Paper 2026/312

RISQrypt: Fast, Secure and Agile Hardware-Software Co-Design for Post-Quantum Cryptography

Abstract

In this paper, we present RISQrypt, the first unified architecture in the literature that implements ML-KEM (f.k.a. CRYSTALS-Kyber) and ML-DSA (f.k.a. CRYSTALS-Dilithium), two standardized lattice-based post-quantum cryptography (PQC) algorithms, with masking. RISQrypt is a hardware–software co-design framework that integrates dedicated cryptographic accelerators to speed up polynomial arithmetic, hashing, and mask-conversion operations, the latter being one of the primary bottlenecks in masked implementations of lattice-based PQC. Our design achieves low latency while providing both theoretical and practical side-channel security through formal proofs in the $t$-probing model and practical experiments. Specifically, the masked decapsulation of ML-KEM-768 requires $\mathbf{109K}$ clock cycles, while masked signing of ML-DSA-65 requires $\mathbf{1230K}$ clock cycles on average. These results demonstrate $\mathbf{11.3\times}$ time-performance improvement over existing masked implementations. Our time performance results for unprotected functions also outperform the existing work; achieving speed-ups of $\mathbf{10.64\times}$ and $\mathbf{8.94\times}$ for ML-KEM's encapsulation and decapsulation algorithms, respectively, and $\mathbf{1.14\times}$ and $\mathbf{2.23\times}$ for ML-DSA’s signature generation and verification algorithms, respectively, when compared to existing designs with similar resource usage. In addition, prior designs are more limited in scope, generally supporting only a single scheme and lacking either the side-channel protection or the unified, crypto-agile framework that enables support for both ML-KEM and ML-DSA as in our architecture. Leveraging the HW/SW co-design approach, the proposed architecture can be reprogrammed through firmware to support other (and future) PQC standards and algorithms sharing similar computational building blocks. As proof of concept, we demonstrate this capability by implementing FN-DSA (f.k.a. Falcon) and SLH-DSA (f.k.a. SPHINCS+).

Note: second revision