Paper 2026/1485 Original: eprint.iacr.org/2026/1485 ↗

From PQC to HHE: Reusing a Co-Design Platform for Side-Channel-Protected PASTA

Abstract

Hybrid homomorphic encryption (HHE) lets a constrained client send compact symmetric ciphertexts while a server transciphers them into homomorphic ciphertexts, making HE-friendly ciphers such as PASTA a practical choice. Efficient and side-channel-secure execution of PASTA on embedded devices, however, remains challenging, since existing hardware relies on dedicated cipher cores and provides no side-channel protection. We present a hardware/software co-design of PASTA on RISQrypt, an existing post-quantum cryptography (PQC) platform, without adding any cipher-specific RTL. The affine layers, S-boxes, and SHAKE128 sampling are executed by the platform's arithmetic and Keccak accelerators under software control. We further integrate first-order arithmetic masking by reusing the masking accelerator for share refreshing and masked-multiplication randomness, requiring no additional hardware while keeping arithmetic on secret shares off the processor datapath. The masked multiplication shows no first-order leakage in a TVLA evaluation with $100\,000$ traces on an Artix-7 FPGA. Compared with a software-only baseline on the same core, the co-design achieves speed-ups of $9.68\times$ and $9.85\times$ in the unmasked and masked configurations, respectively. To the best of our knowledge, this is the first side-channel-protected, hardware-accelerated implementation of PASTA.