Timo Zijlstra

Karim Bigou

Arnaud Tisserand

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

Keywords: post-quantum cryptography, public-key encryption, hardware implementation, high-level synthesis I

This paper deals with hardware implementations for lattice-based cryptography. Various CPA and CCA secure algorithms for LWE, RLWE and MLWE problems have been studied, parallelized, implemented and compared on FPGA using high-level synthesis. The impact of PRNG choices on the implementations performances and costs is also evaluated. HLS allows us to compare various sets of algorithms, architectures and parameters with a reduced design effort. Our results are often similar to state-of-the-art for various speed and cost trade-offs. Sometimes we obtain better results thanks to the exploration of numerous architecture and algorithm optimizations.

Index Terms-learning with errors

When comparing implementation solutions for PKC, hardware ones usually lead to faster computations and a lower energy consumption than software ones. FPGAs offer a cheap but very effective hardware implementation solution when dealing with wide cost-performance space exploration. Hardware implementations can be realized using high-level synthesis (HLS) and input languages such as C for a reduced design effort. HLS also allows to quickly explore numerous algorithms, architectures and optimizations solutions which would be tedious with HDL. But, as for HDL implementation, HLS requires some expertise for low-level optimizations especially for finite field arithmetic. HLS was used for instance by [START_REF] Homsirikamol | Toward a new HLS-based methodology for FPGA benchmarking of candidates in cryptographic competitions: The CAESAR contest case study[END_REF] for benchmarking authenticated encryption algorithms, and by [START_REF] Basu | NIST post-quantum cryptography -a hardware evaluation study[END_REF] for the post quantum standardization project.

Hardware implementations are easier to protect against physical attacks than software ones. In a previous work [START_REF] Zijlstra | FPGA Implementation and Comparison of Protections against SCAs for RLWE[END_REF] (available online), we proposed, implemented and compared on FPGA using HLS several countermeasures against side channel attacks (SCAs) for RLWE schemes.

Here, we reuse and extend our polynomial and modular arithmetic units from [START_REF] Zijlstra | FPGA Implementation and Comparison of Protections against SCAs for RLWE[END_REF] to:

• design, implement and compare various LWE, RLWE and MLWE hardware solutions with several security parameters for PKE/KEM (inspired from Frodo [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF], NewHope [START_REF] Alkim | Post-quantum Key Exchange -A New Hope[END_REF] and Kyber [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF] candidates);

• implement various architectures and study the speed-up achieved for various levels of parallel computations in critical sequences of operations;

• implement the Fujisaki-Okamoto transform [START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF] to obtain CCA secure KEMs for LWE, RLWE and MLWE; • evaluate the impact of PRNG and FPGA choices on the performance and cost of the most efficient MLWE PKE with: a fast and small implementation using Trivium [START_REF] Cannière | Trivium: A stream cipher construction inspired by block cipher design principles[END_REF]; a slower but more secure solution using SHAKE256 [START_REF] Dworkin | SHA-3 standard: Permutation-based hash and extendableoutput functions[END_REF]; and a hybrid one which uses both PRNGs. In our hybrid solution, Trivium generates the pseudorandom part of the public key while SHAKE256 samples the secret error terms during encryption. Using the same implementation methodology, tool, target FPGA, design and optimization efforts for all our implementations, we hope to provide a fair comparison between the various evaluated algorithms, parameters and architectures. Our source codes are available as open source [START_REF] Zijlstra | LWE crypto in HLS on FPGA[END_REF].

Background on PKE algorithms is recalled in Section III. Sections IV, V and VI respectively detail our LWE, RLWE and MLWE implementations with a focus on parallel computations. Our implementations of the CPA to CCA transformation and randomness generation methods are described in Section VII. An extensive comparison of our results with state of the art results is provided in Section VIII.

II. DEFINITIONS AND NOTATIONS

• Z q = Z/qZ and R q = Z q [x]/(x n + 1) for n, q > 0.

• R k×m q is the R q -module. An element from this module is k × m matrix of polynomials in R q .

• Bold font is used for vectors, matrices and polynomials.

• B λ denotes the symmetric binomial distribution centred around 0 with integer parameter λ. • a $ ← -B λ (Z q ) denotes a random element in Z q sampled using B λ .

• a $ ← -B λ (R q ) denotes a random polynomial in R q whose coefficients are sampled using B λ (Z q ).

• A $ ← -B λ (R k×k q
) denotes a random matrix of polynomials sampled using B λ (R q ).

• denotes the point-wise multiplication of vectors.

• a is the integer a closest to a in Z q such that a ≤ a.

• PK and SK respectively denote the public and secret keys.

• For e 0 and e 1 two λ-bit integers, we denote e 0 ||e 1 := e 0 + 2 w+w λ e 1 , where w = 1+ log 2 q and w λ = 1+ log 2 λ .

III. STATE OF THE ART

A. Learning with Errors Cryptography Definition 3.1 (LWE [START_REF] Regev | On Lattices, Learning With Errors, Random Linear Codes, and Cryptography[END_REF]): Let χ be an error distribution, that is, a probability distribution close to 0 and symmetric around 0. Let q and m positive integers; s ∈ Z m q be some secret vector; and a 1 , a 2 , . . . some vectors sampled from the uniform distribution over Z m q . Then the LWE problem is to find the vector s given a number of LWE samples of the form (a i , a i s + e i ), where the error terms e i are sampled from χ.

LWR [START_REF] Banerjee | Pseudorandom functions and lattices[END_REF] replaces the random sampling of e i by a rounding mechanism adding a deterministic error to a i s.

Definition 3.2 (MLWE [START_REF] Langlois | Worst-case to Average-case Reductions for Module Lattices[END_REF]): For some integer parameter k > 0, an MLWE sample for some secret vector of polynomials s ∈ R k q is given by some uniformly random vector a $ ← -R k q , together with the polynomial b = a s + e, where e $ ← -B λ (R q ). The search MLWE problem is to find s given a number of samples.

Note that for n = 1, MLWE is similar to LWE with vectors of length k. In MLWE, small matrices and vectors with polynomial coefficients are used. RLWE is obtained by taking k = 1. Table I reports the parameters (n, k, m) values used in our LWE, RLWE and MLWE implementations. Works [START_REF] Regev | On Lattices, Learning With Errors, Random Linear Codes, and Cryptography[END_REF], [START_REF] Lyubashevsky | On Ideal Lattices and Learning with Errors over Rings[END_REF], [START_REF] Langlois | Worst-case to Average-case Reductions for Module Lattices[END_REF] respectively show that LWE, RLWE and MLWE are at least as hard as solving some hard lattice problems using quantum algorithms.

We describe the framework used for instance by NewHope, Kyber and FrodoKEM. Variations of this framework include the use of deterministic errors [START_REF] D'anvers | Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM[END_REF] or Gaussian noise (used in FrodoKEM) instead of sampling the binomial distribution. The secret key SK is defined by sampling some s

$ ← -B λ (R k×m q ).
The corresponding public key PK is determined by computing a number of LWE/RLWE/MLWE samples for this secret by sampling a uniform random

Input: Plaintext µ ∈ {0, . . . , 2 B } m 2 n , PK = (A, b) Output: Ciphertext (c 1 , c 2 ) e 1 , e 2 $ ← -B λ (R k×m q ) e 3 $ ← -B λ (R m×m q ) c 1 ← e 1 A + e 2 c 2 ← be 1 + e 3 + ENCODE B (µ)
Input: SK = s, ciphertext C = (c 1 , c 2 ) Output: Plaintext µ d ← c 2 -c 1 s µ ← DECODE B (d)
A $ ← -R k×k q and e 0 $ ← -B λ (R m×k q
), and computing PK given by (A, b) where b = s A + e 0 . Encryption and decryption algorithms are described in Figures 1 and2.

The number of bits encoded in each plaintext coefficient is equal to B + 1. For RLWE and MLWE, the parameter B is set to zero and ENCODE B (µ) lifts µ to the ring R q in a straightforward coefficient-wise manner and returns µ q 2 . The DECODE B (d) function maps coefficients of d to 0 if they are in the interval { -q 4 , . . . , q 4 }, else they are mapped to 1. In LWE each coefficient encodes a number of bits B ≥ 1. Encoding then lifts µ to the module Z m×m q and involves a scalar multiplication by q 2 B+1 . Decoding is generalized by dividing Z q up into 2 B+1 intervals as described by [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF].

For n > 1 and k = m = 1, algorithms in Figures 1 and 2 are for the RLWE scheme. Ciphertexts, plaintexts and keys are then polynomials in R q . For n = 1 and k, m > 1 the ring R q is equal to Z q and the plain LWE scheme is obtained, with ciphertexts, plaintext and keys in the form of matrices over Z q . The intermediate parameter sets for which n, k > 1 define the MLWE variant of the scheme.

B. CPA to CCA Conversion

The cryptosystem described in Sec. III-A is secure against chosen plaintext attacks (CPA). The Fujisaki-Okamoto transform [START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF] protects the decryption algorithm against chosen ciphertext attacks (CCA). It consists of computing a reencryption of the decrypted ciphertext and comparing it to the received ciphertext. The decrypted text is returned if and only if the two ciphertexts are equal. If they are not equal, then pseudorandom bits are returned. Since the ciphertext depends on the random error terms generated during encryption, the source of randomness is deterministic and computed by applying a hash function to the message and the public key. A third argument is added to the ENC function that specifies the source of randomness used for the binomial sampling. The CCAsecure algorithms in Figures 3 and4 use hash function H and G, and Algorithms 1 and 2. This CPA to CCA transformation and variants of it are used by Kyber, NewHope, Frodo and other lattice-based key exchange mechanisms.

Input: PK, random µ ∈ {0, 1} n Output: Ciphertext C and session key K Input: Ciphertext C, PK and SK Output: Session key K

1: (r 1 , r 2 ) ← H(PK||µ) 2: C ← ENC(µ, PK, r 1 ) 3: K ← G(C||r 2 )
1: µ ← DEC(C, SK) 2: (r 1 , r 2 ) ← H(PK||µ ) 3: C ← ENC(µ , PK, r 1 ) 4: if C = C then 5: K ← G(C ||r 2 ) 6: else 7: K $ ← -{0, 1} 256 8: end if

C. Implementation of Main Operations

1) Matrix multiplication: The multiplication of the public key A with the error matrix e 1 is the most expensive operation in the standard LWE scheme. It consists of k 2 m multiplications in the rings Z 2 15 or Z 2 16 . In [START_REF] Howe | Optimised Lattice-Based Key Encapsulation in Hardware[END_REF] the matrix multiplication is accelerated by computing partial products in parallel using up to 16 DSP blocks.

2) Polynomial multiplication: In RLWE and MLWE, the most expensive arithmetic operation is the polynomial multiplication. Multiplication in the ring R q is computed using the number theoretic transform (NTT). FPGA implementations of NewHope using the NTT for n = 1024 are given by [START_REF] Oder | Implementing the NewHope-Simple key exchange on low-cost FPGAs[END_REF] and [START_REF] Kuo | Post-Quantum Key Exchange on FPGAs[END_REF]. A fast and area optimized implementation for n = 256 is given by [START_REF] Roy | Compact ring-LWE cryptoprocessor[END_REF]. In [START_REF] Ozcan | High-level-synthesis of number-theoretic transform: A case study for future cryptosystems[END_REF] the usage of HLS for the implementation of the NTT is discussed. While implementations using schoolbook polynomial multiplication have been proposed in [START_REF] Pöppelmann | Area Optimization of Lightweight Lattice-Based Encryption on Reconfigurable Hardware[END_REF], [START_REF] Liu | Optimized Schoolbook Polynomial Multiplication for Compact Lattice-Based Cryptography on FPGA[END_REF], they are much slower than the NTT.

In [START_REF] Liu | Optimized Schoolbook Polynomial Multiplication for Compact Lattice-Based Cryptography on FPGA[END_REF] the schoolbook algorithm is optimized for coefficient multiplication on Xilinx DSP48E blocks with 18 × 25-bit hardwired integer multiplication. The coefficients sampled from the error distribution can be represented on a few bits. Therefore, a naive multiplication of a coefficient with w = log q + 1 bits by an error coefficient would underuse the DSP block. Paper [START_REF] Liu | Optimized Schoolbook Polynomial Multiplication for Compact Lattice-Based Cryptography on FPGA[END_REF] "packs" two error coefficients e 0 , e 1 of size w λ = 1 + log 2 λ into a new (w + 2w λ )bit coefficient e 0 + 2 w+w λ e 1 . If (w + 2w λ ) < 25, then for any w-bit coefficient a the multiplication (e 0 + 2 w+w λ e 1 )a can be computed on one DSP block. The product e 0 a can be read on the first w + w λ LSBs of the output. The product e 1 a is obtained by applying w + w λ right shifts to the output and again selecting the w +w λ LSBs of the remainder. The sign of the products is computed separately. Then two multiplications are obtained for the cost of one.

3) Binomial sampling: The B λ (Z q ) distribution is sampled by generating 2λ random bits x 1 , . . . , x λ , y 1 , . . . , y λ and computing λ i=1 x i -y i mod q. The sampling requires 2λ random bits per coefficient. For a total of mn(2k + m) coefficients for the 3 errors e 1 , e 2 and e 3 , the amount of random bits needed is considerable. In the specifications of most of the NIST round 2 candidates it is suggested to use SHAKE256 or AES to supply the randomness. Some implementations however, such as [START_REF] Howe | Optimised Lattice-Based Key Encapsulation in Hardware[END_REF], use Trivium because it is faster. Precomputing random bits and storing them in BRAM is used in [START_REF] Howe | Standard Lattice-Based Key Encapsulation on Embedded Devices[END_REF] to improve the throughput of the PRNG.

4) Modular reduction: In the LWE scheme the modulus is a power of 2, so that no computation is required to compute modular reduction. In RLWE/MLWE however, for fast polynomial arithmetic, one often chooses to use the NTT which requires the existence of a 2n-th root of unity in Z q . This is the case if q is a prime for which q ≡ 1 mod 2n. The choices for q are therefore limited. For prime moduli of the form q = 2 l1 -2 l2 + 1 for some integers l 1 and l 2 , one has 2 l1 -2 l2 + 1 ≡ 1 mod 2n if l 2 ≥ log 2 (2n). For n = 256 suitable primes include 7681 = 2 13 -2 9 + 1 which is used in the original version of Kyber and for n = 1024 the prime q = 2 14 -2 12 + 1 = 12289 is used in NewHope. We use a modular reduction method in the style of [START_REF] Solinas | Generalized Mersenne Numbers[END_REF] for moduli of the form 2 l1 -2 l2 +1. Using the fact that 2 l1 ≡ 2 l2 -1 mod q, a modular reduction can be computed using only bitwise shifts, additions and subtractions.

D. Parameters Selected for our Implementations

We implement the CPA and CCA secure LWE, RLWE and MLWE schemes for the parameter sets shown in Table I.

We choose LWE parameters from FrodoKEM [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF] except for the Gaussian distribution. We sample the B λ distribution instead, where λ is chosen such that the obtained B λ distributions are close to the Gaussian distributions from FrodoKEM. This allows us to make a fair comparison between LWE on one hand and RLWE and MLWE (both using binomial distributions) on the other. To the best of our knowledge, there does not exist any attack that exploits the small difference between the sampled distribution and the Gaussian distribution used in the security proof. The performance of the best algorithms solving LWE does not depend on the exact error distribution, which is why schemes such as Kyber [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF] also prefer binomial sampling.

Our parameters for RLWE and MLWE are those used by NewHope [START_REF] Alkim | Post-quantum Key Exchange -A New Hope[END_REF] and Kyber [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF] respectively. A newer version of Kyber [START_REF] Bos | CRYSTALS-kyber (version 2.0) -submission to round 2 of the NIST post-quantum project[END_REF] proposes to use the modulus q = 3329. On FPGA, there is hardly any speedup from replacing 13-bit operands by 12-bit when this does not reduce the number of required DSP blocks. Reducing q however, requires to implement quadratic extension field arithmetic. To avoid the overhead in computation time that this would cause, we first implement the original scheme using q = 7681. In section VI, we also implement the scheme with the new modulus and compared its performance to the original scheme.

The parameter sets are designed for the NIST security levels 1, 3 and 5, where level 1 corresponds to AES-128, 3 to AES-192 and 5 to AES-256. Level 1 is claimed by [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF] for Frodo using parameter set LWE-640, and by [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF] for Kyber using parameters set MLWE-512. Level 3 proposals use parameter

IV. FPGA IMPLEMENTATION OF LWE

In Sections IV to VIII, we use Vivado HLS (version 2018.1) on an Artix-7 FPGA (XC7A200) from Xilinx for all our implementations since this FPGA family is frequently used in other works (see Table VII in Section VIII). We also verified several of our architectures for CPA-secure RLWE on a ZedBoard card with a Zynq XC7Z020 FPGA (we do not have an Artix-7 card) where performance and cost results obtained on the Zynq FPGA card accurately confirm the synthesis and place&route (SPR) results. Below we report SPR results on the Artix-7 family.

A. Matrix Arithmetic for LWE

We extend the method from [START_REF] Liu | Optimized Schoolbook Polynomial Multiplication for Compact Lattice-Based Cryptography on FPGA[END_REF] to speed-up schoolbook polynomial multiplication, described in Sec. III-C, to the matrix multiplication for the standard LWE scheme. Matrices A and e 1 coefficients are 15 and w λ = 1 + log 2 λ bits wide respectively. We pack two coefficients e 00 ||e 10 to reduce the 8 × k matrix e 1 with w λ -bit elements to a 4 × k matrix with (w + 2w λ )-bit ones. Then multiplying one coefficient from A by one from e 1 requires a single DSP block.

The coefficients of the public key matrix A are generated by the PRNG. At each clock cycle, one coefficient is generated. During the first clock cycle, a 00 is generated and multiplied by all 4 coefficients in the first column vector of e 1 .

The resulting vector is added to the first column of the output matrix. All the coefficients that are loaded in the first clock cycle are coloured blue in Figure 5. During the second clock cycle, the red coefficients are loaded. The resulting integer products are all added to the first column of the output matrix. The first column of this output matrix is completely computed after k (+ pipeline depth) clock cycles. Only then the computation of the second column begins. Each row of e 1 is stored in one BRAM (i.e. matrix e 1 uses 4 BRAMs). The architecture of the matrix multiplication is shown in Figure 6. To increase the level of parallelism by a factor two, the blue and red multiplications can be performed at the same time. Then twice as many DSP blocks are required for the matrix multiplication and two coefficients of A have to be generated at the same time. For higher degrees of parallelism, multiple elements on the same row of e 1 have to be read simultaneously. Therefore the rows of e 1 have to be implemented on multiple BRAMs each.

B. Parallelization using HLS

The C source code of the matrix multiplication c 1 ← e 1 A, illustrated in Figure 5, is reported in Figure 7. The loops labelled col_A and row_A iterate over the columns and rows of A respectively. Column of the output matrix are loaded and stored by loops copy1 and copy2. The prng function generates the next coefficient of A, and comp_2prods computes a • (e||e ) for coefficients a, e, e using the error encoding method described in paragraph III-C2.

In order to specify optimization to the HLS tool, we use various directives (see [START_REF]Vivado HLS optimization methodology guide[END_REF]). Applying the pipeline directive to the loop row_A, ensures that this loop is pipelined and the subloop row_E is completely unrolled. That is, all 4 iterations of the loop row_E are computed at the same time on 4 DSPs. Arrays are implemented on a single BRAM by default. Without any specifications, the HLS tool would try to implement E1 on a single BRAM. However, all 4 elements of each column have to be loaded simultaneously. Therefore we use the array_partition directive on E1 to partition the local memory into 4 parallel BRAMs.

We parallelize the computation even further by applying the unroll directive on loop row_A using several unrolling factors: 2, 4, 8 and 16. For unrolling factors 4, 8 and 16, multiple elements on the same row have to be accessed at the same time. Therefore the array E1 has to be partitioned in the second dimension as well, using the array_partition directive, to prevent simultaneous accesses to the same BRAM. A similar effect can be obtained using the array_reshape directive, which results in fewer additional BRAMs than array_partition. Using the array_map directive, multiple arrays can be implemented on one single BRAM. This may have a negative impact on the computation time, as some arrays need to be accessed during the same clock cycle.

Other examples of directives used in our implementations includeinline, allocation and dependence. To find the optimal choice of directives, we have tried dozens of directive combinations including

• different factors for array_partition, unroll and array_reshape with different options, • pipelining using different initiation intervals,

• array_map for different variables,

• inline and dependence for various loops and functions, • allocation to set a strict limit to the number of DSPs used by the implementation for various limits.

The same (somewhat) exhaustive approach to the exploration of the design space is used for RLWE and MLWE implementations in sections V and VI. In total we have tested over 100 different configurations, which would not be possible in reasonable time using HDL (and debugging so many architectures would be tedious). Clearly, this demonstrates the interest of HLS for PKC implementations. The complete set of directives used for our source codes is available online in our repository [START_REF] Zijlstra | LWE crypto in HLS on FPGA[END_REF].

C. Implementation results

The implementation results are reported in Table II. The error encoding technique for packing two error terms in one w + 2w λ bits integer allows to compute 8 multiplications in parallel using 4 DSP blocks for the parameters sets of k = 640 and k = 1344. For k = 976 however, the error terms are still 5-bit integers while the coefficient size is increased to 16 bits (see Table I). Therefore w + w λ > 25 and extra DSP blocks are needed for the multiplications. For k = 1344 the size of the error terms decreases to 4 bits.

The matrix multiplication using 4 parallel DSP blocks is computed in roughly k 2 = 409600 cycles for k = 640. This operation takes up 90 percent of the total encryption time. The impact of parallelism on the timing and area implementation results is shown in Figure 8. These results are for the LWE-640 encryption algorithm only. The unrolling factor 2 divides the total encryption time by almost 2 while the overhead in terms of DSPs is lower than 2. In terms of slices, LUTs and BRAMs, the trade-off is even more favourable for the parallelized implementation, which even holds for the more parallelized implementations using unrolling factors 4, 8 and 16. For these Fig. 9. Binomial sampler (yellow part) using PRNG for the error polynomials in the NTT domain (red part). The negative wrapped convolution is computed using a shift and add based multiplier (green part), exploiting the fact that the binomial samples are small. The NTT uses one butterfly operator (BF) that consists of a single DSP block and integer addition/subtraction operators.

V. NEW OPTIMIZED RLWE IMPLEMENTATIONS

We re-used the finite field and polynomial arithmetic units from our previous work [START_REF] Zijlstra | FPGA Implementation and Comparison of Protections against SCAs for RLWE[END_REF], and we added the implementation of the CPA secure RLWE cryptoscheme for n = 256 and n = 1024. Our new architectures include modular reduction, NTT and the binomial sampler, as illustrated in figure 9. The negative wrapped convolution computes the products of small error terms with the 2n-th roots of unity. multiplications are computed using a shift and add based multiplier. The constant geometry variant [START_REF] Pease | An Adaptation of the Fast Fourier Transform for Parallel Processing[END_REF] of the NTT is used. Bitreversal is avoided by using the decimation-in-frequency (DIF) algorithm for the forward NTT and decimation-in-time (DIT) for the inverse, as proposed in [START_REF] Pöppelmann | High-Performance Ideal Lattice-based Cryptography on 8-bit ATxmega Microcontrollers[END_REF].

Our new (CPA and area optimized) implementation results reported in Table III are compared to our non-CPA version from [START_REF] Zijlstra | FPGA Implementation and Comparison of Protections against SCAs for RLWE[END_REF] and RLWE-1024. The sequential architecture requires only one DSP block but doubles the encryption time. In the parallel architecture, 2 forward NTTs are computed simultaneously with n 2 log n less cycles in the encryption function, resulting in a smaller latency. The parallel architecture also leads to a higher frequency than the sequential one, resulting in an even more significant speed-up. The unrolled architecture unrolls loops of the point-wise computations by a factor 2. There is a small speedup compared to the parallel architecture but with some area overhead in terms of DSPs and BRAMs. Thanks to HLS, adding CPA protection was possible in a moderate design time.

VI. MLWE IMPLEMENTATIONS AND COMPARISON

A. Modifying the RLWE Implementation for MLWE

We transform our RLWE-1024 implementation for MLWE using slight changes, starting by changing n from 1024 to 256. The arithmetic units are re-used for computations in R q and MLWE. This includes our architecture in Figure 9 (modified for n = 256) that generates binomial samples in the NTT domain and now denoted BN. The same operations are performed but on polynomial coefficients of k-dimensional vectors over R q . The MLWE scheme is thus implemented by applying the operators used in RLWE to each of the k polynomials (each of degree n) of the vectors in a sequential manner. This is achieved by modifying the control accordingly. Each vector consists of 14 • 256 • k bits and is stored in one 18 kb BRAM. For k = 4, around 14 kb are used in each BRAM, while for k = 2, only 7 kb are used. In a sequential architecture, the number of BRAMs is the same for k ∈ {2, 3, 4}. Extra additions and a modified control are needed to support the multiplication of matrices and vectors of dimension k. To avoid storing the k × k random matrix A, which is part of the public key, we use the PRNG to generate the coefficients of the polynomials in matrix A on the fly, as suggested by [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF]. The public key to be stored in the architecture only consists of the vector b ∈ R k q and the seed for the PRNG. We apply one step of rejection sampling in order to avoid too much bias in the distribution of the coefficients (see section VII-A), as proposed for instance for Kyber in [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF].

As seen in Sec. III-D, several values of the security parameter k ∈ {2, 3, 4} are used for MLWE based candidates. We provide implementations for all those values with results in Table IV. Having a generic source code for HLS allows us to select k easily. In HDL, this would not be simple to optimize the performances using pipelining. k determines the number of required multiplications in R q . During the encryption, k 2 + k multiplications in R q and 2k forward NTTs are needed. The decryption consists of k multiplications in R q , with only one inverse NTT.

Figure 10 compares, for a similar security level, RLWE with n = 1024 and MLWE with k = 4 implementations. For encryption, MLWE is slightly faster but for decryption MLWE is twice as fast as RLWE with only one additional BRAM and even less slices. The impact of k on the decryption time of MLWE is limited, since only the size of the computation c 1 • s depends on k. During the encryption however k 2 + k multiplications in R q and 2k NTTs have to be computed. The encryption time is therefore heavily impacted by increasing the parameter k. In order to estimate the performance of Kyber from the Round 2 specification, we modify the implementation by using modulus q = 3329. The fast modular reduction algorithm for modulus 7681 cannot be used and must be replaced. Moreover, there are no 2n-roots of unity in Z 3329 , therefore the NTT has to be modified as well, and quadratic extension field arithmetic has to be added to replace the pointwise multiplications. As a result, the latency is increased and extra DSP blocks are required as reported in Table IV. Adding a quadratic extension for the field arithmetic is not simple. But using HLS this corresponds to a few days of design and debug (using HDL this would be tedious).

B. Parallelization of Operations in R k q

We also propose parallelized implementations of MLWE encryption and decryption whose computation time is independent of the vector length k. While the computations in Z q are still performed sequentially, hardware is added to compute the operations on a higher level (matrix-vector operations) in parallel. During the encryption the k components of the error vectors e 1 and e 2 have to be sent to the NTT domain. All of these 2k transforms are computed simultaneously. The operation (for k = 2)

e 1 , e 2 →
NTT(e

(0) 1 ) NTT(e (1) 1 )
,

NTT(e

(0) 2 ) NTT(e (1)
2 ) is computed in the time it takes to compute one NTT, that is, n 2 log(n)+δ cycles for where δ is the pipeline depth. Similarly, PRNGs and binomial samplers are added to sample the 2k error polynomials simultaneously. The k 2 multiplications in R q for the computation of c 1 ← A e 1 + e 2 and the k multiplications in R q needed to compute c 2 are also computed in parallel. For k = 2, the operation

e 1 , A → a (00) e (0)
1 + a (01) e

(1) 1 a (10) e

(0)
1 + a (11) e

(1) 1

is computed in just over n cycles, which is the time it takes to compute one single point-wise multiplication. For the computation of A e 1 , in order to compute the k 2 multiplications over R q in parallel, we need to access all k 2 coefficients of A at the same time. Therefore, we generate a seed for the PRNG for each of the k 2 coefficients of A. The public key then consists of a vector b ∈ R k q and a seed for the PRNG used to generate the k 2 seeds for the k × k matrix A. The parallel architecture for k = 3 using the BN unit described in the previous section is shown in Figure 11.

C. Parallel Implementation using HLS

The C source code in Figure 12 is an excerpt of the MLWE encryption. It computes the matrix-vector product A e 1 where all the matrix and vector coefficients are in the NTT domain.

A standard matrix-vector product can be recognized in the loops labelled col and row. The coeff loop iterates over the coefficients of the polynomials in matrices A and e 1 . The matrix A is not read from memory, but computed "on the fly". The k 2 internal PRNG states are read from memory and the PRNG is used to generate the coefficients of the k 2 polynomials in A. The reduce and reduce_fast functions perform modular reduction, the prng function samples a 13bit signed integer, and the DW macro casts the operands of the multiplication to the int26 type, to get a 26-bit signed integer as result.

In order to generate a parallel architecture, some directives have to be specified accordingly in Vivado HLS. To compute all of the k 2 polynomial multiplications simultaneously, we set the pipeline directive on the coeff loop. It forces all subloops to be completely unrolled. Then the k 2 operations in the col and row loops are performed in parallel.

We use the array_partition directive to partition the arrays E1[k][n] and C1 [k][n] into k different arrays. This distributes them over k different BRAMs each. Then k values can be loaded from the array E1 at the same time and k values can be written to C1 at the same time. We apply the same directive to both dimensions of the k × k array Trivium_States. Clearly doing this type of architecture exploration in HDL would be labor intensive.

To generate an architecture for a different vector length k, we use a SageMath script that creates a new header file defining k and computes a new set of valid keys (the C preprocessor in Vivado HLS is not able to perform such mathematical computations). The C source code remains the same and the same directives apply. Our SageMath script also generates all the constants used in the architecture, such as nth roots of unity and exponents parametrizing the modulus. A simple change of parameters in the script is all that is needed to generate architectures for different values of (n, q, k) without changing the C source code. We can even switch between RLWE (k = 1) and MLWE implementations (k = 2, 3 or 4) by simply generating a new header file. For area optimization, we add some specific directives depending on the parameter k. The allocation directive for instance, allows to set a limit to the number of DSP blocks in the implementation.

D. Implementation Results

The PRNG is instantiated with the Trivium stream cipher [START_REF] Cannière | Trivium: A stream cipher construction inspired by block cipher design principles[END_REF]. The results are shown in Table V (in clock cycles) of the arithmetic part of the scheme is then the same for k = 2, 3 and 4. A slight increase in encryption and decryption time is due to the loading and storing of public keys and ciphertexts of increased size. In Table V, increasing k means adding n cycles to the decryption latency, during which the k • n coefficients of the ciphertext part c 1 are loaded. The encryption latency increases by 2n cycles since both b and c 1 consist of k • n coefficients.

The throughput and area (in DSP blocks) trade-offs of our LWE, RLWE and MLWE implementations, with various parallelism levels, are shown in Figure 13. Sequential architectures for RLWE and MLWE using only 1 DSP block and no other optimizations than pipelining are compared to the slightly parallel (computing NTTs simultaneously) and full parallel ones. For RLWE and MLWE implementations, the throughput is increased by computing parallel NTTs during the encryption. Further parallelism is obtained by unrolling loops. This almost doubles the throughput of the slightly parallel architecture for MLWE-1024. However for RLWE-1024, the speedup is limited to only 7 percent compared to the slightly parallel version. This is due to the memory access patterns of the NTTs which limit further parallelism. In RLWE these NTTs consist of 10 stages of 512 butterfly operations each, while in MLWE only 8 × 128 butterfly operations are necessary. The potential for parallel architectures provided by the matrix structure, is clearly an advantage for MLWE compared to RLWE. For the LWE implementations, the throughput increases when Obtaining optimized implementations for such a set of architectures and algorithms in HDL would have been very difficult and costly.

VII. RANDOMNESS GENERATION AND CCA IMPLEMENTATIONS

In this section, we investigate various links between area, performances and security of our solutions. We evaluate the use of: rejection sampling for public-key generation; a more secure PRNG; CCA transformation for higher security.

A. Rejection Sampling

To generate the coefficients of the public key A, uniform sampling over Z q is needed. The naive way for sampling the uniform distribution over Z q is to generate w = log 2 (q) random bits defining a w-bit number a and returning a mod q. This results in a biased distribution: for any a 0 ∈ {0, . . . , 2 wq -1} and a 1 ∈ {2 w -q, . . . , q -1}, the probability of obtaining a 0 is twice as high as the probability of obtaining a 1 . The bias is determined by the probability of obtaining an integer in the range {q, . . . , 2 w -1}, which is equal to 2 w -q 2 w ≈ 2 -4 for q = 7681. To reduce the bias in the obtained distribution, rejection sampling can be performed as proposed for instance in Kyber [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF]. This requires generating a number of random integers a 0 , . . . , a r and selecting one that is in the interval [0, q -1]. The sampling algorithm using r rejection steps, has a probability of returning an integer in the range {q, . . . , 2 w -1} of approximately 2 -4(1+r) . We implemented rejection sampling for r = 0, 1, 2, 3 and 4. The impact of the number of rejection steps on the area utilization is shown in Figure 14. There is a small area overhead in slices, LUTs and flipflops as rejection steps are added (the maximum for r = 4 is less than 3 percent). The number of clock cycles is not impacted by the additional r rejection steps for the range of r considered in Figure 14. The number of DSPs and BRAMs also remains the same. Rejection sampling can thus be efficiently implemented without much overhead.

B. Alternative PRNG

While Trivium leads to fast and small circuits, his 80-bit key space is smaller than the number of security bits (128, 192 or 256, depending on the parameter set) targeted by Kyber, NewHope and Frodo. An attacker has no direct access to the PRNG output used for error sampling. However, the correctness of a Trivium key guess can be checked by reconstructing e 1 using the PRNG and verifying that e 1 A ≈ c 1 . The Trivium key can therefore be found in 2 80 operations. If the Trivium key is compromised, an attacker may compute c 2 -be 1 ≈ q 2 µ to recover the message. An exhaustive search in the 80-bit key space could thus be used for message recovery attacks.

In Kyber, NewHope and Frodo it is suggested to use SHAKE256 or similar algorithms as PRNG. Other schemes propose to use the less secure SHAKE128 to generate the public key part A. We implement a hybrid version using Trivium for the public key and SHAKE256 for the error samples, as presented in [START_REF] Howe | Optimised Lattice-Based Key Encapsulation in Hardware[END_REF]. We also implement a version that uses SHAKE256 for both error sampling and publickey generation

C. CCA Secure Solutions

As proposed for Frodo [START_REF] Bos | Frodo: Take off the Ring! Practical, Quantum-Secure Key Exchange from LWE[END_REF], NewHope [START_REF] Alkim | Post-quantum Key Exchange -A New Hope[END_REF] and Kyber [START_REF] Bos | CRYSTALS -Kyber: A CCA-Secure Module-Lattice-Based KEM[END_REF], we transform our CPA-only secure LWE, RLWE and MLWE implementations (with hybrid sampling mode) into CCA secure implementations using algorithms in Figures 3 and4 CPA-only implementations and the CCA implementations is shown in Figure 18. For LWE, the computation time of the hash functions is small compared to the matrix multiplication. The computation time difference between CPA-secure and CCA-secure encryption are almost entirely accounted for by the matrix multiplication in the encryption algorithm. For MLWE and RLWE however, this is not the case. The difference in computation time between CPA-enc and CCAenc is due to the hash functions, as can be expected from the encapsulation algorithm in Figure 3. This also holds for the difference between CCA-dec and the sum of CPA-enc and CPA-dec. Additional slow-down is caused by a drop in obtained frequency for CCA implementations. The impact on the area is shown in Figure 19. There is a clear increase in DSPs for RLWE and MLWE, showing that the sharing of resources is not optimal.

VIII. COMPARISON WITH OTHER WORKS

Table VI summarizes results for encryption and encapsulation, including this work (TW) and the best FPGA implementations from the literature. State-of-the-art implementations use handwritten HDL to get optimized FPGA implementations (with more extensive implementation effort). All cited results have been implemented on Xilinx FPGAs (7 series and Ultrascale families), except the recent work [START_REF] Andrzejczak | The Low-Area FPGA Design for the Post-Quantum Cryptography Proposal Round5[END_REF] implemented on Intel/Altera FPGA, which makes direct comparisons difficult. Results in Table VI are first grouped by algorithms (R/M/LWE), second by size and then by type (CCA, CPA or KE). For each group, the results are reported by increasing execution time. } MLWR and RLWR-based schemes are often chosen with a modulus q that is a power of 2 to ease modular reduction (see [START_REF] D'anvers | Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM[END_REF], [START_REF] Baan | Round5: Compact and fast post-quantum public-key encryption[END_REF]). . Another advantage is that there is no need for binomial error sampling, as the errors are generated by setting a number of LSBs to zero.

The work [START_REF] Dang | Implementing and Benchmarking Three Lattice-Based Post-Quantum Cryptography Algorithms Using Software/Hardware Codesign[END_REF] provides hardware/software solutions for many PKE/KEM algorithms and sizes. The obtained results are interesting but cannot be compared to pure hardware ones (for instance the area required by a A53 Cortex core cannot be compared with FPGA resources).

For LWE, our implementation of the CCA secure LWE-640 takes more time (increased by a factor 2.45) but uses less DSP blocks (decreased by a factor 3.2) compared to the HDL optimized implementation [START_REF] Howe | Optimised Lattice-Based Key Encapsulation in Hardware[END_REF] using hybrid PRNG. Our implementation uses more slices, but it includes decapsulation whereas [START_REF] Howe | Optimised Lattice-Based Key Encapsulation in Hardware[END_REF] does not.

For RLWE, our results are given for q = 7681. Our CPAsecure RLWE-1024 implementation has an execution time very close to [START_REF] Zhang | Highly Efficient Architecture of NewHope-NIST on FPGA using Low-Complexity NTT/INTT[END_REF] (63µs vs. 62µs), but is less optimized in term of hardware resource consumption (4 vs. 2 DSPs). This shows some potential for HLS implementation.

For MLWE-1024 on Artix-7 FPGAs, our solution is slower (116µs vs. 67.9µs) and larger (factor 5) than [START_REF] Xing | A compact hardware implementation of CCA-secure key exchange mechanism CRYSTALS-KYBER on FPGA[END_REF] (published after our initial submission). Using the same HLS code, we are able to get a much faster solution on a more efficient FPGA (UltraScale+).

As presented in Fig. 15, changing from Hybrid PRNG to a complete SHAKE256 solution adds a time overhead about 30% for RLWE-1024 and 20% for MLWE-1024 due to the frequency drop. It also leads to 30% to 50% area increase. Thus, even with a complete SHAKE solution the results remain good using HLS.

Clearly, recent optimized HDL solutions outperform our HLS ones. But at the time of our initial submission, our HLS solutions were comparable, and sometimes better, to published results based on HDL implementation. Unfortunately, we are not able to compare the respective design efforts to implement many solutions for various algorithms, architectures and parameters. This would be interesting.

IX. CONCLUSION

We implemented several CPA and CCA secure LWE, RLWE and MLWE based cryptosystems on FPGA using HLS for the first time. At the submission time of this paper, our architectures generated using HLS lead to comparable, and sometimes better, results compared to the best references from the state of the art using HDL (such as [START_REF] Kuo | Post-Quantum Key Exchange on FPGAs[END_REF], [START_REF] Oder | Implementing the NewHope-Simple key exchange on low-cost FPGAs[END_REF], [START_REF] Andrzejczak | The Low-Area FPGA Design for the Post-Quantum Cryptography Proposal Round5[END_REF], [START_REF] Howe | Standard Lattice-Based Key Encapsulation on Embedded Devices[END_REF]) but probably for a much smaller design effort. Recent HDL based solutions (such as [START_REF] Zhu | LWRpro: An energy-efficient configurable crypto-processor for module-LWR[END_REF], [START_REF] Xing | A compact hardware implementation of CCA-secure key exchange mechanism CRYSTALS-KYBER on FPGA[END_REF]) are faster and smaller than ours. We showed how HLS can be used effectively to parallelize implementations. We also evaluated the impact of the choice of the PRNG on the performance of the encryption. Using Trivium instead of SHAKE to generate the pseudorandom part of the public key, the encryption can be accelerated. Even more speed-up is obtained when using Trivium for the error sampling as well, although this decreases the theoretical security of the scheme. HLS seems to us, for a first use of this type of hardware implementation method, an interesting solution for PQC algorithms in a tight design budget and for exploration of solutions. So many different implementations and optimizations would have not been possible during a PhD thesis using HDL. We plan to implement other cryptosystems (e.g. isogenies, codes) using HLS and work on arithmetic support libraries for HLS.

Fig. 1 .

 1 Fig. 1. Encryption algorithm ENC(µ, PK).

Fig. 2 .

 2 Fig. 2. Decryption algorithm DEC(C, SK).

Fig. 3 .

 3 Fig. 3. CCA-secure encapsulation function ENCAPS.

Fig. 4 .

 4 Fig. 4. CCA-secure decapsulation function DECAPS.

eFig. 5 .Fig. 6 .

 56 Fig.5. Matrix multiplication e 1 A: each element of A is multiplied with a column vector of e 1 .

Fig. 7 .

 7 Fig. 7. Source code for matrix multiplication c 1 ← e 1 A.

Fig. 8 .

 8 Fig. 8. Comparison of the LWE-640 base implementation (blue) to parallel ones with unrolling factors 2 (green), 4 (red), 8 (cyan) and 16 (magenta).

Fig. 10 .

 10 Fig.10. Comparison of CPA-secure MLWE (using q = 7681) with RLWE (q = 12289) PKE FPGA implementations for the same security level.

Fig. 11 . 1 Fig. 12 .

 11112 Fig.11. Proposed parallel architecture for the matrix-vector multiplication in MLWE-768. The PRNG ("PR") generating matrix A uses the internal PRNG states stored in RAM. The modular arithmetic unit ("MA") computes modular multiplication and addition with the error coefficients supplied by the BN units. The polynomial products are summed up to obtain c 1 = A e 1 + e 2 .

Fig. 13 .

 13 Fig.[START_REF] Fujisaki | Secure Integration of Asymmetric and Symmetric Encryption Schemes[END_REF]. Throughput (in k-encryptions per second) vs area (in DSPs) trade-offs for various parallelism levels. The most left point of each curve corresponds to a sequential architecture, the middle point embeds parallel NTTs (for RLWE/MLWE) and the most right point is a full parallel architecture.

Fig. 14 .

 14 Fig. 14. Area/timing overhead of CPA-secure MLWE-1024 implementation due to rejection sampling.

Fig. 15 .Fig. 16 .

 1516 Fig. 15. Impact of the PRNG choice (Trivium, Hybrid, SHAKE) on the encryption time for CPA-secure MLWE and RLWE architectures.

Fig. 17 .

 17 Fig.[START_REF] D'anvers | Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM[END_REF]. Impact of the choice of PRNG on time × area for CPA-secure MLWE and RLWE architectures.

Fig. 18 .Fig. 19 .

 1819 Fig. 18. Encryption and decryption time for CCA2 and CPA implementations. RLWE and MLWE times are in µs, while ms are used for LWE.

TABLE I PARAMETER

 I SETS USED IN OUR IMPLEMENTATIONS.

	Scheme	n	m	k	q	λ
	LWE	1	8	640 / 976 / 1344 2 15 / 2 16 / 2 16	15 / 10 / 4
	RLWE	1024	1	1	12289	8
	MLWE	256	1	2 / 3 / 4	7681	5 / 4 / 3
	sets LWE-976 and MLWE-768, while LWE-1344, RLWE-
	1024 and MLWE-1024 are used in level 5.

  . In the parallel MLWE implementation, the impact of k on the encryption time is mitigated by adding BRAMs and DSP blocks. The latency

		RAM	RAM			RAM	RAM			RAM	RAM
		13	288	288			13	288	288			13	288	288
	BN	PR	PR	PR	BN	BN	PR	PR	PR	BN	BN	PR	PR	PR	BN
	13	13	13	13	13	13	13	13	13	13	13	13	13	13	13
		MA	MA	MA			MA	MA	MA			MA	MA	MA
		13	13	13			13					13	13	13
							ADD	ADD ADD

TABLE VI CPA

 VI AND CCA-SECURE ENCRYPTION OR ENCAPSULATION (CPA, CCA) OR 'CLIENT' PART IN SERVER-CLIENT-SERVER KEY EXCHANGE (K-E). "HYBRID" IN THE PRNG COLUMN MEANS TRIVIUM + SHAKE. NOTATIONS: SYMBOL * DENOTES RESULTS FOR BOTH ENCRYPTION AND DECRYPTION, TW STANDS FOR "THIS WORK".

		Lvl. of	Scheme			FPGA	Freq. Time Area
	Source Parallel.	type-size	Algorithm PRNG Type	family (model)	MHz	µs DSP, 18kb BRAM, Slices, LUT
	[18]	high	LWE-640	Frodo	Hybrid CCA	Artix-7	171	1212 16, 0, 1692, 5796
	[18]	medium	LWE-640	Frodo	Hybrid CCA	Artix-7	177	2342 8, 0, 1485, 5155
	TW	low	LWE-640		Hybrid CCA	Artix-7 (200)	159	2972 5, 37, 12951, 39077 *
	[18]	low	LWE-640	Frodo	Hybrid CCA	Artix-7	183	4624 4, 0, 1338, 4620
	[25]		LWE-640	Frodo	Hybrid CCA	Artix-7 (35T)	167 19608 1, 11, 1855, 6745
	[18]	high	LWE-976	Frodo	Hybrid CCA	Artix-7	168	2857 16, 0, 1782, 6188
	[18]	medium	LWE-976	Frodo	Hybrid CCA	Artix-7	175	5464 8, 0, 1608, 5562
	TW	low	LWE-976		Hybrid CCA	Artix-7 (200)	167	6317 14, 37, 13468, 41100 *
	[18]	low	LWE-976	Frodo	Hybrid CCA	Artix-7	180 10638 4, 0, 1455, 4996
	[25]		LWE-976	Frodo	Hybrid CCA	Artix-7 (35T)	166 45455 1, 16, 1985, 7209
	TW	low	LWE-1344		Hybrid CCA	Artix-7 200	167 11606 6, 62, 12299, 37342 *
	[20]		RLWE-1024 NewHope SHAKE K-E	Zynq-7 (20)	131	79 8, 14, n.a. 20826
	[19]		RLWE-1024 NewHope SHAKE K-E	Artix-7 (35T)	117	1532 2, 4, n.a., 4498
	TW	medium RLWE-512		Hybrid CPA	Artix-7 (200)	211	50 5, 12, 7797, 16338 *
	[34]		RLWE-1024 NewHope SHAKE CPA	Zynq-7 (20)	200	62 2, 8, n.a, 6781 *
	TW	medium RLWE-1024		Trivium CPA	Artix-7 (200)	259	63 4, 10, 3701, 10112 *
	[31]		RLWR-1018	Round5 SHAKE CPA Cyclone V (5csea5) 133	1000 4116 ALM, 10753 bytes *
	TW	medium RLWE-1024		Hybrid CCA	Artix-7 200	167	137 9, 17, 14026, 42062 *
	[31]		RLWR-1170	Round5 SHAKE CCA Cyclone V (5csea5) 130	1350 6337 ALM, 11765 bytes *
	[36]		MLWR-512	Saber	SHAKE CPA	UltraScale+	100	5.2 85, 12, n.a., 34886
	[36]		MLWR-768	Saber	SHAKE CPA	UltraScale+	100	11.6 85, 12, n.a., 34886
	[36]		MLWR-1024	Saber	SHAKE CPA	UltraScale+	100	21.0 85, 12, n.a., 34886
	[35]		MLWE-512	Kyber	SHAKE CCA	Artix-7 (12T)	161	30.5 2, 6, 2126, 7412
	TW	medium MLWE-512		Hybrid CCA	Artix-7 (200)	170	60 11, 16, 11028, 34206 *
	[37]	high	MLWR-768	Saber	SHAKE CCA UltraScale+ (9eg)	250	26 0, 2, n.a., 23600 *
	[35]		MLWE-768	Kyber	SHAKE CCA	Artix-7 (12T)	161	47.6 2, 6, 2126, 7412
	TW	medium MLWE-768		Hybrid CCA	Artix-7 (200)	167	88 11, 16, 11890, 34145 *
	[38]		MLWR-768	Saber	SHAKE CCA	Zynq-7 (20)	125	4147 28, 4, n.a., 7400 *
	TW	medium MLWE-1024		Hybrid CCA UltraScale+ (9eg)	417	48 9, 16, 9314, 44964 *
	[35]		MLWE-1024	Kyber	SHAKE CCA	Artix-7 (12T)	161	67.9 2, 6, 2126, 7412
	TW	medium MLWE-1024		Hybrid CCA	Artix-7 (200)	170	116 11, 16, 11567, 33707 *
	[39]		MLWE-1024	Kyber	SHAKE CCA	Artix-7 (35T)	60	6900 4, 34, n.a., 1738

TABLE VII CCA

 VII -SECURE MLWE-1024 USING SHAKE256 FOR ERROR SAMPLING FOR DIFFERENT FPGA FAMILIES, USING VIVADO VERSION 2018.3.

		Freq.	Time µs	Area
	FPGA family	MHz	enc/dec	DSP, BRAM, Slices, LUT
	Artix-7	200	99/110	11, 16, 11322, 35607
	Kintex-7	286	70/77	9, 16, 12066, 34175
	Virtex-7	286	70/77	9, 16, 12508, 35718
	Zynq UltraScale+	417	48/53	9, 16, 9314, 44964
	Kintex UltraScale	333	61/68	9, 16, 7238, 43101
	Virtex UltraScale	286	69/77	9, 16, 6474, 33979

ACKNOWLEDGMENT

This work has been supported by a PhD grant from PEC/DGA/Région Bretagne.


Zine Eddine Cherif

Christophe Poil Âne
email: christophe.poilane@unicaen.fr

Thierry Falher

Alexandre Vivet

Nabil Ouail

Bessem Ben Doudou

Jun Chen

Influence of Textile Treatment on Mechanical and Sorption Properties of Flax/Epoxy Composites

The aim of the present work is to study the effect of conventional textile treatments of woven flax on the mechanical properties and the water sorption of flax/ epoxy composites. The flax fabrics are standard 2/2 twills. Various treatments are carried out on fabric such as mercerization, bleaching, and leaching for long fibers or on yarn such as leaching for short fibers. A model, based on a modified rule of mixture applied to composite reinforced with woven fabric, is developed to include the effect of fiber and porosity volume fractions on composite stiffness and strength. Most treatments improve tensile stiffness and strength of flax/epoxy composite and reduce composite water sorption. We prove by X-ray fluorescence analysis, thermogravimetric analysis, and tensile tests of dry fabric that it is due to an improvement in the interfacial bonding between fibers and matrix. The best performances are achieved with bleaching and mercerization treatment. The weakest performances are obtained with the composites made with leached yarns. POLYM.

INTRODUCTION

Natural fibers, especially flax fibers, have shown their capacity to be a good candidate as reinforcement of composite materials through a combination of properties: relatively high-specific strength and modulus, low density, material renewable, and low environmental impact [1,2]. Nevertheless, these fibers have also some disadvantages: they are hydrophilic and have a low thermal resistance [3,4]. Furthermore, the quality of these fibers varies according to the local climate and the nature of the ground [1,5]. Moreover, flax fiber has a structure which can be compared to a composite material composed of helical cellulose fibrils embedded in a matrix of polymers (hemicelluloses, pectin, and lignin) [5,6].

Industrial applications of composites reinforced with flax fibers already exist as tennis racket commercialized by Artengo V R . However, industrial applications of flax composites are still limited because of their low performances due to the incompatibility between the hydrophobic resin and the hydrophilic fiber [2][3][4][5][6][7]. Therefore, in addition to the intrinsic properties of fibers, mechanical properties, and water sorption of natural fiber-reinforced composites largely depend on the adhesion between the fibers and the matrix [8]. This interface can be improved by various chemical and physical methods [9,10]. Van de Weyenberg et al. [7] have reported the beneficial effect of several kinds of treatments such as dissolution by alkalization, silane coating, and impregnation with a dilute epoxy resin on the mechanical properties of flax/epoxy composite. Furthermore, several articles have been published about the positive effect of various chemical treatments on the properties of composites based on different kind of natural fibers such as jute/biopol [11], coir, and oil palm fiber-reinforced polyester composite [12]. Sreekumar et al. [13] have investigated the effect of various chemical and physical treatments, such as mercerization and heating at 100 C on the mechanical properties and water sorption of sisal/polyester composites. They found an enhancement of flexural and tensile mechanical properties and an improvement in the water sorption resistance. Arbelaiz et al. [14] have reported that the use of a coupling agent (maleated polypropylene) improves the mechanical properties and decreases the rate of water uptake of short flax/polypropylene composites.

All these studies focused on the treatment effect of natural short fibers or unidirectional long fiber reinforcement on composite properties. However, there are still few studies on the treatment of long woven flax reinforcements (yarn or fabric). Woven fabrics are attractive as reinforcements for composite materials. The potential of this kind of reinforcement can be summarized by their excellent handiness compared to nonwoven counterparts and their higher mechanical properties for the interlaminar and interfacial strength [START_REF] Li | Textile composites based on natural fibers[END_REF].

In the present work, textile composites based on flax fiber and epoxy resin have been investigated. The flax fabrics are 2/2 twills and they are made with yarn instead of the more usual tow. The work was focused on the effect of conventional textile treatments on woven flax reinforcement, called pretreatments. For that, the relationships between composite manufacturing techniques, mechanical properties and water sorption characteristics have been investigated. Moreover, to better understand macroscopic results, thermogravimetric analysis (TGA), elemental analyses by X-ray fluorescence (XRF) and tensile tests on dry fabric samples, and scanning electronic microscopy (SEM) observations on composite samples was performed.

EXPERIMENTAL PROCEDURES

Material

The prepregs used to elaborate the composites have been supplied by the LINEO NV Company [16]. All the five studied prepregs consist of weight controlled 2/2 twill fabric impregnated by an epoxy resin. Transformation of flax fibers into flax/epoxy resin prepregs was made in several steps: spinning of flax fibers (258 m 21 , 7.2 Nm, diameter 0.58 mm), weaving of fabric, textile treatment (so-called pretreatment and applied before or after the weaving), and impregnation of fabric. The linen fabrics reach the impregnate line (in roll form) after the pretreatment. The impregnation steps are the following: drying fabrics, compatibilization treatment of fabrics (which can be compared with the sizing treatment of glass fibers), final impregnation of fabrics, interleaving between two polyethylene films. The entire process is carried out continuously. The major difference between the prepregs is the reinforcement pretreatment.

The fibers are not subjected to any particular selection. During the first step (yarn spinning), except for the leached yarn product, the fibers are successively scutched, hackled and spinned to form a yarn (Fig. F1 1a). The spinning technique used is the flax semiwet spinning, where yarns are only moistened on their external surface. The "leached yarn" product is different from the other fabrics. This product is made of tows which result from scutching and hackling. The tows are then leached in a specific bath during the spinning process. This kind of spinning is called flax wet-spinning. After spinning, all the yarns are woven in the form of 2/2 twill fabric (Fig. 1b). The weight is set up to 300 g m 22 for all the fabrics with ten yarns by centimeter for both the warp and the weft direction.

After weaving, the fabrics made with yarns coming from the flax semiwet spinning are subjected to pretreatment: "leaching," "bleaching," or "mercerization" (see Table T1 1). Therefore, for a composite application, we compare four pretreated fabric intended for a textile purpose with an untreated fabric. The leaching treatment is an alkaline boiling off. The mercerizing treatment is done with sodium hydroxide. The bleaching treatment is done with a combination of hydrogen peroxide and sodium hypochlorite. These pretreatments are classical alkali treatments used in the textile industry to clean fabrics and thus facilitate the finishing process [START_REF] Fakin | [END_REF].

Pretreatments lead to a slight modification of the fabric weight. First, some components of fibers as pectins could be degraded by pretreatments, consequently the yarn linear mass decreases. Second, on the opposite, pretreatments could increase the fabric surface mass by shrinking warp and weft yarns. To optimize the impregnation of the hydrophilic flax fibers with the hydrophobic epoxy resin, the woven fabrics undergo a compatibilization treatment patented by LINEO NV [18]. Finally, the fabrics are impregnated by an epoxy resin especially formulated for prepregs (Hunstman Araldite LY5150/Aradur 5021/Hardener XB 3471) [19].

Composite Elaboration

The composite materials were prepared by two different processes: hot platen press and autoclave. Laminates were produced with seven layers of prepreg fabrics for hot platen press and six layers for the autoclave process. Even if the 2/2 twill fabric is balanced with the same amount of warp as weft yarns; special care has been always taken to align the warp yarns in the main direction.

Hot Platen Press. Seven layers of fabric (200 mm 3 110 mm) are stacked and cured between the two platens of a heated press [START_REF] Poilâne | Proceeding Compte rendu des JNC16[END_REF]. The platen surface is 240 mm 3 150 mm. To obtain a reinforcement volume fraction V r of Autoclave. The prepreg fabrics are stacked to form a six ply laminate on a highly rigid plate (370 mm 3 330 mm) and placed in a vacuum polymer bag. The laminates are cured in an autoclave after a single-stage cycle at 120 C during 150 min. The applied vacuum and the external pressure are, respectively, set at 2 and 300 kPa.

The final thickness varies from 2.7 to 3.2 mm.

Methods

Tensile Test. Tensile tests on dry fabrics are conducted on an electromechanical testing machine (MTS Criterion TM Model 43) fitted with a 500-N load cell. All the tests (five by fabric) were performed at 23 C and relative humidity 50% with a crosshead speed of 2.0 mm min 21 . Samples dimensions are 11 mm 3 70 mm. They comprise 10 yarns in warp direction (tensile direction) by 37 mm long between jaws. Full strain of sample was measured from the crosshead displacement and the initial length of the samples. The average stress in the yarn is calculated by dividing the tensile strength by the average section of the 10 warp yarns. This section is measured after testing by sampling and weighing of tested yarns using the equation:

A5 m q r :l ( 1
)
where A is the area of the section of ten yarns, m is the weight of the ten yarns, q r is flax density, and l is the initial yarn length. For all products, density used for flax is 1.54.

Tensile tests on composites are conducted on a servohydraulic testing machine (Instron 8801) fitted with a 100-kN load cell. All the tests were performed at room temperature with a crosshead speed of 2.0 mm min 21 (according to the standard ISO 527-4). The elongation is measured with an extensometer of a gauge length of 50 mm and a precision of 0.5%. Specimen length and width are, respectively, equal to 250 and 20 mm. Specimen thickness depends on material type (fabric weight and composite elaboration process). The tensile direction is aligned with fabric warp direction. Indeed, a comparison conducted on the same flax/epoxy composite (untreated 2/2 twill fabric) has shown identical properties in warp and weft direction (see Fig. Sorption Test. Measurement of water sorption of a composite material has been performed using a gravimetric analysis. The method consists in measuring the content of absorbed water as a function of exposure time. The specimen is a square of 200 mm side. First of all, samples are dried at 103 C for 24 h to remove all traces of moisture within the material. To avoid moisture sorption of the four edges of the samples, they were covered with a layer of high temperature silicone. After preparation, the specimens were immersed into a water bath at a controlled temperature of 20 C. The samples were weighted at regular intervals to determine the water sorption rate in time. It should be noted that before weighing, the surface of the specimens was meticulously dried with tissue. The water sorption rate M t at time t can be expressed as follow:

M t 5 W t 2W 0 W 0 ( 2
)
where W 0 is the weight of dried specimen and W t is the weight of the wet specimen at time t.

Thermogravimetric Analysis. All the fabric samples were cleaned for 15 min in demineralized water at 45 C before the XRF and TGA tests. The thermogravimetric measurement has been achieved on a TGA7 Perkin Elmer apparatus and analyzed on a TAC7/DX analyzer Perkin Elmer. The mean weight of the tested samples was 8 mg. The thermal cycle includes heating from 50 to 900 Ca t 10 Cm i n 21 under pure and dry nitrogen at 45 ml min 21 , an isotherm for 1 min under nitrogen, and an isotherm of 10 min under dry air.

XRF Analysis. XRF analyses were conducted on fabric samples of flax using a Philips PW 2404 X-ray spectrometer with a Rh anode and a 27-mm diameter collimator mask. Fabrics were directly analyzed with calibration using in-house polymer standards for C, O, and N elements and standard reference materials for other elements.

RESULTS

Fiber and Porosity Volume Fractions

Natural fibers are relatively more difficult to be impregnated by resin than synthetic fibers (glass or carbon). Moreover, the presence of porosities in composite laminate is known to dramatically decrease the mechanical and the sorption properties [START_REF] Madsen | [END_REF]23]. In addition to the reinforcement volume fraction V r , the porosity volume fraction V p must be taken into account during performance analysis of natural fiber composites.

After elaboration, the composite plate is weighted and measured to obtain its weight W c , its thickness h, its length L and its width w. The knowledge of the basis weight of fabrics g r , the number of layers in the laminate n layer , the reinforcement density q r 51:54 [START_REF] Madsen | [END_REF] (supposed to be equal to fiber density) and the matrix density q m 51:2 [19], allows calculating the volume fractions of the three constituents:

V r 5
Volume yarn Volume composite 5

W r q r L:w:h 5 n layer :g r :L:w q r L:w:h 5 n layer :g r h:q r (3)

V m 5 Volume matrice Volume composite 5 W m q m L:w:h 5 W c 2W r q m L:w:h 5 W c 2W r q m :L:w:h (4) V p 512 V r 1V m ðÞ : (5)
Final uncertainties on V p , V r , and V m values are estimated with the uncertainties on each initial parameter and using the uncertainty propagation method.

In the case of composite prepared with hot platen press, the reinforcement volume fraction varies from 46 to 53% with a mean value around 50% (Fig. F2 2a). It is higher than that produced with autoclave process; the mean value is then 39% with a minimum of 38% and a maximum of 43%. Concerning the porosity volume fraction, it seems to be independent of the textile pretreatment and the production process (Fig. 2b). Indeed, for all the composites made with long fiber yarn, the porosity volume fractions are close, with a mean value of 12.2%. The result for untreated flax-reinforced composite manufactured with the autoclave process differs from this value. It shows a higher value than that obtained with the hot platen press (18.8 vs. 13.3%). Moreover, the higher values of V p obtained for the leached yarn composites is due to the nature of the yarns that are made of short fibers.

The important porosity volume fraction is due to the flax fabric structure. First, the fabrics are made of relatively uncompressible yarn instead of classical tow. Second, the filling rate of the woven fabric is relatively low (Fig. 1b).

Mechanical Properties

Mechanical Properties of composite. A typical strainstress curve of flax-reinforced composite is shown in Fig. 3a. No effect of the flax pretreatment on the global mechanical behavior is observed. The mechanical properties of composites produced with both methods are given in Fig. F4 4. For a same pretreatment, we note that stiffness and strength are higher for the hot platen press than the autoclave process. That can be initially explained by the influence of the reinforcement volume fraction because it is higher for the composite manufactured with the hot platen press method. In addition to the yarn volume fraction, for the untreated reinforcement composite, the low values of stiffness and strength given by the autoclave process are also due to the high porosity volume fraction (V p 5 18.8%). Nevertheless, the ultimate strain is higher for composites prepared with the hot platen press compared to that produced with the autoclave process. For both methods of composite production, pretreatments increase stiffness and strength of flax-reinforced composites except for leached yarns pretreatment. That is probably due to an improvement in the fiber-matrix interface. The best results are given by mercerization and bleaching pretreatment, with an enhancement of stiffness about 44 and 13% and an increase in the strength up to 55 and 29%, for the autoclave process and hot platen press, respectively (same values for mercerization and bleaching). The improvement obtained with leaching pretreatment is estimated at 32 and 14% in stiffness and about 40 and 20% in strength, for the autoclave and hot platen press process, respectively. The weak performances (stiffness and strength) given by the composite made of a fabric with leached yarns are explained by the poor quality of the fibers (scutching and hackling tow). Furthermore, ultimate strain of flax/epoxy composite decreases after the fiber pretreatment. This strain decrease is probably due to a decrease in the fiber-matrix sliding, which may indicate an interface improvement.

Mechanical Properties of Dry Yarns. The observed changes in mechanical properties of composites, caused by the pretreatment, may result from a change in the reinforcement itself [24] or in the fiber-matrix interface [7]. Tensile tests on pretreated dry fabrics are summarized in Fig.

F5 5. The used setup is given in Fig. 5a. Typical stressstrain curves for all the tested fabrics are given in Fig. 5b. We show that all treatments reduced the ultimate strain (B point) and ultimate stress (C point). The apparent stiffness (slope of linear regression line) is related to these two parameters and mostly decreases, except for the bleached for which it increases slightly. The strength of fabrics relates to that of the warp yarns. Yarns strength comes from adhesion properties between technical fibers, intrinsic strength of fibers and average length of these fibers. Treatments can act on these three factors.

Water Sorption

Effect of Pretreatments. The water sorption tests were carried out only on the composites produced with the autoclave process. The water uptake curves for flax/epoxy composites with different pretreatments are shown in Fig. Diffusion behavior in glassy polymers can be classified according to the relative mobility of the penetrant and of the polymer segments. This classification produces three different categories of diffusion behavior [START_REF] Comyn | Polymer Permeability[END_REF][START_REF] Espert | [END_REF]:

Case I (or Fickian diffusion), in which the rate of diffusion is much less than that of the polymer segment mobility; Case II (and super case II), in which penetrant mobility is much greater than other relaxation processes; Non-Fickian or anomalous diffusion, which occurs when the penetrant mobility and the polymer segment relaxation are comparable. It is then an intermediate behavior between case I and case II diffusion.

These categories of diffusion can be distinguished by the shape of the sorption curve [9,[START_REF] Espert | [END_REF] described by the equation:

M t M m 5 k:t n (6)
where M t is the moisture content at time t, M m is the moisture content at the equilibrium, k is a constant characteristic of the polymer which indicates the polymer/ water interactions and n indicates the diffusion mechanism. For the value of n50:5, the diffusion is Fickian, while, for Case II n is equal to 1 (and Super Case II n > 1). For a non-Fickian or anomalous diffusion, n shows an intermediate value (0:5 < n < 1).

To determine the nature of the diffusion mechanism and the kinetics of water sorption by the composite, the diffusion constant n is identified by fitting the experimental data of sorption tests with the equation:

log M t M m 5 log k 1 n log t (7)
which is derived from Eq. 6. The values of the constants n and k are determined by linear regression analysis Fig. F7 7. For all the composites with different pretreatments, the values of the diffusion coefficient n are close to 0.5 (Table T2 2). Consequently, water sorption of flax-reinforced composite follows a Fickian diffusion mechanism. The absorbed water content increases linearly with the square root of time and gradually approaches the equilibrium plateau. The same behavior was reported for other natural fiber-reinforced composites [9,[START_REF] Espert | [END_REF]27].

Transport Coefficients. The permeability of a composite material to water molecules is dependent on water diffusion as well as on water sorption. Once the Fickian nature of water sorption behavior of flax composite is known, the transport coefficients can be identified.

The diffusion coefficient D characterizes the ability of water molecules to diffuse through the composite structure. For small times M t =M m 0:5 ðÞ , the value of diffusion coefficient D can be calculated using the equation [START_REF] Cranck | The Mathematics of Diffusion[END_REF]: where h is the initial thickness of the samples and u is the slope of the linear portion of the sorption curves. Generally, the pretreatments reduce the diffusion coefficient D of flax/epoxy composites compared to the untreated one (Table T3 3). The lowest values of D are obtained for the composites produced using mercerized and bleached fabrics. On the opposite, the leached yarn composite has a slightly higher diffusion coefficient than that of the untreated reinforcement composite.

D5 p 4M m ðÞ 2 M t h ffi ffi t p 2 5p hu 4M m 2 (8)
The sorption coefficient S is calculated using the following equation [27]:

ÁS5 M m M 0 ( 9
)
where M m is the mass of absorbed water at the equilibrium state and M 0 is the sample initial mass. The values of sorption coefficient S of pretreated flax composites are given in Table 3. All pretreatments decrease the sorption coefficient S. The best results are obtained by mercerization and bleaching. Finally, the permeability P of the composite to water molecules can be considered as the net effect of sorption S and diffusion D:

P5DS ( 10
)
The values of the permeability coefficient of the various pretreated flax-reinforced composites are given in Table 3. Once again, except for the leached yarn pretreated composite that shows a permeability coefficient close to that of the untreated composite, it is clear that the pretreatments of reinforcement reduce the permeability of flax/epoxy composites. This decreasing of permeability may be a good indication of the improvement in fiber/matrix adhesion.

Elemental Analysis by XRF and TGA

The results of elemental analysis by XRF obtained for the five woven fabrics are given in Table T4 4. The rate of organic matter (cellulose and hemicellulose H 6 C 10 O 5 , pectins H 6 C 10 O 6 ) is superior to 99% for all samples. The results of the TGA showed a degradation peak at about 400 C. The possible presence of wax is not visible quantitatively. The residue, measured by TGA, was less than 1%, which is highly consistent with the rate of organic matter whatever the fabric (organic matter 1 residue rate $ 100%). This validates the XRF measurements.

The ion rates of potassium (K), calcium (Ca), magnesium (Mg), and sodium (Na) are expressed in microequivalents charge per gram. It is known that these cations bound to pectins, but the calcium is mainly present on the fibers surface [START_REF] Morvan | [END_REF]. The cation rate of 151 lequiv. g 21 , measured for untreated sample shows that the retting of this fabric is perfect. The number of charge on the fibers residual mass increases with treatment. This can be explained by the elimination of neutral polysaccharides (cellulose and hemicellulose) and to a lesser extent pectins. The primary wall and probably the first layer of the secondary wall are damaged. This is especially true for the mercerized fabric (mercerized rate 5 2 times the reference rate). The Ca/Mg ratio decreases with treatment. This shows that the pectin is damaged at the fiber surface. This is especially true with the bleached sample (Ca/Mg reference 5 2 times Ca/Mg bleached).

DISCUSSION

Normally, the pretreatments are carried out with the goal of removing hydrophobic impurities from the flax fiber. Hydrophobic impurities elimination is useful to increase the water sorption of the flax fibers which, for textile industry, is essential for the wet finishing process of fabrics [START_REF] Fakin | [END_REF]. However, in the case of composites, pretreatments decrease the water sorption. As shown in a previous study by Sreekala et al. [9], in addition to the fiber and the matrix composition, moisture sorption depends on the fiber-matrix interface. Indeed, for the pretreated fibers, the hydrophobic impurities are removed, which increases the matrix-fiber interaction, and thus decreases the water sorption. Besides, as reported by these same authors [9], the reduction of matrix-fiber interaction can lead to the formation of porosity within the composite, which increases the water sorption. The best results are obtained by mercerization and bleaching pretreatments. In this case, in addition to the cleaning of impurities of the fiber, these results can be explained by the activation of the hydroxyl groups of cellulose by breaking the hydrogen bond [9][10][11][12][13]. Consequently, the interaction enhancement between fiber and matrix decreases the water sorption. With a fiber-matrix interface of higher quality and a lower porosity fraction, water diffusion is slowed and the sorption coefficient is also reduced for pretreated flax-reinforced composites.

The experimental results for the water sorption of flax/ epoxy composites are compared with the theoretical expression of the Fick's law for a large plate of thickness h, where the water uptake in time is given by the following equation:

M t M m 512 8 p 2 X 1 n50 1 2n11 ðÞ exp 2 2n11 ðÞ 2 p 2 Dt h 2 ! : (11)
Figure F8 8 shows the comparison of the experimental diffusion curve for two examples of flax fiber-reinforced composite (untreated and bleached) with the theoretical Fickian sorption model. A deviation of the experimental curve from the theoretical curve was observed, which indicates a deviation from the Fickian diffusion behavior. The same observation was reported by Joseph et al. [27]. This observation does not invalidate the discussion about transport coefficients but has to be studied in a future work.Reinforcement and porosity volume fractions have an important influence on the mechanical properties of flax-reinforced composite materials. To overcome the effect of these two factors and to quantify the reinforcement efficiency of the yarns in the composite, a calculation of the effective yarn properties (stiffness and strength) is possible. This calculation is based on the micromechanical theory applied to composite reinforced with woven fabric [START_REF] Berthelot | Composite Materials: Mechanical Behavior and Structural Analysis[END_REF]. In this model, we assume that the twill layer is constituted of two unidirectional layers: a warp layer oriented at 0 and a weft layer oriented at 90 . The curvature and the misalignment of yarns are not taken into account. The behavior of each layer is characterized by their elastic modulus: E Lwarp ; E Twarp ; m LT warp ; G LT warp for the warp layer and E Lweft ; E Tweft ; m LT weft ; G LT weft for the weft layer. E L and E T are, respectively, the longitudinal and transversal modulus; m LT is the Poisson's ratio and G LT is the shear modulus. The longitudinal modulus E L comp of a laminate including a layer weft and a layer warp is calculated by the following equation: (13) where n warp and n weft are, respectively, the number of yarns in the warp and the weft direction, k G is a geometric ratio, and a is defined by the following relation:

E L comp 5 12a ðÞ k G a warp E L warp 1 12k G ðÞ
Áa5 k G a warp m LT warp E T warp 1 12k G ðÞ a weft m LT weft E T weft ÂÃ 2 k G a warp E L warp 1 12k G ðÞ a weft E T weft ÂÃ k G a warp E T warp 1 12k G ðÞ a weft E L weft ÂÃ (14)
In the case where the yarns in the warp and weft directions are identical, the elastic properties in the warp and weft directions are also equal:

E L
where E L layer , E T layer and m LT layer are the elastic coefficients of an unidirectional layer with a volume fraction equal to that of the woven reference layer. Consequently, a warp 5a weft 5a layer and the longitudinal modulus (Eq. 12) is therefore simplified as:

E L comp 5 12a ðÞ
k G E L layer E T layer 112k G hi k G 1 12k G ðÞ
E L layer E T layer hi (18)
It has been shown that a and a layer can be rounded off to 0 and 1, respectively [START_REF] Berthelot | Composite Materials: Mechanical Behavior and Structural Analysis[END_REF][START_REF] Bonnafous | The National School of Mechanics and Aerotechnics[END_REF]. Consequently, Eq. 16 can be simplified as:

E L comp 5 k G E L layer 1 12k G ðÞ E T layer ÂÃ (19)
where k G 51=2 for a balanced fabric. Properties of the composite elementary constituents are now introduced. As the twill fabric is made with flax fiber yarns, the elementary constituents are the yarn and the matrix. Therefore, the longitudinal modulus of the composite reinforced with balanced fabric (k G 51=2) can be expressed using the rule of mixtures:

E L comp 5 1 2 E m V m 1E r V r ðÞ 1 E m E r k E E m V r 1V m E r k E ! ( 20
)
where E is the modulus, V is the volume fraction and the indices r and m stand for yarn and for matrix, respectively, and k E is the yarn stiffness anisotropy ratio defined as the ratio between transverse and axial stiffness of flax yarn. The first term is related to the longitudinal modulus of the layer and the second term to its transversal modulus. Baley et al. [6] has estimated experimentally that, for flax fibers, the stiffness anisotropy ratio is comprised between 1/6 and 1/8.5, whereas Cichocki and Thomason [START_REF] Cichocki | [END_REF] obtained a value of 1/7 for jute fiber. In the present work, the ratio k E 5 1/7 is used. Similarly, the ultimate stress r L comp is defined by Eq. 21 where we assume that the ultimate strain of the matrix is higher than that of the reinforcement.

r L comp 5 1 2 r r V r 1V m E m E r 1 r m r r k r V r r m 1V m r r k r ! : (21)
In this study, we assume that the yarn strength anisotropy ratio k r is equal to k E . The rules of mixture do not take the porosity into account. The effect of porosity on stiffness and strength of natural fiber composites is efficiently taken into account by the introduction of the factor 12V p ÀÁ x in the rule of mixture [START_REF] Madsen | [END_REF][START_REF] Toftegaard | Proceedings of the 23rd Risï International Symposium on Materials Science[END_REF][START_REF] Thygesen | [END_REF][35]:

E L comp 5 1 2 E m V m 1E r V r ðÞ 1 E m E r k E E m V r 1V m E r k E ! 12V p ÀÁ x (22) r L comp 5 1 2 r r V r 1V m E m E r 1 r m r r k r V r r m 1V m r r k r ! 12V p ÀÁ x (23)
where V p is the porosity volume fraction and x is the porosity efficiency exponent. First, the effect of porosity is to decrease the load bearing volume which is introduced by reducing the yarn and matrix volumes. Second, the exponent x quantifies the local stress concentration around porosities in the composite. When x50, the porosity has no effect beyond lowering the load bearing volume. In this study, the porosity efficiency exponent x has been identified using the experimental data. The value of x has to be chosen so that the yarn stiffness and strength are independent of the porosity volume fraction V p [START_REF] Toftegaard | Proceedings of the 23rd Risï International Symposium on Materials Science[END_REF]36]. Thereby, x was fixed to the value 1. The effective yarn stiffness E r and the effective yarn strength r r are calculated from Eqs. 22 and 23, respectively. The results are given in Table T5 5. For a same pretreatment, the yarn effective stiffness E r and strength r r are similar regardless of the process used for composite elaboration. Therefore, the yarn effective properties are independent of the elaboration process and only depend on the intrinsic yarn properties and the yarn-matrix interface. Consequently, for each pretreatment, a mean value of the effective yarn stiffness E r and strength r r is calculated Table 5. To facilitate the comparison, pretreatment effect on yarn effective properties is expressed relatively to the untreated yarn properties (Fig. F9 9). The best effect is reached with bleaching pretreatment with an effective yarn stiffness of 58.2 GPa which indicates an improvement of 37%. For mercerization and leaching pretreatments, the yarns effective stiffness is, respectively, 51.2 and 52.2 GPa, which means an enhancement of 21 and 23%. For the leached yarns composite, E r is lower than that with untreated reinforcement composite with a decrease of about 13%. This is due to their low quality (yarn made with scutching and hackling tows). For the effective yarn strength, the best result is also obtained with bleaching pretreatment with a value of 460 MPa and an increase up to 48%. Mercerization and leaching pretreatment show an improvement of 36 and 31%, respectively. r r given by the composite produced with leached yarns is also lower compared to that of untreated yarn. In this case, the reduction is estimated at 14%. Therefore, it is obvious that conventional textile treatments are a powerful way to improve the mechanical properties of flax yarn-reinforced composites. The strength improvement reaches 55% with bleaching or mercerization. Our results prove that after pretreatment, the reinforcement induced by the yarns is enhanced. The reinforcement effect within the composite comes from the intrinsic yarn properties and the yarn-matrix interface. Tensile tests on flax dry fabric show that treatments reduce the mechanical properties of yarns. The strength decrease reached 40%. Three effects explain this decrease. The reduction of the intrinsic properties of the elementary fibers is the first effect [24], which is explained via XRF measurements by polysaccharides degradation in the fiber surface. The separation of the individual fibers in the bundles is the second effect. This separation is explained via XRF measurements by pectins degradation at the fibers surface. It has the effect of reducing the average length of elementary reinforcement. Indeed, originally flax fibers form long bundles of several decades of fibers [37]. The individual fibers separation is first started by the initial transformation process (retting), and the chemical pretreatments complete this fibers separation. The third effect is the modification of surface properties of elementary reinforcements [38,39]. This last effect could act positively on the mechanical properties of dry yarn by improving the adhesion between the elementary reinforcements. Consequently, to obtain the reinforcement effect of the composite, the yarn-matrix interface has to be improved. The interface is modified at three levels. First, pretreatments allow the cleaning of fiber and yarn surfaces by eliminating impurities (waxes, fats, proteins, and inorganic substances) [START_REF] Fakin | [END_REF]. Second, we have seen that pretreatments facilitate the fiber separation. Unlike the untreated sample where we observe a bundle of nonseparated fibers inside the yarn (Fig. F10 10), in pretreated samples fibers are separated. In this case, resin penetration between fibers is facilitated. Finally, during composite elaboration, the weak natural connections between the fibers assumed by pectins are replaced by fiber-matrix interface bondings. The fracture surface of the composite with untreated yarns and pretreated yarns are shown in Fig. F11 11. For the pretreated sample, we observe the presence of matrix on fibers. This observation confirms the penetration of matrix inside the yarns and the good adhesion of the matrix on the reinforcement, contrary to the case of the untreated sample. Finally, treatments roughly increase the efficiency of the load transfer between reinforcement and matrix.

CONCLUSIONS

This work has shown the influence of the conventional textile treatment of flax fibers on the mechanical and moisture sorption of flax/epoxy composites. These fiber surface treatments improve the mechanical properties (strength and stiffness) of these materials. This is due to the improvement in adhesion between matrix and fibers.

The water sorption studies show that water uptake of flax/epoxy is reduced after pretreatment which can also be explained by a better interfacial bonding between fiber It is know that alkali pretreatments remove the impurities from the fibers surface. Moreover, elemental analysis by XRF shows that they facilitate the separation of fibers by damaging pectins in surface. Moreover, the weak natural connections between the fibers assumed by pectins are replaced by fiber-matrix interface bonding. Elemental analysis by XRF shows also that alkali pretreatments decrease the properties of elementary fibers by damaging polysaccharides in surface.

The competition between all the effects is in favor to amelioration of reinforcement/matrix interface. The best results in mechanical properties and water sorption resistance are achieved with mercerization and bleaching pretreatments. Unlike leaching pretreatment, the hydroxyl groups on flax fiber surface are activated which allows further increasing of fiber-matrix interaction.

In contrast, the weakest performances are achieved with composite made from a fabric of short fiber leached yarns. In this case, even if leaching treatment is efficient to improve interface bonding, it is not sufficient to offset the decrease in fiber mechanical properties.

FIG. 1 . 2 ID:

 12 FIG. 1. Optical photography of flax yarn and twill 2/2 fabric made with flax yarn: (a) flax yarn and (b) flax woven. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.] AQ4

  F3 3b)[START_REF] Cherif | [END_REF].SEM Observations. Section and fracture surfaces of composite specimens were observed by means of a scanning electron microscope. Before observations, surfaces are gold-coated in a sputtering chamber (Cressington Carbon Coater 208) to improve composite electrical conductivity and to limit electrical charging. The thickness of the gold coating was about 40 nm. Microscopic observations have been done at 25 kV with a Princeton Cambridge Gamma-Tech SEM.

FIG. 2 .

 2 FIG. 2. Volume fractions of flax/epoxy composites for different pretreatments: (a) reinforcement fraction and (b) porosity fraction.

F6 6 .

 6 FIG. 3. Typical stress-strain curve of 2/2 twill flax fabric-reinforced composite under tensile loading (untreated fabric): (a) used setup, E is the modulus, r u is the ultimate stress, e u is the ultimate strain and (b) tensile curve in warp and weft direction.

FIG. 6 .

 6 FIG. 6. Sorption curves showing moisture uptake at 20 C of flax/epoxy composite with different pretreatments. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.]

  warp 5 E L weft 5 E L layer ; E T warp 5 E T weft 5 E T layer ; m LT warp 5 m LT weft 5 m LT layer :

FIG. 10 .

 10 FIG. 10. Scanning electron micrograph of flax/epoxy composite: (a) untreated and (b) mercerized.

TABLE 1 .

 1 Details of the twill 2/2 fabrics used for the preparation of the composites.

				Stage:	Page: 3
		Basic weight,
	Product name	g f (g m 22 )	Fiber type	Pretreatment
	Untreated	300	Long fibers	No treatment
	Leached	277	Long fibers	Leaching of fabric with a detergent
	Mercerized	302	Long fibers	Mercerization of fabric with NaOH
	Bleached	267	Long fibers	Bleaching of fabric with H 2 O 2 and NaClO
	Leached yarns	316	Short fibers	Leaching of yarns with a detergent

J_ID: PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13 ID: muralir Time: 04:53 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172

TABLE 2 .

 2 Values of the diffusion mechanism constants n and k for flax/epoxy composites.

		n	k(h 2 )
	Untreated	0.533	0.0373
	Bleached	0.528	0.0268
	Mercerized	0.504	0.0297
	Leached	0.536	0.0318
	Leached yarns	0.562	0.0304

TABLE 3 .

 3 Values of diffusion, sorption and permeability coefficients for flax/epoxy composite. PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13

		Diffusion coefficient,	Sorption coefficient,	Permeability coefficient,
		D 3 10 7 (mm 2 s 21 )	S (g g 21 )	P 3 10 7 (mm 2 s 21 )
	Untreated	8.46	0.233	1.97
	Bleached	3.81	0.167	0.64
	Mercerized	3.75	0.157	0.59
	Leached	5.56	0.182	1.01
	Leached yarns	9.21	0.220	2.02

J_ID: ID: muralir Time: 04:54 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172

TABLE 4 .

 4 Results of elemental analysis by X-ray fluorescence and TGA.

	Fabric sample	Untreated	Leached	Leached yarn	Bleached	Mercerized
	XRF results
	C 1 H 1 O	99.603	99.425	99.229	99.133	99.158
	Na	0.025	0.027	0.021	0.036	0.024
	Mg	0.023	0.038	0.055	0.076	0.067
	K	0.008	0.011	0.012	0.014	0.010
	Ca	0.238	0.282	0.420	0.374	0.459
	Other	0.103	0.218	0.263	0.368	0.284
	TAG result
	Residue rate	0.5	0.596	0.796	0.978	0.748
	Water	4.2	4.3	4.0	4.3	4.5
	Residue rate 1 C 1 H 1 O	100.1	100.0	100.0	100.1	99.9
	Cation rate in equivalent charged (mequiv. g 21 )
	K2	3	3	4	3
	Na	11	12	9	16	10
	Mg	19	32	46	63	56
	Ca	119	141	210	187	230
	Total	151	187	268	270	298
	Ca/Mg	6.2	4.5	4.6	3.0	4.1

FIG. 8. Comparison between experimental and theoretical Fickian sorption curves for untreated and bleached pretreated flax-reinforced composite. [Color figure can be viewed in the online issue, which is available at wileyonlinelibrary.com.]

  a weft E T weft ÂÃ

	a warp 5	12	1 E T warp E L warp m 2 LT warp	; a weft 5	1 12 E T weft E L weft m 2 LT weft	;
	k G 5	n warp n warp 1 n weft
	(12)
	with

  a layer k G E L layer 1 12k G

	ðÞ E T layer ÂÃ	(16)
	with
	a layer 5	12	1 E T layer E L layer m 2 LT layer	(17)
	and
	a5	m 2 LT layer

TABLE 5 .

 5 Effective mechanical properties of flax yarn with different pretreatments. PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13

						Stage:	Page: 11
			Effective yarn stiffness (E r )			Effective yarn strength (r r )
		Autoclave	Hot platen press	mean	Autoclave	Hot platen press	mean
	Untreated	40.9 6 2.3	43.7 6 1.3	42.3 6 2.3	310 6 7	310 6 6	310 6 6
	Bleached	60.8 6 1.8	55.5 6 2.2	58.2 6 3.4	476 6 12	435 6 15	460 6 24
	Mercerized	52.4 6 0.9	50.1 6 1.7	51.2 6 1.7	440 6 7	405 6 21	423 6 24
	Leached	51.7 6 5.3	52.8 6 1.8	52.2 6 3.8	422 6 19	389 6 6	405 6 22
	Leached yarns	36.6 6 3.9	37.4 6 1.9	37 6 2.9	280 6 9	255 6 11	267 6 16

FIG. 9. Influence of pretreatments on the effective yarn properties, compared to untreated yarn. (a) Stiffness and (b) strength. J_ID: ID: muralir Time: 04:54 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172

POLYMER COMPOSITES-2013 DOI 10.1002/pc

J_ID: PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13 Stage: Page: 4 ID: muralir Time: 04:53 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172 4 POLYMER COMPOSITES-2013 DOI 10.1002/pc

POLYMER COMPOSITES-2013 DOI 10.1002/pc

J_ID: PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13 Stage: Page: 7 ID: muralir Time: 04:54 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172

POLYMER COMPOSITES-2013 DOI 10.1002/pc

J_ID: PC Customer A_ID: PC22580 Cadmus Art: PC22580 Ed. Ref. No.: 12-1120.R2 Date: 9-July-13 Stage: Page: 9 ID: muralir Time: 04:54 I Path: N:/3b2/PC##/Vol00000/130172/APPFile/JW-PC##130172

POLYMER COMPOSITES-2013 DOI 10.1002/pc

POLYMER COMPOSITES-2013 DOI 10.1002/pc

ACKNOWLEDGMENTS

LINEO NV Company is gratefully acknowledged for providing of all the prepregs. Claudine Morvan is warmly thanked for the very helpful discussion.