Evaluating the Tradeoffs in the Hardware Design of the LEDAcrypt Encryption Functions The confidentiality provided by widely employed asymmetric cryptosystems relying on the hardness of factoring large integers or computing discrete logarithms in a cyclic group will be jeopardized by the availability of quantum computers. As a consequence, the design of quantumcomputing resistant cryptographic primitives has gained traction lately, especially thanks to the U.S. National Institute of Standards and Technology initiative, which aims at selecting a portfolio of primitives for standardization. A prime position in the set of asymmetric encryption primitives is occupied by the ones relying on decoding random linear error correction codes as their trapdoor. Among these primitives, the LEDAcrypt cryptosystem was recently announced to be admitted to the second round of the standardization initiative, where the investigation of the implementation performance is the main focus. In this paper we analyze the possible hardware designs to implement fast polynomial multiplications tailored to the encryption functions of the LEDAcrypt key encapsulation mechanism, and public key encryption primitives. In particular, we describe two designs for binary polynomial multiplications and analyze the advantages provided by exploiting the sparse nature of one of the operands in LEDAcrypt multiplications, validating our designs on a Xilinx Artix 100.

Optimized Polynomial Multiplier Over Commutative Rings on FPGAs: A Case Study on BIKE In this paper, we present two constanttime FPGAbased polynomial multipliers for postquantum secure key encapsulation mechanisms based on quasicyclic codes, which are among round 2 candidates in the NIST PQC standardization process. The pipelined hardware architecture for polynomial multiplications proposed in this work are fully parameterized in terms of the size of the polynomial, and can be further tuned flexibly to achieve a tradeoff between time and area depending on individual needs. We also present a case study on the BIKE key generators which use these two polynomial multiplier architectures as building blocks. Compared with the stateoftheart hardware implementation of BIKE, the design proposed in this work is around 9xc3x97 faster in terms of runtime while maintaining an over 6xc3x97 smaller timearea product.