A High Performance and Efficient Post-Quantum Crypto-Processor for FrodoKEM

TL;DR

This work tackles FrodoKEM hardware latency and resource demands by introducing a high-performance crypto-processor that supports all security levels and protocol phases. It combines a multiple-instruction overlapped execution scheme with a reconfigurable parallel multiplier array and a compact memory scheduling strategy to accelerate the dominant LWE-based matrix multiplications while reducing intermediate storage. The design achieves ATP improvements of about $1.75$–$2.00$× and faster runtimes on FPGA platforms, while maintaining standard-compliant FrodoKEM functionality. These results demonstrate practical viability for PQC deployment in resource-constrained hardware and outline a scalable path toward flexible PQC accelerators.

Abstract

FrodoKEM is a lattice-based post-quantum key encapsulation mechanism (KEM). It has been considered for standardization by the International Organization for Standardization (ISO) due to its robust security profile. However, its hardware implementation exhibits a weakness of high latency and heavy resource burden, hindering its practical application. Moreover, diverse usage scenarios call for comprehensive functionality. To address these challenges, this paper presents a high-performance and efficient crypto-processor for FrodoKEM. A multiple-instruction overlapped execution scheme is introduced to enable efficient multi-module scheduling and minimize operational latency. Furthermore, a high-speed, reconfigurable parallel multiplier array is integrated to handle intensive matrix computations under diverse computation patterns, significantly enhancing hardware efficiency. In addition, a compact memory scheduling strategy shortens the lifespan of intermediate matrices, thereby reducing overall storage requirements. The proposed design provides full support for all FrodoKEM security levels and protocol phases. It consumes 13467 LUTs, 6042 FFs, and 14 BRAMs on an Artix-7 FPGA and achieves the fastest reported execution time. Compared with state-of-the-art hardware implementations, our design improves the area-time product (ATP) by 1.75-2.00 times.

Figures (11)

• Figure 1: Block diagram of key encapsulation mechanism (KEM).
• Figure 2: Overall architecture of the FrodoKEM hardware cryptographic processor.
• Figure 3: (a) Hardware structure of the Keccak-based hash and Gaussian sampler; (b) Dataflow and timing diagram of the buffered hash unit, taking SHAKE128 as an example.
• Figure 4: (a) Hardware architecture of the multiplier array supporting two computation modes; (b) Timing diagram under different computation modes.
• Figure 5: Block partitioning and hierarchical scheduling strategy for matrix multiplication: (a) Core block-level computation as the basic form of block-wise processing; (b) Block-wise addition implemented by reusing existing hardware resources; (c) Block decomposition and loop hierarchy for structured matrix computations.