I. INTRODUCTION

As large-scale quantum computer development progresses ^[1], threats have been raised about the vulnerability of traditional public-key based cryptography. The National Institute of Standards and Technology (NIST) has been standardizing on post-quantum cryptography (PQC) (Fig. 1). After several rounds, in August 2023, NIST published the initial drafts (FIPS-203, FIPS-204, and FIPS-205) for PQC ^[2]. Two of them are ML-KEM and ML-DSA algorithms based on module learning with errors (MLWE), which are based on lattice-based cryptography that is robust against quantum attacks.

Because ML-KEM and ML-DSA require complex computations, their software implementation introduces a lot of latency. In particular, sampling based on cryptographically-secure pseudo random number generator (CS-PRNG) and number-theoretic transforms (NTT) based on modular arithmetic are very complex for microcontroller units (MCUs) to handle. To solve these problems, MLWE accelerator implementations on ASICs or FPGAs have been reported ^[3-6]. Especially considering that IoT devices are more vulnerable to security attacks, a compactly designed crypto processor is needed in the IoT environment.

The followings are the contributions of this work. 1) It reduces lots of latency of sampling and NTT operations by using parallel hardware structure. 2) A modular multiplier design optimized for the specific prime numbers of ML-KEM and ML-DSA. 3) This work supports both of number systems for ML-KEM and ML-DSA efficiently by using clock-gating method.

This work presents the fastest PQC crypto-processor that processes MLWE-based PQC algorithms ML-KEM and ML-DSA. It is implemented and estimated under 28nm CMOS technology @0.9V supply voltage. The estimation is done by using Synopsys Design Compiler syn_R-2020.09, IC Compiler 2020.09-SP1, Primetime prime-R-2020.09-SP1.

Fig. 1. A summary of PQC standardization

II. ARCHITECTURE

Fig. 2 shows the overall architecture of the proposed PQC processor. It consists of memory and operator modules for sampling and arithmetic.

The memory module has an instruction cache (2 KB), banks for polynomials (6 KB), and banks for twiddle factors (1.5 KB). 32-bit instructions can be stored in the instruction cache. The on-chip memory for 8 polynomials is required to process the PQC algorithms on chip. For each polynomial, a bank consists of 16 polynomial coefficient memories, enabling polynomial operations to be accelerated 16x faster. The twiddle factors stored in the twiddle banks are used in the NTT computation\textcolor{color-1}{.} We could reduce the size of ${\omega}$-bank by merging the NTT and multiplication by powers of ${\psi}$ (${\omega}$ = ${\psi}$$^{2}$).

The Arithmetic module performs the polynomial operations required by PQC. It handles modular arithmetic of polynomials, NTT operations, etc. Arithmetic Logic Elements (ALEs) array efficiently handle the operations, and each ALE contains necessary arithmetic units.

The Keccak-based CS-PRNG generates a random bitstream for sampling. The bitstream is passed through specific sampling algorithm filters to generate polynomial coefficients with a uniform, Gaussian distribution. With parallel structure of memory and sampling filters, the latency for sampling is reduced.

Fig. 2. Overall architecture of the proposed crypto-processor.

III. SAMPLER

In software implementation, sampling operations account for 70% of the computation latency ^[4]. Fig. 3 shows the architecture of the sampler module. CS-PRNG generates a random bitstream, and 5 different sampling filters produce polynomial coefficients with uniform or gaussian distribution.

Fig. 3. Block diagram of sampler module.

3. Evaluation

Fig. 4 and Table 1 show a comparison of the latency generated in sampling by the software and hardware implementations. When performing UR sampling, which consumes the most clock cycles in software implementation, the proposed work reduces the latency by 99% compared to software. For CBD and UE sampling, the latency reduction is 92% and 87% respectively. This improvement is achieved by implementing the efficient CS-PRNG hardware design and parallelization of the polynomial banks. The software benchmark is based on an Intel i7-7700 environment.

Fig. 4. Latency of sampler for ML-KEM-512 and ML-DSA-44.

Table 1. Clock cycles of sampling operations

Latency of Sampler
ML-KEM-512	Intel i7-7700	Intel i7-7700 (w/AVX2)	This work
UR (x4)	72,256	15,588	808
CBD (x1)	5,251	6,876	99
ML-DSA-44	Intel i7-7700	Intel i7-7700 (w/AVX2)	This work
UR (x16)	241,688	87,480	2,752
UE (x1)	4,850	2,934	155

IV. ARITHMETIC LOGIC ELEMENT ARRAY

Fig. 5 shows the structure of an ALE array. The ALE array consists of 32 ALEs. Each ALE contains an arithmetic, modular arithmetic, and logical arithmetic operator. All of 32 ALEs operates when the crypto-core processes NTT or INTT instructions. For modular multiplier, we implemented Barrett reduction as hardware.

Fig. 5. Block diagram of ALE array module.

1. Modular Multiplier

The modular multiplication is the heaviest part in the ALE. It involves arithmetic multiplication and calculating the remainder on the q values. To reduce the complexity of the operation, Montgomery, Barrett reduction, etc. are used. However, the reduction operation also requires high power consumption and latency.

On the other hand, modulo q of the PQC protocols is a fixed prime number. Under these conditions, Barrett reduction can be implemented through a simple algorithm (Fig. 6). We implemented the reduction using only a few adders, subtractors, and shifters.

Fig. 6. Block diagram of modular multiplier.

V. PARALLEL OPERATION AND CLOCK GATING

To reduce the execution time of the protocol, we designed the instructions that make the operation of the sampler and ALE array to be performed in parallel. We also reduced the power consumption of the ML-KEM by clock gating.

1. Parallel Operation

Depending on the order of the instructions, the sampler and ALE array can operate independently. If there is a situation where both sampling and NTT operations are required for independent polynomials, the latency can be reduced by performing the operations in parallel (Fig. 7).

Fig. 7. Effect of instruction for parallel operations.

2. Clock Gating

In the proposed implementation, both ML-KEM and ML-DSA are performed on the same hardware. In both of them, all operations are performed on the quotient ring, but modulo q values are different (3329 for ML-KEM and 8380417 for ML-DSA). Operating ML-KEM, about half of registers consume power just by clock network. We applied clock gating for removing the unnecessary power consumption. Fig. 8 shows a comparison of the power consumption of the ALE array when performing NTT operations on ML-KEM. The power consumption of ALE array is reduced by 16% by clock gating.

Fig. 8. Effect of clock gating.

VI. IMPLEMENTATION

The PQC processor is implemented on a 28 nm CMOS technology process using 9.5 KB of on-chip memory and 511.8k NAND gate equivalents. Fig. 9 shows the layout of the proposed design. Table 3 compares the performances with previous works. This implementation consumes 16~24 mW from a supply voltage of 0.9 V while processing ML-KEM-512 and ML-DSA-44. Compared to state-of-the-art ^[6], the implementation shows 2.91x and 2.62x higher power efficiency for ML-KEM-512 and ML-DSA-44, respectively.

Fig. 9. Layout of PQC processor.

V. CONCLUSIONS

This work proposes a hardware architecture for a PQC processor that supports ML-KEM and ML-DSA. The proposed design enables efficient modular multiplication using Barrett reduction, which is configurable specifically for the PQC algorithm. It also utilizes a parallel memory structure and a real-time sampler module. The architecture is implemented in 28nm CMOS technology. The proposed design uses the smallest on-chip memory and achieves 2.91x higher power efficiency compared to the previous state-of-the-art.