[Paper Review] OpenSSLNTRU: Faster post-quantum TLS key exchange

Daniel J. Bernstein, Billy Bob Brumley+2 more|arXiv (Cornell University)|Jun 16, 2021

Cryptographic Implementations and Security19 references4 citations

TL;DR

This paper presents OpenSSLNTRU, a high-performance post-quantum key exchange implementation for TLS 1.3 using the sntrup761 lattice-based key encapsulation mechanism. By optimizing key generation via batch processing and Montgomery’s trick, it achieves faster performance than CECPQ2’s ntruhrss701 while offering higher security, enabling more TLS 1.3 handshakes per second than any OpenSSL 1.1.1k implementation.

ABSTRACT

Google's CECPQ1 experiment in 2016 integrated a post-quantum key-exchange algorithm, newhope1024, into TLS 1.2. The Google-Cloudflare CECPQ2 experiment in 2019 integrated a more efficient key-exchange algorithm, ntruhrss701, into TLS 1.3. This paper revisits the choices made in CECPQ2, and shows how to achieve higher performance for post-quantum key exchange in TLS 1.3 using a higher-security algorithm, sntrup761. Previous work had indicated that ntruhrss701 key generation was much faster than sntrup761 key generation, but this paper makes sntrup761 key generation much faster by generating a batch of keys at once. Batch key generation is invisible at the TLS protocol layer, but raises software-engineering questions regarding the difficulty of integrating batch key exchange into existing TLS libraries and applications. This paper shows that careful choices of software layers make it easy to integrate fast post-quantum software, including batch key exchange, into TLS with minor changes to TLS libraries and no changes to applications. As a demonstration of feasibility, this paper reports successful integration of its fast sntrup761 library, via a lightly patched OpenSSL, into an unmodified web browser and an unmodified TLS terminator. This paper also reports TLS 1.3 handshake benchmarks, achieving more TLS 1.3 handshakes per second than any software included in OpenSSL.

Motivation & Objective

• To improve the performance of post-quantum key exchange in TLS 1.3 by addressing the high computational cost of sntrup761 key generation.
• To enable seamless integration of fast post-quantum cryptography into existing TLS libraries with minimal changes to applications.
• To demonstrate end-to-end compatibility by integrating the optimized sntrup761 library into an unmodified web browser and TLS terminator.
• To provide a reproducible, open-source research environment for post-quantum cryptography benchmarking and deployment.
• To achieve higher performance and security than existing post-quantum and pre-quantum TLS implementations.

Proposed method

• Optimized sntrup761 key generation using batch processing to amortize expensive modular inverses across multiple keys.
• Applied Montgomery’s trick to accelerate modular inversion, a major bottleneck in sntrup761 key generation.
• Implemented SIMD-optimized arithmetic using AVX2 instructions for low-level performance gains.
• Developed engNTRU, a dynamically loadable OpenSSL ENGINE, to expose post-quantum capabilities without modifying application code.
• Integrated the library into a lightly patched OpenSSL fork, supporting sntrup761 in TLS 1.3 cipher suites.
• Conducted end-to-end macrobenchmarks using unmodified Gnome Web (epiphany) and stunnel, validating transparent integration.

Experimental results

Research questions

• RQ1 Can batch key generation significantly reduce the per-key cost of sntrup761 key generation while remaining transparent at the TLS protocol layer?
• RQ2 Can post-quantum key exchange performance be made competitive with or superior to pre-quantum ECC in real-world TLS 1.3 deployments?
• RQ3 Is it feasible to integrate high-performance post-quantum cryptography into existing TLS libraries with minimal changes to applications?
• RQ4 Can a research-grade, reproducible post-quantum TLS stack be built and deployed using open-source tools and minimal system modifications?
• RQ5 Does the higher security level of sntrup761 justify its performance overhead compared to ntruhrss701, especially when key generation is optimized?

Key findings

• The optimized sntrup761 key generation achieves 156,317 cycles per key, a 5.7× improvement over the previous best of 814,608 cycles.
• The total key exchange (keygen + enc + dec) for sntrup761 now runs at 2.57× the cost of ntruhrss701, compared to 2.57× slower before optimization.
• The new implementation achieves more TLS 1.3 handshakes per second than any software included in OpenSSL 1.1.1k, setting a new performance record.
• End-to-end benchmarks confirm that the optimized sntrup761 library successfully integrates into unmodified Gnome Web and stunnel, demonstrating transparent application compatibility.
• The sntrup761 parameter set provides a higher pre-quantum Core-SVP security level of 2^153 compared to 2^136 for ntruhrss701, with no cyclotomic structure concerns.
• The performance gains are achieved without compromising security, and the solution remains compatible with existing TLS 1.3 protocols and application stacks.