Batched LSH on ARMv8 NEON and Its Application to K-SPHINCS+

What it is

This IACR ePrint paper (2026/2351) by Bang, Cho, Hyoung, Kim, and Seo benchmarks hand-written AArch64 NEON assembly implementations of LSH — the Korean standard hash used in K-SPHINCS+ — on ARMv8-A, and uses the results to build what the authors say is the first optimized K-SPHINCS+.

How it works

The authors reimplement three prior LSH optimization techniques in NEON assembly: a 2019 word-permutation technique, a 2023 ARMv8 P-domain placement/LSH-256 2-way approach, and 2024 AVX-512 word-parallel/GPU lane-batching designs. They also test whether NEON scheduling guidance from a 2022 AArch64 Keccak/SPHINCS+ paper transfers to LSH. Every implementation variant is validated against 2,063 public known-answer test vectors plus a differential test suite before benchmarking. The key finding: no single-message NEON implementation beats KISA's portable reference C compiled with clang -O3 — single-message NEON only reaches 0.75–0.90× of reference throughput. Only message-parallel batching wins: hashing two or four independent LSH-256 messages across NEON lanes reaches 1.53–1.66× and ~2.0× reference throughput, respectively. The authors then integrate the four-message batch core into the WOTS+ chain, FORS leaf, and Merkle tree computations of the SPHINCS+ reference framework.

Preconditions / Affected

Applies to ARMv8-A targets (mobile, embedded, server) running K-SPHINCS+ (SPHINCS+ with LSH as the internal hash) across all six K-SPHINCS+ parameter sets. Benefits require batching four independent messages at once — single-message signing/verification workloads don't gain from the NEON core.

What to do

Engineers targeting ARM for K-SPHINCS+ should adopt the four-message batched NEON LSH-256 core rather than attempting single-message NEON optimization, which underperforms plain C. All three hash backends (reference C, single-message NEON, four-message NEON) produce byte-identical signatures, so the batched backend can be substituted as a drop-in without changing output. Reported gains: batched K-SPHINCS+ signs 2.5–2.6× faster than K-SPHINCS+ with reference C LSH, and for 128-bit parameter sets, 2.9–3.2× faster than the SHA-256/SHAKE256 SPHINCS+ reference implementations on the same machine. Code and raw measurements are public (per abstract), though no repository URL is given on this page.

Caveats

The 2.0× batching figure is approximate ("about 2.0×") per the abstract. Gains are measured against the reference C implementations on "the same machine" — no cross-platform or cross-hardware-generation comparison is stated. The paper is a preprint (status: approved 2026-10-07).