Researchers are tackling the significant challenge of implementing post-quantum cryptography in hardware, specifically focusing on the FrodoKEM key encapsulation mechanism. Kai Li, Jiahao Lu, and Fu Yao, alongside Guang Zeng, Dongsheng Liu, and Shengfei Gu, present a novel crypto-processor designed to overcome the high latency and resource demands currently hindering FrodoKEM’s practical deployment. Their work is particularly important as quantum computers develop, threatening current encryption standards, and FrodoKEM is a leading candidate for ISO standardisation. By employing techniques such as overlapped execution, a reconfigurable multiplier array, and compact memory scheduling, this design achieves a substantial improvement in area-time product , up to 2.00times better than existing implementations , paving the way for efficient and widespread adoption of post-quantum security.
FrodoKEM Hardware Acceleration via Overlapped Execution significantly improves
Scientists have developed a high-performance and efficient crypto-processor designed specifically for FrodoKEM, a lattice-based post-quantum key encapsulation mechanism poised for standardization by the International Organization for Standardization. This breakthrough addresses critical limitations in current hardware implementations of FrodoKEM, namely high latency and substantial resource consumption, paving the way for its practical application in secure communication systems. The research team achieved this by introducing a novel multiple-instruction overlapped execution scheme, enabling efficient scheduling of multi-module operations and minimising operational delays, a significant step forward in post-quantum cryptography hardware. Central to this innovation is a high-speed, reconfigurable parallel multiplier array, meticulously integrated to manage the intensive matrix computations inherent in FrodoKEM under diverse computational patterns.
This array substantially enhances hardware efficiency by eliminating the need for dedicated Digital Signal Processing (DSP) blocks through clever exploitation of sign extraction techniques. Furthermore, the researchers implemented a compact memory scheduling strategy, intelligently shortening the lifespan of intermediate matrices and dramatically reducing overall storage requirements, a crucial optimisation for resource-constrained devices. The resulting design fully supports all FrodoKEM security levels and protocol phases, offering unparalleled versatility. Implemented on an Artix-7 FPGA, the crypto-processor consumes 13467 Look-Up Tables (LUTs), 6042 Flip-Flops (FFs), and 14 Block RAMs (BRAMs), achieving the fastest reported execution time for FrodoKEM.
Detailed performance analysis reveals a remarkable improvement in the area-time product (ATP) ranging from 1.75 to 2.00times compared to existing state-of-the-art hardware implementations. This substantial gain in efficiency is a direct result of the combined innovations in execution scheduling, matrix multiplication, and memory management. Experiments show that the overlapped execution scheme delivers at least a 1.65x speedup, while the compact memory scheduling strategy reduces BRAM usage by 30% compared to previous designs. The team’s work not only advances the state-of-the-art in post-quantum cryptography hardware but also establishes a foundation for deploying secure, efficient, and versatile cryptographic solutions in a world increasingly vulnerable to quantum computing threats. This research opens exciting possibilities for securing critical infrastructure, protecting sensitive data, and ensuring the long-term integrity of digital communications.
FrodoKEM Acceleration via Overlapped Execution and Parallel Multipliers
Scientists engineered a high-performance cryptographic processor for the FrodoKEM key encapsulation mechanism, addressing limitations in latency and resource usage. The research team introduced a multiple-instruction overlapped execution scheme to optimise multi-module scheduling and minimise operational latency during key generation and encapsulation. This innovative approach enables concurrent processing of different FrodoKEM modules, significantly accelerating the overall computation. Furthermore, the study pioneered a high-speed, reconfigurable parallel multiplier array to efficiently handle intensive matrix computations inherent in FrodoKEM’s lattice-based cryptography.
The core of the methodology involved constructing a system capable of supporting all FrodoKEM levels and protocol phases, demonstrating comprehensive functionality. Researchers implemented a compact memory scheduling strategy, shortening the lifespan of intermediate matrices and thereby reducing overall storage requirements, a critical optimisation for hardware implementations. The team employed SHAKE, a cryptographic hash function, to derive seeds and generate hash digests, ensuring strong security and enabling a unified hash-based implementation. Specifically, the expanded output stream from SHAKE was parsed to construct the matrix A over Zq, a fundamental step in the FrodoKEM process.
Experiments employed a cumulative distribution function (CDF) based sampling method to produce samples from the discrete error distribution χ, mapping uniformly distributed values from SHAKE to integer error samples bounded by the parameter d. The function Sample generated the secret matrix S and error matrices E, S′, E′, and E′′, crucial for establishing secure keys. Encoding and decoding functions were developed to convert between binary messages and n × n matrices with elements over Zq, utilising a bit width B, which varied between 2, 3, and 4 depending on the selected security level, with n fixed at 8 resulting in message lengths of 64B bits. The study detailed three core algorithms: KeyGen, Encaps, and Decaps, each meticulously designed and optimised for hardware implementation.
KeyGen first derived seedA using SHAKE and generated matrix A, then sampled S and E from seedSE using Sample, computing B = AS + E mod q, a computationally intensive step. Encapsulation began by hashing the public key and deriving a fresh sampling seed, generating ephemeral matrices S′, E′, and E′′, and computing ciphertext components, with B′ = S′A + E′ dominating the cost. Decapsulation involved computing M = C − B′S, recovering the message u′ using Decode, and performing a ciphertext consistency check to ensure security against chosen-ciphertext attacks. The resulting design consumed 13467 LUTs, 6042 FFs, and 14 BRAMs on an Artix-7 FPGA, achieving the fastest reported execution time and improving the area-time product (ATP) by 1.75-2.00times compared to state-of-the-art implementations.
FrodoKEM Crypto-processor Design and FPGA Implementation
Scientists have developed a high-performance and efficient crypto-processor for the FrodoKEM lattice-based key encapsulation mechanism, addressing limitations in hardware implementation such as high latency and resource burden. The research team introduced a multiple-instruction overlapped execution scheme, enabling efficient multi-module scheduling and minimising operational latency during cryptographic processes. Furthermore, a high-speed, reconfigurable parallel multiplier array was integrated to handle intensive matrix computations, significantly enhancing hardware efficiency across diverse computation patterns. Experiments revealed the design consumes 13467 LUTs, 6042 FFs, and 14 BRAMs when implemented on an Artix-7 FPGA.
Measurements confirm the proposed crypto-processor achieves the fastest reported execution time for FrodoKEM, providing full support for all security levels and protocol phases. The team employed a compact memory scheduling strategy, shortening the lifespan of intermediate matrices and reducing overall storage requirements by 30% compared to prior designs. Interleaved and ping-pong access techniques were adopted to sustain high throughput, optimising data flow within the system. Results demonstrate a substantial improvement in area-time product (ATP), achieving gains of 1.75 to 2.00times compared with state-of-the-art hardware implementations.
The breakthrough delivers a 6%-16% reduction in execution time, showcasing the effectiveness of the optimised architecture. Scientists recorded that the design utilises 6609 equivalent slices, demonstrating a balance between performance and resource utilisation. By exploiting sign extraction, the team eliminated the need for DSP blocks, further enhancing hardware efficiency and reducing complexity. Tests prove the multiple-instruction overlapped execution scheme achieves at least a 1.65x speedup by enabling overlapped execution of independent operations. Data shows the reconfigurable parallel multiplier array effectively handles intensive matrix computations, adapting to versatile operation patterns without performance degradation. This work represents a significant step towards practical post-quantum cryptography standardization, aligning with the inclusion of FrodoKEM in the revision of ISO/IEC 18033-2 by the International Organization for Standardization. The research paves the way for secure communication protocols resilient to both classical and quantum attacks.
FrodoKEM Acceleration Via Overlapped Execution
Scientists have developed a high-performance cryptographic processor for FrodoKEM, a lattice-based key encapsulation mechanism considered for standardization. This new design addresses limitations in existing hardware implementations, specifically high latency and substantial resource requirements, which previously hindered practical application. The research introduces a multiple-instruction overlapped execution scheme to optimise multi-module scheduling and minimise operational latency, alongside a reconfigurable parallel multiplier array to accelerate intensive matrix computations. Furthermore, a compact memory scheduling strategy reduces storage demands by shortening the lifespan of intermediate matrices, supporting all FrodoKEM security levels and protocol phases.
Implemented on an Artix-7 FPGA, the processor consumes 13467 LUTs, 6042 FFs, and 14 BRAMs, achieving a faster execution time than current state-of-the-art designs, improving the area-time product by 1.75 to 2.00times. The authors acknowledge that overall execution time is still limited by parallelism in large matrix operations and that their hardware isn’t optimised for the highest operating frequencies. Future work will concentrate on refining specific instruction designs and integrating the processor more closely with RISC-V processors, potentially leading to even greater efficiency and broader applicability.