Multiplying Not-So-Big Integers with FFTs

Sat, 04 Jul 2026 00:00:00 +0000

This first-author research project, Finding and Pushing the Crossover on Large Modern OoO ARM CPUs, studies where NTT-based multiplication becomes practical for not-so-big integer sizes. The paper is available as and was accepted for presentation at the CHES 2026 Poster Session.

The project develops two generations of constant-time NTT-based multiplication for Cortex-A76. The second generation targets smaller operand sizes through tighter range bounds, redesigned 256/512-point NTT organization, fused reconstruction, and shorter carry and instruction-dependency chains.

Key Features

NEON-optimized NTT kernels: Developed constant-time fused NTT kernels in AArch64 assembly using ARM NEON instructions.
Multiplication pipeline: Combined Barrett and Montgomery arithmetic, Good’s trick, CRT reconstruction, and chunking and dechunking.
Crossover result: The second-generation two-unknown-input multiplier outperforms target-tuned variable-time GMP by 6.25% at 5,632 bits and 16.66% at 8,448 bits, placing the observed crossover at or below 5,632 bits.
Montgomery multiplication: The one-known-input implementation improves over OpenSSL’s Neon path by 5.19%-44.40% across the evaluated 5,120-10,240-bit sizes.
OpenSSL integration: End-to-end RSA verification and encryption improve by 15.98%-51.58% across RSA-5120, RSA-6144, RSA-8192, and RSA-10240.
Formal verification: Verified optimized assembly kernels with CryptoLine for algebraic correctness, range safety, and equivalence after Slothy scheduling, then used HOL Light to compose higher-level multiplication specifications.

Cryptography Engineering on Cortex-M4

Thu, 02 Jul 2026 00:00:00 +0000

This project is the final project for Cryptography Engineering (2025 Fall) at National Taiwan University, lectured by Matthias J. Kannwischer. It focuses on aggressive performance optimization of two modern cryptographic primitives on resource-constrained embedded systems.

The project implements highly optimized versions of:

ML-KEM (FIPS 203): NIST’s lattice-based post-quantum key encapsulation mechanism
X25519 (ECDH25519): Elliptic Curve Diffie-Hellman key exchange

Target Platform: ARM Cortex-M4 microcontroller
Constraints: Constant-time execution, strict code-size budgets for NTT routines

Key Optimizations

X25519 (ECDH25519)

Finite Field Arithmetic (mod p = 2^255 - 19): Hand-optimized assembly for fe25519_mul (field multiplication) and fe25519_sqr (field squaring), achieving 81-85% cycle reduction.
Constant-Time Scalar Multiplication: No secret-dependent branches or table indexing to prevent timing side-channel attacks.
Fixed-Base Acceleration: Window method with precomputed tables using constant-time selection, reducing fixed-base scalar multiplication by up to 94% against the course baseline.

ML-KEM (FIPS 203)

NTT/iNTT Kernels: Optimized Number-Theoretic Transform operations with reduced memory traffic, layer fusion, and loop unrolling, achieving 2.85-3.79x speedup.
Polynomial Arithmetic (mod q = 3329): Leveraged ARMv7E-M DSP instructions (SIMD 16-bit operations) for packed polynomial addition and subtraction, achieving 2-2.2x speedup.
Code-Size Budgeting: NTT routines implemented under strict per-function size constraints while maintaining performance.
Course-Baseline Result: Reduced the cycle count of ML-KEM poly_ntt by up to 62% under the same benchmarking setup.