Ingrid Verbauwhede

Fully Homomorphic Encryption (FHE) enables computation on encrypted data while preserving privacy. TFHE is an FHE scheme that efficiently supports arbitrary function evaluation on small encrypted values. Large integers are typically represented across multiple ciphertexts, making carry handling a fundamental component of practical integer arithmetic. Two particularly important operations are message and carry extraction, which separate the message and carry components of a ciphertext, and carry propagation. In this work, we present two optimisations for carry handling in TFHE based on redesigned Lookup Tables for programmable bootstrapping. First, we introduce a single-bootstrap message and carry extraction technique that computes both outputs using a single programmable bootstrap. By modifying the Lookup Table construction, we significantly reduce the error growth compared to a direct MultiLUT-based approach, reducing the required parameter overhead from 48 % to 2 % while achieving a 1.95 × speedup over the extraction method currently used in TFHE-rs. Second, we propose a three-operand group-state combination method for parallel carry propagation. Our approach reduces the sequential depth of the Hillis-Steele prefix-scan from ⌈ log 2 ( g ) ⌉ to ⌈ log 3 ( g ) ⌉ and lowers the total number of required bootstraps, resulting in up to 1.37 × faster carry propagation for large encrypted integers. Both techniques are integrated in the TFHE-rs library and available as patch files.

Fully Homomorphic Encryption (FHE) enables arbitrary computation on encrypted data without decryption, providing strong privacy guarantees for secure cloud computing, encrypted analytics, and privacy-preserving machine learning. However, practical deployment of FHE remains limited by the high computational cost of polynomial arithmetic over large modular rings. In particular, Number Theoretic Transform (NTT)–based polynomial multiplication dominates the execution time of modern lattice-based FHE schemes. In this work, we present TP-NTT, a scalable, throughput-optimized NTT architecture supporting a wide range of ring dimensions used in FHE, from 210 to 216. Our design applies optimizations at multiple levels, from modular arithmetic to the NTT algorithm itself, including multi-dimensional decomposition without requiring additional multiplication blocks. The decomposition dimensionality is configurable at design time, supporting 2-D, 3-D, and 4-D decompositions, each advantageous in specific scenarios. Furthermore, TP-NTT provides design-time-configurable throughput. Combined with its scalable architecture, this enables significant advantages for batch NTT operations compared to other works in the literature. At n = 216, it outperforms the best-performing prior design by 1.33x in average latency while achieving 1.24x better area–time-product (ATP). To demonstrate its efficiency, we present a case study on FHE relinearization, focusing on the BFV scheme. We propose a relinearization accelerator that leverages the fast batch NTT capability of TP-NTT, achieving 67.34x speedup over state-of-theart software implementations and highlighting TP-NTT’s effectiveness in real-world FHE applications.

The Multi-Party Computation (MPC)-in-the-Head (MPCitH) framework enables the construction of post-quantum Digital Signature Algorithms (DSAs), offering competitive public key sizes. However, this comes at a cost of high computational complexity, resulting in high signature generation and verification times.In this work, we propose a compact and efficient hardware accelerator for Mirath, an MPCitH-based DSA and candidate in the ongoing NIST PQC standardization effort. We propose a series of algorithmic and hardware-level optimizations, focusing on Mirath’s most critical operations: GGM tree-based polynomial commitments and MPC arithmetic. Firstly, we observe Mirath greatly relies on symmetric primitives (SHA3 & AES) during the GGM tree expansion and typically requires a large amount of memory to store the derived tree nodes. We propose an on-the-fly scheduling for generating and computing the GGM tree, such that a minimal amount of GGM tree nodes are stored in memory and their computations can be performed in parallel. Our methodology enables temporarily storing a minimal (and configurable) set of parent nodes in local buffers, from which the low-level tree nodes can be efficiently derived instead of repeatedly doing so from the root seed. This is achieved through a novel, hardware-friendly tree node indexing scheme, which enables efficient traversal through GGM tree nodes using only left and right shifts to find their closest previously computed ancestor. Secondly, we analyze the MPC arithmetic in Mirath and propose massively parallel and yet area-efficient arithmetic units, capable of exploiting algorithm-level parallelism in the MPCitH operations. This is achieved by analyzing Mirath’s proposed parameter sets and identifying the most hardware-friendly parameters, for which we design highly fine-tuned modules. Finally, we implement our unified design, which supports all Mirath operations, on an Artix-7 FPGA and compare its performance against Mirath’s AVX2 optimized implementation and state-of-the-art PQC DSA hardware implementations. Compared to an implementation of the MPCitH-based SDitH scheme (TCHES 2024), we reduce on-chip BRAM by up to 81.6% and improve the area-time-product by a factor of 52.7x to 64.8x. Overall, we demonstrate that modern MPCitH constructions can be significantly accelerated in hardware through a combination of algorithmic, architectural and low-level hardware optimizations, in line with real-world performance requirements.

A compact quantum random number generator (QRNG) based on an array of Single Photon Avalanche Diodes (SPADs) is presented here. The main feature of the proposed chip is the capability to generate random numbers without the use of any external source of light. In this view, SPADs are configured to be used in two ways: 1) as a controlled light emitter and 2) as a detector. An embedded logic is able to distinguish dark events against detected emitted photon in such a way to make the system sensitive only to the presence of light. The extracted random bits show a uniform distribution and the QRNG, thanks to an integrated conditioning block maximizing the output entropy, eventually passes all AIS31 tests. The average raw bit rate in the default device configuration (one enabled column) is measured equal to 800 kbps.

Embedded devices that are physically unreachable or contained within tamperproof enclosures are often considered naturally resilient to physical side-channel attacks. We present an active EM side-channel attack technique that enables sidechannel attacks across the security boundaries introduced by these physical security measures. Our technique actively induces side-channel leakage based on a relay mechanism, which serves as a means of leakage propagation from the cryptographic IC to the attacker via intermediate Relay Points located within the boundary. In the first leakage path, the instantaneous current consumption caused by transistor switching inside the cryptographic IC affects the impedance of nearby nonlinear elements (such as regulators) that act as Relay Points. This phenomenon is inevitable due to the necessity of the regulator’s operations to ensure the provision of a stable voltage to the cryptographic IC. In the second path, EM waves irradiated by the attacker from outside the security boundary create a leakage channel where reflected waves are modulated by the impedance variation of Relay Points, and leak outside as side-channel information. We experimentally demonstrate that side-channel attacks can be performed from the power cable on the primary side of an AC/DC adapter, even in environments protected by physical security measures, including a shielded box and ferrite cores. This attack can be executed non-invasively using EM waves in the hundreds of MHz band, and has the advantage of being able to actively control the presence and intensity of leakage. The proposed attack technique may be applicable in a wide range of applications as it exploits the behavior of nonlinear elements present in all embedded systems. As countermeasures against the proposed attack, we discuss the effectiveness of EM fault sensors for detecting continuous wave irradiation, induced EM interference detectors with broadband monitoring capabilities, and tamper detection systems utilizing radio frequencies. This research highlights the importance of considering active EM measurements as a new threat model in physical security evaluations.