ATHOS - Accelerated Trusted Hardware for Optimal Security

ATHOS (Accelerated Technology for Hardware Optimization with RISC-V) is a hybrid accelerator architecture that combines tightly and loosely coupled accelerators to enhance Post-Quantum Cryptography (PQC) performance on RISC-V platforms.
It leverages the Core-V eXtension Interface (CV-X-IF) for seamless integration with the CV32E40X core, marking one of the first real-world applications of this interface.
ATHOS implements acceleration for CRYSTALS-Kyber and CRYSTALS-Dilithium, achieving up to 7.74× and 4.12× speed-ups respectively, while maintaining a modest 1.47× area overhead on ASIC.

---

📁 Repository Structure

ATHOS/
├── hw/             # Hardware modules (RTL for tightly and loosely coupled accelerators)
├── sw/             # Software tests and PQC algorithm applications (Kyber, Dilithium)
├── tb/             # Testbenches for simulation
├── scripts/        # Build utilities and automation
├── config/         # Configuration files for SoC integration
└── util/           # Helper utilities and register definitions

---

🚀 Getting Started

Clone the repository and set up the environment:

git clone <your_repo_url>
cd athos
make vendor-update
make esl_epfl_x_heep-sync
make questasim-sim

---

🧩 IP Tests

The repository includes modular applications to verify individual IPs (Intellectual Property blocks) and their integration in various configurations.

🔷 Keccak

Implements the Keccak permutation (SHA-3 core) used in Kyber and Dilithium:

make app-KECCAK IP_TYPE=KECCAK
make run-KECCAK-questasim IP_TYPE=KECCAK

🔶 NTT

Build and run the Number Theoretic Transform accelerator:

make app-NTT IP_TYPE=NTT
make run-NTT-questasim IP_TYPE=NTT

🔶 INTT

Build and run the Inverse NTT accelerator:

make app-INTT IP_TYPE=INTT
make run-INTT-questasim IP_TYPE=INTT

🧠 COMBO

Combines multiple IPs (e.g., Keccak + NTT/INTT) for full integration testing:

make app-COMBO IP_TYPE=COMBO
make run-COMBO-questasim IP_TYPE=COMBO

There are five predefined configurations.
Select the desired test by renaming the corresponding main#.c file to main.c before building.

File	Configuration
main1.c	Keccak called 2 times
main2.c	Keccak → INTT
main3.c	Keccak → NTT
main4.c	NTT → Keccak
main5.c	INTT → Keccak

These tests validate functional correctness and interoperability across IPs, as required in ML-KEM (Kyber) workloads.

---

🛡️ PQC Applications — CRYSTALS-Kyber

ATHOS accelerates CRYSTALS-Kyber by combining:

• Tightly coupled accelerators (Montgomery, Barrett, polynomial arithmetic, CBD, rej_uniform)
• Loosely coupled accelerators (Keccak, NTT, INTT via DMA)

Run test vectors for different security levels:

🧱 Kyber-512

make app-testvectors-kem-ATHOS-kyber512_clean SCHEME=kyber512 VERSION=ATHOS
make run-testvector-kem-ATHOS-kyber512-questasim SCHEME=kyber512

🧱 Kyber-768

make app-testvectors-kem-ATHOS-kyber768_clean SCHEME=kyber768 VERSION=ATHOS
make run-testvector-kem-ATHOS-kyber768-questasim SCHEME=kyber768

🧱 Kyber-1024

make app-testvectors-kem-ATHOS-kyber1024_clean SCHEME=kyber1024 VERSION=ATHOS
make run-testvector-kem-ATHOS-kyber1024-questasim SCHEME=kyber1024

---

⚙️ Architecture Overview

ATHOS integrates multiple accelerators into X-HEEP, combining:

• ATHOS-tightly: CV-X-IF connected accelerators for arithmetic and sampling.
• ATHOS-loosely: memory-mapped accelerators (NTT, INTT, Keccak) interfaced via XAIF and DMA.

Integration Highlights:

• CV-X-IF enables custom RISC-V instructions without modifying the core or toolchain.
• XAIF + DMA enable large data transfers for loosely coupled IPs.
• Achieves hybrid flexibility, accelerating both scalar and vector operations efficiently.

---

📊 Results Summary

🔹 Code Size Reduction

Algorithm	Improvement
Kyber-512	−12.7%
Kyber-768	−13.9%
Kyber-1024	−5.6%
Dilithium-2	−18.4%
Dilithium-3	−16.9%
Dilithium-5	−17.0%

🔹 Performance Speed-Up (vs Software Baseline)

Scheme	Algorithm	Speed-up
Kyber-512	KeyGen / Enc / Dec	×7.74 / ×6.16 / ×5.38
Kyber-768	KeyGen / Enc / Dec	×6.21 / ×6.83 / ×6.20
Kyber-1024	KeyGen / Enc / Dec	×5.88 / ×7.15 / ×6.52
Dilithium-2	KeyGen / Sign / Verify	×3.42 / ×4.12 / ×3.88

🔹 ASIC Area and Frequency (UMC 65nm)

Design	Area Overhead	Frequency
Baseline X-HEEP	—	100 MHz
ATHOS	+47%	100 MHz

ATHOS preserves the original processor frequency, ensuring no pipeline degradation despite the added accelerators.

---

📎Reference

A. Dolmeta, M. Martina, and G. Masera,
“ATHOS: A Hybrid Accelerator for PQC CRYSTALS-Algorithms Exploiting New CV-X-IF Interface,”
IEEE Access, Dec. 2024. DOI: 10.1109/ACCESS.2024.3511340

📄 License

This repository follows the licensing terms of the respective reference implementations used as the starting point. Please check individual algorithm directories for specific license details.

---

👥 Author

• Alessandra Dolmeta — alessandra.dolmeta@polito.it