FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

The challenge of implementing post-quantum cryptography on microcontrollers has long centered on a difficult trade-off between mathematical compliance and hardware efficiency. FN-DSA is celebrated in the cryptographic community for offering the shortest signature sizes among NIST’s post-quantum signature standards, making it exceptionally attractive for environments where bandwidth and storage are at a premium. However, these compact signatures come with a significant computational cost. The scheme relies heavily on binary64 floating-point arithmetic. Because traditional microcontrollers lack native double-precision floating-point hardware units, these operations must be emulated using complex sequences of integer instructions. This emulation creates a severe performance bottleneck during the signing process, rendering standard implementations sluggish on edge devices and embedded systems.

Prior attempts to solve this performance hurdle have typically fallen into problematic compromises. Earlier optimization strategies either altered the underlying arithmetic or changed the order of random sampling to bypass the heavy floating-point requirements. While these modifications successfully improved execution speeds, they introduced a critical drawback: their generated signatures no longer matched the known-answer tests, commonly known as KATs, specified by the official reference implementation. Other historical acceleration attempts relied on double-precision SIMD instructions, which standard microcontrollers simply do not possess. For industrial applications, secure systems, and standardized protocols, deviating from reference KATs is a major obstacle because it complicates compliance verification, interoperability, and cryptographic certification.

The research team from Hansung University sidesteps these limitations by leveraging the specific hardware architecture of the modern Arm Cortex-M55 processor. This particular core bridges the historical gap between embedded processors and high-performance computing by featuring both a native double-precision floating-point unit and the M-Profile Vector Extension, which is widely known as Helium. By carefully combining these hardware capabilities, the researchers developed the first FN-DSA implementation for a microcontroller that achieves faster execution times than the reference implementation while strictly reproducing its known-answer tests and operating in constant time. Operating in constant time is a vital security requirement to prevent side-channel attacks, such as power analysis, that could otherwise leak secret cryptographic keys during execution.

To achieve these performance gains, the researchers mapped different parts of the cryptographic workload to the specific hardware components best suited to handle them, finding that the FPU excels where the reference implementation emulates complex operations with numerous integer instructions, while the M-Profile Vector Extension shines where algorithms already process integers or fixed-point numbers. On the vector extension side, the team vectorized the Number Theoretic Transforms using layer merging techniques. They also optimized the fixed-point Fast Fourier Transform required during key generation by employing split-word Q32 arithmetic operating across 32-bit lanes.

Concurrently, the processor’s floating-point unit handles bit-exact double-precision operations to execute the Fast Fourier Transform, LDL decomposition, splitting, merging, and the intricate samplers involved in the signing process without altering any mathematical results. Furthermore, the researchers introduced an exponent-normalized division technique that transforms the tedious bit-by-bit divisions typically required during key generation into a single VDIV.F64 instruction characterized by operand-independent latency. This clever adaptation eliminates data-dependent timing variations, reinforcing the constant-time execution profile of the overall cryptographic scheme.

The optimization efforts extend well beyond core arithmetic to encompass supporting algorithms like the Keccak hash function, which is fundamental to modern post-quantum schemes. By implementing vectorized bit interleaving, the research team accelerated every permutation cycle within the hash function. They also introduced request-level batching, a technique that allows the processor to handle four independent verification requests simultaneously. To ensure that these complex optimizations execute with maximum efficiency, the researchers utilized SLOTHY, an automated assembly optimization tool, to meticulously reschedule the MVE and Keccak assembly instructions for optimal pipeline throughput on the Cortex-M55 core.

The empirical results of this architectural alignment are substantial across every phase of the cryptographic lifecycle. When compared directly against the reference implementation running on the same Arm Cortex-M55 core, the Hansung University implementation achieves key generation speeds up to 1.23 times faster. The signing process, historically the most daunting bottleneck for floating-point lattice schemes on embedded hardware, sees an impressive speedup of up to 1.93 times. Meanwhile, signature verification runs up to 1.30 times faster. For applications that require processing multiple incoming authentications, the implementation of batch verification for four signatures simultaneously yields a performance boost of up to 1.75 times over the baseline.

These findings suggest a promising pathway for the deployment of robust post-quantum security measures in the Internet of Things, automotive systems, industrial control units, and other edge devices powered by modern embedded processors. By demonstrating that advanced lattice-based cryptography can run efficiently on microcontrollers without sacrificing mathematical standardization or timing security, the research provides a vital technical foundation for the next generation of secure, quantum-resistant hardware infrastructure.