💻 computer science

PQ-SEAL, Post-Quantum Secure Embedded Architecture with Leakage-Resilient AES on Ibex RV32IMC

This paper presents PQ-SEAL, a bare-metal RISC-V implementation on an FPGA that integrates NIST-standardized post-quantum cryptography with a leakage-resilient AES-128 rekeying scheme, demonstrating a 31-fold improvement in resistance against Correlation Power Analysis attacks without additional hardware costs.

Original authors: Charan Kasimahanti

Published 2026-08-11

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Charan Kasimahanti

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Digital Fortress and the Quantum Storm

Imagine the internet as a massive, bustling city where everyone sends secret letters to one another. To keep these letters safe, we use "locks" (encryption) that are so complex that even the world's best mathematicians can't pick them without the key. For decades, these locks have been incredibly strong. However, scientists have been building a new kind of tool called a "quantum computer." Think of this not as a faster calculator, but as a magical master key that can pick almost any of our current locks in seconds. If someone builds this machine, all our secret letters could be read instantly, even if they were written years ago. This is a big problem because bad guys are already stealing and saving our secret letters today, waiting for the day they can unlock them.

To stop this, experts are designing new locks that are "quantum-proof." These new locks are based on complex math puzzles that even a quantum computer can't solve easily. But there's a catch: making these new locks requires a lot of brainpower and memory, which is hard to fit into tiny devices like smart sensors or simple chips. Furthermore, even if the math is perfect, a sneaky attacker might try to steal the key by watching how much electricity the device uses while it works. This paper explores how to build a tiny, super-strong, quantum-proof fortress on a very small, simple chip, while also putting up a magical shield that confuses anyone trying to spy on its power usage.

The Tiny Guardian: PQ-SEAL

Meet PQ-SEAL, a project created by a researcher named Charan Kasimahanti at the Indian Institute of Technology Madras. The goal was to build a complete, secure communication system on a tiny, bare-metal computer chip (specifically an Ibex RV32IMC running on an FPGA board) that has almost no memory—only 64 KB of RAM, which is less than a single high-resolution photo. Usually, fitting advanced security on such a small chip is like trying to park a semi-truck in a bicycle shed.

The researchers managed to squeeze two massive tasks into this tiny space:

The Quantum-Proof Handshake: They implemented a new, NIST-standardized way to exchange keys using ML-KEM and ML-DSA. This is the "handshake" where two computers say, "Hello, I am who I say I am, and here is a secret key we can use."
The Leakage-Resilient Shield: They added a special trick called LR4 rekeying to protect the actual messages sent after the handshake.

How the Handshake Works

Imagine two spies meeting in a park. Instead of whispering a secret, they perform a complex dance.

The Greeting: The tiny chip (the "Board") sends a public ID card (800 bytes) to a powerful computer (the "Host").
The Magic Trick: The powerful computer does the heavy lifting. It uses the ID card to create a secret code and a digital signature, then sends them back.
The Verification: The tiny chip checks the signature. If it's valid, both sides use a special math function (SHAKE-128) to turn the shared secret into a final 32-byte session key.

This entire dance took only 0.9 seconds on the tiny chip, which was running at 50 MHz. That's incredibly fast for a device with no operating system and no extra memory helpers.

The Magic Shield: LR4 Rekeying

Once the handshake is done, the two sides start sending encrypted messages. Here is where the paper gets really clever. Usually, if an attacker watches a device encrypt messages, they can eventually figure out the key by analyzing the power consumption (a method called Correlation Power Analysis or CPA). It's like listening to a safe-cracker; if they click the dial the same way every time, you can guess the combination.

The paper introduces a countermeasure called LR4 rekeying. Instead of using the same key forever, the system changes the key every 10 blocks of data.

The Analogy: Imagine you are sending a secret message in a box. A normal lock uses the same key for every box. A spy watches you lock 100 boxes and eventually figures out the key.
The PQ-SEAL Trick: Every time you lock the 10th box, the lock automatically changes its internal mechanism to a completely new, random key. The spy watches the first 10 boxes, gets confused, and then the lock changes. They have to start all over again.

The researchers tested this by collecting 300 pairs of messages and their encrypted results.

Without the shield (Plain AES): The spy could figure out the key with a "rank" of 4 (meaning the real key was one of the top 4 guesses) after 300 tries.
With the shield (LR4): The spy's best guess was stuck at a "rank" of 124.

This means the attacker was 31 times more confused and uncertain when the shield was active. The paper proves this improvement happened without needing any extra hardware or special chips; it was done entirely in software.

The Real-World Test

To show this wasn't just a math puzzle, the team built a live, encrypted messaging app. Users could send group chats and direct messages. The tiny chip on the FPGA board encrypted every message before sending it, and the powerful computer decrypted it. The system worked smoothly, proving that even on a tiny, resource-starved chip, you can have a secure, quantum-resistant conversation that is also safe from power-hacking spies.

What This Means

The paper doesn't claim to have solved every problem in the world. The researchers admit that their tests were done in a controlled software simulation of power usage, not with physical power meters on the actual chip yet. They also noted that the code could be improved to prevent timing attacks (where a spy guesses the key based on how long a calculation takes).

However, the results are a strong proof of concept. They showed that you can run the latest, most secure quantum-proof standards on a tiny, cheap chip without an operating system, and you can add a powerful defense against physical spying just by changing how often you switch keys. It's a step toward a future where even the smallest devices can stay safe from both quantum computers and sneaky spies.

Technical Summary: PQ-SEAL

Problem Statement

The standardization of Post-Quantum Cryptography (PQC) algorithms by NIST (specifically FIPS 203 for ML-KEM and FIPS 204 for ML-DSA) mandates the migration of cryptographic infrastructure to quantum-resistant protocols. However, deploying these standards on resource-constrained embedded systems presents a dual challenge:

Computational Constraints: Embedded processors (e.g., IoT devices, FPGA softcores) often operate with limited RAM (<64 KB), low clock speeds (<100 MHz), and lack operating systems or hardware accelerators. The arithmetic demands of lattice-based PQC (Number-Theoretic Transform for polynomial multiplication) are significant for in-order pipelines without multiply-accumulate acceleration.
Physical Layer Vulnerabilities: While PQC addresses the threat of quantum computers, the symmetric layer protecting the data (typically AES) remains vulnerable to side-channel attacks. Specifically, Correlation Power Analysis (CPA) can recover AES keys from a few hundred power traces. Existing PQC implementations on embedded platforms often neglect side-channel countermeasures on the symmetric layer, while existing leakage-resilient (LR) schemes often assume classical key establishment rather than PQC.

There is a gap in the literature for a complete, end-to-end system that integrates a post-quantum handshake with a provably leakage-resilient symmetric encryption scheme on a bare-metal RISC-V softcore within strict memory constraints.

Methodology

The author presents PQ-SEAL (Post-Quantum Secure Embedded Architecture with Leakage-Resilient AES), implemented on an Ibex RV32IMC softcore running on a Xilinx Artix-7 FPGA.

System Architecture

Hardware Platform: The system runs on a Nexys 4 DDR board with the Ibex core operating at 50 MHz and a unified 64 KB SRAM budget. No OS, heap allocator, or external cryptographic libraries are used.
Firmware Footprint: The firmware occupies 53 KB of the 64 KB SRAM. Keys for ML-KEM and ML-DSA are stored in .rodata at compile time to avoid runtime key generation overhead and the need for a hardware True Random Number Generator (TRNG) on the bare-metal target.
Communication: The board communicates with a host PC via a framed UART channel (115200 baud). The host performs all lattice-based arithmetic (ML-KEM encapsulation, ML-DSA signing, SHAKE-128 derivation) using liboqs and PQClean, while the board handles the symmetric encryption and rekeying.

Protocol Design

The system executes a five-step PQ-TLS Handshake:

Client Hello: The board sends its ML-KEM-512 public key (800 B) to the host.
Host Encapsulation: The host performs ML-KEM-512 encapsulation locally to generate a ciphertext and a shared secret.
Host Signing: The host signs a hash of the public key and ciphertext using ML-DSA-44.
Server Hello: The host sends the ciphertext, its public key, and the signature (4504 B total) to the board.
Verification & Key Derivation: The board verifies the signature, derives the session key ( $K_s$ ) using SHAKE-128 from the shared secret, and sends an acknowledgment.

Symmetric Layer & LR4 Rekeying

Post-handshake communication uses AES-128-CTR. To mitigate CPA, the system implements the LR4 rekeying scheme (from Fallen Sanctuary [12]):

Mechanism: The key is updated every $m=10$ blocks using the recurrence $K_{i+1} = \text{AES}_{K_i}(K_i)$ .
IV Generation: IVs are derived via SHAKE-128 to prevent counter reuse across epoch boundaries.
Theoretical Basis: This construction is proven to resist exponential invocations up to the birthday bound of the key size without requiring a leak-free sanctuary, effectively capping the attacker's useful trace budget per key epoch.

Evaluation

Functional Verification: The system successfully completed 10 consecutive handshakes with deterministic session keys. All 300 AES blocks across 30 rekeying events matched a software reference implementation.
Side-Channel Analysis (CPA): The author collected $N=300$ $N = 300$ plaintext-ciphertext pairs from the hardware. A software CPA attack was performed targeting the Hamming Weight of the first AES SubBytes operation.
- Fixed-Key AES: The key rank dropped to 4 at 300 traces, indicating near-complete recovery.
- LR4 Rekeying: The key rank remained at 124 throughout the 300 traces. Each rekeying event (every 10 traces) reset the correlation accumulation, preventing the attacker from discriminating the true key byte.

Key Contributions

System Integration: The first complete implementation of an ML-KEM-512 + ML-DSA-44 post-quantum handshake on a bare-metal Ibex RV32IMC within a 64 KB SRAM constraint, achieving a 0.9-second handshake latency at 50 MHz.
Countermeasure Implementation: The deployment of the LR4 rekeying scheme ( $K_{i+1} = \text{AES}_{K_i}(K_i)$ with $m=10$ ) as a zero-hardware-overhead countermeasure against CPA on a softcore.
Empirical Validation: A software CPA evaluation demonstrating a 31× improvement in key rank (from 4 to 124) using rekeying alone, with full statistical validation of ciphertext uniformity (entropy, avalanche effect, chi-squared tests).
Application Demonstration: A real-time, role-based encrypted messaging platform built atop the secure channel, validating the system in a multi-user deployment scenario.

Results

Performance: The 53 KB firmware footprint leaves 11 KB of SRAM headroom. The handshake completes in 0.9 seconds. AES throughput is limited by the UART baud rate (115200) rather than processor capacity, achieving approximately 10 blocks per second.
Security: The LR4 scheme successfully disrupted the monotonic correlation build-up required for CPA. While the fixed-key AES was vulnerable (Rank 4), the rekeyed system maintained high uncertainty (Rank 124) with no additional hardware cost.
Statistical Properties: Ciphertexts from both fixed-key and rekeyed modes were statistically indistinguishable (Shannon entropy ≈7.99 bits/byte, Chi-squared $p > 0.05$ ), confirming that rekeying does not introduce statistical artifacts detectable by standard cryptographic analysis.

Significance and Claims

The paper claims to provide the first end-to-end integration of NIST-standardized post-quantum key establishment with a provably leakage-resilient symmetric layer on a bare-metal RISC-V softcore.

The author emphasizes that PQ-SEAL establishes a faithful software baseline for the 64 KB bare-metal deployment envelope, proving that:

Full PQC handshakes are feasible on constrained softcores without OS support.
Leakage-resilient symmetric encryption can be achieved on such platforms without hardware accelerators or significant performance penalties.
The combination of PQC and LR4 creates a robust defense against both quantum threats (via ML-KEM/DSA) and physical side-channel attacks (via LR4 rekeying).

The work is presented as an open, reproducible foundation for future research into post-quantum secure channels on embedded RISC-V platforms. The author notes limitations, including the reliance on software-based CPA evaluation (rather than physical EM/power measurements) and the use of non-constant-time NTT implementations, identifying these as primary directions for future work.