FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

Post-quantum cryptography has become a critical area of study as industries prepare for the advent of cryptographically relevant quantum computers, which threaten to break widely used public-key algorithms such as RSA and Elliptic Curve Cryptography. In response, NIST has standardized several post-quantum cryptographic algorithms to secure future digital communications. Among these, FN-DSA stands out for offering the shortest signature sizes of any post-quantum signature standard approved by the agency. However, deploying FN-DSA on resource-constrained embedded systems and microcontrollers has presented a formidable engineering challenge.

The core difficulty in running FN-DSA on microcontrollers lies in its reliance on binary64 arithmetic, also known as double-precision floating-point arithmetic. Standard microcontrollers typically lack native hardware support for double-precision floating-point operations. As a result, when executing the FN-DSA signing process, these devices are forced to emulate FP64 arithmetic using long sequences of integer instructions. This software emulation introduces severe performance overhead, making the signing process unacceptably slow for many practical Internet of Things (IoT) and edge computing applications.

Prior attempts to accelerate FN-DSA on constrained platforms generally forced developers to make difficult compromises. Earlier researchers either modified the underlying arithmetic or altered the order of random sampling to achieve speed improvements. While these modifications yielded faster execution times, they introduced a major drawback: their signatures no longer matched the known-answer tests, commonly known as KATs, of the official reference implementation. Other approaches relied heavily on double-precision SIMD instructions, which traditional microcontrollers simply do not possess. These trade-offs created a dilemma between maintaining strict standards compliance and achieving the execution speeds required for real-world deployment.

The research team from Hansung University sidestepped these compromises by targeting the Arm Cortex-M55 processor, a modern core that features both a native double-precision floating-point unit and the M-Profile Vector Extension, often referred to as Helium. By leveraging these specific architectural capabilities, the researchers developed the first FN-DSA implementation that achieves full compliance with the reference implementation’s known-answer tests while executing in constant time and outperforming the reference code.

To accomplish this, the team deployed a dual-pronged strategy that harnesses the distinct strengths of the hardware architecture. The floating-point unit was put to work where the reference code previously relied on software emulation of complex operations using integer instructions. Meanwhile, the vector extension handled workloads where the architecture already excelled at computing with integers or fixed-point numbers.

Within the vector extension framework, the researchers vectorized the Number Theoretic Transforms using layer merging techniques. They also optimized the fixed-point Fast Fourier Transform required during key generation by employing split-word Q32 arithmetic operating across 32-bit lanes. On the floating-point unit side, bit-exact FP64 arithmetic was utilized to execute the FFT, LDL decomposition, splitting, merging, and signing sampler functions without altering any computational results or breaking standards compatibility.

Furthermore, the team tackled the computational drag of division operations during key generation. Instead of relying on traditional bit-by-bit division routines, they implemented exponent-normalized division. This approach successfully transforms the iterative divisions of key generation into a single execution of a hardware instruction with operand-independent latency, significantly reducing processing cycles.

Additional optimizations were directed toward the Keccak hash function, which is integral to the cryptographic pipeline. By implementing vectorized bit interleaving, the researchers accelerated every permutation required by the algorithm. To maximize throughput during verification tasks, they introduced request-level batching, a technique that processes four independent signature verification requests simultaneously. The resulting assembly code for both the vector extension and Keccak was then fine-tuned using SLOTHY, an advanced software optimization tool designed for instruction scheduling.

The performance gains achieved by these architectural optimizations are substantial. When compared against the standard reference implementation running on the same Arm Cortex-M55 core, the Hansung University team’s implementation demonstrated significant speedups across all major cryptographic operations. Key generation processes run up to 1.23 times faster, signature generation achieves up to a 1.93 times speedup, and signature verification is accelerated by up to 1.30 times. When utilizing the new batch verification method for four signatures simultaneously, the system delivers performance up to 1.75 times faster than standard execution.

By demonstrating that complex lattice-based cryptographic schemes like FN-DSA can run efficiently and natively on modern microcontrollers without sacrificing test vector compliance or constant-time guarantees, this research paves the way for secure, post-quantum IoT devices and embedded systems.