IETF Logo Mail Archive

Re: [Pqc] [Ext] Hardware acceleration for Kyber and other KEMs?

Thom Wiggers <thom@thomwiggers.nl> Wed, 04 October 2023 17:41 UTC

Return-Path: <thom@thomwiggers.nl>
X-Original-To: pqc@ietfa.amsl.com
Delivered-To: pqc@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA5C9C151535 for <pqc@ietfa.amsl.com>; Wed, 4 Oct 2023 10:41:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=thomwiggers.nl
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a7YnbBxqDolG for <pqc@ietfa.amsl.com>; Wed, 4 Oct 2023 10:41:24 -0700 (PDT)
Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF688C14F5E0 for <pqc@ietf.org>; Wed, 4 Oct 2023 10:41:24 -0700 (PDT)
Received: by mail-wm1-x331.google.com with SMTP id 5b1f17b1804b1-405524e6769so769855e9.1 for <pqc@ietf.org>; Wed, 04 Oct 2023 10:41:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thomwiggers.nl; s=google; t=1696441282; x=1697046082; darn=ietf.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=OYq/SO1AhrFtJptCI3/KleG2GFPwWZmn8VBW7DpS6Dk=; b=XJMFgW4oogJTUwC/5fjF2gnXfjVxLOYAt2BzK41upQD6W1fj2sVLkf+oYk7bwLDnx+ RogbMi6VqhixLd3Jjxpdr/5D4mRXkm9vRHQfHy5zFNDM1GIWc9ur/oN/j1Se61sboj2M S3mZYXU/qGqlm9hdNXL/jH0pfAy/z/fpC7WQI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696441282; x=1697046082; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=OYq/SO1AhrFtJptCI3/KleG2GFPwWZmn8VBW7DpS6Dk=; b=cP3X4DisTT94yzCt7k3KO9LUKfTUj3TbhWB56JPN3Pgl2qb1UUpP3io/elBHHOQG4O n+fj8u4MEHwc/17PR8P+vjfqb+HknqwHqEof1+7BUaJhiNdR2ZWR/95AZojLFUGTPWCM +J0QFP/EG6nh9U2qglTarhiM86h/wfCF1l0UINAmyo04rOWnwgplNkFRd3q23r/rLnMD fziw4aOmlpQMq6nXma0FbZtj0/OM6UVXcHuL3xPNhfz0PjGnCmf4DnubYJu7PIBCcCMz QvXnu3mOx7YAvQ83NGRoAwD9WPVrFHEuNbyapcZABjfFPAi6RE6jf/IBq8/yky/sqzOS gv2A==
X-Gm-Message-State: AOJu0YyeYjTJj8WoZVC6WsLsfxHba5Z8rMjmICgRcxfqdapS+txanlrK GlyzoAqykD/wQO6bNoe9auJjUA==
X-Google-Smtp-Source: AGHT+IFEvEzfNPN/x91xcZwUoEwfhiDuKiDYt8mRucDWTIyTjx4EMKH28SJSbq0A8lUuEr0M1fCFCQ==
X-Received: by 2002:a7b:c044:0:b0:3fb:c075:b308 with SMTP id u4-20020a7bc044000000b003fbc075b308mr307414wmc.12.1696441281756; Wed, 04 Oct 2023 10:41:21 -0700 (PDT)
Received: from smtpclient.apple ([195.59.11.99]) by smtp.gmail.com with ESMTPSA id x9-20020a05600c21c900b003fefe70ec9csm2044848wmj.10.2023.10.04.10.41.21 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Oct 2023 10:41:21 -0700 (PDT)
From: Thom Wiggers <thom@thomwiggers.nl>
Message-Id: <B1A51D5D-DBBC-4C7E-BDF1-9C7C331A0963@thomwiggers.nl>
Content-Type: multipart/alternative; boundary="Apple-Mail=_419F6EB9-DC8F-4CAB-A42F-A559AAC5EEE9"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.100.2.1.4\))
Date: Wed, 04 Oct 2023 18:41:10 +0100
In-Reply-To: <A6087E99-79AE-4134-899C-A278573D16C0@icann.org>
Cc: "pqc@ietf.org" <pqc@ietf.org>
To: Paul Hoffman <paul.hoffman@icann.org>
References: <4D63D4AA-41E3-4D45-BE9A-42B15A9FF989@icann.org> <CAMm+LwjVVT_gouZ5KJ5Zufzg3bP8YGmPT+4LjCQhGySvh_ZGKA@mail.gmail.com> <A6087E99-79AE-4134-899C-A278573D16C0@icann.org>
X-Mailer: Apple Mail (2.3774.100.2.1.4)
Archived-At: <https://mailarchive.ietf.org/arch/msg/pqc/5Fp6W5bo-bCydRhlZtltLliQ2XY>
Subject: Re: [Pqc] [Ext] Hardware acceleration for Kyber and other KEMs?
X-BeenThere: pqc@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Post Quantum Cryptography discussion list <pqc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pqc>, <mailto:pqc-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pqc/>
List-Post: <mailto:pqc@ietf.org>
List-Help: <mailto:pqc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pqc>, <mailto:pqc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Oct 2023 17:41:28 -0000

Hi Paul

> Op 3 okt 2023, om 16:36 heeft Paul Hoffman <paul.hoffman@icann.org> het volgende geschreven:
> 
> These responses are helpful, but I'm hoping to hear from one or more people who are actually implementing hardware accelerators, or helping those who are. No trade secrets, of course, but knowing things like "this will work as well as RSA/EC acceleration" or "this is not going to be as fast" would be useful.
> 

My employer, PQShield, is in the business of designing and selling hardware accelerator IP (the kind you put on FPGAs or ASICs), so I grabbed one of our hardware guys to help answer this question.

The speed of a hardware accelerator greatly depends on the amount of area that you want to spend: if you can build a bigger chip, then you can have better performance. The design space for what you optimize for is very, very large and you can go in many directions.

It is possible to design similarly-sized accelerators, but it is very hard to give straight up comparisons. The characteristics greatly depend on whether you’re interested in KEM encapsulation, decapsulation, RSA signing, or ECDSA signing. On top of that, you would need to compare implementations that have similar throughput and latency, implemented on the same technology, to get an apples-to-apples number.

Relatedly, another colleague of ours is contributing to the development of specifications for RISC-V instruction set extensions; you can find some of Markku’s presentations on this on his website https://mjos.fi/.

But in general, I think we can answer your question with: yes, it is possible to do hardware acceleration, but the specifics depend too much on the application requirements and platform to put anything in a draft.

Cheers,

Thom Wiggers (with thanks to my colleague Mike Hutter)


(and of course, if anyone wants to know more specifics about what PQShield’s hardware IP can do, they’re welcome to get in touch.)




> --Paul Hoffman
> 
> -- 
> Pqc mailing list
> Pqc@ietf.org
> https://www.ietf.org/mailman/listinfo/pqc

v2.46.0 | Report a Bug | By Email | System Status