A One-Bitstream KV260 Accelerator for ML-KEM-512 and ML-DSA-44 with Split KEM Datapaths and Sign-Path Early Rejection

Abstract

Post-quantum hardware implementation is moving from accelerating a single primitive or arithmetic kernel to executing multiple standardized primitives in one security flow. Existing FPGA studies have optimized Kyber/ML-KEM, Dilithium/ML-DSA, and number theoretic transform (NTT) kernels separately, but many results do not show how key establishment, message signing, and signature verification behave when they are scheduled together. This paper presents a one-bitstream FPGA SoC accelerator that integrates ML-KEM-512 KeyGen, Encaps, Decaps, and ML-DSA-44 KeyGen, Sign, Verify in the same programmable logic. For ML-KEM, the design separates the KeyGen/Decaps path from the Encaps path while retaining shared Keccak, NTT/PWM, and encoding resources; the three KEM operations take 100.2 us in total. For ML-DSA Sign, hardware profiling shows that most retries are caused by norm rejection. The proposed control path therefore skips MakeHint only after the standard norm check has already rejected the current attempt, without changing thresholds, randomness, or acceptance conditions. The routed implementation runs at 166.7 MHz and uses 95656 LUTs, 52997 FFs, 36 BRAMs, and 20 DSPs. Over 100 passing board runs, the six-command hardware flow takes 54524.1 cycles, or 327.1 us, with 4.199 W Vivado-estimated dynamic power and an energy-delay product of 4.49×105 W•us2. Compared with the same-clock design point without Sign early rejection, the full-flow latency and energy-delay product are reduced by 10.9% and 19.3%, respectively.