RISQ-V: Tightly Coupled RISC-V Accelerators for Post-Quantum Cryptography

Post-quantum cryptography is considered to provide security against both traditional and quantum computer attacks. Dilithium is a digital signature algorithm that derives its security from the challenge of finding short vectors in lattices. It has been selected as one of the standardizations in the NIST post-quantum cryptography project. Hardware-software co-design is a commonly adopted implementation strategy to address various implementation challenges, including limited resources, high performance, and flexibility requirements. In this study, we investigate using compact instruction set extensions (ISEs) for Dilithium, aiming to improve software efficiency with low hardware overheads. To begin with, we propose tightly coupled accelerators that are deeply integrated into the RISC-V processor. These accelerators target the most computationally demanding components in resource-constrained processors, such as polynomial generation, Number Theoretic Transform (NTT), and modular arithmetic. Next, we design a set of custom instructions that seamlessly integrate with the RISC-V base instruction formats, completing the accelerators in a compact manner. Subsequently, we implement our ISEs in a chip design for the Hummingbird E203 core and conduct performance benchmarks for Dilithium utilizing these ISEs. Additionally, we evaluate the resource consumption of the ISEs on FPGA and ASIC technologies. Compared to the reference software implementation on the RISC-V core, our co-design demonstrates a remarkable speedup factor ranging from 6.95 to 9.96. This significant improvement in performance is achieved by incorporating additional hardware resources, specifically, a 35% increase in LUTs, a 14% increase in FFs, 7 additional DSPs, and no additional RAM. Furthermore, compared to the state-of-the-art approach, our work achieves faster speed performance with a reduced circuit cost. Specifically, the usage of additional LUTs, FFs, and RAMs is reduced by 47.53%, 50.43%, and 100%, respectively. On ASIC technology, our approach demonstrates 12, 412 cell counts. Our co-design provides a better tradeoff implementation on speed performance and circuit overheads.

Significant innovation has been made in the development of public-key cryptography that is able to withstand quantum attacks, known as post-quantum cryptography (PQC). This paper focuses on the development of an efficient PQC hardware implementation. Specifically, an implementation of the binary Ring-learning-with-errors (BRLWE)-based encryption scheme, a promising lightweight PQC suitable for resource-constrained applications, is proposed. The paper first develops the mathematical formulation to present the proposed algorithmic process. The corresponding hardware accelerators are then described in detail. Finally, comparisons with previous implementations are provided to demonstrate the superior performance of the proposed design. For instance, the proposed low-complexity accelerator has 34.7% less area-delay product (ADP) than the state-of-the-art design for <inline-formula><tex-math notation="LaTeX">$n=256$</tex-math></inline-formula> in the field-programmable gate array (FPGA) platform. Apart from the efficiency of the hardware architectures, the proposed design also has a complete input/output processing setup, and thus is feasible for emerging lightweight applications.

The emergence of quantum computing seriously threatens the security of legacy cryptographic protocols in consumer electronics devices based on the Internet of Things (IoT). These are essential components of mission-critical infrastructures, such as industrial control systems, smart grids, and healthcare. In particular, this work examines how to strengthen the resistance of the IoT to classical and quantum-based cyberattacks by combining deep learning methods with post-quantum cryptography (PQC). To protect key exchange, encryption, and authentication processes in IoT-consumer devices, we will continue to use quantum-resistant cryptographic algorithms, including lattice-based, hash-based, and code-based cryptography. To provide real-time anomaly detection and response capabilities, we suggest a hybrid security framework combining PQC with deep learning-based intrusion detection systems. Our methodology ensures secure communications and data exchanges linked to quantum attacks in the future within IoT systems while leveraging continuous learning over time to allow Intrusion Detection System (IDS) models to adapt to new attack vectors. We suggest optimized algorithms for PQC solutions that are lightweight and suitable for deployment in edge computing nodes and Internet of Things devices, considering the resource-constrained IoT situations where PQC implementation would be difficult. Through comparative studies and simulations, we demonstrate how our integrated PQC-deep learning framework offers an improved IoT security solution that could safeguard vital systems in a world powered by quantum technology. The results shows the key generation time which is 12.5ms, encryption/decryption time 25.3ms, latency 18.7ms, throughput 5000 operations/sec and energy consumption 2.4mJ.

Ring-Learning-with-Errors (RLWE) has emerged as the foundation of many important techniques for improving security and privacy, including homomorphic encryption and post-quantum cryptography. While promising, these techniques have received limited use due to their extreme overheads of running on general-purpose machines. In this paper, we present a novel vector Instruction Set Architecture (ISA) and microarchitecture for accelerating the ring-based computations of RLWE. The ISA, named B512, is developed to meet the needs of ring processing workloads while balancing high-performance and general-purpose programming support. Having an ISA rather than fixed hardware facilitates continued software improvement post-fabrication and the ability to support the evolving workloads. We then propose the ring processing unit (RPU), a high-performance, modular implementation of B512. The RPU has native large word modular arithmetic support, capabilities for very wide parallel processing, and a large capacity highbandwidth scratchpad to meet the needs of ring processing. We address the challenges of programming the RPU using a newly developed SPIRAL backend. A configurable simulator is built to characterize design tradeoffs and quantify performance. The best performing design was implemented in RTL and used to validate simulator performance. In addition to our characterization, we show that a RPU using 20.5mm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> of GF12nm can provide a speedup of 1485× over a CPU running a 64k, 128-bit NTT, a core RLWE workload.

The expansion of Internet of Things (IoT) ecosystems has created a high demand for secure cryptographic solutions, even in a future with quantum computing capabilities. Traditional mappings, such as RSA or Elliptic Curve Cryptography (ECC), are expected to be broken by Shor's algorithm, driving the realization of post-quantum cryptography (PQC). This work presents a simulative and prototypical framework for assessing PQC integration in IoT communication. With the liboqs library and NS-3 network simulator, along with the Python scripting language, we implement both NIST-standardized algorithms, such as Dilithium (for signatures) and Kyber (for key encapsulation), as well as the classical RSA and ECC baselines. IoT networks of 50-500 virtual nodes are simulated based on IEEE 802.15.4/6LoWPAN with RPL routing. Performance attributes, including encryption/decryption time, key length, packet delivery ratio, latency, and energy consumption, are collected and evaluated. Preliminary results indicate that PQC incurs additional handshake and key overhead, but is relatively practical, with an average overhead of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$15-25 ~\text{ms}$</tex> per processed secure transaction. The effort provides a replicable testbed, showcasing what we consider the best and worst PQC has to offer for resource-constrained IoT. Targeted at master's students and researchers, this book provides an applied approach to investigate quantum-resilient security in IoT. It encourages future expansion to hardware-in-the-loop validation on embedded devices.

This study examines the convergence of rapid Central Bank Digital Currency adoption and the growing threat that quantum computing poses to existing cryptographic systems. As digital sovereign currencies expand globally, with many economies actively exploring or piloting CBDCs, the vulnerability of classical public key cryptography to quantum attacks creates an urgent need for quantum resistant solutions. The research responds to this challenge by developing an evaluation framework focused on secure and interoperable cross border CBDC systems in a post quantum environment. Using desk based computational analysis and simulation methods suitable for remote researchers, the study evaluates lattice based algorithms standardized by the National Institute of Standards and Technology, specifically ML KEM for key encapsulation and ML DSA for digital signatures. The analysis confirms strong quantum resistance against known quantum algorithms, effectively removing harvest now decrypt later risks for future transactions. Interoperability assessments show that ISO 20022 with cryptographic abstraction is well suited for retail CBDC systems, while bridge based architectures such as BIS mBridge are more effective for wholesale settlements. Performance testing on thousands of simulated transactions indicates that post quantum protocols are feasible for wholesale use but introduce significant computational and bandwidth overheads that limit immediate retail scalability without hardware acceleration. Overall, the findings support a phased migration strategy that combines classical and post quantum cryptography in the near term, guided by cryptographic agility. The study provides practical insights for central banks seeking to balance security, efficiency, and cross border compatibility in an evolving quantum threat landscape.

The emergence of large-scale quantum computing presents an imminent threat to contemporary public-key cryptosystems, with quantum algorithms such as Shor’s algorithm capable of efficiently breaking RSA and elliptic curve cryptography (ECC). This vulnerability has catalyzed accelerated standardization efforts for post-quantum cryptography (PQC) by the U.S. National Institute of Standards and Technology (NIST) and global security stakeholders. While theoretical security analysis of these quantum-resistant algorithms has advanced considerably, comprehensive real-world performance benchmarks spanning diverse computing environments—from high-performance cloud infrastructure to severely resource-constrained IoT devices—remain insufficient for informed deployment planning. This paper presents the most extensive cross-platform empirical evaluation to date of NIST-selected PQC algorithms, including CRYSTALS-Kyber and NTRU for key encapsulation mechanisms (KEMs), alongside BIKE as a code-based alternative, and CRYSTALS-Dilithium and Falcon for digital signatures. Our systematic benchmarking framework measures computational latency, memory utilization, key sizes, and protocol overhead across multiple security levels (NIST Levels 1, 3, and 5) in three distinct hardware environments and various network conditions. Results demonstrate that contemporary server architectures can implement these algorithms with negligible performance impact (&lt;5% additional latency), making immediate adoption feasible for cloud services. In contrast, resource-constrained devices experience more significant overhead, with computational demands varying by up to 12× between algorithms at equivalent security levels, highlighting the importance of algorithm selection for edge deployments. Beyond standalone algorithm performance, we analyze integration challenges within existing security protocols, revealing that naive implementation of PQC in TLS 1.3 can increase handshake size by up to 7× compared to classical approaches. To address this, we propose and evaluate three optimization strategies that reduce bandwidth requirements by 40–60% without compromising security guarantees. Our investigation further encompasses memory-constrained implementation techniques, side-channel resistance measures, and hybrid classical-quantum approaches for transitional deployments. Based on these comprehensive findings, we present a risk-based migration framework and algorithm selection guidelines tailored to specific use cases, including financial transactions, secure firmware updates, vehicle-to-infrastructure communications, and IoT fleet management. This practical roadmap enables organizations to strategically prioritize systems for quantum-resistant upgrades based on data sensitivity, resource constraints, and technical feasibility. Our results conclusively demonstrate that PQC is deployment-ready for most applications, provided that implementations are carefully optimized for the specific performance characteristics and security requirements of target environments. We also identify several remaining research challenges for the community, including further optimization for ultra-constrained devices, standardization of hybrid schemes, and hardware acceleration opportunities.

Falcon, a NTRU-based digital signature algorithm, has been selected by NIST as one of the post-quantum cryptography (PQC) standards. Compared to verification, the signature generation of Falcon is relatively slow. One of the core operations in signature generation is discrete Gaussian sampling, which involves a component known as the BaseSampler. The BaseSampler accounts for up to 30% of the time required for signature generation, making it a significant performance bottleneck. This work aims to address this bottleneck.We design a vectorized version of the BaseSample and provide optimized implementations across six different instruction sets: SSE2, AVX2, AVX-512F, NEON, RISC-V Vector (RVV), and RV64IM. The AVX2 implementation, for instance, achieves an 8.4x speedup over prior work. Additionally, we optimize the FFT/iFFT operations using RVV and RV64D. For the RVV implementation, we introduce a new method using strided load/store instructions, with 4+4 and 4+5 layer merging strategies for Falcon-{512,1024}, respectively, resulting in a speedup of more than 4x. Finally, we present the results of our optimized implementations across eight different instruction sets for signature generation of Falcon. For instance, our AVX2, AVX- 512F, and RV64GCVB implementations achieve performance improvements of 23%, 36%, and 59%, respectively, for signature generation of Falcon-512.

The Module-Lattice-Based Key encapsulation Mechanism (ML-KEM) scheme, which is currently being standardised, is a quantum attack resistant KEM that is based on CRYSTALS-Kyber. CRYSTALS-Kyber is the only Public-key Encryption (PKE)/ KEM scheme selected in the first set of successful candidates as part of the NIST initiated Post-Quantum Cryptography (PQC) process. ML-KEM scheme includes three different security levels, namely security level 1, 3, and 5. In this research, we propose a highly area-time efficient hardware ML-KEM architecture. The architecture comprises three computational layers. The first layer comprises a hash and sampling module; the second layer includes a number theoretic transform (NTT), its inverse (INTT) and a point-wise multiplication (PWM) module; and the third layer comprises addition, compressing and encoding. Intra-layer pipelining and out-of-layer scheduling ensures that either layer 1 or layer 2 operate in the shortest time. In the reduction module, we propose a novel hybrid architecture to obtain the final result within 2 cycles with low area consumption. In the NTT module, the PWM pipelining method is modified and an optimised iterative FIFO access method is adopted to reduce the size of FIFO units by 55% over previous research. Look-up tables are also used to replace the first-stage of the NTT to reduce 8 cycles. Furthermore, the memory unit uses only FIFOs, the size are optimised based on the requirements of the most resource-intensive function in ML-KEM (ML-KEM.CPA.Dec). The results show that the proposed architecture has a 48.2%, 41.2%, and 78.1% reduction in computational time in comparison to previous work for security levels 1, 3, and 5, respectively. In addition, the area of proposed optimised ML-KEM designs is reduced by 73%, 70%, 76% and resulting in an improved area-time (AT) product of 15.8%, 10.7%, and 11.3%, for the Level 1, 3, and 5 security levels respectively, compared with state-of-the-art designs.

In today Internet era, confidential information transmitted over an insecure channel. With the significant development in the area of quantum computing, there is a need for unconditional security in confidential information. Quantum key distribution protocols are proven secure if all devices are perfect (in terms of technologies and proper protocol operations). The major challenges in quantum communication are secret key rate, distance, cost and size of QKD devices. The purpose of this survey article is to carry out a systematic review in the area of quantum cryptography by covering various aspects of non-deterministic quantum key distribution protocols, quantum secure direct communication, semi-quantum key distribution, secure multiparty communication protocol, post-quantum cryptography and device-independent cryptography techniques. In addition, we also discussed various experimental work carried out in the area of quantum cryptography, various attacks and challenges relative to the paradigm shift from classical cryptography to quantum cryptography. Quantum cryptography will become a future replacement of classical cryptography techniques after the development of the first physical quantum computer.

In Wireless Sensor Networks (WSNs), the presence of congestion can increase the ratio of packet loss, energy consumption and reduce of the network throughput. Especially, this situation will be more complex in Internet of Things (IoT) environments, which is composed of thousands of heterogeneous nodes. In this paper, we address the congestion problem between child and parent nodes in RPL-enabled networks, which typically consist of low power and resource constraint devices. We use game theory strategy to design a parent-change procedure which decides how nodes changing their next hop node toward sink to mitigate the effect of network congestion. Comparing to the Contiki RPL implementation, the simulation results show that our protocol can achieve more than twofold improvement in packet loss rate and throughput with similar average hop count.

Recent advances in different instruction set architectures (ISAs) and their implementations have revived the argument on the role of ISAs in the overall performance and energy efficiency of a processor. Many computer architects believe that with current compiler and microarchitecture developments, the choice of ISA is not a decisive matter anymore. On the other hand, some believe that ISAs can still play an important role in the overall performance and energy efficiency of a computer system. Our objective is to compare and contrast ISAs by finding the differences in performance and energy consumption across ISAs and the reasons behind those differences. Our work shows that ISAs affect the performance and energy efficiency of applications differently based on their inherent characteristics.

Post-quantum cryptography (PQC) is proposed to resist the attack of quantum computer. Among various PQC schemes, lattice-based cryptography depended on learning with errors (LWE) problem has attracted much attention. As one of the lattice-based PQC schemes, number theory research unit (NTRU) algorithm is flexible, simple and fast. In this paper, we propose a high-performance cryptographic processor towards NTRU. In the processor, we optimize instruction set architecture, which also saves memories. Three-level Karatsuba method is utilized to accelerate polynomial multiplication, and the computing time is reduced by 10x. Fixed and custom instructions are used to control the whole data path, with flexibility and high efficiency. Compared to other FPGA implementations, the results show this design performs the highest operating frequency of 200MHz, only consumes 28k look-up tables (LUTs). Besides, it has the shortest time of encryption, decryption and the best area-time product (ATP), which is 1.4x better than state-of-the-art work.

Hybrid key encapsulation is in the process of becoming the de-facto standard for integration of post-quantum cryptography (PQC). Supporting two cryptographic primitives is a challenging task for constrained embedded systems. Both contemporary cryptography based on elliptic curves or RSA and PQC based on lattices require costly multiplications. Recent works have shown how to implement lattice-based cryptography on big-integer coprocessors. We propose a novel hardware design that natively supports the multiplication of polynomials and big integers, integrate it into a RISC-V core, and extend the RISC-V ISA accordingly. We provide an implementation of Saber and X25519 to demonstrate that both lattice- and elliptic-curve-based cryptography benefits from our extension. Our implementation requires only intermediate logic overhead, while significantly outperforming optimized ARM Cortex M4 implementations, other hardware/software codesigns, and designs that rely on contemporary accelerators.

Side-channel attacks can break mathematically secure cryptographic systems leading to a major concern in applied cryptography. While the cryptanalysis and security evaluation of Post-Quantum Cryptography (PQC) have already received an increasing research effort, a cost analysis of efficient side-channel countermeasures is still lacking. In this work, we propose a masked HW/SW codesign of the NIST PQC finalists Kyber and Saber, suitable for their different characteristics. Among others, we present a novel masked ciphertext compression algorithm for non-power-of-two moduli. To accelerate linear performance bottlenecks, we developed a generic Number Theoretic Transform (NTT) multiplier, which, in contrast to previously published accelerators, is also efficient and suitable for schemes not based on NTT. For the critical non-linear operations, masked HW accelerators were developed, allowing a secure execution using RISC-V instruction set extensions. With the proposed design, we achieved a cycle count of K:214k/E:298k/D:313k for Kyber and K:233k/E:312k/D:351k for Saber with NIST Level III parameter sets. For the same parameter sets, the masking overhead for the first-order secure decapsulation operation including randomness generation is a factor of 4.48 for Kyber (D:1403k)and 2.60 for Saber (D:915k).