International Association for Cryptologic Research

International Association
for Cryptologic Research

Transactions on Cryptographic Hardware and Embedded Systems, Volume 2022

Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1


Hanno Becker
Arm Ltd.

Vincent Hwang
National Taiwan University and Academia Sinica

Matthias J. Kannwischer
Academia Sinica

Bo-Yin Yang
Academia Sinica

Shang-Yi Yang
Chelpis Co. Ltd.


Keywords: NIST PQC, Armv8-A, Neon, Dilithium, Kyber, Saber


Abstract

We present new speed records on the Armv8-A architecture for the latticebased schemes Dilithium, Kyber, and Saber. The core novelty in this paper is the combination of Montgomery multiplication and Barrett reduction resulting in “Barrett multiplication” which allows particularly efficient modular one-known-factor multiplication using the Armv8-A Neon vector instructions. These novel techniques combined with fast two-unknown-factor Montgomery multiplication, Barrett reduction sequences, and interleaved multi-stage butterflies result in significantly faster code. We also introduce “asymmetric multiplication” which is an improved technique for caching the results of the incomplete NTT, used e.g. for matrix-to-vector polynomial multiplication. Our implementations target the Arm Cortex-A72 CPU, on which our speed is 1.7× that of the state-of-the-art matrix-to-vector polynomial multiplication in kyber768 [Nguyen–Gaj 2021]. For Saber, NTTs are far superior to Toom–Cook multiplication on the Armv8-A architecture, outrunning the matrix-to-vector polynomial multiplication by 2.0×. On the Apple M1, our matrix-vector products run 2.1× and 1.9× faster for Kyber and Saber respectively.

Publication

Transactions of Cryptographic Hardware and Embedded Systems, Volume 2022, Issue 1

Paper

Artifact

Artifact number
tches/2022/a2

Artifact published
February 25, 2022

README

ZIP (391 KB)  

View on Github

License


BibTeX How to cite

Becker, H., Hwang, V., Kannwischer, M. J., Yang, B.-Y., & Yang, S.-Y. (2021). Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2022(1), 221–244. https://doi.org/10.46586/tches.v2022.i1.221-244. Artifact at https://artifacts.iacr.org/tches/2022/a2.