ML-KEM and ML-DSA Post-Quantum Engine With Side-Channel and Glitch Countermeasures
Full offload of ML-KEM and ML-DSA, the NIST post-quantum standards. Private keys remain in secure internal key slots behind a single AXI4-Lite interface, with an optional countermeasure configuration providing side-channel, fault and glitch attack protection.
Whole post-quantum operations behind one AXI4-Lite interface, with private keys held in internal key slots
ML-KEM-512, ML-KEM-768 and ML-KEM-1024 (FIPS 203), with key generation, encapsulation and decapsulation selected per operation.
ML-DSA-44, ML-DSA-65 and ML-DSA-87 (FIPS 204), with key generation, signing and verification selected per operation.
Private keys are generated in internal key slots and used from there. Software refers to each key by its slot number. Key slots and secret memory are cleared on command, from a hardware input and after every reset.
The shared secret of a key establishment goes directly to StealthKey or another key store. A configuration option also returns it to the host for key schedules that run in software.
A dedicated input connects to StealthKey or another approved DRBG.
An AXI4-Lite host interface with a completion interrupt starts every operation. The core is delivered in Verilog or VHDL.
Choose the Standard or Fast configuration, or a configuration with ML-KEM or ML-DSA alone, to fit your area budget.
ML-KEM-1024 and ML-DSA-87 are the parameter sets that CNSA 2.0 requires. StealthPQ is part of the CNSA 2.0 Security Suite.
Every algorithm passes NIST's ACVTS test vectors. An ACVP harness with validation support is available as an option.
ML-KEM and ML-DSA protect against the threat of quantum computers. Side-channel and glitch attacks target the hardware that runs them, so the protection must be built into the implementation. The countermeasure configuration offers the same standards and host interface, with additional protection for high-assurance applications.
Masking of all secret-dependent operations.
Over 30 specific protections, including a dual-lockstep controller.
Detected faults lock the core until all keys are erased.
Area and performance figures for the countermeasure configuration are available on request.
| Standards | FIPS 203 ML-KEM-512, ML-KEM-768 and ML-KEM-1024, and FIPS 204 ML-DSA-44, ML-DSA-65 and ML-DSA-87 |
| Host Interface | AXI4-Lite with a completion interrupt |
| Key Storage | Internal key slots with zeroization |
| Configurations | Standard and Fast, ML-KEM or ML-DSA only, and countermeasure |
| Software | StealthAPI library, Linux driver and wolfSSL integration |
| Deliverables | Verilog or VHDL RTL, a test suite with NIST ACVP vectors, a C header and documentation |
| AMD Versal AI Edge | Microchip PolarFire SoC | Altera Agilex 5 | ||||
|---|---|---|---|---|---|---|
| Standard | Fast | Standard | Fast | Standard | Fast | |
| Max Frequency | 200 MHz | 200 MHz | 120 MHz | 120 MHz | 155 MHz | 155 MHz |
| Logic | 17.0K LUT6 | 22.6K LUT6 | 34.4K 4LUT | 45.6K 4LUT | 15.5K ALM | 19.0K ALM |
| Flip-Flops | 10.4K | 13.2K | 15.6K | 22.5K | 20.0K | 24.2K |
| Block RAM | 43 RAMB36+ 5 RAMB18 | 73 RAMB36+ 5 RAMB18 | 80 LSRAM+ 6 uSRAM | 140 LSRAM+ 6 uSRAM | 90 M20K | 150 M20K |
| Multipliers | 13 DSP58 | 26 DSP58 | 27 Math | 54 Math | 13 DSP | 25 DSP |
Post-place-and-route results for the core alone on a mid-range device of each family, without the countermeasure option. Results vary with device, tools and design.
| Operations per Second at 200 MHz | Standard | Fast | ||||
|---|---|---|---|---|---|---|
| Key Generation | Encapsulation | Decapsulation | Key Generation | Encapsulation | Decapsulation | |
| ML-KEM-512 | 16,80011.9 k cycles | 12,40016.0 k cycles | 8,55023.4 k cycles | 22,2009.0 k cycles | 17,20011.6 k cycles | 12,00016.7 k cycles |
| ML-KEM-768 | 10,80018.4 k cycles | 8,61023.2 k cycles | 6,04033.1 k cycles | 15,00013.3 k cycles | 12,40016.1 k cycles | 8,73022.9 k cycles |
| ML-KEM-1024 | 7,60026.3 k cycles | 6,30031.7 k cycles | 4,50044.4 k cycles | 10,80018.4 k cycles | 9,27021.6 k cycles | 6,60030.3 k cycles |
| Key Generation | Signing | Verification | Key Generation | Signing | Verification | |
| ML-DSA-44 | 7,42026.9 k cycles | 1,180169 k cycles | 5,42036.9 k cycles | 9,31021.5 k cycles | 1,950103 k cycles | 7,25027.6 k cycles |
| ML-DSA-65 | 4,91040.7 k cycles | 703284 k cycles | 3,89051.4 k cycles | 6,05033.0 k cycles | 1,190167 k cycles | 5,19038.5 k cycles |
| ML-DSA-87 | 3,46057.8 k cycles | 613326 k cycles | 2,77072.0 k cycles | 4,23047.2 k cycles | 1,010196 k cycles | 3,64054.9 k cycles |
Rates scale with the clock frequency of each family. Signing figures are averaged over the expected number of attempts. StealthPQ is available for AMD Versal, UltraScale+, UltraScale and 7 Series, Microchip PolarFire, PolarFire SoC, SmartFusion 2 and IGLOO2, and Altera Agilex, Arria 10, Stratix 10 and Cyclone 10 FPGAs, and for ASICs.
A test suite including the NIST ACVP test vectors of both standards.
The interface conventions of the StealthCores family, in Verilog or VHDL, with comprehensive documentation.
Decades of cryptographic experience, with dedicated integration support.
Designed for commercial, aerospace and defense applications.
Contact StealthCores for area and performance figures for your target device, and for help choosing the configuration that fits your design.