Implementing and Benchmarking Three LatticeBased PostQuantum Cryptography Algorithms Using SoftwareHardware Codesign It has been predicted that within the next tenfifteen years, quantum computers will have computational power sufficient to break current publickey cryptography schemes. When that happens, all traditional methods of dealing with the growing computational capabilities of potential attackers, such as increasing key sizes, will be futile. The only viable solution is to develop new standards based on algorithms that are resistant to quantum computer attacks and capable of being executed on traditional computing platforms, such as microprocessors and FPGAs. Leading candidates for new standards include latticebased postquantum cryptography (PQC) algorithms. In this paper, we present the results of implementing and benchmarking three latticebased key encapsulation mechanisms (KEMs) that have progressed to Round 2 of the NIST standardization process. Our implementations are based on a softwarehardware codesign approach, which is particularly applicable to the current stage of the NIST PQC standardization process, where the large number and high complexity of the candidates make traditional hardware benchmarking extremely challenging. We propose and justify the choice of a suitable systemonchip platform and design methodology. The obtained results indicate the potential for very substantial speedups vs. purely software implementations, reaching 28x for encapsulation and 20x for decapsulation.

A HighLevel Synthesis Approach to the SoftwareHardware Codesign of NTTBased PostQuantum Cryptography Algorithms Due to an emerging threat of quantum computing, one of the major challenges facing the cryptographic community is a timely transition from traditional publickey cryptosystems, such as RSA and Elliptic Curve Cryptography, to a new class of algorithms, collectively referred to as PostQuantum Cryptography (PQC). Several promising candidates for a new PQC standard can have their software and hardware implementations accelerated using the Number Theoretic Transform (NTT). In this paper, we present an improved hardware architecture for NTT, with the hardwarefriendly modular reduction, and demonstrate that this architecture can be efficiently implemented in hardware using HighLevel Synthesis (HLS). The novel feature of the proposed architecture is an original memory writeback scheme, which assists in preparing coefficients for performing later NTT stages, saving memory storage used for precomputed constants. Our design is the most efficient for the case when log2N is even. The latency of our proposed architecture is approximately equal to (N log2(N) 3N)4 clock cycles. As a proof of concept, we implemented the NTT operation for several parameter sets used in the PQC algorithms NewHope, FALCON, qTESLA, and CRYSTALSDILITHIUM.