Paper 2026/2352
X-Wing on Cortex-M85: Architecture-Aware Integration and End-to-End Evaluation
Abstract
X-Wing combines ML-KEM-768 and X25519 for hybrid key establishment. On Cortex-M85, we adapted the coefficient representation and storage order of an MVE NTT to the existing ML-KEM path and optimized data-format transformations and X25519 arithmetic while preserving draft-10. During encapsulation, the two X25519 results share an inversion. We compared the eight-technique integrated implementation B8 with the baseline A0 in the same executable. Across ten paired comparisons from five independent reflashes of one EK-RA8M1 board, the minimum reported cycle reductions were 18.61% for key generation, 18.89% for encapsulation, 12.25% for decapsulation reusing an expanded key, and 15.22% for decapsulation including seed expansion. Nonvolatile storage increased by 35,692 B, including a 33,024 B fixed-base table. We separately report the cost and validation of B8S, which corrects identified secret-sign-dependent operand-address selections in B8. Some key-varying tests retained timing signals after this correction. Their causes remained partly unresolved, so no whole-program constant-time pass is claimed for B8S.
Metadata
- Available format(s)
-
PDF
- Category
- Implementation
- Publication info
- Preprint.
- Keywords
- X-WingHybrid KEMML-KEMX25519Cortex-M85M-profile Vector ExtensionEmbedded cryptographic optimization
- Contact author(s)
-
rhcp030418 @ gmail com
hwajeong84 @ gmail com - History
- 2026-10-07: approved
- 2026-10-05: received
- See all versions
- Short URL
- https://ia.cr/2026/2352
- License
-
CC0
BibTeX
@misc{cryptoeprint:2026/2352,
author = {Do-Yun Park and Hwa-Jeong Seo},
title = {X-Wing on Cortex-M85: Architecture-Aware Integration and End-to-End Evaluation},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/2352},
year = {2026},
url = {https://eprint.iacr.org/2026/2352}
}
