgomery curve over $p_2$p 2 leads to a 4.5-5% slowdown; on the other hand, 29 and 30.5 extra bits of security, respectively, are gained. For designers aiming for the 256-bit security level, the new curves over $p_1$p 1 and $p_2$p 2 provide an acceptable trade-off between security and efficiency.

ACE: ARIA-CTR Encryption for Low-End Embedded Processors.

In this paper, we present the first optimized implementation of ARIA block cipher on low-end 8-bit Alf and Vegard’s RISC processor (AVR) microcontrollers. To achieve high-speed implementation, primitive operations, including rotation operation, a substitute layer, and a diffusion layer, are carefully optimized for the target low-end embedded processor. The proposed ARIA implementation supports the electronic codebook (ECB) and the counter (CTR) modes of operation. In particular, the CTR mode of operation is further optimized with the pre-computed table of two add-round-key, one substitute layer, and one diffusion layer operations. Finally, the proposed ARIA-CTR implementations on 8-bit AVR microcontrollers achieved 187.1, 216.8, and 246.6 clock cycles per byte for 128-bit, 192-bit, and 256-bit security levels, respectively. Compared with previous reference implementations, the execution timing is improved by 69.8%, 69.6%, and 69.5% for 128-bit, 192-bit, and 256-bit security levels, respectively.

Fast Number Theoretic Transform for Ring-LWE on 8-bit AVR Embedded Processor.

In this paper, we optimized Number Theoretic Transform (NTT) and random sampling operations on low-end 8-bit AVR microcontrollers. We focused on the optimized modular multiplication with secure countermeasure (i.e., constant timing), which ensures high performance and prevents timing attack and simple power analysis. In particular, we presented combined Look-Up Table (LUT)-based fast reduction techniques in a regular fashion. This novel approach only requires two times of LUT access to perform the whole modular reduction routine. The implementation is carefully written in assembly language, which reduces the number of memory access and function call routines. With LUT-based optimization techniques, proposed NTT implementations outperform the previous best results by 9.0% and 14.6% for 128-bit security level and 256-bit security level, respectively. Furthermore, we adopted the most optimized AES software implementation to improve the performance of pseudo random number generation for random sampling operation. The encryption of AES-256 counter (CTR) mode used for random number generator requires only 3184 clock cycles for 128-bit data input, which is 9.5% faster than previous state-of-art results. Finally, proposed methods are applied to the whole process of Ring-LWE key scheduling and encryption operations, which require only 524,211 and 659,603 clock cycles for 128-bit security level, respectively. For the key generation of 256-bit security level, 1,325,171 and 1,775,475 clock cycles are required for H/W and S/W AES-based implementations, respectively. For the encryption of 256-bit security level, 1,430,601 and 2,042,474 clock cycles are required for H/W and S/W AES-based implementations, respectively.

Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Computing the optimal Ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

New rank codes based encryption scheme using partial circulant matrices

We propose a new rank metric code based encryption based on the hard problem of rank syndrome decoding problem. We consider a generator matrix for Gabidulin codes in the form of k-partial circulant matrix. We distort the matrix G by adding it with another random k-partial circulant matrix and multiplying the product with a random circulant matrix. We also convert our encryption into an IND-CCA2 secured encryption scheme under assumption of Rank Syndrome Decoding problem. Our encryption has the smallest key size (of 4.306 KB) at 256-bit security level as compared to all the other rank code based encryption schemes with zero decryption failure and hidden structure for the decodable codes.

An Efficient and Lightweight Deniably Authenticated Encryption Scheme for e-Mail Security

The most important security requirements to secure electronic mail (e-mail) systems are: confidentiality, authentication, non-repudiation and data integrity. In conventional e-mail systems, Secure/Multipurpose Internet Mail Extensions (S/MIME) and Pretty Good Privacy (PGP) digital envelops are used to satisfy these security requirements. However, confidentiality and authentication are performed in two different phases, which increases computations and leads to more energy consumption. Moreover, the receiver can easily reveal the source of the message, violating the sender's privacy. In this paper, we propose a low-cost deniably authenticated encryption scheme (DA-ENS), where all the cryptographic primitives are being performed in a single logical step to achieve these goals. Experimental results show that our scheme, DA-ENS, achieves low computational cost and communication overhead at 80-bit, 112-bit, 128-bit, 192-bit and 256-bit security levels. Energy consumption is shown to be reduced to 80%, 67%, 42%, 62% and 48% compared to similar schemes SL+BF, LXJ+BF, Fagen Li et al. (FL), AJL and CZJZJSZ respectively. Also, we have proven that, our scheme DA-ENS is provably secure in random oracle model.

Selecting elliptic curves for cryptography: an efficiency and security analysis

We select a set of elliptic curves for cryptography and analyze our selection from a performance and security perspective. This analysis complements recent curve proposals that suggest (twisted) Edwards curves by also considering the Weierstrass model. Working with both Montgomery-friendly and pseudo-Mersenne primes allows us to consider more possibilities which help to improve the overall efficiency of base field arithmetic. Our Weierstrass curves are backwards compatible with current implementations of prime order NIST curves, while providing improved efficiency and stronger security properties. We choose algorithms and explicit formulas to demonstrate that our curves support constant-time, exception-free scalar multiplications, thereby offering high practical security in cryptographic applications. Our implementation shows that variable-base scalar multiplication on the new Weierstrass curves at the 128-bit security level is about 1.4 times faster than the recent implementation record on the corresponding NIST curve. For practitioners who are willing to use a different curve model and sacrifice a few bits of security, we present a collection of twisted Edwards curves with particularly efficient arithmetic that are up to 1.42, 1.26 and 1.24 times faster than the new Weierstrass curves at the 128-, 192- and 256-bit security levels, respectively. Finally, we discuss how these curves behave in a real-world protocol by considering different scalar multiplication scenarios in the transport layer security protocol. The proposed curves and the results of the analysis are intended to contribute to the recent efforts towards recommending new elliptic curves for Internet standards.

A high-speed unified hardware architecture for 128 and 256-bit security levels of AES and the SHA-3 candidate Grøstl

One of the five final SHA-3 candidates, Grøstl, has been inspired by the Advanced Encryption Standard. This unique feature can be exploited in a large variety of practical applications. In order to have a better picture of the Grøstl–AES computational efficiency (high-level scheduling, internal pipelining, resource sharing, etc.), we designed a high-speed coprocessor for the Grøstl-based HMAC and AES in the counter mode. This coprocessor offers high-speed computations of both authentication and encryption/decryption with relatively small penalty in terms of area and speed when compared to the authentication (original Grøstl circuitry) functionality only. From our perspective, the main advantage of Grøstl over other finalists is the fact that its hardware architecture naturally accommodates AES at the cost of a small area overhead.