Efficient and Compact High-order Masking Raccoon on Memory Constrained Devices

What it is

A TCHES 2026 paper (DOI 10.46586/tches.v2026.i4.369-396, ePrint 2026/2540) with a high-order masked implementation of Raccoon on ARM Cortex-M4. Raccoon is a lattice-based signature presented at CRYPTO 2024, with an O(d log d) masking overhead. It did not advance beyond the first round of NIST's additional call for post-quantum signatures. The paper still treats it as a candidate because of its low masking cost and provable side-channel resistance. The implementation covers masking orders up to 32.

Numbers the catalog summary lacks

Masked Raccoon-192 is faster than masked Dilithium3 by 3.12x at order d=2, 8.07x at d=4 and 2.71x at d=8. The speedup is not monotonic in the order, and the abstract gives no reason for the peak at d=4. Against the Raccoon reference implementation the gain is 1.85x to 2.25x. The one-shot SHAKE256 change gives at least 1.80x on every sampling routine in Raccoon.

How it works

• Sampling: the authors found that frequent incremental SHAKE256 calls on small data chunks were a bottleneck on Cortex-M4. Switching to one-shot calls removes it.
• Polynomial multiplication: a consecutive 32-bit NTT/INTT covers both of Raccoon's moduli. It merges layers 3+3+3 to cut memory accesses and uses lazy reduction to skip modular reductions.
• Negative double Montgomery reduction: a new technique that speeds up the double modular reductions in a multi-moduli NTT. The authors call it a side contribution, so it may apply to other multi-moduli NTT code.
• Memory: the paper also describes memory-saving techniques that make orders up to 32 practical on resource-constrained IoT devices. The abstract does not describe them.

Caveats

• The leakage evaluation covers only the second-order implementation. It shows strong DPA resistance only after micro-architectural transitional leakage is mitigated. The abstract does not say how, so check the paper before assuming a given board or compiler build is protected.
• The abstract gives no cycle counts, RAM figures or code link. The page notes that Figure 1 and the stack usage in Table 4 were slightly updated after TCHES 2026 artifact evaluation.
• The page does not say whether the Dilithium3 comparison uses an equally optimized masked baseline.