Scabbard：关于基于 Learning with Rounding 的密钥封装机制的硬件感知设计选择的探索性研究
Scabbard: An Exploratory Study on Hardware Aware Design Choices of Learning with Rounding-based Key Encapsulation Mechanisms
AI总结：
本文提出含 Florete、Espada、Sable 的基于 LWR 的 KEM 套件 Scabbard，并通过软硬件实现评估效率、并行性、内存与面积等硬件感知设计权衡。
摘要：
近年来，基于格上困难问题构造密码方案受到了广泛关注。除具备抗量子能力外，基于格的密码学还允许底层困难问题存在多种变化。由于密码方案可能在不同环境中运行，并受到内存占用、硅片面积、效率、功耗需求等不同操作约束，因此底层困难问题中的这些变化对于设计者构造不同密码方案非常有用。在本工作中，我们探索了基于格的密码学的各种设计选择及其在现实世界中对性能的影响。具体而言，我们提出了一组基于 learning with rounding（带舍入学习）问题的密钥封装机制，重点关注改进基于格的密码学在不同方面的性能。我们的套件包含三个方案。第一个方案是 Florete，面向效率设计。第二个方案是 Espada，旨在提升并行化、灵活性和内存占用。最后一个方案是 Sable，可被视为 Saber 密钥封装机制在密钥尺寸和参数方面的改进版本；Saber 是美国国家标准与技术研究院后量子标准化流程的最终入围方案之一。在本文中，我们描述了每个方案背后的设计原理。此外，为证明我们设计决策的合理性，我们提供了软件和硬件实现。结果表明，Florete 在软件和硬件平台上快于大多数最先进的 KEM。Espada 方案所需的内存和面积小于大多数最先进方案的实现。Sable 的实现在硬件和软件平台上的性能与内存需求方面，保持了 Florete 与 Espada 之间的折中。
英文摘要：
Recently, the construction of cryptographic schemes based on hard lattice problems has gained immense popularity. Apart from being quantum resistant, lattice-based cryptography allows a wide range of variations in the underlying hard problem. As cryptographic schemes can work in different environments under different operational constraints such as memory footprint, silicon area, efficiency, power requirement, etc., such variations in the underlying hard problem are very useful for designers to construct different cryptographic schemes. In this work, we explore various design choices of lattice-based cryptography and their impact on performance in the real world. In particular, we propose a suite of key-encapsulation mechanisms based on the learning with rounding problem with a focus on improving different performance aspects of lattice-based cryptography. Our suite consists of three schemes. Our first scheme is Florete, which is designed for efficiency. The second scheme is Espada, which is aimed at improving parallelization, flexibility, and memory footprint. The last scheme is Sable, which can be considered an improved version in terms of key sizes and parameters of the Saber key-encapsulation mechanism, one of the finalists in the National Institute of Standards and Technology's post-quantum standardization procedure. In this work, we have described our design rationale behind each scheme. Further, to demonstrate the justification of our design decisions, we have provided software and hardware implementations. Our results show Florete is faster than most state-of-the-art KEMs on software and hardware platforms. The scheme Espada requires less memory and area than the implementation of most state-of-the-art schemes. The implementations of Sable maintain a trade-off between Florete and Espada regarding performance and memory requirements on the hardware and software platform.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
