International Association for Cryptologic Research

International Association
for Cryptologic Research


Classic McEliece on the ARM Cortex-M4

Ming-Shing Chen , Ruhr University Bochum, Bochum, Germany
Tung Chou , Academia Sinica, Taipei, Taiwan
DOI: 10.46586/tches.v2021.i3.125-148
Search ePrint
Search Google
Abstract: This paper presents a constant-time implementation of Classic McEliece for ARM Cortex-M4. Specifically, our target platform is stm32f4-Discovery, a development board on which the amount of SRAM is not even large enough to hold the public key of the smallest parameter sets of Classic McEliece. Fortunately, the flash memory is large enough, so we use it to store the public key. For the level-1 parameter sets mceliece348864 and mceliece348864f, our implementation takes 582 199 cycles for encapsulation and 2 706 681 cycles for decapsulation. Compared to the level-1 parameter set of FrodoKEM, our encapsulation time is more than 80 times faster, and our decapsulation time is more than 17 times faster. For the level-3 parameter sets mceliece460896 and mceliece460896f, our implementation takes 1 081 335 cycles for encapsulation and 6 535 186 cycles for decapsulation. In addition, our implementation is also able to carry out key generation for the level-1 parameter sets and decapsulation for level-5 parameter sets on the board.
Video from TCHES 2021
  title={Classic McEliece on the ARM Cortex-M4},
  journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
  publisher={Ruhr-Universit├Ąt Bochum},
  volume={2021, Issue 3},
  author={Ming-Shing Chen and Tung Chou},