LM-PQC-K is a post-quantum cryptographic IP core for hardware offloading of key establishment in FPGA and SoC designs.
The engine implements ML-KEM — the Module-Lattice-Based Key-Encapsulation Mechanism standardised as FIPS 203 — in all three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024. Key generation, encapsulation and decapsulation are performed entirely in hardware, including the number-theoretic transform, the sampling algorithms, the byte encoding and compression, and the Keccak sponge the standard is built on.
The core is delivered as vendor-neutral SystemVerilog and builds from one source on AMD, Altera and Efinix devices. It presents four AXI4-Stream data ports and an AXI4-Lite register map, and public and secret material never share a port in either direction. An ANSI C driver is provided for fast integration into the target platform.
Measured FPGA results
Product top, out of context, constrained at the target clock. AMD and Efinix report LUTs, Altera reports ALMs; the two are never combined.
| Device | Configuration | Logic | FF | Memory | DSP | Fmax |
|---|---|---|---|---|---|---|
| Altera Agilex 3A3CW135BM16AE6S · quartus-pro 26.1.1 | KEM_1024=1, KEM_512=1, KEM_768=1 | 7,656 ALM | 7,086 | 174 Kb M20K | 14 | 175.0 MHztarget 175 |
| AMD Kintex UltraScale+xcku3p-ffva676-1-e · vivado 2026.1 | KEM_1024=1, KEM_512=1, KEM_768=1 | 11,208 LUT | 4,302 | 12 BRAM | 16 | 301.8 MHztarget 300 |
| Efinix Titanium Ti375Ti375N1156 · efinity 2026.1 | KEM_1024=1, KEM_512=1, KEM_768=1 | 16,481 LUT | 4,726 | 32 RAM | 26 | 213.4 MHztarget 175 |
Features
Key encapsulation
- ML-KEM-512, ML-KEM-768, ML-KEM-1024, selectable at run time
- Key generation, encapsulation and decapsulation
- Implicit rejection on decapsulation, exactly as FIPS 203 requires
Standards
- FIPS 203 complete, including the input checks of sections 7.2 and 7.3
- FIPS 202 Keccak sponge, SHA3-256/512 and SHAKE128/256 as the standard uses them
Security
- Constant-time datapath. Execution time and control flow do not depend on secret data, so the core resists timing analysis and simple power analysis by construction
- Public and secret material on separate ports, in both directions, so a secret path can be routed through a protected region of the SoC and seen to be so at the pins
- No key material at any register address
- Pre-operational known-answer self-test after every reset de-assert, with data output inhibited until it passes
- Working memories and internal buffers zeroised at the end of every operation
Integration
- AMBA AXI4-Lite control and four AXI4-Stream data interfaces
- Two delivery tops: complete AXI product, or bare engine for a custom fabric
- Single clock domain, single reset
- ANSI C driver, UVM RAL, IP-XACT, SystemRDL register description
Applications
- TLS and IKEv2 key establishment with post-quantum security
- Hybrid key exchange alongside classical ECDH
- Secure boot and firmware update key transport
- Machine-to-machine and IoT session establishment
- Long-lifetime systems exposed to harvest-now-decrypt-later capture
- Root-of-trust and HSM subsystems
Block diagram
Parameter sets
| Set | Security category | Encapsulation key | Decapsulation key | Ciphertext | Shared secret |
|---|---|---|---|---|---|
| ML-KEM-512 | 1 | 800 B | 1 632 B | 768 B | 32 B |
| ML-KEM-768 | 3 | 1 184 B | 2 400 B | 1 088 B | 32 B |
| ML-KEM-1024 | 5 | 1 568 B | 3 168 B | 1 568 B | 32 B |
All three are present in every build and selected at run time. Sizes are reported by the driver from the hardware rather than held in a table, so a host never carries a second source of truth for FIPS 203.
Interfaces
Four AXI4-Stream ports carry data and an AXI4-Lite interface carries control. The port count is a security property rather than a convenience: public and secret material never share a wire, in either direction.
| Interface | Type | Width | Carries |
|---|---|---|---|
s_axil | AXI4-Lite slave | 32-bit data, 7-bit address | configuration, command, status, counters, lengths |
s_axis_pub | AXI4-Stream sink | 32-bit | encapsulation key, ciphertext, key-check subject |
s_axis_sec | AXI4-Stream sink | 32-bit | seeds, decapsulation key, private half of a key pair |
m_axis_pub | AXI4-Stream source | 32-bit | encapsulation key, ciphertext |
m_axis_sec | AXI4-Stream source | 32-bit | decapsulation key, shared secret |
irq | level | 1-bit | completion and error events |
enable low holds the engine idle and inhibits every output.
Security properties
Timing and simple power analysis. The datapath is constant-time with respect to secret data: no branch, no memory address and no loop bound depends on a secret value. The core therefore resists timing analysis and simple power analysis by construction, which is the resistance ML-KEM's own structure admits.
Differential power analysis is out of scope. No masking, no shuffling and no randomised addressing is implemented. An application facing an attacker able to collect many traces requires countermeasures above this core.
Implicit rejection is preserved. A decapsulation whose ciphertext does not check returns a shared secret derived from the rejection seed rather than an error, exactly as FIPS 203 specifies, so an attacker learns nothing about whether a ciphertext was well-formed. No status bit reports it, deliberately.
The randomness is the integrator's. The core contains no random bit generator. FIPS 203 section 3.3 requires the seeds from an approved RBG at the security strength of the parameter set, and the driver takes that from a caller-supplied callback. LM-DRBG is one such source.
Pre-operational self-test. A known-answer test runs once after every reset de-assert and data output is inhibited until it passes. This is the module-level obligation FIPS 140-3 places on a cryptographic module; the certificate itself is an accreditation of a whole module by a laboratory and is not claimed here.
Configuration
| Parameter | Type | Effect |
|---|---|---|
| parameter set | run time (cfg) | ML-KEM-512, 768 or 1024 |
KEM_512, KEM_768, KEM_1024 | elaboration | compile a set out if it is not needed |
| top choice | elaboration | full AXI product, or bare engine |
Resources and performance
Resource utilisation and maximum clock frequency for each target device are measured out of context and published per target in the measured results on this page. AMD and Efinix rows report LUTs; Altera rows report ALMs, and the two are never combined. Cycle counts per operation and parameter set are published with them.
Deliverables
| Item | Contents |
|---|---|
| RTL | parameterised SystemVerilog, vendor-neutral |
| Model | bit-accurate C++ model |
| Registers | SystemRDL source plus six generated exports |
| Verification | UVM RAL, formal property wrappers, ACVP/KAT vector drivers |
| Software | ANSI C reference driver with generated header and JSON |
| Packaging | IP-XACT, IEEE 1685-2022 |
| Implementation | runnable flow script per FPGA vendor, file list, SDC |
| Documentation | integration guide |