A Polynomial Multiplication Accelerator for Faster Lattice Cipher Algorithm in Security Chip

Round 1

Reviewer 1 Report

This paper considers concepts to speed up the arithmetic for homomorphic encryption (HE). In particular, the number theoretic transform (NTT) is considered, which is a form of the discrete Fourier transform (DFT) for finite fields. The paper focuses on determining the performance factors for NTT. A method is proposed to generate the twiddle factors on-the-fly and to alleviate the main-memory bandwidth bottleneck. Compared to the radix-2 NTT implementation, the proposed optimizations achieve a significant speedup on GPUs. The paper is well-written, and the results are convincing.

Author Response

The authors are very grateful to the reviewer for the review and evaluation of this paper.

Reviewer 2 Report

NTT is an important part of PQC including Kyber KEM. NTT and Keccak account for majority of PQC area, power.

The paper is well drafted, some minor comments:

- References are not uniformly formatted.

- Please add comparisons in a table (or subsection) so that one could fairly compare your work with similar previous works


- With the advent of post-quantum cryptography, it is better to add some relevant papers including the followings to make sure you cover that topic too. When PQC replaces ECC/RSA every security application from smart phones to block chains will be affected:

A High-Performance SIKE Hardware Accelerator
Z Ni, M O'Neill, W Liu - … on Very Large Scale Integration (VLSI …, 2022 - ieeexplore.ieee.org

A. Sarker, M. Mozaffari Kermani, and R. Azarderakhsh, "Fault detection architectures for inverted binary Ring-LWE construction benchmarked on FPGA," IEEE Transactions on Circuits and Systems II, vol. 68, no. 4, pp. 1403-1407, Apr. 2021.

High-speed FPGA implementation of sike based on an ultra-low-latency modular multiplier
J Tian, B Wu, Z Wang - … Transactions on Circuits and Systems I …, 2021 - ieeexplore.ieee.org


- Also add some previous works on side-channel attacks and lightweight cryptography:

Strengthening SIMON implementation against intelligent fault attacks
J Dofe, J Frey, H Pahlevanzadeh… - IEEE Embedded Systems …, 2015 - ieeexplore.ieee.org

J. Kaur, A. Sarker, M. Mozaffari Kermani, and R. Azarderakhsh, "Hardware constructions for error detection in lightweight Welch-Gong (WG)-oriented streamcipher WAGE benchmarked on FPGA," IEEE Transactions on Emerging Topics in Computing, vol. 10, no. 2, pp. 1208-1215, Jun. 2022.

 A. Cintas Canto, M. Mozaffari Kermani, and R. Azarderakhsh, "CRC-based error detection constructions for FLT and ITA finite field inversions over GF(2^m)," IEEE Transactions on Very Large Scale Integrated (VLSI) Systems, vol. 29, no. 5, pp. 1033-1037, May 2021.

P. Ahir, M. Mozaffari Kermani, and R. Azarderakhsh, "Lightweight architectures for reliable and fault detection Simon and Speck cryptographic algorithms on FPGA," ACM Transactions on Embedded Computing Systems, vol. 16, no. 4, pp. 109:1-109:17, Sep. 2017.

Fault attacks on AES and their countermeasures
S Ali, X Guo, R Karri, D Mukhopadhyay - Secure System Design and …, 2016 - Springer

- You could add a subsection for Discussions

- Please add one or more future works for enhancing your presentation

 

Please also comment on ASIC FPGA and ARM RISC-V implementations in a discussions section.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 3 Report

Aim of this research work is to investigate in NTT-based lattice cipher algorithm accelerator for security chip. The emergence of quantum algorithms based solution cannot be denied and considered to be fundamental for traditional cryptographic security for which Lattice based cryptography is a good alternative.

Authors provides a detail study for the polynomial multiplication of number theoretic transformation (NTT), a simple element of Montgomery module reduction with pipeline structure is proposed to realize fast module multiplication. Then, in order to improve the throughput of the NTT module, the block storage technology is used in the NTT hardware module to enable the computing unit to read and write data alternately. Overall the author feels that it is a good study but before considering further for publication following suggestions need to address carefully.

1. Abbreviation in the title should be avoided and moreover based word in the title is not sound sound appropriate.

2. First few sentences of the abstract should be removed and if necessary narrate them in introduction. Moreover, in this paper, or word paper repeated almost three time in the abstract, please avoid this if possible. Additionally, it is better to proved some quantitative or qualitative conclusions and comparisons for better understanding of the contributions.

3. Introduction is too long, please segment the introduction is subsection such as related studies, problem statement with justification, research gap, innovative contributions and insights, organization etc.

4. The elaborative description of the pseudocode should be provided.

5. Results section needs more comparative outcomes for better understanding of the working of NTT-based lattice cipher algorithm.

6. Limitations, advantages and future related studies should be the part of conclusion section.

7. Latest references should be cited on a consistent template.

 

 

 

Based on the NTT module designed in this paper, a pre calculated parameter 10 storage and real-time calculation method suitable for the hardware architecture of this paper is also 11 proposed. This method is based on existing hardware resources, and some parameters are calculated 12 in real time to reduce the memory required without reducing the overall performance. Finally, the 13 hardware of polynomial multiplier based on NTT hardware module is implemented, and its function 14 simulation and performance evaluation are carried out. The results show that the proposed hardware 15 accelerator can greatly improve the performance of polynomial multiplication, thus meeting the 16 computational performance requirements of lattice cipher algorithms in security chips. 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 4 Report

The paper is devoted to developing numerical multiplication algorithm and its hardware implementation. The presented calculation scheme is known in general, the authors develop the issues related to memory exchange costs in detail. The paper is written clearly, is easy to follow, all necessary parts of the study are presented.

There are the following minor issues.

1. Line 92: incomplete phrase.

2. Formula (1): sum is for 'n' index, rather than 'N'.

3. Formula (2): the meaning of W, although well known, should be described.

4. Algorithms 1 and 2: terms are sometimes printed in normal font and sometimes in italic. Is there any sense behind this? If no, style should be unified.

5. Line 664: 'proposes' -> 'propose'.

After these minor corrections the paper can be published.

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

Comments addressed.

Reviewer 3 Report

No further comments.