FAEST Hardware Study Highlights the Practical Work Behind Quantum-Safe Security

Villanova University researchers have developed what they describe as the first hardware accelerator for the quantum-resistant digital signature scheme FAEST, offering a design that addresses the computing and memory demands of a potential future cybersecurity standard.

The work, published in Cryptology ePrint Archive, covers key generation, signing and verification across all 12 configurations of FAEST version 2.0. The researchers implemented the design for an AMD programmable chip and report efficiency advantages over selected hardware implementations of other post-quantum signature schemes.

The study also illustrates a broader challenge facing quantum-safe cybersecurity. An algorithm’s mathematical security is only part of its suitability for deployment. Engineers must determine how much memory it needs, how quickly it operates and whether its physical implementation exposes secrets.

The paper suggests these questions are important because digital signatures allow systems to check who signed information and whether it has changed. Signatures support applications including software updates, certificates and electronic documents.

Sufficiently capable quantum computers could undermine widely used public-key signature systems. Post-quantum schemes seek to provide replacements that run on conventional computers while resisting attacks from both conventional and quantum machines.

FAEST is being evaluated through the National Institute of Standards and Technology’s additional digital signature process. It remains a candidate rather than an approved standard.

Making the Entire Process Work

FAEST builds signatures using established cryptographic components, including AES and SHA3, combined with a proof that demonstrates knowledge of a secret without revealing it.

Using familiar components does not make the resulting signature system simple to implement. Generating and checking its proofs requires additional calculations, intermediate data and carefully ordered operations.

The Villanova researchers designed an accelerator using a field-programmable gate array, or FPGA, a chip whose circuitry can be configured for particular tasks.

Their framework covers three security categories, two algorithm families and settings that favor either faster processing or shorter signatures. The researchers report checking functional correctness against the FAEST reference implementation for every parameter set. Hardware performance figures were obtained after the design’s placement and routing, the process of assigning circuit elements and their connections within the chip.

Covering all three signature operations makes the work more informative than accelerating an isolated calculation. A system that signs efficiently may still require substantial resources to generate keys or verify signatures.

The researchers also emphasize keeping required working data within the accelerator in their main designs. That addresses a recurring issue in hardware comparisons. Moving storage or computation to an external computer can make an accelerator appear smaller while leaving part of the system’s cost outside the reported figures.

Memory Is Part of Performance

One of the paper’s central engineering choices concerns whether to retain intermediate information or calculate it again when needed.

FAEST expands compact starting values into larger collections of data used during proof generation. Keeping all those results avoids repeated calculations, but requires memory and circuitry to manage access.

The researchers describe ways to pass generated values directly into subsequent operations and preserve enough information to recover data needed later. An optimized configuration regenerates portions of that information rather than retaining everything.

This exchanges additional computation for reduced storage requirements.

The broader lesson is that fewer calculations do not automatically produce the most practical hardware. Memory capacity, data movement and access circuitry can influence a design’s size and performance alongside arithmetic.

FAEST’s configurations reveal another tradeoff, in that settings that produce shorter signatures require more work during signing and verification. Faster settings produce larger signatures.

For a prospective user, that creates a workload question. A device with a slow communications link may place greater value on compact signatures, while a service checking large numbers of signatures may prioritize verification speed. The appropriate balance depends on the application.

The researchers report that their fast configurations achieve at least a 98% reduction in a combined hardware-resource-and-processing-time measure compared with selected complete SDitH implementations.

That result concerns a particular comparison and metric. It does not establish a 98% reduction in electricity consumption, manufacturing cost or processing time alone, nor does it establish superiority across all post-quantum signature systems.

The accelerator remains a research design with important work remaining.

It implements FAEST v2.0. The paper identifies changes in v3.0 that would require further hardware development, including changes to proof calculations and commitments.

The researchers also leave protections against side-channel and fault attacks for future work. Side-channel attacks seek secrets through physical effects such as power consumption. Fault attacks deliberately disturb a computation to expose information or undermine its checks.

These threats differ from the mathematical attacks that post-quantum algorithms are designed to resist. A quantum-resistant construction can still be vulnerable if its implementation leaks secret information.

The study was undertaken by Brendan Funk and Jiafeng Xie, both of Villanova University.

For a more technical look, please review the paper in the Cryptology ePrint Archive. Preprint archives, like this one, are not peer-reviewed.