Patrick Karl
TUM School of Computation, Information and Technology, Technical University of Munich, Munich, Germany

Francesco Antognazza
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Alessandro Barenghi
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Gerardo Pelosi
Politecnico di Milano, Department of Electronics, Information and Bioengineering (DEIB), Milan, Italy

Georg Sigl
TUM School of Computation, Information and Technology, Technical University of Munich, Munich, Germany; Fraunhofer Institute for Applied and Integrated Security, Garching, Germany

Keywords: Hardware Accelerator, CROSS, Post-quantum Digital Signature, Restricted Syndrome Decoding Problem, FPGA

Abstract

In October 2024, the National Institute of Standards and Technology announced the second round candidates of its standardization effort for additional post-quantum signatures. One of these candidates is CROSS, a code-based scheme relying on the restricted syndrome decoding problem. In this work, we present the first hardware design of CROSS, delineating efficient implementation strategies for the critical components of the cryptographic scheme. Our architecture parallelizes rejection sampling in two dimensions, enabling to simultaneously generate multiple vectors, as well as multiple entries of these vectors. We implement hardware friendly modular reduction circuits requiring only shifts and additions to obtain a DSPfree design, and carefully schedule operations enabling to hide them behind more computationally intensive tasks. Depending on the chosen security level, our design generates a key pair in 8 to 148 μs, signs a message in 338 μs to 4.62 ms, and verifies a signature in 303 μs to 3.27 ms on an AMD Artix-7 device. We show that our design is among the fastest and smallest when compared with other on-ramp candidates, namely LESS, MEDS, MAYO, Raccoon and SDitH, and comparable to current standard-selected ML-DSA, FN-DSA, and SLH-DSA in terms of efficiency.