After completing his Ph.D. and postdoctoral research at the University of Pisa, Stefano Di Matteo was hired in 2024 by the CEA as a research engineer and chairholder for the PQ-TLS project, funded by the l'ANR[1] as part of the “Quantique de France 2030" PEPR[2].
“I was drawn to the environment at Leti, which fosters collaboration with cryptography experts," he recalls. “In fact, it was this proximity that led to my collaboration with Emanuele." His research focuses on the hardware implementation of post-quantum cryptography, as he explains:
“It involves integrating algorithms designed to withstand attacks from future quantum computers directly into physical components, rather than into software."
A graduate of the Polytechnic University of Turin, Emanuele Valea devoted his dissertation, completed in Montpellier, to hardware cybersecurity for securing integrated circuits and implementing cryptography. He then joined CEA-List in Grenoble in 2020.
“I liked the idea of applied research, the result of collaborations between different areas of expertise," he says. “At the CEA, we manufacture the chips we're working on so we can see concrete results."
Accelerating Post-Quantum Cryptography
Quantum computers could one day break current cryptographic schemes. To address this threat, post-quantum cryptography has been developed, which is based on mathematical models that are resistant to quantum attacks. Since 2024, post-quantum cryptography standards have been in place, including the ML-KEM algorithm, which is designed for secure key exchange. The challenge now is to integrate them into the microcontrollers of embedded systems. These chips typically feature hardware accelerators to efficiently execute cryptographic functions.
“Our challenge is to design these accelerators, which are not found in commercially available circuits," says Stefano. “We focused on the number-theoretic transform[3] (NTT), an arithmetic building block that significantly impacts ML-KEM's execution time." Emanuele continues: “The literature proposes various NTT architectures, but no study has guided their integration into a complete microcontroller. Our approach, therefore, was to treat acceleration as a system integration problem."
The researchers evaluated several architectures and integration scenarios, seeking the most general ones possible. Their conclusion? The performance of an NTT accelerator does not depend solely on its computational capacity. Its integration into the system, particularly data management in shared-bus communication architectures and memory systems, as well as transfer mechanisms between the processor and the accelerator, can have a major impact on its overall performance.
The study, which won the Best Paper Award, serves as a comprehensive guide to integrating accelerators into microcontrollers. Designers can then estimate the performance achievable based on their chip's area and resources.
From smart cards to industrial controllers
“Our goal now is to develop post-quantum cryptography that is secure and efficient enough for use on embedded devices, such as credit cards or access badges, to be truly viable," says Stefano Di Matteo.
This research is of interest to any manufacturer designing electronic systems that will need to transition to post-quantum cryptography. This includes manufacturers of industrial controllers, which already encrypt their data. The CEA has led several industrial projects on this topic and is supporting small and medium-sized enterprises (SMEs), which are less prepared for this transition than large corporations. At stake is the security of tomorrow's communications, infrastructure, and connected devices.
[1] National Research Agency
[2] Priority Research Programs and Equipment
[3] A transform refers to the result of an operation or modification that changes an object, a function, or a figure from one state to another.