SAPA: A Programmable Shared Polynomial Arithmetic Accelerator with Semantic Handoff Validation for Staged ML-KEM/ML-DSA Flows

Abstract

ML-KEM and ML-DSA are dominated by the same modular polynomial operators, which makes a shared FPGA datapath attractive. However, an accelerator that runs both primitives back to back has a failure mode that arithmetic checking alone cannot catch: a command can be locally correct yet bound to the wrong cross-command state. In a staged encapsulate–sign–verify flow, the verifier may accidentally read a stale source-message buffer and still emit a correct-looking accept result whenever the original and decapsulated messages are equal. This paper presents SAPA, a programmable and semantics-aware shared polynomial accelerator for staged ML-KEM-512 and ML-DSA-44. SAPA couples a host-programmable command interface, an NTT/INTT/base-multiply/reduction backend reused across both schemes, and a probe-and-poison handoff validator that makes the message stream consumed by verification observable to the host. On the ZCU102 platform, SAPA closes timing at 100 MHz (0.291 ns WNS) using 62043 LUTs, 98128 registers, 48 DSP slices, and 1.5 BRAM tiles, and completes one staged six-command flow in 131923 RTL cycles (705576 on-board cycles, 142 flows/s). The semantic validator costs only 1.36% of staged cycles, yet RTL regression and fault injection show that it rejects stale-source, wrong-base, and stale-status integration faults that a start/done/accept interface reports as success. These results indicate that the origin of consumed state should be treated as a first-class validation property of shared post-quantum accelerators.