A Flexible Shared Hardware Accelerator for NIST-Recommended Algorithms CRYSTALS-Kyber and CRYSTALS-Dilithium with SCA Protection

Abstract

NIST recently decided upon a set of cryptographic algorithms for future standardization. These algorithms are built upon hard mathematical problems which are believed to be difficult for both classical and quantum computers, unlike RSA and ECC which are trivially broken by a quantum computer running Shor’s algorithm. Cryptographic operations are computationally intense, and therefore are often offloaded to dedicated hardware in order to improve performance and reduce energy usage. However, different applications have different needs for performance, energy, and cost. Thus it is beneficial to have a variety of performance options for hardware acceleration. In this work we present a flexible hardware architecture for selected algorithms, Kyber and Dilithium. Our architecture includes separate instances optimized for either Kyber and Dilithium as well as a combined architecture which support both algorithms in one design. Further, the design can be instantiated at three levels of performance: lightweight, mid-range, and high performance. We also present a masked implementation for the Kyber-only implementation which protects against first order differential power analysis attacks and timing attacks. The masked implementation requires $2.5\!\times$ more LUTs and $6.5\!\times$ more clock cycles for decapsulation.