HQC is a quantum-resistant cryptographic key encapsulation mechanism, recently selected by NIST as a future standard. Polynomial multiplication is one of the most critical operations in HQC. Due to side-channel security concerns, the previously-used sparse-dense method was recently replaced by classical dense-dense multiplication implemented using Karatsuba’s algorithm. This change has made polynomial multiplication the primary performance bottleneck, accounting for approximately 95% of the total execution time. This paper presents an alternative polynomial multiplication technique for HQC: the Frobenius Additive Fast Fourier Transform (FAFFT), which provides significant algorithmic-level performance improvements. We also present ANDROMEDA, the first state-of-the-art hardware implementation of FAFFT, and evaluate its performance impact by integrating our solution in a resourceconstrained RISC-V-based System-on-Chip scenario. Experimental results show that our solution improves HQC performance by approximately $9.64 \times$ and $19.22 \times$ across its security levels, making HQC more practical for real-world deployment.

Modern mobile devices such as smartphones make use of complex Systems-on-Chip (SoC) that often come with a DRAM chip stacked above the SoC. This packaging method that was designed to increase space efficiency is called a Package-on-Package (PoP). PoP has also an incidental impact on local Fault Injection methods such as Electromagnetic Fault Injection (EMFI). This paper shows that conventional EMFI may not always be the most effective approach for inducing faults into a SoC implemented in a PoP. We provide and compare methodologies to successfully induce faults within this kind of target. A PoP DRAM can be removed while keeping the SoC operationnal during the first boot stages. We applied this method and used conventional EMFI on a SoC without DRAM. We also present a new way to induce voltage glitches on the target power supply rail by using EM pulses. Conventional voltage glitches are also performed in order to compare the faults obtained. It appeared that faults injected by EM-induced glitches are closer to faults obtained with conventional EMFI than faults induced by conventional voltage glitches.

High-Level Synthesis (HLS) is used by hardware developers to achieve higher abstraction in circuit descriptions. In order to shorten the hardware development time via HLS, we present an adjustment of the Iterative and Incremental Design (IID) methodology, frequently used in software development. In particular, our methodology is relevant for the development of applications with unusual complexity: the method was applied here to the development of large modular arithmetic, commonly used for cryptography applications (e.g., Elliptic Curves). Rapid feedback on circuit characteristics is used to evaluate deep architectural changes in short time, greatly reducing the time-to-market with respect to hand-made designs. In addition, our approach is highly flexible, since the same generic high-level description can be used to produce an entire set of circuits, each with different area/performance trade-offs. Thanks to the proposed approach, any change to the initial specification (e.g., the curve used) is also very fast, while it may require a large effort in the case of hand-made designs.

Elliptic curve cryptosystems (ECCs) may be chosen instead of RSA in secure embedded systems, thanks to shorter keys. However, ECC may be vulnerable, as any other cryptographic implementation, to side channel analysis, which may reveal secret information by analyzing collateral sources of information, such as power consumption. To protect the device against Timing, Simple and Differential Power Analysis, we propose the implementation of a new scalar multiplication algorithm based on randomized windows method.

Embedded systems are increasingly providing secure functionalities, which often rely on some dedicated hardware for symmetric and public-key cryptography. When resources are limited, elliptic curve cryptography (ECC) may be chosen instead of the more widely known RSA, which needs much longer keys for the same security level. However, ECC may be vulnerable, as any other cryptographic implementation, to side channel analysis, which may reveal secret information by analyzing collateral sources of information, such as power consumption. Countermeasures must be thus adopted at the design level, in order to ensure robust and secure operation of the device. We propose here a new scalar multiplication algorithm on an elliptic curve, based on a novel randomized window method. This design is protected against side channel attacks (Timing, Simple and Differential Power Analysis) and it is implemented over prime fields, but it can be applied to binary fields as well. In order to evaluate this countermeasure, we provide its costs, and an estimation of the additional entropy added to the computation against side channels attacks.