Number-theoretic transform (NTT) is an efficient polynomial multiplication technique of lattice-based post-quantum cryptography including Kyber which is standardized as the NIST key encapsulation mechanism (KEM) in 2022. Prominent NTT architectures have recently been implemented on hardware/software coprocessors. In this article, we introduce new error detection schemes embedded efficiently in the NTT accelerator architecture, detecting both transient and permanent faults. By encoding the operands with two approaches, i.e., negating and swapping, we detect the faults in such constructions after recomputing and decoding. Through simulation, our schemes show high error coverage for the stuck-at fault model. Moreover, we implement the schemes on field-programmable gate array (FPGA) and assure that acceptable overhead is achieved for performance and implementation metrics. The low overhead and high efficiency of our schemes make them suitable for various constrained usage models. Additionally, our schemes are also applicable to similar classical and post-quantum sub-blocks to obtain more reliable respective hardware constructions.

Among the National Institute for Standards and Technology (NIST) postquantum cryptography (PQC) standardization Round 3 finalists (announced in 2020 and anticipated to conclude in 2022–2024), SABER and Falcon are efficient key encapsulation mechanism (KEM) and compact signature scheme, respectively. SABER is a simple and flexible cryptographic scheme, highly suitable for thwarting potential attacks in the postquantum era. Implementing SABER can be performed solely in hardware (HW) or on HW/software coprocessors. On the other hand, the compact key size, efficient design, and strong reliability proof in the quantum random oracle model (QROM) make Falcon a highly suitable signature algorithm for PQC. Although Falcon is crucial as a PQC signature scheme, the utilization of the Gaussian sampler makes it vulnerable to malicious attacks, e.g., fault attacks. This is the first work to present error detection schemes embedded efficiently in SABER as well as Falcon’s sampler architectures, which can detect both transient and permanent faults. Moreover, we implement HW design for the ModFalcon signature algorithm as well as the Gaussian sampler. These schemes are implemented on a formerly Xilinx field-programmable gate array (FPGA) family, for both SABER and Falcon variants, where we assess the error coverage and the performance. The proposed schemes incur low overhead (the area, delay, and power overheads being 22.59%, 19.77%, and 10.67%, respectively, in the worst case) while providing a high fault detection rate (99.9975% in the worst case scenario), making them suitable for high efficiency and compact HW implementations of constrained applications.

Ring learning with error (ring-LWE) within lattice-based cryptography is a promising cryptographic scheme for the post-quantum era. In this article, we explore efficient error detection approaches for implementing ring-LWE encryption. For achieving accurate operation of the ring-LWE problem and thwarting active side-channel attacks, error detection schemes need to be devised so that the induced overhead is not a burden to deeply embedded and constrained applications. This article, for the first time, investigates error detection schemes for both stages of the ring-LWE encryption operation, i.e., ring polynomial multiplication and modular reduction. Our schemes exploit recomputing with encoded operands, which successfully counter both natural faults (for the stuck-at model). We implement our schemes on an application-specific integrated circuit. As performance metrics show hardware overhead, our schemes prove to be low complexity with high error coverage. The proposed efficient architectures can be tailored and utilized for post-quantum cryptographic schemes in different usage models with diverse constraints.

Polynomial multiplication is one of the most rigorous arithmetic construction of postquantum cryptosystems. Utilizing number-theoretic transformations, the product of such multiplication can be efficiently computed in quasi-linear time O(n.lgn). Error detection schemes of number-theoretic transform (NTT) architectures are essential to ensure correct mathematical operations, improved security, and thwart active side-channel attacks mounted through faults. NTT is not only significant to post-quantum cryptosystems, but the structure is also valuable to the already existing security protocols, e.g., signature schemes, hash functions, and the like. This paper, for the first time, introduces new error detection schemes of NTT architectures, successfully detecting both permanent and transient faults. Our schemes are based on recomputing with negated, scaled, and swapped operands. We have implemented the proposed schemes on the application-specific integrated circuit (ASIC). Performance and implementation metrics on this hardware platform show acceptable hardware overhead. As our schemes provide acceptable complexity and high efficiency, they can be utilized in compact hardware implementations of constrained applications, e.g., deeply embedded architectures.

Through pseudorandom permutation, tweakable enciphering schemes (TES) constitute block cipher modes of operation which perform length-preserving computations. The state-of-the-art research has focused on different aspects of TES, including implementations on hardware [field-programmable gate array (FPGA)/ application-specific integrated circuit (ASIC)] and software (hard/soft-core microcontrollers) platforms, algorithmic security, and applicability to sensitive, security-constrained usage models. In this article, we propose efficient approaches for protecting such schemes against natural and malicious faults. Specifically, noting that intelligent attackers do not merely get confined to injecting multiple faults, one major benchmark for the proposed schemes is evaluation toward biased and burst fault models. We evaluate a variant of TES, i.e., the Hash-Counter-Hash scheme, which involves polynomial hashing as other variants are either similar or do not constitute finite field multiplication which, by far, is the most involved operation in TES. In addition, we benchmark the overhead and performance degradation on the ASIC platform. The results of our error injection simulations and ASIC implementations show the suitability of the proposed approaches for a wide range of applications including deeply embedded systems.