Integration and optimization of a RISC-V based Keccak accelerator

Nowadays the use of cryptography is pervasive. It is an essential component of modern digital infrastructure and has various applications that goes from finance transactions to medical devices. Cryptographic systems are built on hard mathematical problems, hard since is assumed they require an exponential time to be solved. For example, the security of online communication relies on the hardness of the RSA, whose hardness is based on factorizing the product of two large prime numbers. The previous statement has been challenged by Peter Shor in 1994. He provided an algorithm that running on a quantum computer could solve the underling RSA problem in polynomial time. This discovery implies that many commonly used cryptosystems would be completely broken if large quantum computers would exist. Considering the progress at which quantum computers are developing, this poses a big threat to current security protocols. Since 2015 the National Institute of Standards and Technology (NIST) is running a selection process to define one or more quantum-resistant algorithms. These algorithms are NP hard to solve by quantum computers and are defined as post-quantum cryptography (PQC) algorithms. Among the finalists, lattice-based cryptographic systems are the most-promising ones. The computational complexity of these algorithms though requires non-negligible running-time in deployments scenario. The state of the art solutions consist of reducing processing unit workload by accelerating them totally or partially in hardware. In this thesis the acceleration of lattice-based algorithm CRYSTALS-Kyber has been investigated: a hardware accelerator has been developed and tested with the RISCV-based advanced microcontroller PULPissimo. In a preliminary step, by profiling the Kyber algorithm, it has been found that the Keccak sub-function is the most expensive one in terms of running time and therefore the most promising to accelerate. The keccak accelerator is built upon the Bertoni’s team implementation and has been tailored to achieve best performance with PULPissimo SoC. The accelerator is connected to SoC peripherals and communicates with PULPissimo through an AXI interface. The accelerator shows outstanding results in its preliminary form, then there is an ample room for improvements. The results achieved by the proposed architecture highlights the importance of an accelerator with CRYSTALS-Kyber algorithm and is a starting point to explore the acceleration of others PQC algorithms and cryptographic primitives.