System-Level Optimization Beyond Cryptographic Kernels: An ML-KEM Case Study on Arm Cortex-M7
Researchers cut ML-KEM cycles on Arm Cortex-M7 by up to 74.6% with system-level optimizations.
The paper studies ML-KEM on an Arm Cortex-M7, starting from a SLOTHY-optimized implementation across all three parameter sets. Beyond arithmetic kernels, the authors use memory hierarchy, tightly coupled memory, peripherals, clock configuration, and public-data reuse without changing the algorithm or wire formats. Profiles without auxiliary public state reduce cycles by up to 2.5%, while a reuse profile cuts encapsulation and decapsulation by up to 74.6% and 58.8%.
- Starts from a SLOTHY-optimized ML-KEM build on Cortex-M7.
- Covers all three ML-KEM parameter sets without changing wire formats.
- Profiles without auxiliary public state save up to 2.5% of cycles.
- Public-data reuse cuts encapsulation cycles by up to 74.6%.
Full article133 words · extracted from arxiv.org · click to collapse
Recent work on embedded post-quantum cryptography has focused primarily on instruction-level optimization, including arithmetic-kernel improvements, assembly tuning, register allocation, and instruction scheduling. Using the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) on an Arm Cortex-M7 as a case study, we examine the additional gains available from memory-hierarchy utilization, tightly coupled memory placement, peripheral integration, clock configuration, and deterministic public-data reuse. The evaluation starts from a state-of-the-art SLOTHY-optimized implementation and covers all three ML-KEM parameter sets. Without modifying the cryptographic algorithm or standardized wire formats, the evaluated profiles without auxiliary public state reduce cycles by up to 2.5%. A selected public-data-reuse profile reduces encapsulation and decapsulation cycles by up to 74.6% and 58.8%, respectively. These results demonstrate that substantial deployment gains remain after arithmetic-kernel optimization and motivate a two-stage methodology that also examines the surrounding execution system.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.01960