FN-DSA on Arm Cortex-M55: Revisiting a Floating-Point Lattice Signature with Native FP64 and Helium

What it is

A preprint (IACR ePrint 2026/2559, approved 20 October 2026) by Seung-Won Lee, Min-Joo Sim, Min-Seo Kim and Hwa-Jeong Seo. It presents an FN-DSA implementation for the Arm Cortex-M55, which has both a double-precision FPU and the M-Profile Vector Extension (MVE, Helium). FN-DSA has the shortest signatures among NIST's post-quantum signature standards, but its signing is slow on microcontrollers because the binary64 arithmetic is emulated with integer instructions.

The authors say earlier speedups either change the arithmetic or the order of random sampling, so their signatures no longer match the reference known-answer tests (KATs), or they need double-precision SIMD that microcontrollers lack. This implementation matches the reference KATs and runs in constant time.

How it works

The work is split between the FPU and MVE.

• FPU, signing: bit-exact FP64 computes the FFT, LDL decomposition, split, merge and sampler without changing any result.
• FPU, key generation: exponent-normalized division replaces the bit-by-bit divisions with a single VDIV.F64, whose latency does not depend on the operands.
• MVE, NTT: vectorized NTTs with layer merging.
• MVE, key generation FFT: a fixed-point FFT using split-word Q32 arithmetic on 32-bit lanes.
• Keccak: vectorized bit interleaving speeds up every permutation.
• Batch verification: request-level batching processes four independent verification requests at once.
• Scheduling: SLOTHY reschedules the MVE and Keccak assembly.

What to do

The authors give a placement rule. Use the FPU where the reference emulates an operation with many integer instructions. Use MVE where the reference already computes with integers or fixed point.

Measured against the reference on the same core, key generation is up to 1.23x faster, signing up to 1.93x and verification up to 1.30x. Batch verification of four signatures is up to 1.75x faster.

Caveats

The page is an abstract only. It gives no cycle counts, memory figures, parameter-set breakdown (for example per security level) or code link, and the speedups are stated as "up to". The paper is a preprint. The constant-time claim is stated by the authors, and the page does not describe how it was checked. The result applies to cores with both a double-precision FPU and MVE, and the page does not cover other Cortex-M parts.