RISC-V Chip Design Brings Post-Quantum Cryptography Closer to FPGA Reality

Researchers have built and validated on a field-programmable gate array a tightly coupled RISC-V instruction-set extension that accelerates Classic McEliece, a code-based post-quantum encryption scheme. The work, published in Discover Computing by Haridhayal Maheswaran, Samuel Kennedy and Basel Halak, reports that the complete design occupies 10,531 adaptive logic modules on a Cyclone V FPGA and reaches a fitted maximum clock frequency of 118.89 MHz. Under matched asynchronous-memory simulation, the extension cuts encapsulation cycle counts by 87.4 percent and decapsulation by 86.1 percent, a 7.18-fold improvement over an unaccelerated baseline. The synchronous FPGA build completes both operations with host-generated keys, requiring 3,654,113 cycles for decapsulation.

Classic McEliece has been studied by cryptanalysts for more than four decades and rests on binary Goppa codes. The National Institute of Standards and Technology declined to standardise it in its 2025 fourth-round report, stating scepticism that the scheme would see widespread use, but the report nevertheless remained confident in the scheme’s security, subject to a qualification on certain parameter variants. Very large public keys and slow key generation remain the principal drawbacks. In June 2026, Clause 13 of Amendment 2 to ISO/IEC 18033-2 specified the Classic McEliece key-encapsulation mechanism, and the scheme is considered well suited to applications that are sensitive to ciphertext size and rarely transmit public keys. Those deployment costs motivate continued architectural work on making the scheme practical for embedded platforms.

The new study starts from an earlier RV32I instruction-set extension by Kennedy and Halak, which offered single-cycle GF(2^m) arithmetic, a transposed register file and Berlekamp-Massey decoding, with reported cycle reductions of 71.9 percent for encapsulation and 49.7 percent for decapsulation in matched simulation. That earlier design, however, left root finding and key generation in software and was never demonstrated on an FPGA, partly because its asynchronous-read memories could not be implemented in the target device’s block RAM. The authors asked a narrower architectural question: which additional Classic McEliece stages remain useful as tightly coupled instructions once data movement, memory inference and full-program execution are included?

To answer it, the team compared four candidate mappings at the instruction-set boundary. Support-list Chien search, fixed-size Gaussian elimination for minimal-polynomial generation and streaming systematic-form reduction for public-key generation were all retained. A direct-memory-access-assisted composeinv candidate was rejected after integrated profiling showed only a 1.0 to 1.1-fold improvement in the controlbits stage, because the recursive call structure repeatedly crosses the narrow memory boundary and erases the kernel-level benefit. The authors argue this negative result carries a broader lesson for accelerator selection: speeding up a bulk kernel is insufficient when the calling structure dominates the cost of moving data.

Making the inherited design executable on real hardware required substantial corrections. Bring-up of the inherited Berlekamp-Massey state machine revealed four defects, including an incorrect shift-loop bound, an inverted operand in a field-fraction computation, a mask computation broken by implicit 32-bit promotion, and missing zero-extension on multiplier inputs that leaked upper bits into results. The transpose path also used an ordinary register file where a cross-wired 64-by-64 transpose store was required, a defect that only integrated decapsulation tests exposed. The team moved the custom instructions into the standard RISC-V custom-0 opcode space, replacing binary-patched stubs with GCC .insn directives, which removes roughly 20 cycles of function-call overhead per invocation and lets the compiler schedule the custom instructions across surrounding code.

The measurements use deliberately reduced parameters, with the error-correcting capability t set to 2, the code length n to 48 and the field degree GFBITS to 12, matching the inherited baseline and keeping the design within the DE1-SoC board’s area budget. At these settings, the Berlekamp-Massey sub-operation falls from 5,832 to 40 cycles and the Gaussian-elimination engine reduces minimal-polynomial generation from 297 to 38 cycles, a 7.8-fold gain. The breakdown shows that support generation now dominates, absorbing more than 99 percent of decapsulation cycles in both memory regimes, because the residual cost lies in the Benes permutation network that drives support generation rather than in the accelerated decoder logic. Encapsulation, including SHA-256, takes 13,585 cycles on the FPGA.

Verification combined component-level and system-level testing. Each accelerator was checked in ModelSim against a software golden reference, with the finite-field inverse test enumerating all 4,096 field elements and the public-key generator compared byte by byte against its software reference inside the real keypair path. At system level, the processor passed one reference known-answer test and four directed weight-two error patterns chosen to cover the systematic part, the far codeword boundary, interior parity positions and a byte boundary. The authors note this directed set provides neither exhaustive nor statistical coverage, since 1,128 valid weight-two patterns exist, and a larger randomised or exhaustive hardware campaign remains necessary before any production deployment.

Key generation tells a more cautious story. The controlbits computation, which remains in software, pushes the complete key-generation path beyond a 300-million-cycle simulation budget, establishing only a lower bound: more than 60 seconds at the board’s 5 MHz execution clock, or more than 2.52 seconds if the fitted 118.89 MHz maximum were attainable by the complete system. The final latency remains unknown because execution did not complete, and the FPGA image instead loads keys generated by a host implementation. Complete on-device key generation was neither timed nor demonstrated on the board. Power analysis using Intel Quartus PowerPlay estimates 458.34 mW total for the fitted build at the 5 MHz board clock, with a single silicon decapsulation taking roughly 731 milliseconds and dissipating about 335 mJ, of which approximately 90 percent is static leakage.

The authors are explicit about the limits of the evidence. The results cover architectural analysis and a reduced-parameter FPGA implementation; production-parameter performance and side-channel resistance remain unevaluated, and no side-channel experiment was performed, so the design has no empirical resistance evidence. Fixed instruction latency alone provides neither constant-time software execution nor constant-power hardware behaviour, and decoder leakage has already enabled key recovery against Classic McEliece implementations in prior work. A scaling analysis for the full-size mceliece348864 parameter set shows that the packed matrix, the 255-kilobyte public key and processor memories do not fit together in the target FPGA’s roughly 496 kilobytes of block memory, so the toy-specialised accelerator blocks would require redesign rather than simple scaling.

Nevertheless, the study establishes something the field previously lacked: a complete, corrected, FPGA-fitted demonstration that a tightly coupled instruction-set extension can execute Classic McEliece encapsulation and decapsulation end to end on silicon, with the synchronous-memory costs that matched simulations typically omit. The cycle-area profiles show that the Berlekamp-Massey and Chien-search blocks deliver the largest cycle reduction per unit of logic, each closing a sub-operation almost entirely for under 1,000 adaptive look-up tables, while the streaming public-key generator is the largest single accelerator at 4,705 ALUTs and is justified only when on-device key generation is required. The authors conclude that a production Classic McEliece implementation requires full-parameter redesign together with side-channel and fault evaluation, but the architectural map of which stages reward tight coupling, and which do not, now rests on measured rather than simulated ground.

Subject of Research: FPGA validation of a RISC-V instruction-set extension accelerating Classic McEliece post-quantum cryptography

Article Title: Architectural exploration and FPGA validation of a RISC-V instruction-set extension for Classic McEliece

Article References: Maheswaran, H., Kennedy, S., & Halak, B. (2026). Architectural exploration and FPGA validation of a RISC-V instruction-set extension for Classic McEliece. Discover Computing, 29(1), Article 808. https://doi.org/10.1007/s10791-026-10770-1

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10770-1

Keywords: Classic McEliece, RISC-V, instruction-set extension, FPGA, post-quantum cryptography, Cyclone V, Berlekamp-Massey, Chien search, key generation, code-based cryptography, hardware acceleration, embedded security