Why Crypto in Hardware?

Software executes sequentially on general-purpose ALUs. Cryptographic algorithms expose massive data-level parallelism and fixed dataflow — ideal for dedicated circuits.

Accelerator Taxonomy

AES-128 Round Architecture

Each AES round applies four transformations to a 128-bit state matrix. Hardware maps each to a combinational block.

S-Box Implementation Strategies

SubBytes dominates AES area and critical path. The S-Box computes the multiplicative inverse in GF(2⁸) followed by an affine transformation.

AES-GCM Hardware

Galois/Counter Mode combines AES-CTR encryption with GHASH authentication. The GHASH unit requires a GF(2¹²⁸) multiplier — a second major hardware block alongside AES.

SHA-3 (Keccak) Hardware

Keccak operates on a 1600-bit state (5×5×64) through 24 rounds of θ, ρ, π, χ, ι permutations. Its structure maps naturally to hardware — no S-Box lookup tables needed.

RSA Hardware Architecture

RSA's core operation is modular exponentiation: C = M^e mod n. With a 2048-bit private exponent this is ~3,000 modular multiplications (2,048 squarings + ~1,000 multiplies) over 2048–4096-bit operands.

ECC Scalar Multiplication

ECC computes Q = k·P via repeated point addition and doubling over a 256-bit prime field. The hierarchy of operations creates a natural hardware decomposition.

Edwards25519 hardware: unified point add/double in 646 cycles, full scalar multiplication in 164,730 cycles at 117 MHz → 1.4 ms per operation on Virtex-5.

NIST PQC Standards & Hardware

NIST finalized three PQC standards in August 2024: two lattice-based (ML-KEM, ML-DSA) and one hash-based (SLH-DSA). The lattice schemes, and Falcon (FN-DSA, pending as FIPS 206), share a common bottleneck: polynomial multiplication, accelerated via the Number Theoretic Transform (NTT).

Number Theoretic Transform (NTT)

NTT is the finite-field equivalent of FFT. It converts O(n²) polynomial multiplication into O(n log n) operations modulo a prime q.

  Cooley-Tukey (CT):    a' = a + ω·b (mod q)
                         b' = a - ω·b (mod q)

  Gentleman-Sande (GS): a' = a + b     (mod q)
                         b' = (a - b)·ω (mod q)

NTT Hardware Architectures

PQC Accelerator SoC Integration

Real deployments integrate NTT engines into RISC-V or ARM SoCs via memory-mapped registers or custom instruction set extensions (ISEs).

Architecture based on CRYSTALS-Dilithium post-quantum SoC designs for wired-communication critical systems.

Side-Channel Attack Taxonomy

Algorithmically secure crypto can be broken by observing physical leakage during computation. Hardware designers must defend against all channels simultaneously.

Hardware Countermeasures

Threshold Implementation (TI)

TI splits every sensitive variable into shares — at least t·d+1 of them for a degree-t function at order d (3 shares for a quadratic function at first order) — that are processed separately. Even if an attacker observes glitch-induced transient leakage, no single share reveals information.

// Masked AES S-box, 2 shares, DOM-style (concept only, body omitted).
// A true TI needs 3+ shares; DOM gets by with d+1 by adding fresh randomness.
// Each share never sees the complete unmasked value

module ti_sbox (
  input  [7:0] x_share1, x_share2,  // Masked input shares
  input  [7:0] fresh_random,          // Fresh randomness per clock
  output [7:0] y_share1, y_share2    // Masked output shares
);
  // Non-linear layer uses cross-domain terms with fresh masks
  // Linear layers (affine transform) applied to each share independently
  // Area: a few kGE vs ~250–350 GE unmasked — roughly 10× overhead
endmodule

ASIC vs. FPGA Trade-offs

Crypto Instruction Set Extensions

Rather than a fully separate accelerator, ISEs add crypto-specific instructions to the CPU pipeline. They offer a middle ground between pure software and dedicated hardware.

Inline Encryption Engines

Modern network SoCs embed crypto engines directly in the data path. The CPU never touches plaintext packets — the engine encrypts/decrypts at wire speed.

SystemVerilog: AES Round (1/2)

module aes_round (
  input  logic [127:0] state_in,
  input  logic [127:0] round_key,
  input  logic         is_last_round,  // Skip MixColumns on round 10
  output logic [127:0] state_out
);
  logic [127:0] after_sub, after_shift, after_mix;

  // SubBytes: 16 parallel S-Box instances (composite field)
  genvar i;
  generate
    for (i = 0; i < 16; i++) begin : gen_sbox
      aes_sbox_cf u_sbox (
        .in  (state_in[8*i +: 8]),
        .out (after_sub[8*i +: 8])
      );
    end
  endgenerate

SystemVerilog: AES Round (2/2)

  // ShiftRows: fixed byte permutation (zero-cost in hardware — just wiring)
  assign after_shift = {
    after_sub[127:120], after_sub[ 87: 80], after_sub[ 47: 40], after_sub[  7:  0],
    after_sub[ 95: 88], after_sub[ 55: 48], after_sub[ 15:  8], after_sub[103: 96],
    after_sub[ 63: 56], after_sub[ 23: 16], after_sub[111:104], after_sub[ 71: 64],
    after_sub[ 31: 24], after_sub[119:112], after_sub[ 79: 72], after_sub[ 39: 32]
  };

  // MixColumns: GF(2^8) matrix multiply per column
  generate
    for (i = 0; i < 4; i++) begin : gen_mixcol
      aes_mixcolumn u_mix (
        .in  (after_shift[32*i +: 32]),
        .out (after_mix[32*i +: 32])
      );
    end
  endgenerate

  // AddRoundKey: 128-bit XOR
  assign state_out = (is_last_round ? after_shift : after_mix) ^ round_key;
endmodule

SystemVerilog: Composite Field S-Box (1/2)

// AES S-Box via tower field: GF(2^8) → GF((2^4)^2) → GF(((2^2)^2)^2)
// No ROM — pure combinational logic (~300 gates)
module aes_sbox_cf (
  input  logic [7:0] in,
  output logic [7:0] out
);
  logic [7:0] mapped, inv_mapped;
  logic [3:0] hi, lo, inv_hi, inv_lo;
  logic [3:0] sum_hl, sq_scale, prod, inv_d, t;

  // Step 1: Isomorphic mapping GF(2^8) → GF((2^4)^2)
  assign mapped = iso_map(in);     // 8×8 binary matrix multiply
  assign hi = mapped[7:4];
  assign lo = mapped[3:0];

SystemVerilog: Composite Field S-Box (2/2)

  // Step 2: Compute inverse in GF((2^4)^2)
  assign sum_hl   = hi ^ lo;                        // GF(2^4) add
  assign sq_scale = gf16_sq_scale(hi);               // hi² · λ (combined)
  assign prod     = gf16_mul(sum_hl, lo);             // (hi⊕lo) · lo
  assign t        = sq_scale ^ prod;                  // Norm: hi²λ ⊕ (hi⊕lo)·lo
  assign inv_d    = gf16_inv(t);                      // Inversion in GF(2^4)
  assign inv_hi   = gf16_mul(hi, inv_d);              // hi · inv_d
  assign inv_lo   = gf16_mul(sum_hl, inv_d);          // (hi⊕lo) · inv_d

  // Step 3: Inverse map + affine transformation
  assign inv_mapped = inv_iso_map({inv_hi, inv_lo});
  assign out        = affine_transform(inv_mapped);
endmodule

Each gf16_* function decomposes further into GF(2²) arithmetic — ultimately reducing to AND/XOR gates. The deepest path is ~22 XOR + ~12 AND gate delays.

SystemVerilog: NTT Butterfly (1/2)

// Cooley-Tukey NTT butterfly for ML-KEM (Kyber)
// q = 3329, coefficients are 12-bit
module ntt_butterfly #(
  parameter Q     = 3329,
  parameter WIDTH = 12
)(
  input  logic                clk, rst_n,
  input  logic [WIDTH-1:0]    a_in, b_in,     // Input coefficients
  input  logic [WIDTH-1:0]    omega,           // Twiddle factor (root of unity)
  output logic [WIDTH-1:0]    a_out, b_out     // Output coefficients
);
  logic [2*WIDTH-1:0] prod;
  logic [WIDTH-1:0]   omega_b, sum_val, diff_val;

  // Modular multiplication: ω · b (mod q) via Montgomery
  assign prod = omega * b_in;                   // Full-width multiply

  // Montgomery reduction: t = prod · q_inv mod R; result = (prod + t·q) >> R
  montgomery_reduce #(.Q(Q), .W(WIDTH)) u_mont (
    .product (prod),
    .result  (omega_b)
  );

SystemVerilog: NTT Butterfly (2/2)

  // Butterfly: a' = a + ω·b (mod q),  b' = a - ω·b (mod q)
  mod_add_sub #(.Q(Q), .W(WIDTH)) u_add (
    .a(a_in), .b(omega_b), .sum(sum_val), .diff(diff_val)
  );

  // Pipeline register
  always_ff @(posedge clk or negedge rst_n)
    if (!rst_n) begin a_out <= '0; b_out <= '0; end
    else        begin a_out <= sum_val; b_out <= diff_val; end
endmodule

SystemVerilog: Montgomery Reduction

// Multiplier-less Montgomery reduction for Kyber (q = 3329)
// Returns product · 2^(-16) mod q. Constants are shift-add friendly:
// q = 13·2^8 + 1 and -q^(-1) mod 2^16 = 3327 = 13·2^8 - 1
module montgomery_reduce #(
  parameter Q         = 3329,
  parameter NEG_Q_INV = 3327,   // -q^(-1) mod 2^16
  parameter W         = 12
)(
  input  logic [2*W-1:0]  product,   // 24-bit input (a × b), < q·2^16
  output logic [W-1:0]    result     // Reduced to [0, q)
);
  logic [15:0] t;
  logic [31:0] u;
  logic [W:0]  r;

  // Step 1: t = (product mod R) × (-q^(-1)) mod R,  R = 2^16
  assign t = product[15:0] * NEG_Q_INV[15:0];  // Low 16 bits only

  // Step 2: u = product + t × Q is divisible by R; r = u / R < 2q
  assign u = product + (t * Q);

  // Step 3: Conditional subtraction
  assign r = u[28:16];
  assign result = (r >= Q) ? (r - Q) : r[W-1:0];
endmodule

Key optimization: For Kyber's q=3329, the constant multiplies by 3327 and by q are each one shift and one add or subtract (13 = 8+4+1), so the reduction needs no hardware multiplier — only the ω·b product does. Because the result carries a factor 2⁻¹⁶, twiddles are stored in Montgomery form (ω·2¹⁶ mod q).

AES Implementation Comparison

Post-Quantum Hardware Benchmarks

Figures as reported by each design's authors; ATP = area-time product. Post-quantum hardware is rapidly maturing. Unified Kyber+Dilithium accelerators sharing NTT/Keccak datapaths will become the standard building block for PQC-ready SoCs.

Crypto Accelerator Design Flow

Emerging Hardware Challenges

References & Standards