FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

As the global cybersecurity landscape prepares for the advent of cryptanalytically relevant quantum computers, standardization bodies like the National Institute of Standards and Technology have moved to finalize and deploy post-quantum cryptographic primitives. Among these, FN-DSA stands out for possessing the shortest signature sizes within NIST’s portfolio of post-quantum signature standards. These compact signatures are particularly valuable in environments where bandwidth and storage are severely limited. However, deploying FN-DSA on microcontrollers has historically presented a steep technical hurdle. Specifically, the signing process relies heavily on binary64 floating-point arithmetic, a requirement that traditional microcontrollers lack native hardware to support. On standard embedded chips, these operations must be emulated entirely using sequences of integer instructions, resulting in sluggish performance that can stall embedded systems.

Previous attempts to overcome this performance bottleneck have generally relied on compromises. Researchers have tried altering the underlying arithmetic or modifying the order of random sampling to make the computations more microcontroller-friendly. While these modifications can yield speed improvements, they come at a significant cost: their resulting signatures fail to match the known-answer tests, commonly referred to as KATs, established by the official reference implementation. Other historical acceleration attempts have depended on advanced double-precision Single Instruction, Multiple Data instructions, which standard microcontrollers simply do not possess. These deviations from the reference standard create compatibility headaches and complicate verification, limiting their practical deployment in strictly standardized cryptographic ecosystems.

The research team from Hansung University circumvented these limitations by focusing on the advanced architectural capabilities of the Arm Cortex-M55 processor. This specific core is equipped with both a native double-precision floating-point unit, known as an FP64 FPU, and the M-Profile Vector Extension, frequently referred to as Helium. Leveraging these dual hardware features allowed the researchers to develop the first FN-DSA implementation for the Cortex-M55 that achieves superior performance while strictly maintaining compliance with the reference implementation. Crucially, the new software reproduces the exact known-answer tests of the reference code and executes entirely in constant time, a vital security property that prevents side-channel attacks by ensuring operations take the same amount of time regardless of secret input data.

To achieve these performance gains, the team meticulously mapped different cryptographic tasks to the hardware components best suited for them. The researchers observed a clear division in how hardware pays off: the floating-point unit excels in areas where the reference implementation traditionally emulates complex operations with numerous integer instructions, whereas vector extensions shine in tasks that already compute with integers or fixed-point numbers. On the M-Profile Vector Extension side, the team vectorized the number theoretic transforms with layer merging techniques and handled the fixed-point fast Fourier transform required during key generation using split-word Q32 arithmetic executed across 32-bit lanes.

Meanwhile, the floating-point unit was put to work handling bit-exact FP64 calculations. This native hardware successfully computes the fast Fourier transform, LDL decomposition, splitting, merging, and the sampler phases of the signing operation without altering a single mathematical result. Furthermore, the team implemented exponent-normalized division, a technique that transforms the tedious, bit-by-bit divisions normally required during key generation into a single division instruction with operand-independent latency. This hardware-level optimization eliminates significant execution overhead during the key setup phase.

The performance optimizations extended beyond the core mathematical routines of FN-DSA to include the Keccak hash function, which is integral to the cryptographic scheme. The researchers implemented vectorized bit interleaving to accelerate every permutation required by Keccak. To maximize throughput further, they introduced request-level batching, an approach that processes four independent verification requests simultaneously. To ensure that these complex instructions ran as efficiently as possible on the hardware, the team utilized SLOTHY, an automated assembly optimization tool, to meticulously reschedule their M-Profile Vector Extension and Keccak assembly code.

The cumulative effect of these hardware-tailored optimizations is a substantial performance boost across every phase of the cryptographic lifecycle. When compared against the reference implementation running on the exact same Arm Cortex-M55 core, the Hansung University team’s key generation, signing, and verification routines achieved speedups of up to 1.23 times, 1.93 times, and 1.30 times faster, respectively. Moreover, when leveraging request-level batching to handle four signatures concurrently, the verification process became up to 1.75 times faster than the reference standard. These improvements demonstrate that advanced post-quantum algorithms can be executed efficiently on standard microcontroller hardware without abandoning strict compliance with cryptographic reference standards.