Speeding up R-LWE Post-quantum Key Exchange

Abstract

Post-quantum cryptography has attracted increased attention in the last couple of years, due to the threat of quantum computers breaking current cryptosystems. In particular, the key size and performance of post-quantum algorithms became a significant target for optimization. In this spirit, Alkim et al. have recently proposed a significant optimization for a key exchange scheme that is based on the R-LWE problem. In this paper, we build on the implementation of Alkim et al., and focus on improving the algorithm for generating a uniformly random polynomial. We optimize three independent directions: efficient pseudorandom bytes generation, decreasing the rejection rate during sampling, and vectorizing the sampling step. When measured on the latest Intel processor Architecture Codename Skylake, our new optimizations improve over Alkim et al. by up to $1.59\times$ on the server side, and by up to $1.54\times$ on the client side.

A Vectorized Rejection Sampling - Code Snippets

The relevant part of our AVX2 optimizations in the source code is shown in Listing 2. Listing  3 shows the relevant part of our AVX512 optimizations. Note that the AVX512 sampling gets much easier thanks to the new masks feature that gives more targeted data-control in almost all instructions. In particular, the VPCOMPRESSD instruction allows us to write back only specific values instead of a whole vector.

In both these approaches, we incorporate our proposal to reduce the rejection rate as explained in Sect. 4.1. Since we are working on vectors of integers, we do not have a division function in the AVX integer instructions (like in Listing 1) and implement this by repeatedly comparing and subtracting.