Special Topics: Post-Quantum Cryptographic Engineering
Post-quantum cryptography is moving from standards to implementation. In this course, you will learn the building blocks behind the NIST post-quantum standards and build them yourself in software or hardware.
Industry and government are beginning the transition to post-quantum cryptography, which increases the need for engineers who understand both the standards and how they work in practice.
What you will learn
- Understand how quantum computing affects RSA, ECC, and modern cryptography.
- Learn the arithmetic behind post-quantum algorithms.
- See how ML-KEM and SLH-DSA are built from smaller components.
- Build and test one of those components in Python or HDL.
- Evaluate performance, implementation cost, and security.
Three labs, step by step
-
Lab 1: Start with the basics
Work with polynomial arithmetic at small teaching parameters, which makes the underlying math easier to understand in code or hardware.
-
Lab 2: Build a small NTT
Build a small NTT and inverse NTT, which you will verify against the polynomial multiplication from Lab 1.
-
Lab 3: Choose your module
Choose one building block to explore in more depth: ML-KEM NTT, Keccak/SHAKE, or a Montgomery or Barrett modular multiplier.
Choose your track
SoftwarePython
HardwareVerilog, SystemVerilog, or VHDL
Both tracks cover the same concepts and use the same test cases, which means you can choose the platform that fits your background best.
- No quantum physics required
- Software or hardware
- CS students welcome
From basic components to post-quantum standards
You will first study how Shor's algorithm threatens RSA and elliptic-curve cryptography, and how Grover's algorithm affects symmetric encryption. You will also learn how NIST security categories describe the security levels of post-quantum algorithms.
Next, you will study Barrett and Montgomery reduction, two methods used in modular arithmetic. You will then implement polynomial addition and multiplication with small examples. These prepare you for the number-theoretic transform (NTT), a tool for fast polynomial multiplication. To check your NTT implementation, you will compare its multiplication results with the direct method from Lab 1. Both methods should give the same result for the same inputs.
The next topics are hash functions and random bit generation. You will study SHA-2, Keccak, and the sponge construction used by SHA-3 and SHAKE. You will also learn about entropy sources, deterministic random bit generators (DRBGs), and sampling methods that produce the values a cryptographic algorithm needs.
You will then read selected sections of FIPS 203 and FIPS 205. You will see how the components you have studied fit into ML-KEM and SLH-DSA. Studying the components first helps you understand how these two standards work.
The final topics cover implementation security and the transition to post-quantum cryptography. You will study how timing, cache behavior, power use, and electromagnetic emissions can reveal secret information. You will also examine attacks that introduce faults and problems caused by poor randomness. Finally, you will compare post-quantum approaches and explain your choices based on key size, signature size, and implementation cost.
Lab 3 in more detail
For all options and tracks
For every option, you will check your implementation using supplied test inputs and expected outputs, called test vectors. You will also report its performance and resource use. Choose your software or hardware track in Lab 1. You can switch tracks before Lab 3.
-
Option AFIPS 203
The ML-KEM NTT
Move from the Lab 2 toy transform to ML-KEM arithmetic at
n=256,q=3329. Implement and verify an NTT and polynomial-multiplication module. The complete KEM is NOT implemented. -
Option BFIPS 202
Keccak and SHAKE
Implement the Keccak-f[1600] permutation, the five steps θ, ρ, π, χ, ι, and drive SHA-3 and SHAKE from it. Software students implement the permutation rather than calling a hash library. An iterative hardware architecture is sufficient.
-
Option CModular arithmetic
A modular multiplier
Design a modular multiplier computing
c = ab mod qby Montgomery or by Barrett reduction, and compare it against a straightforward reference. Implementing both methods is extra credit, not a requirement.
Prerequisite
CPE 645 or CS 685, or instructor consent.
If you have not taken CPE 645 or CS 685, you may still be able to enroll with instructor consent. If you know modular arithmetic and can write Python or an HDL, email me to discuss your background.
- You are comfortable with modular arithmetic and finite fields
- You can write Python, or Verilog, SystemVerilog or VHDL with a testbench
- You want to implement cryptographic algorithms yourself
Assessment
| Component | Weight |
|---|---|
| Three labs | 50% |
| Midterm exam, in class | 15% |
| Three homework assignments | 15% |
| Two reading responses | 10% |
| Quizzes, best two of three | 10% |
There is no final exam and no separate final project. Lab 3 replaces both. Lab work averages about 1–2 hours per week over the 16-week semester. The time needed will vary by week.
These grading weights may change. The published syllabus sets the final requirements.
Materials
The textbook and the standards are read together. You will practice using a technical specification to guide your implementation.
Every standard on this list is free to download. All course material is drawn from published standards, published research, and public reference implementations.
- Textbook
Paar, Pelzl and Güneysu, Understanding Cryptography, 2nd edition, Springer 2024. Selected chapters.
- Standards
ML-KEM (FIPS 203) and SLH-DSA (FIPS 205). Selected sections.
- Hashing
FIPS 180-4 and FIPS 202, for the hash and extendable-output modules.
- Randomness
NIST SP 800-90A Rev. 1, SP 800-90B, and SP 800-90C, for DRBGs and entropy sources.
Interested in the course?
Email me with questions or to let me know you plan to enroll. Your interest helps me estimate enrollment and plan the hardware lab. I am happy to discuss the course before you register.