FN-DSA holds a prestigious position within the cryptographic community as the post-quantum signature standard boasting the shortest signature sizes among the candidates selected by the National Institute of Standards and Technology. However, this efficiency in signature size comes with a heavy computational trade-off when deployed on smaller computing devices. On typical microcontrollers, the binary64 floating-point arithmetic specified by the standard cannot be executed natively and must instead be heavily emulated using basic integer instructions. This emulation process introduces significant latency, making the signing operation notably slow and impractical for many embedded system applications where performance and power efficiency are paramount.
Historically, efforts to accelerate FN-DSA on constrained hardware have forced developers into difficult compromises. Previous optimization attempts typically altered either the underlying arithmetic operations or the specific sequence of random sampling. While these modifications successfully improved execution speed, they broke compatibility with the known-answer tests, commonly known as KATs, established by the official reference implementation. Other acceleration strategies relied heavily on double-precision SIMD instructions that standard microcontrollers simply do not possess. These constraints left a critical gap for developers seeking standard-compliant, high-performance post-quantum security on edge devices.
The research team from Hansung University solved this dilemma by leveraging the unique hardware capabilities of the Arm Cortex-M55 architecture. The Cortex-M55 core stands out because it incorporates both a dedicated double-precision floating-point unit, capable of true FP64 operations, and the advanced M-Profile Vector Extension, also known as Helium. By carefully combining these hardware resources, the researchers developed the first FN-DSA implementation that strictly adheres to the reference implementation’s known-answer tests while running in complete constant time and achieving speeds that comfortably outperform the reference code.
To achieve these performance gains, the team distributed the computational workload across the processor’s available execution units based on their inherent strengths. The M-Profile Vector Extension was deployed to vectorize the number theoretic transforms using advanced layer merging techniques. Additionally, the fixed-point fast Fourier transform utilized during key generation was optimized using split-word Q32 arithmetic operating across 32-bit lanes. Meanwhile, the floating-point unit took charge of bit-exact FP64 calculations, handling the FFT, LDL decomposition, splitting, merging, and the critical signing sampler without altering a single resulting value.
Key generation further benefited from an innovative approach to division operations. Instead of relying on the traditional, time-consuming bit-by-bit division sequences typically required during key generation, the researchers implemented exponent-normalized division. This technique collapses the complex division steps into a single VDIV.F64 instruction characterized by operand-independent latency, protecting the system against certain classes of timing side-channel attacks while drastically improving execution speed.
The optimizations extended beyond the core cryptographic math to include supporting functions such as the Keccak hash permutation. By employing vectorized bit interleaving, the researchers accelerated every permutation required by the scheme. Furthermore, they introduced request-level batching, a technique that processes four independent verification requests simultaneously. To ensure that these complex vectorized sequences and Keccak routines executed with optimal efficiency, the team utilized SLOTHY, an automated assembly optimization tool, to carefully reschedule the generated M-Profile Vector Extension and Keccak assembly code.
The practical impact of these architectural optimizations is substantial. When evaluated on the Arm Cortex-M55 core, the Hansung University implementation achieves key generation speeds up to 1.23 times faster than the reference implementation. The improvements are even more pronounced during the signing phase, which runs up to 1.93 times faster, while verification routines experience a 1.30 times speedup. When utilizing batch verification to process four signatures simultaneously, the system delivers performance up to 1.75 times faster than the standard reference code running on the same hardware platform.
The findings illustrate a clear strategic principle for embedded cryptographic engineering: the floating-point unit delivers maximum efficiency in scenarios where the reference implementation otherwise resorts to lengthy integer instruction emulations, whereas vector extensions excel in domains where algorithms already rely on integer or fixed-point mathematics. This balanced utilization of modern microcontroller hardware paves the way for secure, post-quantum authentication in resource-limited Internet of Things devices and edge infrastructure without sacrificing cryptographic standardization or compliance.
