Constant Time Algorithms for ROLLO-I-128

Abstract

In this work, we propose different techniques that can be used to implement the rank-based key encapsulation methods and public key encryption schemes of the ROLLO, and partially RQC, family of algorithms in a standalone, efficient and constant time library. For simplicity, we focus our attention on one specific instance of this family, ROLLO-I-128. For each of these techniques, we present explicit code (including intrinsics), or pseudo-code and performance measures to show their impact. More precisely, we use a combination of original and known results and describe procedures for Gaussian reduction of binary matrices, generation of vectors of given rank, multiplication with lazy reduction and inversion of polynomials in a composite Galois field. We also carry out a global performance analysis to show the impact of these improvements on ROLLO-I-128. Through the SUPERCOP framework, we compare it to other 128-bit secure KEMs in the NIST competition. To our knowledge, this is the first optimized full constant time implementation of ROLLO-I-128.

Pseudocode for the binary field arithmetic

The plain C carryless multiplication algorithm $\textsf {clmul}_K(a,b)$ is described in algorithm 14. Notice that algorithm 14 works for $64< m < 129$.

The AVX2 carryless multiplication algorithm $\textsf {clmul}_S(a,b)$ is described in algorithm 15. Note that, as algorithm 14, algorithm 15 is suitable for fields ${\mathbb {F}}_{2^{m}}$ with $64< m < 129$, which include all ROLLO-I and ROLLO-II variants. Let us recall that using Karatsuba multiplication [31] in algorithm 15 instead of steps 3-6 would not give any advantage, as the cost of multiplication and addition with AVX2 instruction is very close. In practice, as we will show, it even performs worse, due to alignment problems.

The algorithm to inverleave zeros used for the squaring algorithm is a small modification of the method Interleave bits with 64-bit multiply given by Sean Eron Anderson on his web page Bit Twiddling Hacks [21] which is given in algorithm 16.

The squaring method is given in algorithm 17. For the AVX2 version, a look-up table based on the instruction _mm_shuffle_epi8 is implemented both in the submission and our work.

The algorithm for reduction is presented in algorithm 18, where the symbols $\ll , \gg$ denote field multiplication and division by x respectively (left and right shift operators), $\oplus$ is the field addition (bit-wise XOR operator), $\otimes$ the bit-wise AND operator. As for algorithm 15, algorithm 18 is suitable for fields of size up to $2^{128}$ up to the modification of the values of the masks, the amount of shifts and their width.

The inversion of an element $x \in {\mathbb {F}}_{2^{m}}$ is described in algorithm 19. This has been derived using Fermat’s little Theorem stating that $x^{2^{m}-2} = x^{-1}$. The fixed exponentiation is achieved by the strategy presented in [38, Section 6.2] using the following addition chain of length 9:

$$\begin{aligned} 1 \rightarrow 2 \rightarrow 4 \rightarrow 8 \rightarrow 16 \rightarrow 32 \rightarrow 33 \rightarrow 66 \rightarrow 67 \,. \end{aligned}$$