Implementing MLKEM and MLDSA on Microcontrollers

In July 2022, the US National Institute Institute of Standards and Technology (NIST) has announced the first set of post-quantum schemes to be standardized: MLKEM (Kyber), MLDSA (Dilithium), FNDSA (Falcon), and SLHDSA (SPHINCS+). Official standards for MLKEM, MLDSA, and SLHDSA are expected to be published in summer 2024. This tutorial covers the implementation of the lattice-based key-encapsulation mechanism MLKEM (Kyber) and the digital signature scheme MLDSA (Dilithium) on embedded microcontrollers such as the Arm Cortex-M4. I will cover the basics of implementing (post-quantum) cryptography on embedded microcontrollers with a focus on the widely used Arm Cortex-M4 microcontroller. The Cortex-M4 is the default microcontroller target for the NIST PQC competition resulting in a vast number of open-source Cortex-M4 implementations and literature. The tutorial starts from scratch introducing the Armv7E-M instruction-set architecture and the basics of getting software to run on a Cortex-M4 board. Participants will learn how to write constant-time implementations on the Cortex-M4 and the pitfalls to avoid. It then covers the state-of-the-art tricks for speeding up cryptography including pre-quantum schemes (focussing on Chacha20) and post-quantum schemes (mostly MLKEM and MLDSA). It will include examples that show how features of the Arm Cortex-M4 like the barrel-shifter and conditional execution can be used to make cryptography fast and constant time. Additionally, participants will learn about word-sized modular arithmetic using Barrett, Montgomery, and Plantard multiplication. At the end of the tutorial, participants should be able to write, test, debug, and benchmark their own implementations of cryptographic schemes and reason about their performance. Additionally, participants will be able to judge the quality of implementations of any of the covered schemes. In the practical parts of this tutorial, participants will be able to get some hands-on experience implementing cryptography on the Arm Cortex-M4. The assignment will cover the stream cipher Chacha20 and (parts of) the post-quantum key-encapsulation mechanism MLKEM and the digital signature scheme MLDSA.

The Wonderland of Fault Attacks

Fault attacks are considered among critical threat to embedded cryptography. This talk will introduce the general background of fault attacks followed by a look into advanced fault attacks. We will present Persistent Fault Analysis (PFA) and how it can break redundancy based countermeasures as well as higher order masking with just one fault. Next, we showcase fault attack on post quantum cryptography with LWE construction under one (or few) fault. We also discuss practical combined attacks (fault + side-channels) on bit permutation based ciphers and other sensitive targets.