VPQC: A Domain-Specific Vector Processor for Post-Quantum Cryptography Based on RISC-V Architecture

• Published in: IEEE transactions on circuits and systems. I, Regular papers Vol. 67; no. 8; pp. 2672 - 2684
• Main Authors: Xin, Guozhu, Han, Jun, Yin, Tianyu, Zhou, Yuchao, Yang, Jianwei, Cheng, Xu, Zeng, Xiaoyang
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.08.2020; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Algorithms; Array processors; Communication networks; Computer architecture; Cryptography; Elliptic curve cryptography; Encryption; Hardware; lattice based cryptography; Lattices; Logic circuits; Microprocessors; Parallel processing; Post-quantum cryptography; processor; Quantum computers; Quantum computing; Quantum cryptography; ring-LWE; RISC; RISC-V; Sampling; vector architecture; Vector processing (computers)
• DOI: 10.1109/TCSI.2020.2983185
• ISSN: 1549-8328

In the 5G era, massive devices need to be securely connected to the edge of communication networks, while emerging quantum computers can easily crack the traditional public-key ciphers. Lattice-based cryptography (LBC) is one of the most promising types of schemes in all post-quantum cryptography (PQC) due to its security and efficiency. To meet the requirements of high-throughput and diverse application scenarios of 5G, we investigate the vectorization of kernel algorithms of several LBC candidates and thus present a domain-specific vector processor, VPQC, leveraging the extensible RISC-V architecture. To support the parallel computation of number theoretic transform (NTT) of different dimensions (from 64 to 2048), a vector NTT unit is implemented in VPQC. Besides, a vector sampler executing both uniform sampling and binomial sampling is also employed. Evaluated under TSMC 28nm technology, the vector coprocessor of VPQC consumes 942k equivalent logic gates and 12KB memories. Experimental results show that VPQC can speed up several typical key encapsulation mechanisms (NewHope, Kyber and LAC) by an order of magnitude compared with previous state-of-the-art hardware implementations.