LM-PQC-D is a post-quantum cryptographic IP core for hardware offloading of digital signature generation and verification in FPGA and SoC designs.
The engine implements ML-DSA — the Module-Lattice-Based Digital Signature Algorithm standardised as FIPS 204 — in all three parameter sets, ML-DSA-44, ML-DSA-65 and ML-DSA-87. Key generation, signing and verification are performed entirely in hardware, including the number-theoretic transform, the rejection samplers, the rounding and hinting functions, the bit packing and the Keccak sponge the standard is built on.
The core is delivered as vendor-neutral SystemVerilog and builds from one source on AMD, Altera and Efinix devices. It presents five AXI4-Stream data ports and an AXI4-Lite register map, and the message, public material and secret material never share a port. An ANSI C driver is provided for fast integration into the target platform.
Measured FPGA results
Product top, out of context, constrained at the target clock. AMD and Efinix report LUTs, Altera reports ALMs; the two are never combined.
| Device | Configuration | Logic | FF | Memory | DSP | Fmax |
|---|---|---|---|---|---|---|
| Altera Agilex 3A3CW135BM16AE6S · quartus-pro 26.1.1 | DSA_44=1, DSA_65=1, DSA_87=1 | 11,939 ALM | 29,641 | 995 Kb M20K | 6 | 195.7 MHztarget 195 |
| AMD Kintex UltraScale+xcku3p-ffva676-1-e · vivado 2026.1 | DSA_44=1, DSA_65=1, DSA_87=1 | 14,877 LUT | 7,925 | 32 BRAM | 12 | 250.1 MHztarget 235 |
| Efinix Titanium Ti375Ti375N1156 · efinity 2026.1 | DSA_44=1, DSA_65=1, DSA_87=1 | 25,365 LUT | 9,005 | 126 RAM | 24 | 240.8 MHztarget 230 |
Features
Digital signature
- ML-DSA-44, ML-DSA-65, ML-DSA-87, selectable at run time
- Key generation, signing and verification
- Hedged or deterministic signing, selected per signature
- External-mu entry points for messages larger than the message port
- Internal entry points taking M′ already formed, for HashML-DSA constructions
Standards
- FIPS 204 complete, including the rounding, hinting and rejection loops
- FIPS 202 Keccak sponge, SHAKE128 and SHAKE256 as the standard uses them
Security
- Constant-time datapath. Execution time and control flow do not depend on secret data, so the core resists timing analysis and simple power analysis by construction
- Message, public and secret material on separate ports, so a secret path can be routed through a protected region of the SoC and seen to be so at the pins
- No key material at any register address
- Working memories and internal buffers zeroised at the end of every operation
Integration
- AMBA AXI4-Lite control and five AXI4-Stream data interfaces
- Two delivery tops: complete AXI product, or bare engine for a custom fabric
- Single clock domain, single reset
- ANSI C driver, UVM RAL, IP-XACT, SystemRDL register description
Applications
- Code signing, secure boot and firmware update authentication
- Certificate issuance and validation with post-quantum security
- Hybrid signatures alongside classical ECDSA or RSA
- Device identity and attestation
- Long-lifetime systems whose signatures must remain valid for decades
- Root-of-trust and HSM subsystems
Block diagram
Parameter sets
| Set | Security category | Public key | Private key | Signature | RBG strength |
|---|---|---|---|---|---|
| ML-DSA-44 | 2 | 1 312 B | 2 560 B | 2 420 B | 128 bits |
| ML-DSA-65 | 3 | 1 952 B | 4 032 B | 3 309 B | 192 bits |
| ML-DSA-87 | 5 | 2 592 B | 4 896 B | 4 627 B | 256 bits |
All three are present in every build and selected at run time; together they cost marginally more area than one alone. Sizes are reported by the driver from the hardware rather than held in a table, so a host never carries a second source of truth for FIPS 204.
Interfaces
Five AXI4-Stream ports carry data and an AXI4-Lite interface carries control. The port count is a security property rather than a convenience: the message, public material and secret material never share a wire.
| Interface | Type | Width | Carries |
|---|---|---|---|
s_axil | AXI4-Lite slave | 32-bit data, 6-bit address | configuration, command, status, counters, lengths |
s_axis_msg | AXI4-Stream sink | 32-bit, tkeep | the message to sign or verify |
s_axis_pub | AXI4-Stream sink | 32-bit | public key, signature, context string |
s_axis_sec | AXI4-Stream sink | 32-bit | seed, private key, hedging randomness |
m_axis_pub | AXI4-Stream source | 32-bit | public key, signature |
m_axis_sec | AXI4-Stream source | 32-bit | private key |
irq | level | 1-bit | completion and error events |
enable low holds the engine idle and inhibits every output.
Security properties
Timing and simple power analysis. The datapath is constant-time with respect to secret data: no branch, no memory address and no loop bound depends on a secret value. The core therefore resists timing analysis and simple power analysis by construction.
Differential power analysis is out of scope. No masking, no shuffling and no randomised addressing is implemented. An application facing an attacker able to collect many traces requires countermeasures above this core.
Hedged and deterministic signing are both offered, per signature. Hedged draws 32 bytes from the integrator's RBG; deterministic substitutes zeros, making the signature a function of the key and message alone. Deterministic signing is reproducible and testable; hedged signing is the stronger choice against fault attacks. The selection is explicit rather than a default.
A signature that does not verify is a result, not an error. Verification returns success with a validity flag of zero. No exceptional path distinguishes a forgery from a bus fault.
The randomness is the integrator's. The core contains no random bit generator. FIPS 204 section 3.6.3 requires an approved RBG at the security strength of the parameter set, and the driver takes that from a caller-supplied callback. LM-DRBG is one such source.
Configuration
| Parameter | Type | Effect |
|---|---|---|
| parameter set | run time (cfg) | ML-DSA-44, 65 or 87 |
DSA_44, DSA_65, DSA_87 | elaboration | compile a set out if it is not needed |
| top choice | elaboration | full AXI product, or bare engine |
Resources and performance
Resource utilisation and maximum clock frequency for each target device are measured out of context and published per target in the measured results on this page. AMD and Efinix rows report LUTs; Altera rows report ALMs, and the two are never combined. Cycle counts per operation and parameter set are published with them; signing is a rejection loop, so its cost is reported as a distribution rather than a single number.
Deliverables
| Item | Contents |
|---|---|
| RTL | parameterised SystemVerilog, vendor-neutral |
| Model | bit-accurate C++ model |
| Registers | SystemRDL source plus six generated exports |
| Verification | UVM RAL, formal property wrappers, ACVP/KAT vector drivers |
| Software | ANSI C reference driver with generated header and JSON |
| Packaging | IP-XACT, IEEE 1685-2022 |
| Implementation | runnable flow script per FPGA vendor, file list, SDC |
| Documentation | integration guide |