Keccak Acceleration for Post-Quantum Cryptography: A DMA-Enhanced RISC-V Architecture
(2026) EITM02 20261Department of Electrical and Information Technology
- Abstract
- Post-quantum cryptography increases the computational and data-movement demands placed on embedded processors. Many standardized and candidate schemes rely heavily on Keccak, SHA-3, and SHAKE operations, where the 1600-bit Keccak state is repeatedly updated and may become a bottleneck when accelerated through software-hardware interaction. This thesis presents a direct memory access (DMA)-enhanced Keccak acceleration architecture for a RISC-V-based system, aiming to reduce Keccak offloading overhead while preserving a non-intrusive memory-mapped programming model.
The proposed design provides two complementary acceleration paths. The first is a raw Keccak-f[1600] DMA backend that offloads permutation-level state transfer and... (More) - Post-quantum cryptography increases the computational and data-movement demands placed on embedded processors. Many standardized and candidate schemes rely heavily on Keccak, SHA-3, and SHAKE operations, where the 1600-bit Keccak state is repeatedly updated and may become a bottleneck when accelerated through software-hardware interaction. This thesis presents a direct memory access (DMA)-enhanced Keccak acceleration architecture for a RISC-V-based system, aiming to reduce Keccak offloading overhead while preserving a non-intrusive memory-mapped programming model.
The proposed design provides two complementary acceleration paths. The first is a raw Keccak-f[1600] DMA backend that offloads permutation-level state transfer and computation. The second is a one-shot SHAKE256 sponge DMA backend used for selected HQC operations, raising the acceleration boundary from a single permutation to a complete sponge transaction. Both accelerators are integrated into the X-HEEP system and evaluated on an FPGA platform using software-only, raw DMA, and hybrid configurations. Correctness is verified through key-encapsulation shared-secret checks and digital-signature verification across HQC, ML-KEM, ML-DSA, and SPHINCS+-SHAKE workloads.
Experimental results show that the raw DMA backend provides stable Keccak-layer acceleration of approximately 28 times across the evaluated workloads. The corresponding end-to-end improvement varies with the Keccak fraction of each algorithm: HQC benefits only modestly, ML-KEM and ML-DSA obtain moderate speedups, and SPHINCS+-SHAKE benefits the most because it is dominated by repeated Keccak invocations. Hardware counters further indicate that the Keccak datapath itself is fast, while DMA transaction and software-interface overhead remain visible.
These results show that memory-mapped DMA provides reusable and low-intrusion Keccak acceleration for RISC-V-based post-quantum cryptographic workloads, with portability and fallback capability traded against higher invocation overhead than tightly coupled custom-instruction or register-based co-processor interfaces. (Less) - Popular Abstract
- Today's online security relies on mathematical problems that ordinary computers struggle to solve. A large quantum computer could break several of these systems, which is why researchers are preparing post-quantum cryptography: new methods intended to remain secure in the quantum era.
Security alone is not enough. These algorithms must also run efficiently on real hardware, including the small processors used in connected devices, vehicles, sensors and industrial systems.
This project focused on Keccak, the technology behind SHA-3 and SHAKE. Keccak can be imagined as a digital blender: it takes data, mixes it in a carefully controlled way, and produces output that is extremely hard to reverse or predict. Many post-quantum algorithms... (More) - Today's online security relies on mathematical problems that ordinary computers struggle to solve. A large quantum computer could break several of these systems, which is why researchers are preparing post-quantum cryptography: new methods intended to remain secure in the quantum era.
Security alone is not enough. These algorithms must also run efficiently on real hardware, including the small processors used in connected devices, vehicles, sensors and industrial systems.
This project focused on Keccak, the technology behind SHA-3 and SHAKE. Keccak can be imagined as a digital blender: it takes data, mixes it in a carefully controlled way, and produces output that is extremely hard to reverse or predict. Many post-quantum algorithms use this blender again and again, making it an attractive target for hardware acceleration.
The challenge is that Keccak works on a large internal state of 1600 bits. Even if the hardware mixer is fast, time can still be lost moving data between the processor, memory and accelerator. This project therefore studied a DMA-enhanced Keccak accelerator for a RISC-V-based system. DMA, or direct memory access, gives the accelerator something like its own delivery service: it can fetch data from memory, process it, and write the result back without asking the processor to move every piece by hand.
The design used two acceleration paths. One speeds up the basic Keccak operation so it can be reused by several post-quantum algorithms. The other accelerates a complete SHAKE256 operation for selected HQC tasks, moving a larger piece of work into hardware. The accelerator was tested in an FPGA prototype based on the X-HEEP RISC-V platform with workloads including HQC, ML-KEM, ML-DSA and SPHINCS+-SHAKE.
The key result was that the Keccak part became about 28 times faster with the raw DMA accelerator. Full applications did not all speed up by the same amount: SPHINCS+-SHAKE benefited strongly because it uses Keccak heavily, while HQC improved only modestly because much of its time is spent elsewhere. (Less)
Please use this url to cite or link to this publication:
https://lup.lub.lu.se/student-papers/record/9230814
@misc{9230814,
abstract = {{Post-quantum cryptography increases the computational and data-movement demands placed on embedded processors. Many standardized and candidate schemes rely heavily on Keccak, SHA-3, and SHAKE operations, where the 1600-bit Keccak state is repeatedly updated and may become a bottleneck when accelerated through software-hardware interaction. This thesis presents a direct memory access (DMA)-enhanced Keccak acceleration architecture for a RISC-V-based system, aiming to reduce Keccak offloading overhead while preserving a non-intrusive memory-mapped programming model.
The proposed design provides two complementary acceleration paths. The first is a raw Keccak-f[1600] DMA backend that offloads permutation-level state transfer and computation. The second is a one-shot SHAKE256 sponge DMA backend used for selected HQC operations, raising the acceleration boundary from a single permutation to a complete sponge transaction. Both accelerators are integrated into the X-HEEP system and evaluated on an FPGA platform using software-only, raw DMA, and hybrid configurations. Correctness is verified through key-encapsulation shared-secret checks and digital-signature verification across HQC, ML-KEM, ML-DSA, and SPHINCS+-SHAKE workloads.
Experimental results show that the raw DMA backend provides stable Keccak-layer acceleration of approximately 28 times across the evaluated workloads. The corresponding end-to-end improvement varies with the Keccak fraction of each algorithm: HQC benefits only modestly, ML-KEM and ML-DSA obtain moderate speedups, and SPHINCS+-SHAKE benefits the most because it is dominated by repeated Keccak invocations. Hardware counters further indicate that the Keccak datapath itself is fast, while DMA transaction and software-interface overhead remain visible.
These results show that memory-mapped DMA provides reusable and low-intrusion Keccak acceleration for RISC-V-based post-quantum cryptographic workloads, with portability and fallback capability traded against higher invocation overhead than tightly coupled custom-instruction or register-based co-processor interfaces.}},
author = {{Lin, Teng}},
language = {{eng}},
note = {{Student Paper}},
title = {{Keccak Acceleration for Post-Quantum Cryptography: A DMA-Enhanced RISC-V Architecture}},
year = {{2026}},
}