FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

The breakthrough addresses a long-standing performance bottleneck in the deployment of modern post-quantum cryptography on edge devices and embedded systems. FN-DSA is notable for offering the shortest signature sizes among NIST’s approved post-quantum signature standards, making it an exceptionally attractive option for memory-limited environments where communication bandwidth and storage overhead are at a premium. However, putting FN-DSA into practice on standard microcontrollers has historically presented a severe engineering challenge. The signing algorithm specified by the standard relies heavily on binary64 floating-point arithmetic. Because traditional microcontrollers lack native hardware support for double-precision floating point, these complex operations must be emulated using software-level integer instructions, resulting in sluggish execution times that hinder real-world adoption.

Prior attempts to accelerate FN-DSA on small processors have typically forced developers to make difficult compromises. Earlier speedup methodologies often altered the underlying arithmetic or modified the order in which random sampling is conducted. While these adjustments successfully improved execution speed, they introduced a major compliance issue: the resulting signatures no longer matched the known-answer tests, commonly known as KATs, established by the official reference implementation. Other historical acceleration strategies relied on double-precision SIMD instructions, hardware capabilities that standard microcontrollers simply do not possess. These constraints left engineers searching for a solution that could simultaneously deliver high performance, strict adherence to reference KATs, and robust protection against side-channel attacks through constant-time execution.

The research team at Hansung University resolved this dilemma by turning their attention to the Arm Cortex-M55 processor, a modern embedded core that features both a dedicated double-precision floating-point unit and the M-Profile Vector Extension, often referred to as Helium. On this advanced hardware platform, the researchers engineered the first FN-DSA implementation that preserves the exact known-answer tests of the reference code while executing in constant time and outperforming the reference baseline. This achievement represents a major step forward for secure embedded computing, proving that advanced post-quantum algorithms can run efficiently on hardware designed for Internet of Things devices and edge controllers without requiring modifications to standard compliance test vectors.

To extract maximum performance from the Cortex-M55 architecture, the researchers carefully partitioned tasks between the processor’s vector extension and its floating-point unit, aligning each algorithmic operation with the hardware component best suited to handle it. On the M-Profile Vector Extension side, the team vectorized the number theoretic transforms using layer merging techniques. They also optimized the fixed-point fast Fourier transform utilized during key generation by implementing split-word Q32 arithmetic operating across 32-bit lanes. These vector-level optimizations allow the microcontroller to process multiple data elements concurrently, dramatically reducing the clock cycles required for polynomial arithmetic and transform operations.

Concurrently, the team harnessed the processor’s floating-point unit to handle the demanding arithmetic requirements of the signing process. Bit-exact FP64 operations execute the fast Fourier transform, LDL decomposition, splitting, merging, and the crucial sampler routines of the signing phase without altering a single mathematical result, thereby guaranteeing complete compliance with the reference standard. Furthermore, the researchers introduced exponent-normalized division to streamline key generation. This technique transforms the traditional, time-consuming bit-by-bit divisions required during key generation into a single division instruction with operand-independent latency, removing a major source of computational drag and protecting against certain types of timing side-channel vulnerabilities.

The optimization effort extended beyond core signature math to encompass cryptographic hashing and execution scheduling. For the Keccak permutation operations underpinning the signature scheme, the researchers implemented vectorized bit interleaving to accelerate every permutation round. To maximize hardware utilization during verification, they introduced request-level batching, a technique that allows the processor to handle four independent verification requests simultaneously. To ensure that these complex software structures executed with maximum efficiency and security, the team employed SLOTHY, an automated assembly optimization tool, to meticulously reschedule the MVE and Keccak assembly code for the Cortex-M55 pipeline.

The combined impact of these hardware-software co-design strategies is substantial across all phases of the cryptographic lifecycle. When tested on the Arm Cortex-M55 core, the new implementation achieves key generation speeds up to 1.23 times faster than the reference implementation. The performance gains are even more pronounced in the signing phase, which runs up to 1.93 times faster, and in signature verification, which achieves up to a 1.30-fold speedup. Moreover, when leveraging request-level batching to process four signatures at once, the system’s batch verification throughput increases by up to 1.75 times compared to processing them individually on the baseline reference code.

Analyzing the broader architectural implications of their work, the researchers observed a clear division of labor within the Cortex-M55 silicon. The floating-point unit delivers exceptional value in areas where the reference implementation would otherwise be forced to emulate complex operations using long chains of integer instructions. Meanwhile, the M-Profile Vector Extension shines in routines where the underlying algorithms already rely on integers or fixed-point arithmetic. By mapping each computational phase to the hardware feature best equipped for it, the Hansung University team has established a new benchmark for post-quantum cryptographic efficiency on embedded microcontrollers, paving the way for secure, quantum-resistant communications in resource-constrained environments.