The cryptographic community has long recognized FN-DSA for producing the shortest signature sizes among NIST’s standardized post-quantum signature schemes. This compact footprint makes it highly attractive for environments with strict bandwidth limitations. However, deploying the algorithm on resource-constrained microcontrollers has historically presented a severe performance bottleneck. Specifically, the signing operation relies heavily on binary64 floating-point arithmetic. Because traditional low-power microcontrollers lack native hardware support for double-precision floating-point calculations, they are forced to emulate these operations using a dense sequence of standard integer instructions. This software emulation introduces significant computational latency, making signing operations drastically slower on embedded devices than on general-purpose processors.
Past efforts to accelerate FN-DSA on small-scale hardware generally fell into compromises that fractured software standardization. Researchers attempted to speed up execution either by altering the underlying arithmetic framework or by modifying the precise order in which random sampling is conducted. While these modifications yielded performance gains, they introduced a critical drawback: their signatures no longer matched the official known-answer tests, commonly known as KATs, established by the reference implementation. Alternatively, other acceleration strategies depended heavily on double-precision SIMD instructions, hardware capabilities that standard microcontrollers simply do not possess.
The Hansung University team bypassed these traditional trade-offs by targeting a specific, modern embedded core: the Arm Cortex-M55. This processor architecture uniquely integrates both a dedicated double-precision floating-point unit and the M-Profile Vector Extension, widely referred to as Helium. By carefully mapping different phases of the cryptographic workload to the hardware components best suited to handle them, the researchers created the first FN-DSA implementation for this class of hardware that maintains exact bit-level compatibility with reference KATs, executes entirely in constant time to resist side-channel attacks, and still achieves a performance level faster than the reference implementation running on the same core.
Achieving this balance required distinct optimization strategies for the vector extension and the floating-point unit. On the M-Profile Vector Extension side, the research team vectorized the Number Theoretic Transforms utilizing layer merging techniques, alongside the fixed-point Fast Fourier Transform required during key generation. This was accomplished by implementing split-word Q32 arithmetic operating across 32-bit vector lanes. Meanwhile, on the floating-point unit, bit-exact double-precision operations handled the Fast Fourier Transform, LDL decomposition, data splitting and merging, and the crucial signing sampler without altering a single resulting value. Furthermore, the team applied exponent-normalized division to replace the cumbersome bit-by-bit divisions normally required during key generation with a single hardware instruction, specifically VDIV.F64, utilizing operand-independent latency to prevent timing leaks.
The optimizations extended beyond core mathematical transformations to encompass hash-based components and assembly-level tuning. For the Keccak cryptographic permutation function, the researchers implemented vectorized bit interleaving to accelerate every individual permutation. Additionally, they introduced request-level batching, a technique that allows the processor to handle four independent verification requests simultaneously. To ensure maximum hardware efficiency, the team utilized SLOTHY, an automated assembly scheduler, to optimize the final MVE and Keccak assembly code.
The cumulative performance gains across the entire cryptographic lifecycle are substantial. Compared to the standard reference implementation running on the exact same Arm Cortex-M55 core, the Hansung University team’s key generation runs up to 1.23 times faster. The performance improvement is even more pronounced during the signing phase, which achieves speeds up to 1.93 times faster than the reference benchmark. Verification processes see a boost of up to 1.30 times faster, while the batch verification of four signatures simultaneously reaches speeds up to 1.75 times faster than standard sequential verification.
Analyzing the underlying architecture reveals a clear division of labor that explains these efficiency gains. The research demonstrates that the hardware floating-point unit pays off significantly in code sections where the reference implementation would otherwise be forced to emulate complex operations using long chains of integer instructions. Conversely, the M-Profile Vector Extension delivers maximum benefit in routines where the algorithm already relies heavily on integers or fixed-point arithmetic. By aligning each computational task with the most appropriate hardware resource, the team has established a new benchmark for deploying floating-point lattice-based cryptography on secure embedded microcontrollers.
