QUASAR: Achieving Quantum Readiness for Post-Quantum Cryptography on RISC-V at Minimum Hardware Cost

The threat of quantum computers to public-key cryptography has spurred a rapid search for post-quantum cryptography (PQC) standards, leading NIST to standardize ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). Porting these algorithms to resource-constrained devices is challenging. A software-only approach is too slow even on optimized cores, while existing accelerators either consume a lot of area overhead or omit one of the two dominant kernels (NTT and Keccak), leaving the corresponding bottleneck in software. We present QUASAR, the smallest hardware–software co-design for the CV32E40P RISC-V core that accelerates all three NIST PQC algorithms simultaneously. Two loosely coupled engines (LUNA for NTT, SPOKE for Keccak), selected through a profiling-driven design-space exploration of coupling strategies, add only 886 LUTs—a +19% overhead over the bare processor core. On a mid-range Zynq-7000 SoC at 110 MHz, our proposed hardware–software co-design achieves speedups of 2.49–2.57 × (60–61% cycle reduction) for ML-KEM, 2.36–2.46 × (58–59%) for ML-DSA, and 3.10–3.18 × (68–69%) for SLH-DSA and a 3.21 × lower area–time product than the next-best design supporting both key encapsulation and digital signature algorithms.