Lattice-based post-quantum cryptography for memory-constrained IoT devices

Functional quantum computers could become reality in the short-term future, threatening the current internet security landscape, whose classical public-key cryptography schemes are vulnerable to Shor’s algorithm. In the American NIST’s standardization process for quantum secure cryptography, an ongoing effort to replace these vulnerabilities, schemes based on lattices performed well and some have been selected for standardization. This post-quantum cryptography will have to support application in resource-constrained systems such as microcontroller environments in the IoT. The inherently higher resource consumption of these schemes compared to classical cryptography makes this task challenging. This is especially the case with regard to memory-constraints,which are said to be the main bottleneck for implementations on constrained devices. Due to their relatively small keys and efficient execution, lattice-based cryptography again seems suitable. We investigate the suitability of lattice-based cryptography for memory-constrained devices and look particularly at the KEM Kyber and the DSA Dilithium. Lattice-based PQC schemes have been successfully implemented on high-end microcontrollers such as the ARM Cortex-M4, where some achieved low memory usage and performances that compete with classical cryptography. Lattice-based PQC schemes have been further optimized to fit memory-constrained devices with <10kB RAM. These implementations can suffer from considerable performance penalties. Both Kyber and Dilithium seem to be the most suitable of the KEMs and DSAs respectively for memory-constrained devices. The memory-optimized implementations of both show reasonable performances.