Secure Implementation of Post-Quantum Cryprography

Post-Quantum Cryptography (PQC) is now required by several institutions and vendors, especially for applications related to low-level security functions (secure boot, firmware management, secure channels establishment, etc.). Not only standardized PQC algorithms must match correctly their specification, but also they must be implemented in accordance with market requirements. Those mostly consist of Performance-Power-Area (PPA) and certification constraints. In turn, the PPA encompasses tradeoffs between speed and implementation size, but also optimal adequation with available resources (vectorization in software, parallelism in hardware, dedicated accelerators in embedded systems, etc.) The certification relates to secure implementation in the context of adversaries trying to gain information on the secrets, exploiting for instance some surreptitious information leakage (secret-dependent timing or power consumption). There is an interplay between PPA and certification aspects that we detail in this paper, for different classes of PQC algorithms. We also give some insights on the order in which PQC algorithms will be rolled-out, dictated by the requirements to implement in hardware some services which cannot be retrofitted later on in software, namely those that are in charge of firmware lifecycle management