X-Wing on Cortex-M85: Architecture-Aware Integration and End-to-End Evaluation

What it is

An architecture-aware implementation of X-Wing (ML-KEM-768 + X25519 hybrid KEM) targeting the ARM Cortex-M85, authored by Do-Yun Park and Hwa-Jeong Seo (ePrint 2026/2352, approved 2026-10-07). The paper names two specific variants: B8, the integrated implementation combining eight optimization techniques, and B8S, a corrected version addressing a side-channel issue found in B8. Both are benchmarked against baseline A0 on an EK-RA8M1 board.

How it works

The implementation adapts the coefficient representation and storage order of an M-profile Vector Extension (MVE) NTT to the existing ML-KEM path, optimizes data-format conversions, and reworks X25519 arithmetic — all while preserving conformance to X-Wing draft-10. A specific trick: during encapsulation, the two X25519 field inversions are shared rather than computed separately.

Preconditions / Affected

Targets Cortex-M85 hardware specifically (evaluated on the EK-RA8M1 board), relying on MVE support. Results are hardware/compiler-specific and were validated via ten paired comparisons across five independent reflashes of one board — not an average across diverse hardware.

What to do

If evaluating this for an embedded hybrid-KEM deployment, note the measured minimum cycle reductions of B8 over A0: 18.61% for key generation, 18.89% for encapsulation, 12.25% for decapsulation reusing an expanded key, and 15.22% for decapsulation including seed expansion. The cost is 35,692 B of additional nonvolatile storage, of which 33,024 B is a fixed-base table — meaning the table dominates the flash overhead and could potentially be trimmed or shared if flash is constrained. For side-channel-sensitive deployments, use B8S, not B8, since B8 has a confirmed secret-sign-dependent operand-address selection flaw.

Caveats

Even in the corrected B8S variant, some key-varying timing signals persisted in testing, and their root cause was only partly resolved. The authors explicitly do not claim a whole-program constant-time guarantee for B8S — treat it as hardened, not timing-safe.