MergeExchange Sort Based Discrete Gaussian Sampler with Fixed Memory Access Pattern Discrete Gaussian samplers are used to sample integers from a discrete Gaussian distribution. Since this functionality is used in operations such as key generation, signing, or key encapsulation of latticebased schemes, it is a fundamental building block of these cryptographic algorithms. One required feature of modern discrete Gaussian samplers when used in cryptographic algorithms is to be constanttime, to ensure security against timing sidechannel attacks. Further, it is often desired to minimize potential for power or EM sidechannel attacks by limiting how much information an attacker can gain from measuring power traces. To address the need for having a Gaussian sampler with these features in hardware, this paper presents a novel hardware implementation of a constanttime discrete Gaussian sampler with fixed memory access pattern realized on FPGAs. The design uses an approach based on Cumulative Distribution Table (CDT). Further, the new sampler uses a mergeexchange sort algorithm that enables generating the samples in batches. In the hardware, due to the use of the mergeexchange sort algorithm, the memory access pattern is always fixed, regardless of the values of the secret samples. This increases the resistance of the sampler to potential power or EM sidechannel attacks as memory usage and accesses are independent of the secret values. The presented sampler can be fully parameterized at compiletime with the following Gaussian parameters: standard deviation, precision, and tail cut, generating a hardware design that matches the exact parameters required by the cryptographic algorithm. In addition, it can be parameterized, at compiletime, with the batch size for the number of samples to generate at a time. The design evaluation is based on synthesis data for various Xilinx FPGAs.

Evaluating the Tradeoffs in the Hardware Design of the LEDAcrypt Encryption Functions The confidentiality provided by widely employed asymmetric cryptosystems relying on the hardness of factoring large integers or computing discrete logarithms in a cyclic group will be jeopardized by the availability of quantum computers. As a consequence, the design of quantumcomputing resistant cryptographic primitives has gained traction lately, especially thanks to the U.S. National Institute of Standards and Technology initiative, which aims at selecting a portfolio of primitives for standardization. A prime position in the set of asymmetric encryption primitives is occupied by the ones relying on decoding random linear error correction codes as their trapdoor. Among these primitives, the LEDAcrypt cryptosystem was recently announced to be admitted to the second round of the standardization initiative, where the investigation of the implementation performance is the main focus. In this paper we analyze the possible hardware designs to implement fast polynomial multiplications tailored to the encryption functions of the LEDAcrypt key encapsulation mechanism, and public key encryption primitives. In particular, we describe two designs for binary polynomial multiplications and analyze the advantages provided by exploiting the sparse nature of one of the operands in LEDAcrypt multiplications, validating our designs on a Xilinx Artix 100.