Is there any educated views or references on how the PQC NIST finalists compare to legacy crypto with regards to power consumption?
Many thanks
$\begingroup$
$\endgroup$
4
-
$\begingroup$ do you mean "how much more/less?" or do you mean "how different?" w.r.t. maybe side channel type of concerns? please edit in the question itself so it is self-contained. $\endgroup$– kodluSep 15, 2022 at 0:58
-
$\begingroup$ Thinking about this, maybe you could do a transistor count multiplied with the compute time to get any meaningful figure, comparing it with a selected set of common classic algorithms that have the same security level (and, of course, with both protected against the same side channel attacks). I'd otherwise guess that simply comparing the clock cycles would be next to identical to comparing power consumption. $\endgroup$– Maarten Bodewes ♦Sep 15, 2022 at 11:10
-
$\begingroup$ To some extent, the delta in power consumed is overwhelmed by other factors. Most implementations that are power sensitive rely on RF for communication. Postquantum crypto uses a lot more the bandwidth (larger public keys, ciphertexts, signatures); the power needed to transmit these larger objects will overwhelm any power delta due to the actual computation (and I don't know what the sign of that delta might be) $\endgroup$– ponchoSep 16, 2022 at 2:17
-
$\begingroup$ At CHES 2005 a paper (iacr.org/archive/ches2005/006.pdf) was published whose result was that - for long integer arithmetic, but I wouldn't expect the type of calculation to matter - the energy consumption is essentially proportional to the running time of the algorithm. Same for energy consumption of communication, which depends on key/signature sizes. For older, important algorithms HW-support might be present in your chip, cutting down running time and power consumption. So I'd just compare running times and communication size for estimating power consumption. $\endgroup$– j.p.Sep 16, 2022 at 6:14
Add a comment
|