The findings, detailed in a paper titled "FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium," are set to be published in the Cryptology ePrint Archive as Paper 2026/2559. This breakthrough addresses one of the most stubborn performance bottlenecks facing modern cryptographic standardization efforts, specifically the challenge of executing floating-point-heavy lattice cryptography on low-power silicon.
As the global cybersecurity landscape prepares for the advent of quantum computing, the National Institute of Standards and Technology has established post-quantum cryptographic standards to replace legacy algorithms vulnerable to quantum attacks. Among NIST’s chosen post-quantum signature standards, FN-DSA stands out for offering the shortest signatures, making it exceptionally attractive for constrained environments where bandwidth and storage are at a premium. However, a significant operational hurdle has hindered its adoption on standard microcontrollers. FN-DSA relies heavily on binary64 floating-point arithmetic. Because typical microcontrollers lack native hardware support for double-precision floating-point operations, these calculations must be emulated using software-based integer instructions. This emulation process results in unacceptably slow signing speeds on edge devices.
Prior attempts to accelerate FN-DSA on microcontrollers have generally fallen into two problematic categories. Some researchers chose to alter the underlying arithmetic or modify the order of random sampling to bypass the performance penalty. While these approaches successfully speed up execution, they fundamentally alter the resulting signatures, meaning they no longer match the known-answer tests of the official reference implementation. Other optimization strategies have relied on advanced double-precision SIMD instructions that simply do not exist on standard microcontroller architectures. This left developers caught in a difficult compromise between compliance and performance.
The Hansung University team bypassed these limitations by targeting the Arm Cortex-M55 processor, a modern core that features both a native double-precision floating-point unit and the M-Profile Vector Extension, also known as Helium. By leveraging these specific architectural capabilities, the researchers developed the first FN-DSA implementation for a microcontroller that achieves full compliance with the reference implementation’s known-answer tests while running entirely in constant time and outperforming the reference software.
Achieving this balance required a deep, multifaceted redesign of how the cryptographic algorithms interact with the underlying hardware. On the M-Profile Vector Extension vector units, the researchers vectorized the Number Theoretic Transforms using layer merging techniques. They also optimized the fixed-point Fast Fourier Transform utilized during key generation by implementing split-word Q32 arithmetic across 32-bit execution lanes. This careful orchestration ensures that integer and fixed-point operations make maximum use of the processor’s vector capabilities.
Simultaneously, the team utilized the core’s floating-point unit to handle the complex mathematical components of the scheme without sacrificing precision or deviating from expected outputs. Bit-exact FP64 arithmetic was deployed to compute the Fast Fourier Transform, LDL decomposition, splitting, merging, and the sampler phases of the signing process. By executing these tasks natively on the hardware, the implementation produces exact mathematical results that match the reference code while eliminating the massive overhead of software emulation.
Furthermore, the researchers addressed the traditional bottlenecks found in key generation. By applying exponent-normalized division, they transformed the slow, bit-by-bit division sequences typically required during key generation into a single instruction utilizing VDIV.F64 with operand-independent latency. This shift drastically reduces cycle counts for key generation routines.
To handle the Keccak hash function—a critical component underpinning many modern cryptographic schemes—the team introduced vectorized bit interleaving to accelerate every permutation required by the protocol. Building upon this, they implemented request-level batching, allowing the system to process four independent signature verification requests simultaneously. To tie these disparate optimizations together, the researchers employed SLOTHY, an automated scheduling tool, to fine-tune and reschedule the MVE and Keccak assembly code for optimal execution pipelines on the Cortex-M55 core.
The performance gains achieved through this comprehensive hardware-software co-design are substantial. According to the research paper, key generation, signing, and verification are now up to 1.23 times, 1.93 times, and 1.30 times faster, respectively, than the reference implementation running on the exact same core. Moreover, when leveraging request-level batching for verification, the system processes four signatures up to 1.75 times faster than standard sequential verification methods.
Analyzing the core distribution of the workload, the researchers noted a clear functional division within the processor architecture. The floating-point unit delivers maximum value in routines where the reference code would otherwise rely on extensive integer emulation to handle complex numbers and decompositions. Meanwhile, the M-Profile Vector Extension excels in areas where the algorithm already processes data using integers or fixed-point representations, demonstrating that modern microcontroller architectures can successfully host advanced post-quantum schemes without sacrificing cryptographic integrity or behavioral consistency.
