Kavach: Lightweight masking techniques for polynomial arithmetic in lattice-based cryptography

• Published in: IACR transactions on cryptographic hardware and embedded systems Vol. 2023; no. 3; pp. 366 - 390
• Main Authors: Aikata, Aikata, Basso, Andrea, Cassiers, Gaetan, Mert, Ahmet Can, Sinha Roy, Sujoy
• Format: Journal Article
• Language: English
• Published: Ruhr-Universität Bochum 09.06.2023
• Subjects: Lattice-based Cryptography; Masking; Post- Quantum Cryptography; Side-Channel Attacks
• ISSN: 2569-2925; 2569-2925
• DOI: 10.46586/tches.v2023.i3.366-390

Lattice-based cryptography has laid the foundation of various modern-day cryptosystems that cater to several applications, including post-quantum cryptography. For structured lattice-based schemes, polynomial arithmetic is a fundamental part. In several instances, the performance optimizations come from implementing compact multipliers due to the small range of the secret polynomial coefficients. However, this optimization does not easily translate to side-channel protected implementations since masking requires secret polynomial coefficients to be distributed over a large range. In this work, we address this problem and propose two novel generalized techniques, one for the number theoretic transform (NTT) based and another for the non-NTT-based polynomial arithmetic. Both these proposals enable masked polynomial multiplication while utilizing and retaining the small secret property.For demonstration, we used the proposed technique and instantiated masked multipliers for schoolbook as well as NTT-based polynomial multiplication. Both of these can utilize the compact multipliers used in the unmasked implementations. The schoolbook multiplication requires an extra polynomial accumulation along with the two polynomial multiplications for a first-order protected implementation. However, this cost is nothing compared to the area saved by utilizing the existing cheap multiplication units. We also extensively test the side-channel resistance of the proposed design through TVLA to guarantee its first-order security.