In this work, we elaborate on our endeavors to design, implement, fabricate, and post-silicon validate CoFHEE 1, a co-processor for low-level polynomial operations targeting Fully Homomorphic Encryption execution. With a compact design area of 12mm2, CoFHEE features ASIC implementations of fundamental polynomial operations, including polynomial addition and subtraction, Hadamard product, and Number Theoretic Transform, which underlie most higher-level FHE primitives. CoFHEE is capable of natively supporting polynomial degrees of up to n = 214 with a coefficient size of 128 bits, and has been fabricated and silicon-verified using 55nm CMOS technology. To evaluate it, we conduct performance and power experiments on our chip, and compare it to state-of-the-art software implementations and other ASIC designs.

In this paper, we present the blueprint of a specialized co-processor for Fully Homomorphic Encryption, dubbed CoFHEE. With a small design area of$12mm^{2}$, CoFHEE incorporates ASIC implementations of fundamental polynomial operations, such as polynomial addition and subtraction, Hadamard product, and Number Theoretic Transform, which are underneath all higher-level FHE primitives. CoFHEE has native support of polynomial degrees of up to$n=2^{14}$with a coefficient size of 128 bits. We evaluate our chip with performance and power experiments and compare it against state-of-the-art software implementations and other ASIC designs. A more elaborate description of the CoFHEE design can be found in [1].

As security and privacy continue to grow in importance, new techniques, including fully homomorphic encryption (FHE) and post-quantum cryptography (PQC), have emerged to provide new capabilities. Many of these techniques are based on the ring learning with errors problem and operate over rings. Elements of a ring are computed using modular arithmetic, with modular multiplication being a primary component. These components are far more complex than standard integer computing, especially when working with large bit widths. As FHE and PQC become increasingly popular, the need for well-designed and optimized modular multipliers also grows in importance. In this paper, we analyze the power, area, performance, energy, and thermal characteristics of two commonly used modular multipliers: Barrett (bit parallel) and Interleaved (bit parallel). To understand these multipliers' characteristics, this study provides necessary insights into the sources of area, power, frequency, and energy overhead, considering a range of different bit widths (16–256). This paper rigorously analyzes the sub-blocks of modular multipliers and their contributions to overall power, performance, and area (PPA).

Ring-Learning-with-Errors (RLWE) has emerged as the foundation of many important techniques for improving security and privacy, including homomorphic encryption and post-quantum cryptography. While promising, these techniques have received limited use due to their extreme overheads of running on general-purpose machines. In this paper, we present a novel vector Instruction Set Architecture (ISA) and microarchitecture for accelerating the ring-based computations of RLWE. The ISA, named B512, is developed to meet the needs of ring processing workloads while balancing high-performance and general-purpose programming support. Having an ISA rather than fixed hardware facilitates continued software improvement post-fabrication and the ability to support the evolving workloads. We then propose the ring processing unit (RPU), a high-performance, modular implementation of B512. The RPU has native large word modular arithmetic support, capabilities for very wide parallel processing, and a large capacity highbandwidth scratchpad to meet the needs of ring processing. We address the challenges of programming the RPU using a newly developed SPIRAL backend. A configurable simulator is built to characterize design tradeoffs and quantify performance. The best performing design was implemented in RTL and used to validate simulator performance. In addition to our characterization, we show that a RPU using 20.5mm2of GF12nm can provide a speedup of 1485× over a CPU running a 64k, 128-bit NTT, a core RLWE workload.

Fully Homomorphic Encryption (FHE) promises data protection by computing on encrypted data, but demands resource-intensive computation. FHE hardware accelerators, which improve FHE scheme performance with densely packed computing units, could potentially damage the chip with excessive heat dissipation because of high power consumption. Therefore, it is necessary to reduce the power consumption of the accelerator and its most critical module, i.e., modular multiplier. In this work, we extend the idea of allowing a specific form of modulus to achieve a low-power Barrett modular multiplier (BM). BM with constraint width can reduce power consumption by 15% and area by 20%. We propose an approximation for the number of moduli available with the discussed constraints on the modulus.

NIST is standardizing postquantum cryptography (PQC) algorithms that are resilient to the computational capability of quantum computers. Past works show malicious subversion with cryptographic software algorithm subversion attacks (ASAs) that weaken the implementations. We show that PQC digital signature (DS) codes can be subverted in line with previously reported flawed implementations (2008) (Bernstein et al., 2016) that generate verifiable, but less-secure signatures, demonstrating the risk of such attacks. Since all processors have built-in hardware performance counters (HPCs), there exists a body of work proposing a low-cost machine learning (ML)-based integrity checking of software using HPC fingerprints. However, such HPC-based approaches may not detect subversion of PQC codes. A miniscule percentage of qualitative inputs when applied to the PQC codes improves this accuracy to 98%. We propose gray-box fuzzing as a preprocessing step to obtain inputs to aid the proposed HPC-based method.

Improving fully homomorphic encryption computation by designing specialized hardware is an active topic of research. The most prominent encryption schemes operate on long polynomials requiring many concurrent modular multiplications of very big numbers. Thus, it is crucial to use many small and efficient multipliers. Interleaved and Montgomery iterative multipliers are the best candidates for the task. Interleaved designs, however, suffer from longer latency as they require a number comparison within each iteration; Montgomery designs, on the other hand, need extra conversion of the operands or the result. In this work, we propose a novel hardware design that combines the best of both worlds: Exhibiting the carry save addition of Montgomery designs without the need for any domain conversions. Experimental results demonstrate improved latency-area product efficiency by up to 47% when compared to the standard Interleaved multiplier for large arithmetic word sizes.

Hardware accelerators (HAs) are essential building blocks for fast and energy-efficient computing systems. Accelerator Quick Error Detection (A-QED) is a recent formal technique which uses Bounded Model Checking for pre-silicon verification of HAs. A-QED checks an HA for self-consistency, i.e., whether identical inputs within a sequence of operations always produce the same output. Under modest assumptions, A-QED is both sound and complete. However, as is well-known, large design sizes significantly limit the scalability of formal verification, including A-QED. We overcome this scalability challenge through a new decomposition technique for A-QED, called A-QED with Decomposition (A-QED$^2$). A-QED$^2$ systematically decomposes an HA into smaller, functional sub-modules, called sub-accelerators, which are then verified independently using A-QED. We prove completeness of A-QED$^2$; in particular, if the full HA under verification contains a bug, then A-QED$^2$ ensures detection of that bug during A-QED verification of the corresponding sub-accelerators. Results on over 100 (buggy) versions of a wide variety of HAs with millions of logic gates demonstrate the effectiveness and practicality of A-QED$^2$.

National Institute of Standards and Technology (NIST) is standardizing post-quantum cryptographic (PQC) algorithms. Most of the PQC algorithms are complex; rendering their hardware modeling, evaluation, and benchmarking challenging. We developed a High-Level Synthesis (HLS) → ASIC flow for fast evaluation of Power, Area, Speed, and Security (PASS) trade-offs of the NIST round 2 PQC algorithms using an industry-standard design flow. In this paper, we discuss this flow and the preliminary results on some of the PQC signature algorithms.