Implementing and Evaluating the Quantum Resistant Cryptographic Scheme Kyber on a Smart Card

Abstract: Cyber attacks happen on a daily basis, where criminals can aim to disrupt internet services or in other cases try to get hold of sensitive data. Fortunately, there are systems in place to protect these services. And one can rest assured that communication channels and data are secured under well-studied cryptographic schemes. Still, a new class of computation power is on the rise, namely quantum computation. Companies such as Google and IBM have in recent time invested in research regarding quantum computers. In 2019, Google announced that they had achieved quantum supremacy. A quantum computer could in theory break the currently most popular schemes that are used to secure communication. Whether quantum computers will be available in the forseeable future, or at all, is still uncertain. Nonetheless, the implication of a practical quantum computer calls for a new class of crypto schemes; schemes that will remain secure in a post-quantum era. Since 2016 researchers within the field of cryptography have been developing post-quantum cryptographic schemes. One specific branch within this area is lattice-based cryptography. Lattice-based schemes base their security on underlying hard lattice problems, for which there are no currently known efficient algorithms that can solve them. Neither with quantum, nor classical computers. A promising scheme that builds upon these types of problems is Kyber. The aforementioned scheme, as well as its competitors, work efficiently on most computers. However, they still demand a substantial amount of computation power, which is not always available. Some devices are constructed to operate with low power, and are computationally limited to begin with. This group of constrained devices, includes smart cards and microcontrollers, which also need to adopt the post-quantum crypto schemes. Consequently, there is a need to explore how well Kyber and its relatives work on these low power devices. In this thesis, a variant of the cryptographic scheme Kyber is implemented and evaluated on an Infineon smart card. The implementation replaces the scheme’s polynomial multiplication technique, NTT, with Kronecker substitution. In the process, the cryptographic co-processor on the card is leveraged to perform Kronecker substitution efficiently. Moreover, the scheme’s original functionality for sampling randomness is replaced with the card’s internal TRNG. The results show that an IND-CPA secure variant of Kyber can be implemented on the smart card, at the cost of segmenting the IND-CPA functions. All in all, key generation, encryption, and decryption take 23.7 s, 30.9 s and 8.6 s to execute respectively. This shows that the thesis work is slower than implementations of post-quantum crypto schemes on similarly constrained devices.