Timo Keller

— On the schedule —

Optimizing ML-KEM and ML-DSA with Vector Instructions and Mathematical Techniques

ML-KEM and ML-DSA are computationally intensive post-quantum cryptographic algorithms whose performance is heavily influenced by polynomial arithmetic. This talk presents a set of implementation techniques that substantially improve their efficiency on architectures with 128-bit vector registers, including IBM Z and POWER systems, while remaining applicable to other vector widths. The presented optimizations combine vectorized arithmetic with mathematical techniques such as Montgomery multiplication, partial and lazy reductions, and a novel approach that I call twisted Karatsuba multiplication. Particular attention is paid to maintaining constant-time execution throughout the implementation. The talk discusses practical implementation details, design trade-offs, and benchmarking results. Compared to unvectorized implementations, the resulting ML-KEM encapsulation and decapsulation operations achieve speedups of more than 6× and compared to autovectorized code by a factor of 2–3. Attendees will gain insights that can be applied to high-performance implementations of post-quantum cryptographic algorithms in OpenSSL and beyond.