高效的基于TCitH的SLH-DSA替代方案：Mirath的跨层ASIC设计
Efficient TCitH-Based Alternatives to SLH-DSA: Cross-Layer ASIC Design of Mirath
- RPTU Kaiserslautern-Landau（莱茵兰-普法尔特技术大学凯泽斯劳滕-兰道）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
针对后量子签名非格替代方案的高效实现需求，采用跨层方法在22nm FD-SOI工艺下实现首个基于TCitH的Mirath签名方案ASIC，性能和面积均优于同工艺SLH-DSA ASIC。
AI中文摘要：
为应对量子计算机构成的安全风险，美国国家标准与技术研究院（NIST）已将后量子签名方案ML-DSA、FN-DSA和SLH-DSA标准化。ML-DSA和FN-DSA基于格密码，而SLH-DSA依赖哈希假设。为支持针对未来漏洞的密码敏捷性，NIST正在评估非格候选方案作为SLH-DSA的替代项。其中，基于TCitH的方案因密钥紧凑、签名短小而极具前景。\n 然而，这类方案计算复杂度高、内存占用大，给资源受限嵌入式平台上的高效实现带来了严峻挑战，相关研究在此场景下仍十分匮乏，尤其是ASIC实现方面。为填补这一空白，我们采用结合算法层与硬件层的跨层方法，在基于RISC-V的系统中实现了Mirath（一种基于TCitH的签名方案）的ASIC设计——据我们所知这是首个此类实现。该设计采用22nm FD-SOI工艺节点实现。与同一工艺节点下实现的SLH-DSA ASIC相比，所提出的架构签名延迟降低了17.8倍，总单元面积减少了58%，从实现角度证明了基于TCitH的签名作为高效非格替代方案的潜力。
英文摘要：
To address the security risks posed by quantum computers, the U.S. National Institute of Standards and Technology (NIST) has standardized the post-quantum signature schemes ML-DSA, FN-DSA, and SLH-DSA. While ML-DSA and FN-DSA are lattice-based, SLH-DSA relies on hash-based assumptions. To support cryptographic agility against future vulnerabilities, NIST is evaluating non-lattice candidates as alternatives to SLH-DSA. Among these, TCitH-based schemes are particularly promising due to their compact keys and small signatures. However, their high computational complexity and memory footprint pose significant challenges for efficient implementations on resource-constrained embedded platforms. They remain largely unexplored in this context, particularly in ASIC implementations. To address this gap, we use a cross-layer methodology combining algorithmic and hardware layers to present, to the best of our knowledge, the first ASIC implementation of Mirath, a TCitH-based signature scheme, in a RISC-V-based system. The design is implemented in a 22nm FD-SOI technology node. Compared with an SLH-DSA ASIC implemented in the same technology node, the proposed architecture achieves 17.8x lower signing latency while requiring 58% less total cell area, showing the potential of TCitH-based signatures as efficient non-lattice alternatives from an implementation perspective.
