ML-KEM Key Encapsulation IP Core

The KiviPQC™-KEM is a hardware accelerator for post-quantum cryptographic operations. It implements the Module Lattice-based Key Encapsulation Mechanism (ML-KEM), standardized by NIST in FIPS 203. This mechanism realizes the appropriate procedures for securely exchanging a shared secret key between two parties that communicate over a public channel using a defined set of rules and parameters. The KiviPQC™-KEM supports key generation, encapsulation, and decapsulation procedures, making it suitable for both (client/server) sides of key exchange.

The engine supports all three parameter sets for ML-KEM, i.e. ML-KEM-512, ML-KEM-768, and ML-KEM-1024. It is based on a RISC-V-like SoC topology and includes a 32-bit RISC-V-based processor. The resulting shared key is of 32 bytes. Designed for straightforward integration, the communication with the host is accomplished via an AMBA® AXI4-Lite Subordinate port.

Two versions are available: a Fast (F) and a Tiny (T) version. The Fast (F) includes hardware crypto accelerators, a hardware timer module, and a crossbar interconnect module for internal data routing. The Tiny (T) version is a more compact architecture, targeting low area, with no hardware crypto accelerators. Both versions are currently offered with a software implementation of a Random Byte Generator (RBG), however, they are able to be integrated with an external (third-party) entropy source and RBG, via a fully customized interface, depending on the entropy/RBG selection.

The KiviPQC™-KEM provides hardware acceleration for computationally intensive operations while maintaining a small footprint and can be integrated into any system-on-chip (SoC) for ASIC or FPGA implementation. Beyond that, it combines a minimal attack surface with modest resource requirements for future-proof and quantum-safe systems.

NIST FIPS Compliant

• Module Lattice-based Key Encapsulation Mechanism (ML-KEM)
  • NIST FIPS 203
• All three ML-KEM parameter sets
• 512 / 768 / 1024

Versions

• Fast (F): Enhanced performance, with balanced area
• Tiny (T): Compact architecture, targeting low area

Enhanced Security

• Self-contained engine with a minimal attack surface
• Protection against timing-based side channel attacks

Resource-efficient Acceleration

• Hardware offloading and acceleration of time-consuming PQC operations
  • 600MHz, with 83k or less eq. gates in modern ASICs (F)
• Minimal logic utilization
  • 35k or less eq. gates, at 100MHz in modern ASICs (T)

Straightforward SoC Integration

• Lightweight, simple-control AMBA® AXI4 Interface
• Re-usable design, LINT-clean

• The KiviPQC™-KEM realizes a quantum-safe exchange of a shared secret key between two parties (client and server) communicating over a public channel. During the key sharing, the client generates a decapsulation key and an encapsulation key, keeps the first as private and sends the second as public to the server. The server generates a copy of the shared key and an associated ciphertext using the client’s encapsulation key and sends it to the client. Finally, the client generates a copy of the same shared key using the ciphertext received from the server and the kept private decapsulation key.

• The core offers quantum-resistant security for a wide range of applications. In public-key infrastructure and cloud security, it ensures long-term confidentiality and integrity for sensitive information. It can play a vital role in safety-critical infrastructure and networks, safeguarding communication and exchange channels from potential threats. In the realm of secure IoT device communication, the core provides strong cryptographic support to protect shared secret keys. Additionally, it is well-suited for hardware security modules (HSMs) and Trusted Platform Modules (TPMs), enhancing secure key management and cryptographic processing. Its capabilities extend to supporting MACsec key agreement (MKA) protocols for secure Ethernet communications, Internet Key Exchange (IKEv2) protocols, strengthening VPN and secure network authentication mechanisms, and edge computing.

The core is available in RTL (System Verilog) source code.

Its deliverable package includes the following:

• Self-checking HDL testbench
• Hardware Abstraction Layer (HAL) and driver for the application processor
• Sample simulation & synthesis scripts
• User documentation