# Post-Quantum Authentication in the MQTT Protocol
## 6 Related Work
#### Other Postquantum Testing  
Work has been more generally conducted on different lattice-based problems. In [36], they find that the ring-learning with errors (R-LWE) problem is the most practical and efficient. They then go on to propose R-BinLWE, where a binary distribution is used. They propose a novel multiplication technique that reduces area usage by 57.8% and power usage by 48.42% on the device. In [37] they implement a R-LWE encryption scheme on the ARM Cortex-M4F with high speed and low memory usage. They achieved this through having fast discrete Gaussian sampling and efficient polynomial multiplication. They found their implementation to be faster than ECC-based encryption schemes by one order of magnitude at minimum and about seven times faster than other R-LWE implementations. In [38], they propose an efficient R-LWE implementation on the ARM NEON and MSP430 architecture. They optimize the NTT-based polynomial multiplication and achieve an implementation that was faster than all other R-LWE implementations at the time. They also compared their implementation with classic cryptography schemes (RSA and ECC) and found that their optimization was also faster than these cryptoschemes. In [39] they propose an optimized implementation of Kyber and Dilithium for the Cortex-M4. The optimizations in the arithmetic resulted in increases of around 5% for Dilithium and just over 15% for Kyber. One main area of concern for security when implementing cryptographic protocols is ensuring the security is not compromised by side channel attacks. This is where information such as duration, power or faults that occur can be used to undermine the security provided by the protocol. It is important to make sure that implementations are taking this vulnerability into account. In [40] they propose an optimized implementation of the supersingular isogeny key encapsulation mechanism (SIKE) for an ARM Cortex-M4. They measured the energy consumption, and also found whilst benchmarking their implementation that it was around 20% faster than previous implementations. It was found for the Cortex-M4 implementation of SIKE based on the reference implementation that a full recovery of keys was possible with a side-channel attack [41]. This brings to the fore the importance of implementation-specific security testing. In [42], they propose an architecture for fault detection that will provide protection against fault analysis vulnerabilities among R-LWE lattice-based key generation and encryption. This implementation was benchmarked on a field-programmable gate array (FPGA) and provided a high level of error coverage with a relatively low overhead. In [43], they discuss the use of Curve448 to provide hybrid postquantum security. This means that the algorithm can provide both classical and postquantum cryptography. This provides a greater level of assurance, as it provides protection against quantum attacks, but if vulnerabilities are found in the postquantum protocol--which, given the recency of most postquantum protocols, is a notable concern for many--the classic cryptographic scheme is also there. They propose the first implementation of Curve448 on a 32-bit ARM Cortex-M4. They provide assurance against a timing attack with their regular and constant implementation. In [44], they outline a design for Curve448 and Ed448 on Cortex-M4. These are curves that are expected to be able to provide post-quantum security. This design of the underlying operations has resulted in a significantly faster implementation for the key exchange and digital signature for Curve448 and Ed448, respectively. In [45], they outline a new approach to implement a cryptographic accelerator on a FPGA for an Ed25519-based digital signature scheme. This is a hybrid digital signature scheme, and through its optimization, it resulted in an improved efficiency of around 84%. A particular type of side-channel attack that is often a consideration for the IoT context is fault attacks. This is where errors occur during the running of the algorithm, causing vulnerabilities.