Post-Quantum Cryptography (PQC) schemes, such as Learning with Errors (LWE), rely on adding Gaussian noise to arithmetic operations to achieve security against quantum adversaries. Efficient generation of this noise is critical for hardware implementations, particularly in resource-constrained environments like IoT devices. Traditional approaches employ Gaussian samplers to produce discrete Gaussian noise, but these methods introduce significant area overhead and latency, limiting their practical applicability. In this work, we propose a novel hardware architecture that generates Gaussian-like noise using controlled XOR-based bit-flip operations integrated directly into arithmetic circuits. Our approach achieves up to a$3 \times$reduction in area compared to conventional hardware Gaussian samplers, while introducing negligible delay. The resulting architectures provide an efficient and lightweight solution for noise injection, making them highly suitable for deployment in constrained hardware platforms.

The standardization of post-quantum cryptography (PQC) has led to the adoption of ML-KEM, a lattice-based key encapsulation mechanism derived from CRYSTALS-Kyber. ML-KEM heavily relies on polynomial multiplication over the Module Learning With Errors (MLWE) problem, efficiently implemented using the Number Theoretic Transform (NTT). While the NTT significantly reduces computational complexity, its irregular memory access patterns and high arithmetic intensity pose challenges for efficient software execution, especially in constrained environments. Consequently, hardware acceleration has become essential for enabling practical ML-KEM deployment in embedded and edge systems. Recent research has proposed several hardware accelerators for the NTT, but often without demonstrating their effectiveness in accelerating full matrix-vector products within ML-KEM. Designing such accelerators requires careful architectural trade-offs involving memory organization, data movement, parallelism, and system integration. The main contribution of this paper is a comprehensive assessment of communication, memory arrangement, and architectural overheads in NTT accelerators. We analyze state-of-the-art NTT acceleration techniques for ML-KEM and we propose a hardware architecture optimized for efficient matrixvector multiplication. Our NTT-based accelerator is integrated into a RISC-V System-on-Chip (SoC), and we evaluate the impact of key architectural choices (e.g., parallelism on the butterfly units, latency of communication and memory arrangement) on area and performance.

International audience

This paper presents a performant and compact hardware accelerator for the ML-KEM algorithm, compliant with the NIST FIPS 203 specification and implemented in a 22nm ASIC technology. The proposed design supports all three standardized security levels (ML-KEM-512, -768, and -1024) using a unified, parameter-agnostic architecture that avoids logic duplication. The design relies exclusively on SRAM blocks for storage, completely eliminating FIFOs and intermediate buffers, while flip-flops are used only in timing-critical paths to achieve high-frequency operation with minimal area overhead. Among all known ASIC implementations, our architecture achieves the best normalized area-time product across all ML-KEM parameter sets, demonstrating efficiency and scalability, while also delivering the lowest power and energy per operation among state-of-the-art solutions. These results make the proposed design a strong candidate for real-world post-quantum cryptographic deployments on constrained hardware and IoT platforms.

The increasing deployment of digital communications in modern society has heightened the need for security and privacy, particularly within the Internet-of-Things (IoT) domain, where cost-effective implementations remain a challenge. Post-quantum cryptography (PQC) schemes based on hard learning problems, such as learning with errors (LWEs) and learning parity with noise (LPN), have gained significant attention due to their robustness against quantum attacks. A key challenge in these cryptographic schemes is the generation of error distributions, which must maintain secrecy and adhere to specific statistical properties. Traditional approaches rely on complex two-phase sampling chains, making hardware implementations both resource-intensive and vulnerable to physical attacks. To address these challenges, inexact or approximate computing has been explored as a means of generating errors. The learning parity with physical noise (LPPN) scheme was introduced as an alternative, leveraging controllable computational inaccuracies instead of explicit error sampling. Initially demonstrated using frequency–voltage Over-Scaling techniques on a 65-nm technology, its viability on advanced semiconductor nodes remains uncertain. In this work, we implement the LPPN technique on a 22-nm fully depleted silicon-on-insulator (FD-SOI) technology, assessing the limitations of conventional voltage–frequency Over-Scaling. Furthermore, we propose the use of back-gate voltage scaling, a unique capability of FD-SOI, to enhance error controllability. Experimental results from both simulations and on-chip measurements demonstrate that back-gate voltage scaling improves the precision of error generation, reducing the sensitivity factor of the error probability by up to four times compared to conventional methods.

Post-quantum cryptography (PQC) has garnered significant attention across various communities, particularly with the National Institute of Standards and Technology (NIST) advancing to the fourth round of PQC standardization. One of the leading candidates is Hamming Quasi-Cyclic (HQC), which received a significant update on February 23, 2024. This update, which introduces a classical dense-dense multiplication approach, has no known dedicated hardware implementations yet. The innovative Core-V eXtension InterFace (CV-X-IF) is a communication interface for RISC-V processors that significantly facilitates the integration of new instructions to the Instruction Set Architecture (ISA), through tightly connected accelerators. In this paper, we present a TightlY-coupled accelerator for RISC-V for Code-based cryptogrAphy (TYRCA), proposing the first fully tightly-coupled hardware implementation of the HQC-PQC algorithm, leveraging the CV-X-IF. The proposed architecture is implemented on the Xilinx Kintex-7 FPGA. Experimental results demonstrate that TYRCA reduces the execution time by 94% to 96% for HQC-128, HQC-192, and HQC-256, showcasing its potential for efficient HQC code-based cryptography.

HQC is a quantum-resistant cryptographic key encapsulation mechanism, recently selected by NIST as a future standard. Polynomial multiplication is one of the most critical operations in HQC. Due to side-channel security concerns, the previously-used sparse-dense method was recently replaced by classical dense-dense multiplication implemented using Karatsuba’s algorithm. This change has made polynomial multiplication the primary performance bottleneck, accounting for approximately 95% of the total execution time. This paper presents an alternative polynomial multiplication technique for HQC: the Frobenius Additive Fast Fourier Transform (FAFFT), which provides significant algorithmic-level performance improvements. We also present ANDROMEDA, the first state-of-the-art hardware implementation of FAFFT, and evaluate its performance impact by integrating our solution in a resourceconstrained RISC-V-based System-on-Chip scenario. Experimental results show that our solution improves HQC performance by approximately $9.64 \times$ and $19.22 \times$ across its security levels, making HQC more practical for real-world deployment.

2.5D and 3D integrated circuits (IC) are the natural evolution of traditional 2D SoCs. 2.5D and 3D integration is the process of assembling pre-manufactured chiplets in an interposer or in a stack. This process can damage the chiplets or lead to faulty connections. Thus, the importance of post-bond test of chiplets. The IEEE Std 1838(TM)-2019 (IEEE 1838) design-for-testability (DFT) standard defines mandatory and optional structures for accessing DFT functions on the chiplet. Compliant chiplets form a DFT network that can be exploited by attackers to violate the confidentiality or integrity of the message transmitted over the serial path. In this work, we combine a message integrity verification system with a scan encryption mechanism to protect the scan chain of an IEEE 1838-compliant DFT implementation. The scan encryption prevents unauthorized actors from writing meaningful data into the scan chain. Message integrity verification makes messages from untrustworthy sources detectable. In conjunction, both security primitives protect the scan chain from malicious chiplets on the stack, scan-based attacks, and brute force attacks. The proposed solution causes less than 1% area overhead on designs composed of more than 5 million gates and less than 1% test time overhead for typical DFT implementations.

In today’s digital landscape, cryptography plays a vital role in ensuring communication security through encryption and authentication algorithms. While traditional cryptographic methods rely on hard mathematical problems for security, the rise of quantum computing threatens their effectiveness. Post-Quantum Cryptography (PQC) algorithms, like CRYSTALSKyber, aim to withstand quantum attacks. Recently standardized, CRYSTALS-Kyber is a lattice-based algorithm designed to resist quantum attacks. However, its implementation faces computational challenges, particularly with Keccak-based functions, which are crucial for security and upon which the FIPS 202 standard is based. Our paper addresses this technological challenge by designing a FIPS 202 hardware accelerator to enhance CRYSTALS-Kyber efficiency and security. We chose to implement the entire FIPS 202 standard in hardware in order to widen the applicability of the accelerator to all possible algorithms that rely on such hash functions, taking care to provide realistic assumptions on system-level integration inside a System-on-Chip (SoC). We provide results in terms of area, frequency, and clock cycles for both ASIC and FPGA targets. An area reduction of up to $22.3 \%$ is achieved with respect to state-ofthe-art solutions. In addition, we integrated the accelerator inside a 32-bit RISC-V based security-oriented SoC, where we show a strong performance gain on CRYSTALS-Kyber execution. The design presented in this paper performs better in all Kyber1024 primitives, with an improvement up to $3.21 \times$ in Kyber-KeyGen.

In an era where embedded systems play an increasingly vital role in critical domains like electric mobility, healthcare, industry, or infrastructure monitoring, the demand for real-time data processing is paramount. This paper addresses the challenges posed by high sensor data rates and limited processing power of microcontrollers (MCUs) in these applications. It introduces a novel computational method leveraging the Serial Ferroelectric RAM (FeRAM) architecture, along with the Computational SRAM concept, and will be called Compute-In-Place (CIP). This exploration of CIP Serial FeRAM reveals its potential for improving predictability, energy efficiency and security in high-throughput processing of large volumes of sensor data. Unlike conventional computing architectures, CIP Serial FeRAM lightens the MCU's computational load, reduces latency and improves energy efficiency by enabling computational tasks within memory. This paper emphasizes the flexibility of CIP Serial FeRAM for diverse real-time tasks, paving the way for more performance, efficient and adaptable critical embedded systems.

Systems on a chip have seen their surface area increased by a factor of 10 and their consumption multiplied by 5 during the last ten years. Each technological node that enabled this integration has also added new constraints challenging the overall system reliability. In addition, the integration of analog/RF blocks adds specific issues, in particular the high cost of the required test equipment. It is therefore necessary to improve test and reliability solutions in order to guarantee the production yield and the system life-time. Moreover, the massive increase in the use of communicating systems has introduced security as a cornerstone of their development. The entire hardware production flow is therefore subject to security and trust issues requiring the development of dedicated test solutions. In this paper, we focus on LIRMM contributions in the HADES project especially with details on Embedded Test Instruments (ETIs) for reliability of digital ICs, low-cost RF test based on indirect DC measurements or digital ATE capture, management of secure scan access.

The globalized supply chain in the Integrated Circuit (IC) industry raises several security concerns such as overproduction, IP piracy and Hardware Trojan insertion. Logic locking has emerged as a potential countermeasure to address these issues. However, its efficiency is challenged by various attacks, especially oracle-guided attacks based on Boolean Satisfiability (SAT) solvers. These attacks rely on the possibility for an attacker to control and observe in the field the internal state of a functional IC, which acts as an oracle. This ability to control/observe the IC states is offered by scan chains, typically used for IC production testing. In this paper, we propose a method, complementary to logic locking, to prevent such attacks. This method introduces a scan chain controller with a key-based authentication mechanism, in order to prevent unauthorized access to the scan chains once the IC is deployed in the field. The solution can be coupled with any logic locking technique at the cost of negligible area overhead. Furthermore, it is secure against state-of-the-art attacks and supports full testing.

Standard test infrastructures, such as IEEE Std. 1149.1 (JTAG), IEEE Std. 1500 and IEEE Std. 1687 (IJTAG), are widely used in nowadays Integrated Circuits (ICs). However, they pose an important security challenge to the designers because of the high controllability and observability they offer through the Test Access Port (TAP). For instance, malicious users can exploit test infrastructures in order to access the internal scan chains of crypto-cores and perform scan attacks. Moreover, these infrastructures connect all the devices of the system to the same network. For this reason, the data sent to a target device are potentially visible to all the others. Consequently, this poses a threat to the confidentiality of data content. The encryption of test data is a countermeasure that has been conceived in order to overcome these threats. In this paper, we propose a new secure version of the JTAG infrastructure, relying on stream-based encryption.