Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Energy-Efficient NTT Sampler for Kyber Benchmarked on FPGA

Paresh Baidya, Rourab Paul, Vikas Srivastava, Sumit Kumar Debnath

TL;DR

This work tackles the energy and latency bottleneck of uniform polynomial sampling in Kyber by introducing Modified SampleNTT, a hardware-friendly sampler that reduces the required randomness from SHAKE-128 and enables two-squeeze polynomial generation with high success. The method preserves the statistical properties of the standard SampleNTT and passes a comprehensive battery of randomness tests, while achieving substantial reductions in bit usage per element (about 2523.8 vs 3785) and two-squeeze success (99.16%). Hardware experiments on an Artix-7 FPGA show significant gains: approximately 33% lower energy consumption and latency, with minimal or modest area reductions compared to the conventional approach. The results demonstrate that Modified SampleNTT is a practical alternative for low-power PQC implementations, enabling Kyber in constrained devices such as IoT and wearables, with potential applicability to other lattice-based schemes.

Abstract

Kyber is a lattice-based key encapsulation mechanism selected for standardization by the NIST Post-Quantum Cryptography (PQC) project. A critical component of Kyber's key generation process is the sampling of matrix elements from a uniform distribution over the ring Rq . This step is one of the most computationally intensive tasks in the scheme, significantly impacting performance in low-power embedded systems such as Internet of Things (IoT), wearable devices, wireless sensor networks (WSNs), smart cards, TPMs (Trusted Platform Modules), etc. Existing approaches to this sampling, notably conventional SampleNTT and Parse-SPDM3, rely on rejection sampling. Both algorithms require a large number of random bytes, which needs at least three SHAKE-128 squeezing steps per polynomial. As a result, it causes significant amount of latency and energy. In this work, we propose a novel and efficient sampling algorithm, namely Modified SampleNTT, which substantially educes the average number of bits required from SHAKE-128 to generate elements in Rq - achieving approximately a 33% reduction compared to conventional SampleNTT. Modified SampleNTT achieves 99.16% success in generating a complete polynomial using only two SHAKE-128 squeezes, outperforming both state-of-the-art methods, which never succeed in two squeezes of SHAKE-128. Furthermore, our algorithm maintains the same average rejection rate as existing techniques and passes all standard statistical tests for randomness quality. FPGA implementation on Artix-7 demonstrates a 33.14% reduction in energy, 33.32% lower latency, and 0.28% fewer slices compared to SampleNTT. Our results confirm that Modified SampleNTT is an efficient and practical alternative for uniform polynomial sampling in PQC schemes such as Kyber, especially for low-power security processors.

Energy-Efficient NTT Sampler for Kyber Benchmarked on FPGA

TL;DR

This work tackles the energy and latency bottleneck of uniform polynomial sampling in Kyber by introducing Modified SampleNTT, a hardware-friendly sampler that reduces the required randomness from SHAKE-128 and enables two-squeeze polynomial generation with high success. The method preserves the statistical properties of the standard SampleNTT and passes a comprehensive battery of randomness tests, while achieving substantial reductions in bit usage per element (about 2523.8 vs 3785) and two-squeeze success (99.16%). Hardware experiments on an Artix-7 FPGA show significant gains: approximately 33% lower energy consumption and latency, with minimal or modest area reductions compared to the conventional approach. The results demonstrate that Modified SampleNTT is a practical alternative for low-power PQC implementations, enabling Kyber in constrained devices such as IoT and wearables, with potential applicability to other lattice-based schemes.

Abstract

Kyber is a lattice-based key encapsulation mechanism selected for standardization by the NIST Post-Quantum Cryptography (PQC) project. A critical component of Kyber's key generation process is the sampling of matrix elements from a uniform distribution over the ring Rq . This step is one of the most computationally intensive tasks in the scheme, significantly impacting performance in low-power embedded systems such as Internet of Things (IoT), wearable devices, wireless sensor networks (WSNs), smart cards, TPMs (Trusted Platform Modules), etc. Existing approaches to this sampling, notably conventional SampleNTT and Parse-SPDM3, rely on rejection sampling. Both algorithms require a large number of random bytes, which needs at least three SHAKE-128 squeezing steps per polynomial. As a result, it causes significant amount of latency and energy. In this work, we propose a novel and efficient sampling algorithm, namely Modified SampleNTT, which substantially educes the average number of bits required from SHAKE-128 to generate elements in Rq - achieving approximately a 33% reduction compared to conventional SampleNTT. Modified SampleNTT achieves 99.16% success in generating a complete polynomial using only two SHAKE-128 squeezes, outperforming both state-of-the-art methods, which never succeed in two squeezes of SHAKE-128. Furthermore, our algorithm maintains the same average rejection rate as existing techniques and passes all standard statistical tests for randomness quality. FPGA implementation on Artix-7 demonstrates a 33.14% reduction in energy, 33.32% lower latency, and 0.28% fewer slices compared to SampleNTT. Our results confirm that Modified SampleNTT is an efficient and practical alternative for uniform polynomial sampling in PQC schemes such as Kyber, especially for low-power security processors.
Paper Structure (31 sections, 6 equations, 6 figures, 5 tables, 4 algorithms)

This paper contains 31 sections, 6 equations, 6 figures, 5 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Public Key Generation in Kyber: $\mathsf{ SampleNTT}$
  4. $\mathsf{Modified SampleNTT}$
  5. Analysis
  6. Statistical Analysis
  7. Frequency Test
  8. Serial Test
  9. Runs Test
  10. KS Test
  11. Entropy Test
  12. Hardware Architecture
  13. Conventional SampleNTT
  14. Seed Memory ($SeedMem$)
  15. Seed Memory Controller $SeedMem\_ctrl$
  16. ...and 16 more sections

Figures (6)

  • Figure 1: Hardware Architecture of Conventional SampleNTT used in Kyber
  • Figure 2: Timing Diagram of Conventional SampleNTT used in Kyber
  • Figure 3: Hardware Architecture of Modified Sample NTT
  • Figure 4: Timing Diagram of Modified SampleNTTs
  • Figure 5: Reduction of Implementation Cost of Our Modified SampleNTT$^\star$ + ${\sf SHAKE-128}^\circledast$ and SPDM3$^\star$ + ${\sf SHAKE-128}^\circledast$ as Compared to SampleNTT$^\star$ + ${\sf SHAKE-128}^\circledast$
  • ...and 1 more figures