Efficient and Implementation-Hardened RBLWE on Commodity Cortex-M Microcontrollers

1

Efficient and Implementation-Hardened RBLWE on Commodity Cortex-M Microcontrollers

arXiv:2610.07820v1 [cs.CR] 6 Oct 2026

Muhammad Asim Javaid, Muhammad Adeel Pasha, and Muhammad Ali Siddiqi

Abstract—Efficient post-quantum cryptography on resourceconstrained Internet-of-Things (IoT) devices requires implementations that exploit the target processor architecture while resisting practical implementation attacks. This paper presents an ISA-accelerated and implementation-hardened realization of Ring Binary Learning with Errors (RBLWE) encryption on a commodity ARM Cortex-M33 microcontroller. Packing four 8bit polynomial coefficients into the byte lanes of a 32-bit register and processing them with SIMD-style instructions, together with a packed message codec, accelerates encryption and decryption, while a buffered hardware-TRNG entropy source drawn from the on-die Secure Element drives the key-generation gain. Together these give same-core cold-start speedups of 4.06×, 3.35×, and 3.01× for key generation, encryption, and decryption over a scalar baseline, and 3.52×/3.18× lower encryption/decryption cycle counts than a reference Cortex-M0 implementation. On top of this accelerated core, we add four staged countermeasures, constant-time execution, fault hardening against zeroing, randomcorruption, and instruction-skip faults, a Fujisaki–Okamoto (FO)style CCA2 transform, and first-order shared (masked) CPA decryption, reporting each layer’s cost individually. Binary-level inspection confirms these countermeasures survive compilation, and identifies a compiler-induced masking flaw resolved with a hand-written assembly replacement. Dudect-style timing tests, debugger-assisted fault-injection campaigns, and component-level TVLA then provide implementation-level evidence for the staged protections. The results demonstrate a practical accelerationsecurity tradeoff for RBLWE on off-the-shelf microcontrollers and reusable architecture-aware techniques for lightweight postquantum implementations. Index Terms—Post-quantum cryptography, RBLWE, CortexM33, SIMD, side-channel security, fault resistance

I. I NTRODUCTION The emergence of quantum computing threatens the longterm security of conventional public-key cryptography, motivating the shift to Post-Quantum Cryptography (PQC) [1], with lattice-based schemes such as ML-KEM occupying a central position [2], [3]. However, for embedded and IoT deployments, algorithmic security is not sufficient: implementations must meet strict latency, memory, and energy budgets while resisting physical attacks on devices that are inexpensive, battery-powered, and accessible to an adversary [4]. Ring Binary Learning with Errors (RBLWE) [5] is attractive for exactly this setting: by drawing binary rather than Gaussian secrets and errors, it reduces sampling and arithmetic complexity relative to general Ring-LWE [6], [7], making it a natural candidate for IoT nodes with the smallest footprint. RBLWE acceleration remains an active research goal, evidenced by a steady stream of recent FPGA and dedicatedThe authors are with the Department of Electrical Engineering, Lahore University of Management Sciences, Lahore, Pakistan.

hardware designs [8]–[14] that report substantial throughput and area-time product gains. These designs, however, accelerate the arithmetic in isolation: they report cycle counts or area-time products without evaluating the design against side-channel or fault adversaries, despite operating in physically exposed deployment settings that motivate RBLWE’s use. On the software side, Buchmann et al. established the first lightweight RBLWE implementation on 8-bit AVR and Cortex-M0 targets [5], while Ebrahimi and Bayat-Sarmadi extended this line with fault-resilient binary Ring-LWE for constrained devices [15]. Both target unaccelerated, generalpurpose cores: neither exploits 32-bit SIMD-style instructions nor on-die security peripherals now standard on commodity Cortex-M MCUs. Power-based leakage assessment and binarylevel verification of countermeasure survival were also absent from those works. The result is a gap between two otherwise mature lines of work: (i) architecture-aware acceleration is evaluated without implementation-security scrutiny, and (ii) implementation-hardened software is evaluated without architectural acceleration. This paper closes that gap on a single commodity CortexM33 MCU. We map RBLWE’s binary polynomial arithmetic onto the core’s byte-lane SIMD instructions, packing four coefficients per 32-bit word and using UADD8/USUB8 to process them concurrently, which drives most of the encryption and decryption speedup, and pair this with word-oriented encoding and decoding to reduce scalar loads and stores. We also draw randomness from the MCU’s Secure Element True Random Number Generator (TRNG) in larger batches rather than one small call at a time, which similarly dominates the key-generation gain by reducing its invocation frequency. Starting from this accelerated Chosen-Plaintext-Attack (CPA) secure core, we add protections in stages: (i) constant-time execution, (ii) hardening against zeroing, random-corruption, and instruction-skip faults, (iii) a Fujisaki–Okamoto (FO)-style adaptive Chosen-Ciphertext-Attack (CCA2) transform built on Secure-Element SHA-256, and (iv) first-order shared CPA decryption, so that each protection layer’s cost is individually visible. We further verify, at the linked-binary level, that the compiler preserves these properties, and in doing so identify a compiler-induced masking flaw that motivates a Thumbassembly replacement. In summary, this paper makes the following contributions (also summarized in Fig. 1): C1. ISA- and Hardware-Assisted RBLWE Acceleration: Byte-lane SIMD arithmetic, packed encoding/decoding, and a buffered Secure-Engine TRNG together give samecore speedups of 4.06×, 3.35×, and 3.01× for key

2

lattice problems in the worst case [16]. Ring-LWE transfers this structure to a polynomial quotient ring [6], operating over Rq = Zq [x]/(xn + 1),

Fig. 1. End-to-end overview of the proposed RBLWE pipeline (top), the three acceleration techniques and four staged countermeasures applied to it, and the evaluation techniques used to validate them.

(1)

where n is the polynomial degree and q is the coefficient modulus. Each ring element is a polynomial of degree at most n − 1, with coefficients indexed i = 0, . . . , n − 1 and reduced modulo q. Addition is coefficient-wise; multiplication is negacyclic, since xn = −1 causes terms crossing degree n − 1 to wrap to lower-degree positions with a sign change. RBLWE further restricts the secret and error polynomials to binary coefficients, and this coefficient layout, together with the ring’s modular and negacyclic structure, determines the polynomial kernels developed in Section III.

generation, encryption, and decryption over a scalar baseline, and 3.52×/3.18× lower encryption/decryption cycle counts than the reference Cortex-M0 implementation; SIMD arithmetic accounts for most of the encryption and decryption gain, while buffered TRNG batching accounts for most of the key-generation gain. C2. Staged Implementation Hardening: The accelerated core is progressively extended with constant-time execution, fault-hardened comparison and selection, a CCA2oriented wrapper, and first-order shared CPA decryption, with the cycle and memory cost of each layer reported separately. C3. Binary-Level Verification: Final Executable and Linkable Format (ELF) inspection confirms that countermeasures survive compilation, and identifies a case where GCC recombined masked shares inside a noinline gadget, resolved with a hand-written assembly replacement. C4. Implementation-Security Evaluation: Dudect-style timing tests, component-level Test Vector Leakage Assessment (TVLA), and 2,678 debugger-assisted fault trials provide implementation-level evidence for the staged protections, including cases where an injected fault propagated through despite the tested countermeasures. The rest of the paper is organized as follows. Section II presents the RBLWE background while Section III details the proposed architecture-aware acceleration. Section IV defines the adversary model and then presents the staged countermeasures. Section V describes the evaluation methodology, and the results are discussed in Section VI. Section VII concludes this article.

It then computes the two ciphertext components

II. BACKGROUND AND P RELIMINARIES

c1 = ae1 + e2 ,

(5)

c2 = pe1 + e3 + Encode(m),

(6)

This section summarizes the Ring-LWE foundations underlying the RBLWE construction and defines the binary distributions, encryption/decryption operations, and bias-aware decoding rule used in this paper. A. Ring-LWE Computational Model Learning With Errors (LWE) is a well-established hardness assumption: recovering a secret from noisy linear relations is, in the average case, at least as hard as solving certain

B. RBLWE Dataflow and Bias-Aware Decoding We adopt the RBLWE public-key encryption scheme of Buchmann et al. [5], including its coefficient-dependent decoding rule. Binary sampling reduces sampler and arithmetic complexity relative to wider error distributions, but also introduces a coefficient-dependent noise bias that the decoder (Section II-B4) must correct for. 1) Key generation: A public polynomial a is selected from Rq . Key generation then draws two binary polynomials independently and uniformly, i.e., with each coefficient distributed as Bernoulli(1/2), r1 , r2 ← {0, 1}n

(2)

and computes p = r1 − ar2

in Rq .

(3)

The resulting public key is pk = (a, p), while the secret key is sk = r2 . As in [5], a is treated as a system parameter fixed at deployment rather than transmitted with each public key; our implementation stores a local copy of a inside the in-memory public-key object rather than as a separate shared value. 2) Encryption: Given a public key pk = (a, p) and a binary message polynomial m, encryption draws three fresh binary polynomials independently and uniformly from {0, 1}n , e1 , e2 , e3 ← {0, 1}n .

(4)

where all operations are performed in Rq and q is even. Each message bit is mapped to the corresponding coefficient of the encoded polynomial: ( 0, mi = 0, Encode(m)i = (7) q/2, mi = 1. The resulting ciphertext is c = (c1 , c2 ).

3

(a) Fixed q/4 +b µi

0

m b =0 m b =1

Algorithm 1 SIMD-Accelerated Negacyclic Multiplication

(b) Bias-aware Li

µ bi + q/2 m bi = 1

q/2

m bi = 0 µ bi

3q/4

Li + q/2

Fig. 2. Fixed and bias-aware decoding regions [5]. The rotation uses µ bi = i − n/2 + 2 and Li = µ bi + q/4.

3) Decryption and residual noise: Given c = (c1 , c2 ) and the secret key r2 , decryption first computes w = c1 r2 + c2 .

(8)

Substitution yields, w = Encode(m) + ν,

ν = e1 r1 + e2 r2 + e3 ,

(9)

where the ae1 r2 terms cancel and ν is the residual noise. 4) Bias-aware decoding: The binary variables take values in {0, 1} and therefore have a built-in positive skew rather than the zero-centered noise of Gaussian-based schemes. In addition, negacyclic multiplication introduces positive and negative wrapped terms whose numbers depend on the coefficient index i. Consequently, following the analysis of [5], the expected residual noise is coefficient-dependent: n 3 −n + 2i + 2 , µi = E([ν]i ) = i − + . 4 2 2 For even n, the decoder rounds the half-integer center and computes

n Require: a ∈ Zn q , b ∈ {0, 1} , q ∈ {128, 256}; 8-bit coefficients Ensure: r = a ⊛ b ∈ Rq 1: r ← 0 2: for i ← 0 to n − 1 do 3: if bi = 1 then 4: A DD R ANGE 4(ri:n−1 , a0:n−i−1 ) ▷ UADD8 + scalar tail 5: S UB R ANGE 4(r0:i−1 , an−i:n−1 ) ▷ USUB8 + scalar tail 6: end if 7: end for 8: if q = 128 then 9: r ← r & 0x7f coefficient-wise 10: end if 11: return r

Algorithm 2 Packed message encoding and decoding 1: procedure PACKED E NCODE(m, n, q) 2: for j ← 0 to n/8 − 1 do 3: for t ← 0 to 7 do
4: µt ← 0 − ((mj ≫ t) & 1) & (q/2) 5: end for 6: P8j:8j+7 ← PACK S TORE(µ0 , . . . , µ7 ) 7: end for 8: return P 9: end procedure 10: procedure PACKED D ECODE(P, n, q) 11: m b ← n/8 zero bytes 12: for i ← 0 to n − 1 do 13: Li ← i − n/2 + q/4 + 2 14: z ← (Pi − Li ) & (q − 1)
15: d ← 1 ⊕ z ≫ (log2 q − 1) 16: m b ⌊i/8⌋ ← m b ⌊i/8⌋ | (d ≪ (i mod 8)) 17: end for 18: return m b 19: end procedure

E([ej rj ]i ) =

µ bi = ⌈µi ⌉ = i − n/2 + 2,

Li = µ bi + q/4,

zi = (wi − Li ) mod q,

m̂i = 1 ⊕ MSBlog2 q (zi ). (10)

Thus, subtracting Li compensates for index-dependent noise bias before the branch-free Most Significant Bit (MSB) decision is applied as visualized in Fig. 2. III. A RCHITECTURE -AWARE I MPLEMENTATION A. Target Resources and Data Representation The implementation runs on the 32-bit ARM Cortex-M33 core of a Silicon Labs EFM32PG28. Polynomial arithmetic remains software-executed, since the on-die Secure Element supplies random bytes but does not accelerate polynomial multiplication. For the evaluated (n, q) = (256, 256) baseline, the coefficients are stored contiguously as bytes. This representation permits four coefficients to occupy one 32-bit register, and the byte-lane arithmetic detailed in Section III-B keeps each lane’s overflow independent, making per-lane wraparound equivalent to reduction modulo 256. The firmware exposes (n, q) = (256, 256), (256, 128), and (512, 256) as compile-time configurations, matching the parameter sets for which Buchmann et al. reported classical security estimates and per-bit decryption-failure probabilities of 84 bits/2−32 , 94 bits/2−10 , and 190 bits/2−18 , respectively [5]. Set 2 is retained only for baseline consistency

and overhead comparison; its reported decryption-failure-rate (DFR) precludes a deployment recommendation or the CCA2security claim developed in Section IV-B. B. Acceleration Mechanisms In our proposed approach, three changes produce the accelerated baseline: 1) Four-lane polynomial arithmetic: Algorithm 1 maps binary negacyclic multiplication to the Cortex-M33 bytelane DSP instructions. For each bi = 1 and output index k ∈ {0, . . . , n − 1}, rk receives +ak−i when k ≥ i and −an+k−i when k < i, as required by xn = −1. Equallength ranges are processed four coefficients at a time; only their zero-to-three coefficient tails are scalar. Bytelane wraparound gives reduction modulo 256, followed by a final seven-bit mask when q = 128. 2) Packed message processing: the codec processes one message byte as eight coefficients (Algorithm 2). Encoding maps each bit branch-free to 0 or q/2 and stores the results as two 32-bit words; decoding applies (10) to eight coefficients and packs the recovered bits into one byte. This preserves the scalar codec output while reducing control and memory overhead; unlike polynomial arithmetic, it is a data-layout optimization and does not use __UADD8/__USUB8. Here, PACK S TORE is our notation for concatenating eight bytes into two 32-bit words, not an ARM/CMSIS intrinsic.

4

rejection remain fail-closed. Underlying RBLWE, hash, and key-derivation primitives are assumed computationally secure. 2) Validation Scope: Evaluation is limited to the tested binaries and components: fixed-versus-random timing, TVLA, and debugger-assisted single faults. Multi-target faults and electromagnetic or invasive injection are considered out of scope for this work. B. Countermeasure Design

Fig. 3. Baseline CPA RBLWE dataflow on the EFM32PG28, resolved down to KeyGen, Encrypt, Decrypt, and the shared TRNG-backed Sampler Bank. Packed message encoding and decoding run on the same four-lane SIMD engine as the polynomial arithmetic.

3) Buffered hardware randomness: a circular pool batches Secure Element TRNG output and supplies the binary samplers. In the prefetched mode, the pool is filled before the timed operation and the pool-refill step is moved off the latency-critical path. In the reported cold start mode, the operation begins with an empty pool, and every required refill is counted against the reported cycle count. These transformations change the execution mapping, not the RBLWE equations or Bernoulli distributions. The q = 128 configuration additionally masks the results with 0x7f to restrict the coefficient to the valid 7-bit range [0, 127], since byte-lane overflow naturally wraps modulo 256, rather than modulo 128. This final reduction is valid because 128 divides 256. Parameter-specific correctness and the security results are therefore reported separately in Section VI. Fig. 3 consolidates the verified baseline dataflow and its mapping to the target resources. IV. S ECURITY C OUNTERMEASURES This section first defines the adversary model assumed for a commodity IoT deployment, then presents the security countermeasures introduced in response. A. Adversary Model 1) Adversary Capabilities: In our adopted model, the adversary may request encryptions of chosen plaintexts and submit arbitrary, including malformed, ciphertexts for decryption, observing outputs and externally visible execution behavior but not the secret key or internal random state. Given physical access, the adversary additionally collects timing and power traces across repeated executions and injects one targeted fault per execution, namely instruction skip, state zeroing, or value substitution, at key generation, encryption, decryption, re-encryption, or verification/output stages. A fault is security-relevant if it admits a weak key or malformed ciphertext, releases unauthenticated or corrupted plaintext, or silently corrupts a valid output; explicit failure and implicit

Building on fault-resilient Binary Ring-LWE [15], we add constant-time execution, fault hardening, a CCA2-oriented transform, and first-order shared CPA decryption as security countermeasures to be tested in our work. 1) Constant-Time Execution: The baseline binary polynomial multiplication can skip an outer-loop iteration when a sensitive multiplier coefficient is zero. Such skip-zero behavior makes execution time and instruction activity depend on the Hamming weight and positions of the binary multiplier. Let bi = b[i] ∈ {0, 1} denote its ith coefficient; depending on the call site, b is a secret-key or ephemeral polynomial. In the protected implementation, the skip branch is replaced by a full-width mask Mi = −(bi & 1),

(11)

so that Mi = 0x00000000 when bi = 0 and Mi = 0xFFFFFFFF when bi = 1. The firmware does not materialize the complete negacyclic shift NShifti (a). Instead, during outer iteration i, it applies Mi to each packed fourcoefficient source word loaded from a. Nonwrapped words are accumulated with __UADD8, whereas wrapped words are accumulated with __USUB8 to implement xn ≡ −1; residual boundary coefficients use the corresponding 8-bit mask. Thus, each masked word is a packed source block contributing to NShifti (a), not the complete shifted polynomial. Every bi follows the same loop structure: zero is accumulated when bi = 0, and the ith negacyclic shift of a is accumulated when bi = 1. 2) Fault-Injection Hardening: If any step of key generation fails, for example a sampling or Secure Element error, both the public and secret key objects are erased before the call returns, rather than leaving a partially formed or possibly weak key pair in memory. During decryption, forward and reverse comparisons produce independent masks, and candidate data is released only if both masks pass and no internal error occurs (Algorithm 3). Unlike the comparison step, the final output loop and store are not similarly duplicated, leaving a single, non-redundant point that Section VI shows can still be exploited. 3) CCA2-Oriented Protection: The CCA2-oriented layer is designed to prevent a modified ciphertext from being accepted as valid. It follows the deterministic re-encryption approach used by Ebrahimi and Bayat-Sarmadi [15] and Oder et al. [17]. As shown in Fig. 4, RBLWE encrypts a fresh binary vector v rather than the message m. The message is masked in c3 , while c4 authenticates the complete ciphertext. Here, H denotes SHA-256 hashing, including the domain-separated seed derivation from (v, m, hpk); HH is a domain-separated

5

Algorithm 3 Redundant verification and hardened output selection b candidate m, alternative Require: received data C, recomputed data C, output r, operation status s b 1: df ← CompareForward(C, C) b 2: dr ← CompareReverse(C, C) 3: Mf ← EqMask(df ) 4: Mr ← EqMask(dr ) 5: if s ̸= 0 then 6: Mf ← 0; Mr ← 0 7: end if 8: for i ← 0 to |m| − 1 do 9: outi ← ri ⊕ ((mi ⊕ ri ) & Mf & Mr ) 10: end for 11: return out

(a) Encryption

(b) Decryption

1 Inputs m; fresh v from software TRNG pool hpk = H(pk) from SE SHA-256

1 Inputs C, shared sk′ , and hpk z from software TRNG pool at key setup

2 Derive coins and mask SE SHA-256 with software framing G(v ∥ hpk)

2 Recover vector Cortex-M33 shared CPA decryption v ′ = Decsk′ (c1 , c2 )

3 RBLWE and message path c1 = ae1 + e2 c2 = pe1 + e3 + Encode(v) c3 = m ⊕ G(v ∥ hpk)

3 Recover candidate SE: G(v ′ ∥ hpk) M33: m′ = c3 ⊕ G(v ′ ∥ hpk)

4 Authenticate and transmit SE SHA-256 context tag c4 C = (c1 , c2 , c3 , c4 )

4 Recompute ciphertext SE H, HH: coins; M33: c′1 , c′2 SE: c′4 and R(z, H(C)) 5 Verify and select Bidirectional compare and twomask Thumb assembly selection valid → m′ invalid → R(z, H(C)) internal failure → error

Fig. 4. Implemented FO-style CCA2 RBLWE dataflow on the EFM32PG28. Blue, teal, amber, and gray cards denote Cortex-M33 computation, Secure Element hashing, verification and selection, and inputs, respectively. The TRNG and SHA-256 engine are hardware services. Authentication failure returns R(z, H(C)); an internal service failure reports an error.

SHA-256 chaining function for the subsequent seeds; and G is an HMAC-based Key Derivation Function (HKDF) expansion using SHA-256 that produces the plaintext mask. For Set 1 (n = 256, q = 256), the four components of C = (c1 , c2 , c3 , c4 ) occupy 256, 256, 32, and 32 bytes, respectively; c3 and c4 scale with n, giving 64 bytes each at Set 3 (n = 512). Decryption first recovers candidates v ′ and m′ , then rebuilds ′ c1 , c′2 , c′4 . The candidate message is returned only when all three rebuilt components match the received ones. A mismatch returns the pseudorandom message R(z, H(C)) instead and does not expose a validity flag. Furthermore, internal processing failures, such as a failed Secure Element hash call, are reported as errors. Firmware derives several independent functions, H, G, and the tag/coin derivations, from the Secure Element’s single SHA-256 hardware. Each call is tagged with a distinct label and its output combined via HKDF, keeping the functions cryptographically separate. The CCA2 wrapper follows the

same re-encryption pattern as standardized schemes like MLKEM but uses its own byte layout, so the two are not interchangeable. Like the underlying RBLWE scheme, the wrapper is evaluated empirically here, not backed by a formal CCA2 proof. 4) First-Order Shared CPA Decryption: The countermeasures introduced so far leave the core polynomial arithmetic exposed to power analysis: an attacker could still recover r2 (secret key) from repeated observations of the ciphertexttimes-key multiplication. Masking closes this gap by splitting every sensitive value into two random shares, so no single observed value depends on the whole secret. Masking begins when r2 is created, not at the decoder. Each binary coefficient of r2 is stored as two arithmetic shares, r2 = r2,0 + r2,1

(mod q).

(12)

The first share is random and the second completes the required binary value. Before every decryption, a fresh random polynomial δ refreshes the key as r2,0 ← r2,0 + δ and r2,1 ← r2,1 − δ, leaving their sum unchanged. The firmware then computes u0 = c1 r2,0 and u1 = c1 r2,1 , followed by w0 = u0 and w1 = u1 + c2 . Hence, w0 + w1 = c1 r2 + c2 ,

(13)

without first reconstructing either r2 or the decryption polynomial w. The shared-key build likewise computes the public-key product from both shares without reconstructing r2 . Because the shares are general elements of Zq , these operations use the general rather than the faster binary multiplier, which dominates the shared KeyGen overhead. Unlike the four-lane byte-SIMD arithmetic used elsewhere, the decoder processes each coefficient pair (wi,0 , wi,1 ) separately, since recovering a single bit from a masked value requires a carry-propagating conversion rather than independent, byte-lane-parallel operations. This conversion turns the arithmetic shares into two Boolean shares via a masked log2 q-bit ripple-carry addition, protecting each carry step with an Ishai-Sahai-Wagner (ISW)-style masked-AND gadget that computes on shares alone, then applies the public decoding offset without combining the shares. For Set 1, with (n, q) = (256, 256) and uniform binary sampling, Li = i − 62 and the decoded bit is mi = 1 ⊕ MSB((wi − Li ) mod 256).

(14)

The output bit shares are packed into two n/8-byte buffers and combined only after all n coefficients have been decoded. Each coefficient consumes five buffered random bytes: two input masks, two bytes for arithmetic-to-Boolean conversion, and one byte for the public-offset addition. The decoder and key-share refresh therefore consume 6n random bytes per decryption (1,536 bytes for Set 1). For Set 1, the source-level path also holds four 256-byte polynomial temporaries, a 256byte refresh buffer, and two 32-byte message-share buffers. A random-pool failure clears the output and returns an error. Masking ends when the two message buffers are combined; the subsequent CCA2 hashing, re-encryption, comparison, and output selection remain unmasked. The implemented claim is

6

Fig. 5. TVLA acquisition setup: the EFM32PG28 target board, host-controlled capture software, and BK Precision 2569B-MSO oscilloscope recording the AEM current signal and GPIO trigger.

therefore first-order shared CPA decryption, not a fully masked CCA2-PKE operation. V. E XPERIMENTAL S ETUP AND M ETHODOLOGY A. Evaluated Configurations Each parameter tuple is rebuilt with uniform binary sampling in seven cumulative configurations: scalar arithmetic and codec with direct TRNG calls, packed arithmetic, packed codec, buffered branchy CPA, branch-free CPA, branch-free plus CCA2/fault protection, and the latter with first-order shared CPA decryption. End-to-end measurements begin without prefetched randomness; the sampler and baseline arithmetic remain fixed after the accelerated CPA boundary, and CCA2 processing remains unmasked. B. Toolchain Constraints and Binary-Level Verification Optimizing compilers do not necessarily preserve sourcelevel constant-time or masking properties [18]. The evaluated firmware uses ARM GNU Toolchain GCC 12.2.1 (build 20221205), targets Thumb code for the Cortex-M33, and is compiled as C17 with -Os and -fno-lto. Compiler identity, options, and source revision are therefore part of the evaluated configuration; changing any of them requires the binary audit to be repeated. Using arm-none-eabi-objdump and arm-none-eabi-nm from the same toolchain, we inspected the application objects and final ELF file for secret-dependent branches and memory addresses, fixed loop bounds, removal of countermeasure operations, and recombination of Boolean shares. The audit was performed on the fully hardened CCA2-masked configuration for parameter Set 1 (n = 256, q = 256), with branch-free binary multiplication, CCA2-PKE, and masked decryption enabled. The audit confirmed mask-based execution in the binary multiplier, fixed control flow in the masked decoder, full-length ciphertext comparison, and branch-free implicitrejection selection. The remaining loop branches depend only on fixed public iteration counts. C. Performance and Memory Measurement The Cortex-M33 Data Watchpoint and Trace (DWT) cycle counter measures key generation, encryption, or decryption

with interrupts disabled, and correctness is checked outside the timed interval. Measurements distinguish operation latency when the required entropy has already been prefetched into the TRNG-backed pool from caller-visible end-to-end latency when execution begins with an empty pool and, therefore, includes synchronous hardware refilling. Firmware builds without masked decryption use a fixed 1,024-byte pool. When masked decryption is enabled, the secret polynomial is stored and processed as two arithmetic shares, s = s0 + s1 (mod q), and the pool capacity is increased to 6n bytes so that all randomness required by one protected decryption can be prefetched. Reported cold-start values include batched synchronous TRNG refill, pool reads, polynomial arithmetic, Secure-Element SHA-256 calls, and countermeasure logic, but exclude test-vector preparation, correctness checks, and UART output. This cold-start measurement is deliberately conservative, not a formal worst-case bound: whichever operation runs first has to wait for fresh randomness, and that wait counts against it. Prefetching avoids that wait but does not remove the underlying cost, it only moves the work and energy outside the timed window. Flash usage is the linked .text+data size. Static RAM is the map file’s allocated .data plus ordinary .bss, excluding the linker-reserved stack and memory-manager heap. Reported Stack and Heap figures are those linker allocations, not measured runtime high-water marks. D. Fixed-versus-Random Timing Tests We perform four dudect-style tests covering polynomial multiplication during decryption and encryption, as well as both complete CCA2 operations. Each test collects 100,000 DWT measurements, divided equally between two classes, using the (n, q) = (256, 256) firmware image. In the decryption test, a fixed secret binary multiplier is paired with either a fixed or random ciphertext polynomial. In the encryption test, a fixed polynomial is paired with either a fixed or random temporary binary multiplier. Complete encryption compares an all-zero plaintext with random plaintexts under one public key. Complete decryption compares valid ciphertexts with branchlessly corrupted invalid ciphertexts under one secret key. Balanced class labels are shuffled before capture. Both classes use the same untimed preparation, working-buffer addresses, branchless selection, and untimed warm-up. Random generation, pool refill, validation, and UART transmission remain outside the timed call. Offline analysis applies Welch’s t-test where the no-detection criterion requires final and maximum running |t| < 4.5 with no sustained growth. E. Power-Trace Leakage Assessment Component-level fixed-versus-random TVLA compares the unshared and first-order shared multiplication kernels for (n, q) = (256, 256). A BK Precision 2569B-MSO oscilloscope records the board’s Advanced Energy Monitor (AEM) currentmeasurement output (Fig. 5) on channel 1 at 5 MSa/s; a GPIO trigger pulse on channel 2 delimits the selected kernel. Input preparation, UART synchronization, and random-pool refill occur while the trigger is low. Captures are aligned to the trigger edge and analyzed offline with the |t| = 4.5 threshold.

VI. R ESULTS AND D ISCUSSION A. Per-Mechanism Acceleration Gains Table I isolates the three cumulative acceleration changes presented in Section III-B. SIMD arithmetic provides the main arithmetic gain, delivering 1.51×, 2.40×, and 2.97× speedups over the scalar build for KeyGen, encryption, and decryption, respectively. Packed encoding and decoding provide smaller incremental gains of 1.006× and 1.025× for encryption and decryption, while leaving KeyGen essentially unchanged. Batched TRNG access reduces Secure Element invocation overhead and adds 2.68× and 1.39× incremental gains to KeyGen and encryption; CPA decryption is unaffected because it requires no randomness. All measurements use an empty TRNG pool, so refills occur synchronously and no gain is attributed to prefetching. Combined, these mechanisms provide 4.06×, 3.35×, and 3.01× speedups over the scalar Cortex-M33 baseline for KeyGen, encryption, and decryption. Compared with the reference Cortex-M0 implementation, the final Cortex-M33 build achieves 3.52–3.75× encryption and 3.18–3.62× decryption cycle-count speedups across the three parameter sets. B. Binary-Level Verification Finding The binary audit in Section V, checking for secretdependent branches, fixed loop bounds, and recombination of Boolean shares, surfaced a compiler-induced flaw in the original C masked-AND gadget. Although marked noinline, GCC factored its expression into an instruction computing b0 ⊕ b1 , temporarily reconstructing the sensitive value from its two Boolean shares. We replaced the gadget with standalone Thumb assembly that holds the four ISW cross-products in separate registers. Reinspection confirmed that the linked routine neither recombines the input shares nor introduces conditional branches or secret-dependent memory accesses.

4.5 CCA2 dec. CCA2 enc.

1.5

|t|

On-target logical injections use the GNU Debugger (GDB) through J-Link at addresses resolved from the campaign’s linked ELF. Each campaign applies a single intervention per execution: zeroing selected state, substituting seeded values in registers or stack locations, or emulating a Thumb instruction skip by advancing the program counter to the next instruction. Valid or deliberately invalid fixed ciphertexts are selected according to the target. Each run records the API status, output class, candidate-bit release, crash or timeout behavior, and whether the injection point was reached. Zeroing uses three repetitions at each of ten locations. Randomization exhausts all 256 byte values separately for each of the forward and reverse ciphertext-validity masks used by the hardened final plaintext selector, applies 1,000 seeded 32-bit values to each comparison accumulator, and uses 100 seeded values for a recovered intermediate. Instruction-skip experiments use three repetitions at each of 12 security-critical instructions. These experiments represent reproducible, software-controlled fault models and do not constitute claims about any particular voltage, clock, or electromagnetic glitch apparatus.

Poly. mult. dec. Poly. mult. enc.

1.0 0.5 0.0

0

10000 20000 30000 40000 50000

Samples per class

Fig. 6. Running Welch |t| convergence for the four timing tests; dashed lines mark the |t| = 4.5 reference. 6

(a) Unmasked

threshold: |t| = 4.5

3 0

Welch t-statistic

F. Debugger-Assisted Fault Campaigns

|t|

7

−3 −6 6

(b) Masked

3 0 −3 −6 0.0

0.2

0.4 0.6 0.8 1.0 Time from trigger (ms)

1.2

Fig. 7. Fixed-versus-random TVLA comparison of unmasked (unshared) and first-order masked (shared) multiplication; dashed lines mark |t| = 4.5.

C. Performance Impact of Staged Security Countermeasures Table II reports the impact of branch-free (BF) execution, the combined CCA2/fault layer, and shared CPA decryption for each parameter set. Branch-free execution’s uniform, noskip processing raises the KeyGen cycle count over the branchy baseline even before any further protection is added. CCA2 affects decryption most because it adds recovery, reencryption, verification, and implicit rejection. In the current shared-key (masked) build, secret sharing leaves encryption essentially unchanged but dominates KeyGen and decryption through general multiplication on arithmetic shares, key refresh, and masked decoding. Table III gives the companion prefetched measurements for Set 1. Relative to the cold-start values in Table II, the KeyGen reduction falls from 29.6% at the branchy CPA baseline to 4.0% in the final shared configuration, while finalconfiguration encryption and decryption improve by 0.9% and 6.8%, respectively. The benefit is therefore operationdependent and follows the relative contribution of randomness generation to the timed path. D. Resistance to Timing Attacks Under the fixed-versus-random procedure of Section V, all four timing statistics remained below the |t| = 4.5 reference

8

TABLE I BASELINE ACCELERATION FOR S ET 1 AND COMPACT ALL - SET COMPARISON . Configuration

Platform

Scalar arithmetic + scalar codec + direct SE TRNG Packed SIMD arithmetic + scalar codec + direct SE TRNG SIMD + optimized encoding/decoding + direct SE TRNG SIMD + optimized encoding/decoding + batched TRNG buffer (cold) Controlled cycle-count speedup, scalar to final

Cortex-M33, 39 MHz Cortex-M33, 39 MHz Cortex-M33, 39 MHz Cortex-M33, 39 MHz

Accelerated CPA comparison across all tested parameter sets Set 1: (n, q) = (256, 256) Set 2: (n, q) = (256, 128) Set 3: (n, q) = (512, 256)

M33/M0 M33/M0 M33/M0

KeyGen [Kcycles (ms)]

Encrypt [Kcycles (ms)]

Decrypt [Kcycles (ms)]

783.783 (20.10 ms) 520.450 (13.34 ms) 517.612 (13.27 ms) 193.275 (4.96 ms) 4.06×

898.871 (23.05 ms) 373.886 (9.59 ms) 371.505 (9.53 ms) 268.056 (6.87 ms) 3.35×

381.322 (9.78 ms) 128.547 (3.30 ms) 125.369 (3.21 ms) 126.568 (3.25 ms) 3.01×

193.275/– 199.583/– 614.738/–

268.056/944.000 (3.52×) 266.696/999.000 (3.75×) 979.851/3 483.000 (3.55×)

126.568/403.000 (3.18×) 127.523/437.000 (3.43×) 469.875/1 701.000 (3.62×)

Note: Direct and batched TRNG configurations use 4-byte requests and 32-byte refills, respectively. All-set entries report this work/Buchmann et al. [5] in Kcycles, followed by the cycle-count speedup; “–”: unreported KeyGen. TABLE II S TAGED COLD - START PERFORMANCE AND MEMORY COSTS ACROSS RBLWE PARAMETER SETS . Stage

KeyGen [Kcycles (ms)]

Encrypt [Kcycles (ms)]

Decrypt [Kcycles (ms)]

ROM (B)

Static RAM (B)

Stack (B)

Heap (B)

Set 1: n = 256, q = 256 Branchy CPA baseline Branch-free CPA Branch-free + CCA2/fault protection BF + CCA2/fault + shared CPA decryption

193.275 (4.96 ms) 310.189 (7.95 ms) 330.053 (8.46 ms) 2 661.295 (68.24 ms)

268.056 (6.87 ms) 498.272 (12.78 ms) 604.186 (15.49 ms) 604.811 (15.51 ms)

126.568 (3.25 ms) 240.100 (6.16 ms) 871.055 (22.33 ms) 3 973.488 (101.88 ms)

26 612 26 644 29 048 30 200

4 164 4 164 4 804 5 572

8 192 8 192 8 192 8 192

249 788 249 788 249 148 248 380

Set 2: n = 256, q = 128 Branchy CPA baseline Branch-free CPA Branch-free + CCA2/fault protection BF + CCA2/fault + shared CPA decryption

199.583 (5.12 ms) 313.338 (8.03 ms) 332.078 (8.51 ms) 3 055.053 (78.33 ms)

266.696 (6.84 ms) 503.665 (12.91 ms) 609.302 (15.62 ms) 610.505 (15.65 ms)

127.523 (3.27 ms) 242.374 (6.21 ms) 879.130 (22.54 ms) 4 315.989 (110.67 ms)

26 676 26 676 29 080 30 264

4 164 4 164 4 804 5 572

8 192 8 192 8 192 8 192

249 788 249 788 249 148 248 380

Set 3: n = 512, q = 256 Branchy CPA baseline Branch-free CPA Branch-free + CCA2/fault protection BF + CCA2/fault + shared CPA decryption

614.738 (15.76 ms) 1 109.371 (28.45 ms) 1 105.646 (28.35 ms) 11 341.880 (290.82 ms)

979.851 (25.12 ms) 1 974.466 (50.63 ms) 2 065.859 (52.97 ms) 2 065.767 (52.97 ms)

469.875 (12.05 ms) 969.186 (24.85 ms) 3 043.904 (78.05 ms) 14 815.736 (379.89 ms)

26 644 26 676 29 048 30 264

5 508 5 508 6 692 9 252

8 192 8 192 8 192 8 192

248 444 248 444 247 260 244 700

Note: Measurements use the 39-MHz Cortex-M33 and report end-to-end cold-start latency, including any required batched synchronous TRNG refill.

TABLE III S ET 1 PREFETCHED LATENCY AND REDUCTION FROM COLD START. Stage Branchy CPA Branch-free CPA BF + CCA2/fault BF + CCA2/fault + shared

KeyGen 136.031 (29.6%) 253.568 (18.3%) 268.244 (18.7%) 2 554.062 (4.0%)

Encrypt

Decrypt

243.861 (9.0%) – 481.297 (3.4%) – 598.590 (0.9%) – 599.188 (0.9%) 3 701.445 (6.8%)

TABLE IV F IRST- ORDER TVLA RESULTS FOR THE PROTECTED OPERATIONS . Operation Masked multiplication Masked decoding Masked CCA2 decryption CCA2 encryption

Max. |t| 3.566 3.320 4.360 4.194

Note: Kcycles (% reduction from Table II); “–”: no randomness to prefetch.

threshold without sustained growth (Fig. 6). In the order shown in the figure legend, namely complete CCA2 decryption, complete CCA2 encryption, decryption polynomial multiplication, and encryption polynomial multiplication, the maximum running |t| values were 1.589, 1.037, 1.634, and 0.000, respectively, while the final |t| values were 0.578, 0.126, 0.405, and 0.000, respectively. Therefore, no classdependent timing was detected for this (256, 256) binary in this experiment. This result provides empirical evidence rather than a universal proof of constant-time execution. E. Power-Trace Leakage Under the component-level procedure of Section V, firstorder TVLA was performed in successive stages of 5,000 traces, with multiple iterations used to confirm the observed behavior. The unmasked multiplication crossed the |t| = 4.5 threshold, whereas the shared multiplication and the other protected operations remained below it (Table IV and Fig. 7).

Masked multiplication and masked decoding, which test the protected core in isolation, stay well clear of the threshold; masked CCA2 decryption and CCA2 encryption sit closer to it because both traces also capture the unmasked CCA2 hashing, re-encryption, and comparison logic surrounding the protected core. Overall, no statistically significant leakage was detected in the evaluated operations under the applied test conditions.

F. Resistance to Fault-Injection Attacks The following results use the single-intervention logicalfault procedure of Section V-F; Table V summarizes 2,678 trials on the hardened builds. Preliminary testing had exposed two weaknesses: zeroing one comparison accumulator bypassed authentication, and zeroing the complete secret admitted an all-zero key in the selectable unshared-key build. Redundant comparisons and two-mask selection removed the former; structural validation and key erasure removed the latter in that configuration.

9

TABLE V L OGICAL FAULT- INJECTION CAMPAIGN SUMMARY.

Encryption efficiency 1.00

Fault

Injection target

Zeroing

Selection, verification, and decryption state Complete secret in unsharedkey build Forward/reverse selection masks Forward/reverse comparison accumulators Recovered decryption intermediate Comparisons, mask generation, and mask use Selector store and loop control

Zeroing Random Random Random Skip Skip Skip Skip Total

Encryption randomness and tag generation Sampling and validation in unshared-key build 27 targeted groups

location/value

Trials

Observed outcome

27

Safe rejection

3

Explicit key-generation error; key erased Safe rejection; both masks protected release Safe rejection; independent check remained Safe rejection by re-encryption check Safe rejection through redundant path Silent corruption of valid output Explicit error returned

512 2 000 100 18 6 6 6

Explicit error; invalid key rejected

2 678

No authentication bypass or weak-key output

Note: The six silent corruptions caused neither authentication bypass nor weak-key output. Tests used debugger-assisted single-point logical faults at addresses resolved from the evaluated ELF.

All 2,612 value-substitution trials safely rejected, and none produced authentication bypass or weak-key output. The six selector-store and loop-control skip trials reveal a narrower integrity limitation: skipping the final store or loop control silently corrupts a valid output, so output-selection duplication or a loop-completion check remains necessary. No authentication bypass, candidate release, weak key, crash, or hang was observed after hardening. Zeroing-campaign records did not independently log each pre-injection value, so an already-zero target cannot be distinguished retrospectively from an effective zeroing fault. The conclusions remain limited to the tested single-point logical model.

Power-SCA masking evidence

0.75 0.50

This work: Set 1 [15]: Cortex-M0 [19]: IoT-Basic Decryption efficiency

0.25

Constant-time evidence

CCA2-mechanism evidence Fault protection

Fig. 8. Normalized encryption/decryption cycle efficiency and documented security-feature evidence. The comparison uses the final protected Set 1 configuration for this work, the n = 256, q = 256 Cortex-M0 result from [15], and the n = 256, q = 2053 IoT-Basic result from [19]. Higher values are favorable, but the mixed platforms, moduli, and protection boundaries make the profiles descriptive rather than directly rank-equivalent.

Our trace uses the final, fully protected Set 1 configuration, including masked decryption, so that efficiency and feature evidence refer to the same boundary; this differs from Table VI, which retains the unmasked CCA2/fault boundary because the cited works report no equivalent masked variant. Since encryption is unaffected by masking, our final configuration leads encryption efficiency outright; for decryption, our masked result is compared against the Cortex-M0 implementation of Ebrahimi and Bayat-Sarmadi [15], which leads on this axis since it carries no masking overhead. Ma et al. [19] claim constant-time arithmetic, lightweight masking, and basic fault checks, but their Table 2 protection boundary is unclear and they do not demonstrate CCA2 security; those coordinates are therefore scored as claimed-only evidence. H. Discussion

G. Comparison with Prior Embedded Lattice Implementations Table VI compares our branch-free CCA2/fault-protected unmasked configuration with prior embedded Binary RingLWE implementations. The comparison excludes our sharedkey generation and first-order shared CPA decryption because the cited implementations do not report equivalent masking; schemes with substantially different arithmetic or constructions are omitted. Because the implementations do not expose a common benchmark boundary, Fig. 8 gives a normalized profile rather than a direct speedup claim. The chart’s six axes are scored by two separate rules. The two efficiency axes (encryption, decryption) use Ei,o = minj Cj,o /Ci,o for operation o ∈ {Enc, Dec}, where Cj,o is the reported cycle count of implementation j on operation o and the minimum is taken over all compared implementations. The remaining four axes (CCA2-mechanism, fault protection, constant-time, and power-SCA masking evidence) use an ordinal rubric: 1 denotes an implemented feature supported experimentally or formally, 0.5 a claim unvalidated at the reported boundary, and 0 a feature not demonstrated in the paper; zero is not evidence of absence.

The staged data show that byte packing, four-lane arithmetic, compact codecs, and buffered randomness accelerate RBLWE, whereas branch-free execution, CCA2-oriented verification, and sharing impose distinct costs. Cross-platform numbers remain indicative because schemes, parameters, security notions, and protected boundaries differ; our claim is a measurable transition from an accelerated CPA core to a hardened MCU implementation, not dominance over all prior work. The reported security and DFR estimates apply only to the original uniformly sampled binary parameters and bias-aware decoder, not automatically to our custom, non-ML-KEMcompatible PKE wrapper. Sharing covers CPA decryption but not its surrounding oracle and re-encryption logic; fault results cover the tested single-point logical model. Future work should extend the evaluation through independent benchmark replication, higher-resolution power measurements, broader leakage tests, physical and multi-fault campaigns, and formal wrapper analysis for deployment-appropriate parameters. VII. C ONCLUSION This paper mapped RBLWE onto a commodity Cortex-M33 MCU using byte-lane SIMD arithmetic, a packed message

10

TABLE VI E MBEDDED B INARY R ING -LWE PERFORMANCE COMPARISON . Scheme / Implementation

Platform

Variant / Security Level

Key Gen [Kcycles (ms)] Encrypt./Encaps. [Kcycles (ms)] Decrypt./Decaps. [Kcycles (ms)]

PQ-IoTCrypt [19] PQ-IoTCrypt [19]

ARM Cortex-M4F (168 MHz) ARM Cortex-M4F (168 MHz)

IoT-Basic (n=256, q=2053) IoT-Advanced (n=512, q=4093)

7 022.400 (41.8 ms) 26 241.600 (156.2 ms)

6 417.600 (38.2 ms) 24 141.600 (143.7 ms)

5 812.800 (34.6 ms) 21 806.400 (129.8 ms)

Fault-resilient BRLWE [15] Fault-resilient BRLWE [15]

AVR ATxmega128A1 ARM Cortex-M0

n=256, q=256 n=256, q=256

1 335.000 (39.8 ms† ) 1 481.000 (44.1 ms† )

2 691.000 (80.2 ms) 1 755.000 (52.3 ms)

4 037.000 (120.3 ms) 3 404.000 (101.4 ms)

ARM Cortex-M33 (39 MHz) n=256, q=256 330.053 (8.46 ms) 604.186 (15.49 ms) 871.055 (22.33 ms) ARM Cortex-M33 (39 MHz) n=256, q=128 332.078 (8.51 ms) 609.302 (15.62 ms) 879.130 (22.54 ms) ARM Cortex-M33 (39 MHz) n=512, q=256 1 105.646 (28.35 ms) 2 065.859 (52.97 ms) 3 043.904 (78.05 ms) † Note: Times use native clocks; KeyGen times are inferred from reported cycle/time pairs. This work’s three rows report cold-start, batched-TRNG results This work (Set 1) This work (Set 2) This work (Set 3)

for the branch-free + CCA2/fault configuration, without shared decryption. Platform, parameter, and protection differences preclude direct ranking.

codec, and a buffered Secure Element TRNG, yielding samecore speedups of 4.06×, 3.35×, and 3.01× for key generation, encryption, and decryption. On top of this accelerated core, we staged four countermeasures, constant-time execution, fault hardening, a CCA2-oriented FO-style wrapper, and first-order shared CPA decryption, reporting each layer’s cost individually. Binary-level verification confirmed these countermeasures survive compilation and caught a compiler-induced masking flaw, fixed in hand-written assembly. Dudect timing tests, component-level TVLA, and 2,678 fault trials found no exploitable leakage in the tested configurations, but surfaced one residual gap: an unduplicated output-selection step that a targeted instruction-skip fault can still corrupt, fixable by duplicating the store or adding a loop-completion check. The result is a measurable, staged transition from an accelerated CPA core to an implementation-hardened realization, with evidence and limitations reported at every stage. A RTIFACT AVAILABILITY Source code, build scripts, binary-audit material, and evaluation data are available at github.com/MuhammadAsimJavaid/ rbinlwe-efm32pg28. ACKNOWLEDGMENT The authors used Claude (Anthropic) to generate the initial scaffolding of Figs. 2, 4, and 8, Algorithms 1–3, and Tables I, II, and VI. All technical content and data are the authors’ own or drawn from cited work; the AI system generated no results, claims, or scientific content. Claude was also used for grammar and prose-flow editing. R EFERENCES [1] W. Buchanan and A. Woodward, “Will quantum computers be the end of public key encryption?” Journal of Cyber Security Technology, vol. 1, no. 1, pp. 1–22, 2017. [2] R. Avanzi, J. Bos, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, J. M. Schanck, P. Schwabe, G. Seiler, and D. Stehlé, “CRYSTALS-Kyber: Algorithm specifications and supporting documentation (version 2.0),” Specification document, submission to Round 2 of the NIST PostQuantum Cryptography Standardization Project, Mar. 2019. [Online]. Available: https://pq-crystals.org/kyber/data/kyber-specification-round2. pdf [3] G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. M. Kelsey, J. Lichtinger, Y.-K. Liu, C. A. Miller, D. Moody, R. Peralta, R. Perlner, A. Robinson, and D. Smith-Tone, “Status report on the third round of the NIST post-quantum cryptography standardization process,” National Institute of Standards and Technology, Gaithersburg, MD, USA, NIST Interagency/Internal Report 8413-upd1, Sep. 2022. [Online]. Available: https://doi.org/10.6028/NIST.IR.8413-upd1

[4] T. M. Fernández-Caramés, “From pre-quantum to post-quantum iot security: A survey on quantum-resistant cryptosystems for the internet of things,” IEEE Internet of Things Journal, vol. 7, no. 7, pp. 6457–6480, 2019. [5] J. Buchmann, F. Göpfert, T. Güneysu, T. Oder, and T. Pöppelmann, “High-performance and lightweight lattice-based public-key encryption,” in Proceedings of the 2nd ACM international workshop on IoT privacy, trust, and security, 2016, pp. 2–9. [6] V. Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” Journal of the ACM (JACM), vol. 60, no. 6, pp. 1–35, 2013. [7] A. Khalid, S. Bian, C. Wang, M. O’Neill, W. Liu et al., “Axrlwe: A multilevel approximate ring-lwe co-processor for lightweight iot applications,” IEEE Internet of Things Journal, vol. 9, no. 13, pp. 10 492–10 501, 2021. [8] P. He, T. Bao, J. Xie, and M. Amin, “Fpga implementation of compact hardware accelerators for ring-binary-lwe-based post-quantum cryptography,” ACM Transactions on Reconfigurable Technology and Systems, vol. 16, no. 3, pp. 1–23, 2023. [9] P. He, Y. Tu, J. Xie, and H. Jacinto, “Kina: Karatsuba initiated novel accelerator for ring-binary-lwe (rblwe)-based post-quantum cryptography,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 31, no. 10, pp. 1551–1564, 2023. [10] T. Bao, P. He, S. Bai, and J. Xie, “Tina: Tmvp-initiated novel accelerator for lightweight ring-lwe-based pqc,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 32, no. 5, pp. 870–882, 2023. [11] S. Ahmadunnisa and S. E. Mathe, “x2dl: A high throughput architecture for binary-ring-learning-with-error-based post quantum cryptography schemes,” IET Quantum Communication, vol. 5, no. 4, pp. 349–359, 2024. [12] ——, “Cnc: A lightweight architecture for binary ring-lwe based pqc,” Microprocessors and Microsystems, vol. 106, p. 105044, 2024. [13] P. He, T. Bao, and J. Xie, “High-performance instruction-set hardware accelerator for ring-binary-lwe-based lightweight pqc,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 2025. [14] T. Bao, P. He, D. Fujimoto, Y. Hayashi, and J. Xie, “Chirp: Compact and high-performance fpga implementation of unified hardware accelerators for ring-binary-lwe-based pqc,” ACM Transactions on Reconfigurable Technology and Systems, vol. 18, no. 2, pp. 1–27, 2025. [15] S. Ebrahimi and S. Bayat-Sarmadi, “Lightweight and fault-resilient implementations of binary ring-lwe for iot devices,” IEEE Internet of Things Journal, vol. 7, no. 8, pp. 6970–6978, 2020. [16] O. Regev, “On lattices, learning with errors, random linear codes, and cryptography,” Journal of the ACM (JACM), vol. 56, no. 6, pp. 1–40, 2009. [17] T. Oder, T. Schneider, T. Pöppelmann, and T. Güneysu, “Practical cca2secure and masked ring-lwe implementation,” IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 142–174, 2018. [18] M. Schneider, D. Lain, I. Puddu, N. Dutly, and S. Capkun, “Breaking bad: How compilers break constant-time implementations,” in Proceedings of the 20th ACM Asia Conference on Computer and Communications Security, 2025, pp. 1690–1706. [19] C. Ma, A. Shankar, S. Kumari, and C.-M. Chen, “A lightweight brlwebased post-quantum cryptosystem with side-channel resilience for iot security,” Internet of Things, vol. 28, p. 101391, 2024.

Related documents

• Efficient and Implementation-Hardened RBLWE on Commodity Cortex-M Microcontrollers#1217195
• Peregrino: A Full-Hardware Accelerator for the Complete Falcon Post-Quantum Digital Signature Scheme on Resource-Constrained Edge Devices#1105810
• GPU Acceleration of Learning With Errors KEMs Using OpenACC for Post-Quantum Cryptography#246447
• E-ReCON: An Energy- and Resource-Efficient Precision-Configurable Sparse nvCIM Macro for Conventional and Spiking Neural Edge Inference#1249392
• An Emerging NVM-Based On-Chip Training Architecture with Non-Ideality Mitigation Through Bipolar Weight Distributions#822363