Jonas Schupp
TUM School of Computation, Information and Technology, Technical University of Munich, Munich, Germany

Marco Gianvecchio
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Alessandro Barenghi
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Patrick Karl
TUM School of Computation, Information and Technology, Technical University of Munich, Munich, Germany

Gerardo Pelosi
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Georg Sigl
TUM School of Computation, Information and Technology, Technical University of Munich, Munich, Germany; Fraunhofer Institute for Applied and Integrated Security, Garching, Germany

Keywords: Post-quantum Signature, Code-based signature, Software optimized implementation

Abstract

Post-quantum cryptosystems are currently attracting significant research efforts due to the continuous improvements in quantum computing technologies, which led the National Institute of Standards and Technology (NIST) to open standardization competitions to foster proposals and public scrutiny of cryptosystems and digital signatures. Whilst NIST has chosen, after four selection rounds, three digital signature algorithms, it also has opened a new selection process as the chosen candidates were either relying only on lattice-based computationally hard problems, or had unsatisfactory performance figures. In this work, we propose two optimized implementations of the Codes and Restricted Objects Signature Scheme (CROSS) targeting the Cortex-M4 platform. One implementation targets the minimal possible stack size while the other trades some memory space for performance optimization using DSP instructions for some performance critical arithmetic operations. We show that all parameter sets fit within at maximum 24 kB of stack which corresponds to a reduction by a factor of 15 to 45 with respect to the reference implementation. The memory footprint of our implementation, taking the size of the signature also into account, is less than 128 kB. We additionally outline different stack reduction options which allow for a fine grained trade-off between memory footprint and performance of the algorithm. Notably, we also show that our memory optimizations alone have no significant performance impact on the signature verification of CROSS while we even achieve a speed-up factor of up to 1.7 when taking the stack and speed optimizations into account.