Post-Quantum cryptography (PQC) typically requires more memory and computational power than conventional public-key cryptography. Until now, most active research in PQC optimization for embedded devices has focused on 32-bit and 64-bit ARM architectures, specifically Cortex-M0/M3/M4 and ARMv8. To enable a smooth migration of PQC algorithms in Internet of Things environments, optimization research is also required for devices with lower computational capabilities. To address this gap, we present the optimized implementation methodologies of CRYSTALS– Kyber and CRYSTALS–Dilithium, the National Institute of Standards and Technology (NIST) standardized key-encapsulation mechanism (KEM) and digital signature algorithm (DSA) on a widely used 16-bit MSP430 microcontroller. We review the current state-of-the-art implementation methodologies for Keccak, Kyber, and Dilithium, and carefully redesign them to suit the MSP430 architecture. For Number-Theoretic Transform (NTT)-based polynomial multiplication, we redesign optimal modular arithmetic, layer merging, and point-wise multiplication by taking full advantage of the characteristics of the MSP430. As a result, compared with the reference implementations in C, the optimized 16-bit NTT achieves performance improvements of 134%, 249%, and 210% for NTT, NTT−1, and point-wise multiplication, respectively, while the optimized 32-bit NTT achieves performance improvements of 91%, 96%, and 56% for NTT, NTT−1, and point-wise multiplication, respectively. Furthermore, for Keccak, we propose twisting and zig-zag techniques tailored to the MSP430, aimed at optimizing memory accesses. As a result, compared with the reference implementation in C, the optimized Keccak achieves a performance improvement of 57%. Moreover, compared with the reference implementations in C, our Kyber and Dilithium implementations achieve 46.1%–51.3%, 45.6%–60.0%, and 46.2%–62.3% for key generation (KeyGen), encapsulation (Encaps), and decapsulation (Decaps), respectively, and 44.5%–48.3%, 57.5%–65.0%, and 46.1%–50.0% improvements for KeyGen, signing (Sign), and verifying (Verify), respectively.

ML-KEM (FIPS203) and ML-DSA (FIPS204) were two of the first post quantum cryptography schemes to be standardized by the National Institute of Standards and Technology; Both CRYSTALS algorithms utilize modulo reduction, specifically Montgomery reduction. Montgomery reduction traditionally is suited to computing moduli much larger than 32/64-bits and as such, the introduction of a new modulo reduction method published by Thomas Plantard allows for more efficient modulo reduction than Montgomery and Barrett as this new method allows for one less multiplication at the reduction stage. This is achieved by doubling the word size of the values being calculated, meaning the word size of data computed within CRYSTALS-Dilithium doubles from 32-bit to 64-bit and from 16-bit to 32-bit for CRYSTALS-Kyber. In this paper we present the worlds first Plantard ISEs ever that can compute both CRYSTALS-Kyber and CRYSTALS-Dilithium. Utilizing Plantard reduction as a set of Instruction Set Extensions, we are able to reduce the cycle counts required to compute the entire CRYSTALS-Kyber algorithm by up to 19.5% and reduce the cycle counts required to compute CRYSTALS-Dilithium by 26.6% as well as the CRYSTALS-Kyber INTT by 2.66x and the CRYSTALS-Dilithium INTT by 2.42x.

CRYSTALS-Kyber (FIPS203) was one of the first post quantum cryptography schemes to be standardized by the National Institute of Standards and Technology; CRYSTALS-Kyber utilizes Montgomery reduction at the heart of the modulo reduction. Montgomery reduction traditionally is suited to computing moduli much larger than 32/64-bits. Recently a new modulo reduction method was published named Plantard reduction which allows for one less multiplication at the reduction stage. However, this does require doubling the word size of the values being calculated, in the case of CRYSTALS-Kyber increasing from 16-bit to 32-bit. In this paper we present the worlds first Plantard ISE on the Ibex RISC-V core and investigate the impact Instruction Set Extensions can have utilizing this new modulo reduction method over original methods such as Montgomery and Barrett reduction. Utilizing Plantard reduction as a set of Instruction Set Extensions, we are able to reduce the cycle counts required to compute the entire CRYSTALS-Kyber algorithm by up to 21% and reduce the cycle counts of the NTT by 1.7x and the INTT by 2.6x against the reference implementation.

This work presents an area-efficient hardware-software co-design approach to accelerate the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) post-quantum cryptographic standard on the Ibex RISC-V core. We propose six custom instructions and a specialized accelerator targeting two primary bottlenecks in ML-KEM: the finite field arithmetic (Montgomery multiplication and Barrett reduction) and the Number Theoretic Transform (NTT) butterfly operation. We introduce a novel software-driven memory optimization that packs two 16-bit coefficients into a single 32-bit register, reducing memory transactions by 43% per pass. The RISC-V Instruction Set Extensions (ISE) accelerator, called RV-KEM, is supported by a unified hardware accelerator datapath; the proposed extensions achieve a 3.90× and 4.23× speedup for NTT and INTT operations, respectively. Implementation on an Artix-7 FPGA demonstrates a speedup-to-area efficiency of 9.8, representing a 10.5% improvement over the current state-of-the-art, making it suitable for resource constrained environments.

CRYSTALS-Dilithium serves as the foundation of the NIST-standardised PQC digital signature scheme, and has been declared as the first recommended digital signature algorithm. However, due to the computational complexity and intricate processing flow of CRYSTALS-Dilithium, two limitations are shown in existing methods: its applicability on resource-constrained devices is limited and the performance reported so far remains relatively low. This paper presents a lightweight yet high-performance hardware architecture that optimises the core computational units of CRYSTALS-Dilithium. First, an iterative dual-Keccak SHA-3 module is proposed, where two cores operate with a 26-cycle offset to accelerate processing without compromising frequency. In addition, the rejection sampler is streamlined by two compact registers for intermediate values and counters, improving efficiency when consuming interleaved SHA-3 outputs. Second, for small bit-width polynomials, we eliminate the first NTT stage via lookup tables and data regrouping, reducing NTT cycles by 11.7% with little hardware overhead. Further hardware savings are achieved by maximising IP core utilisation and simplifying input multiplexers. Furthermore, a compact scheduling strategy ensures that all intermediate storage fits within a single polynomial-sized memory block. On Xilinx Artix-7 FPGAs, the design reduces hardware overhead by 14.2% compared with state-of-the-art lightweight implementations. Across three security levels, KeyGen and Verify are 27.3% and 13.5% faster, respectively, than high-performance prior designs. At level 5, the best-case Sign latency is only 120 & micro;s.

The iterative forward and inverse number theoretic transform (NTT) is a key component in lattice-based post-quantum cryptography (PQC), typically implemented using Cooley-Tukey and Gentleman-Sande butterfly units. Existing iterative NTT accelerators often rely on ping-pong memory schemes and large memory blocks tied to the cyclotomic ring, which limits overall efficiency. To overcome this, we propose a memory-parallelization strategy using four smaller n/4-sized memories for ring size n, preserving the total memory footprint of conventional designs. We also introduce a multiplication-free rescaling architecture for the inverse NTT. Building on these innovations, we perform a comprehensive hardware-based design space exploration of unified Cooley-Tukey and Gentleman-Sande butterfly units, evaluating both coarse- and fine-grained pipelining strategies. The resulting optimized butterfly unit forms the core of our proposed pipelined and memory-parallelized NTT accelerator, "PIP-NTT". It integrates two such units alongside the memory-parallelization scheme to boost computational throughput under tight area constraints. Experimental results on FPGA platforms show that PIP-NTT achieves 2.67x and 1.48x higher efficiency in average Area-Time Product compared to the most area-optimized and high-speed NTT accelerators in the literature. The design is scalable across butterfly radices and adaptable to other PQC schemes, making it a versatile solution for future cryptographic hardware

Satellite communication networks play a critical role in providing connectivity to remote regions and areas with limited infrastructure. However, their inherently open nature and physical exposure make them particularly susceptible to security threats, including replay, impersonation, and man-in-the-middle attacks. The emergence of quantum computing further undermines the robustness of conventional cryptographic schemes that rely on number-theoretic assumptions. To mitigate these challenges, this article proposes HBQS , a lightweight Post-Quantum authentication framework designed for satellite platforms with limited resources. HBQS integrates physically unclonable functions (PUFs) with hash-based cryptography, leveraging SPHINCS+ digital signatures and SHA-3 hashing to provide secure mutual authentication and session key establishment. The protocol HBQS was implemented and evaluated on embedded hardware platforms, including Raspberry Pi 4.0, PYNQ-Z2 FPGA, and a Dell ground control station. The experimental results demonstrate that HBQS achieves mutual authentication in 0.88 ms, offering an approximately 67% reduction in execution time compared to representative baselines from the prior literature. Entropy analysis confirms that the proposed protocol maintains a high entropy across critical components, with HBQS achieving a signature entropy of 164.63 bits and PUF response entropy of 172.58 bits, indicating strong resistance to statistical and modeling attacks. A formal security analysis conducted within the random oracle model (ROM) demonstrates semantic security against both classical and quantum adversaries. The protocol HBQS shows a significant improvement over existing methods, achieving approximately 67% reduction in computational execution time, approximately 11.5% faster user-side handshake time, approximately 0.6% improvement on the satellite side, and full security coverage across all evaluated security features with only a 21.4% increase in static memory usage as the tradeoff. These findings position HBQS as an efficient, secure, and scalable authentication solution for next-generation satellite communication systems operating in the Post-Quantum era.

The Number Theoretic Transform (NTT) and its inverse (INTT) are pivotal operations in Fully Homomorphic Encryption (FHE) schemes to facilitate efficient polynomial multiplication over modular rings. We propose a compact and hardware-efficient NTT/INTT architecture for FHE systems with a novel twiddle factor generator (TFG) for Radix-2 multi-path delay commutator (MDC) designs, saving up to 97.2% of on-chip memory by storing the twiddle factors (TF) for the initial 11 stages (for log(2)(N)=15 to 17) and only the TF bases for on-the-fly generation in the remaining stages. DSP-efficient multipliers via non-standard tiling are designed to reduce DSP utilization as compared to standard tiling, without sacrificing performance. Benchmarking on comparable Xilinx FPGAs reveals that our design is the most compact, along with a significant efficiency advantage with up to 2.72 x reduction in average area-time product (ATP) and up to 2.57x increase in throughput-per-equivalent-LUT (TPE) compared to state-of-the-art NTT designs. In various configurations, the architecture maintains lower BRAM and DSP utilization, and better overall efficiency, making it a scalable and efficient solution for real-world FHE deployments.

CRYSTALS-Kyber, officially standardized by the U.S. National Institute of Standards and Technology (NIST) in August 2024 as ML-KEM FIPS, is the only post quantum secure key encapsulation mechanism (KEM) standard. Due to its inherent computationally intensive nature, mapping it on lightweight IoT devices is often a struggle. This study examines the replacement of the Keccak hashing function in Kyber-KEM with the NIST LWC competition winner called Ascon hash function. We compare speed/ memory improvement by executing Kyber-KEM-Ascon on an ARM Cortex M4 device and present novel benchmarking results; Kyber-KEM-Ascon shows about 25% reduction in clock cycles, along with lower memory usage requirements (about 8%). These results suggest that Kyber-KEM-Ascon is more suited for lightweight platforms, offering benefits for IoT security applications.

CRYSTALS family of Kyber key encapsulation mechanism and Dilithium digital signature algorithm are the first post quantum cryptography schemes standardized recently by the National Institute of Standards and Technology; numerous endeavours to accelerate them via instruction set extensions using the RISC-V instruction set architecture have been reported. Many of them focus on accelerating the costly Number Theoretic Transform and its inverse, either solely on CRYSTALS-Kyber or as part of greater lattice-based cryptography improvements. In this work, we demonstrate that by only one unified tightly coupled Instruction Set Extension for the Montgomery reduction operation, we improve the NTT/INTT cycle counts of CRYSTALS-Kyber by 1.69x/1.47x respectively and by 2.12x/2.36x in CRYSTALS-Dilithium respectively while costing a minimal additional hardware overhead on the Ibex RISC-V core implemented on an AMD Xilinx Artix-7 xc7a35tcsg324-1 device. Additionally, we also benchmark the NTT/INTT ISE in CRYSTALS-Kyber evaluating diminishing returns vs. the additional hardware cost induced.

We demonstrate a template power side channel attack that recovers the full secret key on an implementation of a radix- 2 Decimation in Time Fast Fourier Transform (DIT-FFT) optimised Toeplitz Hashing based privacy amplification, commonly used in quantum key distribution. The duration of the attack is linear in time with respect to the input key length when the target platform is an ARM Cortex-M4 and is successful with a single power trace. We demonstrate that key leakage is present in an Artix-7 FPGA power trace, but high noise makes a single trace attack difficult.

The lattice-based Raccoon scheme is one of the candidates in Round 1 of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) additional digital signatures standardization process. As a scheme with built-in masking features, Raccoon is also a viable candidate for NIST’s Masking Circuit and Threshold Cryptography project. Current Raccoon implementations are limited to software or software-hardware co-designs only and consequently lacking in terms of high throughput performance that hardware implementations can generally promise. To achieve this, we are the first to propose a configurable and high-performance pure hardware architecture for Raccoon. The proposed FPGA architecture features extensive optimizations in key modules for Raccoon such as the modular reduction, polynomial operations, and sampling. The segmentation and loop-based scheduling scheme interacts with the defined BRAM-based memory access pattern to ensure efficient and coherent data flow under the three security levels and two masking modes (non- and first-order masking). Implementation results of Raccoon on an AMD Artix- 7 FPGA device show that our proposed architecture achieves a 1.4–2.1x speedup compared to software implementations and a 20–42x speedup compared to softwarehardware co-designs for the three security levels, despite its hardware area being comparable to that of the lightweight CRYSTALS-Dilithium architecture. Finally, a TVLA test is demonstrated on Raccoon-128 with non-masking and first-order masking to evaluate its resilience to side-channel attacks.

Post-quantum multivariate public key cryptography (MPKC) schemes resist quantum threats but require heavy operations, such as rejection sampling, which challenge resource-limited devices. Prior hardware designs have addressed various aspects of MPKC signature generation. However, rejection sampling remains largely unexplored. This paper presents RejSCore, a lightweight hardware accelerator for rejection sampling in post-quantum cryptography. It targets the QR-UOV scheme, which is a prominent candidate under the second-round of the National Institute of Standards and Technology (NIST) additional digital signature standardization process. The architecture includes an AES-CTR-128-based pseudorandom number generator. Moreover, a lightweight iterative method is employed in rejection sampling, offering reduced resource consumption and area overhead while slightly increasing latency. The performance of RejSCore is comprehensively evaluated on Artix-7 FPGAs and 65nm CMOS technology using the Area-Delay Product (ADP) and Power-Delay Product (PDP). On Artix-7 and 65nm CMOS, RejSCore achieves an area of 2042 slices and 464,866 mu m(2), with operating frequencies of 222MHz and 565 MHz, respectively. Using the QR-UOV parameters for security level I (q = 127, v = 156, m = 54, l = 3), the core completes its operation in 8525 clock cycles. The ADP and PDP evaluations confirm RejSCore's suitability for deployment in resource-constrained and security-critical environments.

With the emergence of blockchain and smart contracts, traditional digital applications 1 such as identity management, supply chain management, banking and finance etc. are expected 2 to be transformed into Decentralized Applications (DApps). Blockchain interoperability is a new 3 and exciting aspect of blockchain technology that is quickly gaining popularity in many industries. 4 However, the widespread use of blockchains has not yet been achieved because DApps running on the 5 blockchain using smart contracts require access to authentic off-chain data. Users are more conscious 6 of their personal data privacy and consequently are more reluctant to share their data, posing a 7 challenge in the adoption of DApps. To solve this challenge, we present a novel quantum-resistant, 8 data authentication and zero-knowledge proof scheme named zk-DASTARK. Based on our proposed 9 scheme, we present a novel framework which can be used to feed authenticated off-chain data to 10 DApps without compromising user data privacy. Our proposed framework is quite efficient against 11 well-known off-chain data authentication frameworks. The proposed framework is implemented on 12 state-of-the-art quantum-resistant IOTA Blockchain and is highly efficient as it takes approximately 13 60 ms to generate a proof and approximately 10 ms to verify a proof.

This work presents a complete mathematical model of a novel cryptanalytic attack that combines the Cascade error correction leakages with the side channel information leakage to construct a more powerful attack than either of these two launched alone. We find that a higher Quantum Bit Error Rate (QBER) leaves Cascade more vulnerable to reliable information being extracted from side channel leakage and as such, reliable complete key recovery. For a key length of 1024 bits and QBER of 0.2, on any device where the ratio between the difference of noiseless power consumption levels of an XOR function outputting 0 or 1, and power consumption noise, is greater than 1.7, a full key recovery is expected. For lower QBER, we see that for the ratio of the difference of noiseless power consumption and power consumption noise must higher in order to successfully recover the key.

The Module-Lattice-Based Key encapsulation Mechanism (ML-KEM) scheme, which is currently being standardised, is a quantum attack resistant KEM that is based on CRYSTALS-Kyber. CRYSTALS-Kyber is the only Public-key Encryption (PKE)/ KEM scheme selected in the first set of successful candidates as part of the NIST initiated Post-Quantum Cryptography (PQC) process. ML-KEM scheme includes three different security levels, namely security level 1, 3, and 5. In this research, we propose a highly area-time efficient hardware ML-KEM architecture. The architecture comprises three computational layers. The first layer comprises a hash and sampling module; the second layer includes a number theoretic transform (NTT), its inverse (INTT) and a point-wise multiplication (PWM) module; and the third layer comprises addition, compressing and encoding. Intra-layer pipelining and out-of-layer scheduling ensures that either layer 1 or layer 2 operate in the shortest time. In the reduction module, we propose a novel hybrid architecture to obtain the final result within 2 cycles with low area consumption. In the NTT module, the PWM pipelining method is modified and an optimised iterative FIFO access method is adopted to reduce the size of FIFO units by 55% over previous research. Look-up tables are also used to replace the first-stage of the NTT to reduce 8 cycles. Furthermore, the memory unit uses only FIFOs, the size are optimised based on the requirements of the most resource-intensive function in ML-KEM (ML-KEM.CPA.Dec). The results show that the proposed architecture has a 48.2%, 41.2%, and 78.1% reduction in computational time in comparison to previous work for security levels 1, 3, and 5, respectively. In addition, the area of proposed optimised ML-KEM designs is reduced by 73%, 70%, 76% and resulting in an improved area-time (AT) product of 15.8%, 10.7%, and 11.3%, for the Level 1, 3, and 5 security levels respectively, compared with state-of-the-art designs.

This study evaluates the trade-offs between area, time, and power in an FPGA-based Number-Theoretic Transform (NTT) hardware accelerator designed for post-quantum cryptography (PQC) applications. Using CRYSTALS-Dilithium parameters as a case study, the proposed architecture integrates Cooley-Tukey and Gentleman-Sande configurations to optimize computational efficiency. A Barrett-based modular reduction enhances power efficiency, while an iterative transformation method minimizes hardware area. Performance analysis on the Artix-7 FPGA in two frequency ranges (10–40MHz and 100–250MHz) demonstrates a balanced trade-off between area-time product and power-performance-area efficiencies. The results highlight the accelerator’s suitability for energy-conscious edge computing and high-throughput cryptographic applications, making it a viable solution for PQC implementations that require optimized resource utilization.

CRYSTALS-Kyber is the only Public-key Encryption (PKE)/ Key-encapsulation Mechanism (KEM) scheme that was chosen for standardization by the National Institute of Standards and Technology initiated Post-quantum Cryptography competition (so called NIST PQC). In this paper, we show the first successfully malicious modifications of the bitstream of a Kyber FPGA implementation. We successfully demonstrate 4 different attacks on Kyber hardware implementations on Artix-7 FPGAs that either reduce the complexity of polynomial multiplication operations or enable direct secret key/ message recovery by: disabling BRAMs, disabling DSPs, zeroing NTT ROM and tampering with CBD2 results. Two of our attacks are generic in nature and the other two require reverse-engineering or a detailed knowledge of the design. We evaluate the feasibility of the four attacks, among which the zeroing NTT ROM and tampering with the CBD2 result attacks produce higher public key and ciphertext complexity and thus are difficult to be detected. Two countermeasures are proposed to prevent the attacks proposed in this paper.

Quantum key distribution (QKD) and post-quantum cryptography (PQC) are the two counter measures against cryptographic attacks via quantum computing. While QKD offers information theoretic security but limited authentication scalability, PQC facilitates scalable authentication in high density networks but is not information theoretic secure. Therefore, an ideal quantum-safe framework should efficiently leverage the complementarity of both techniques. However, despite growing efforts in integrating both, current realizations have focused on channel authentication, and a complete cryptosystem addressing both hybrid authentication and hybrid key exchange is yet to be demonstrated. Here, an authenticated hybrid key exchange protocol is introduced that incorporates PQC and QKD in a modular and information-theoretic secure architecture. The quantum-safe protocol is inherently resilient to catastrophic cryptographic failures and provides both forward and post-compromise security. As proof-of-concept implementation, the cryptosystem on a QKD hardware prototype is integrated, with the QKD processing, PQC key exchange and secret state masking via physical unclonable functions (PUFs) all running on a single field programmable gate array (FPGA). This work paves the way for the deployment of versatile and modular quantum-safe networks that exploit the complementarity of PQC and QKD. By leveraging the complementarity of Quantum, Post-Quantum, and Classical Cryptography, the authors design a modular Hybrid Authenticated Cryptosystem with advanced features of forward security and post-compromise security. In its optimal instantiation, the protocol is information theoretic secure for both authentication and key exchange. A proof-of-concept implementation is provided experimentally using a commercial-grade QKD system, where the post-quantum KEM algorithm is implemented in hardware on the same FPGA that runs the QKD functions. image