Protecting Quantum Era Cryptography. Today.

FIQ-PQC04B Hybrid Classical and Post-Quantum Cryptography

Hybrid Classical and Post-Quantum Cryptography IP Core for Future-Proof Security

FortifyIQ’s Hybrid Cryptography IP core combines traditional asymmetric algorithms—such as RSA and ECC—with post-quantum standards including ML-KEM (Kyber) and ML-DSA (Dilithium)—in a single, efficient hardware module. Designed for applications requiring smooth migration to quantum-safe cryptography, it enables hybrid key exchange and digital signature schemes that meet both current and future security standards. Optimized for balanced power, area, and performance, the IP supports secure SoC integration with protections against side-channel and fault injection attacks, making it suitable for FIPS 140-3 and Common Criteria certification. Ideal for secure boot, firmware authentication, and long-lifecycle systems requiring cryptographic agility.

Features

  • Efficient Performance
  • SCA/FIA Protections
  • Patented High-Performance Modulo Multiplication
  • Flexible Interfaces
  • RAM/ROM Firmware Support
  • Security Certification Readiness

Applications

  • IoT Devices
  • Automotive Systems
  • Embedded and Industrial Control
  • Authentication Tokens
  • Payment Systems
  • Secure Communications
  • Network Devices
Technical Overview

FortifyIQ’s Hybrid Cryptography IP core is a unified, high-efficiency hardware engine combining classical public-key cryptography (RSA and ECC) with post-quantum algorithms ML-KEM (Kyber) and ML-DSA (Dilithium), enabling hybrid cryptographic schemes which are compliant with emerging standards from NIST and other regulatory bodies. Designed for secure SoC integration, the IP offers a future-proof solution that maintains compatibility with current systems while preparing for the quantum threat.

The IP supports RSA signature verification (RSA-2048/4096) and ECC operations (ECDH/ECDSA over NIST P-192 to P-521), alongside full support for ML-KEM and ML-DSA at all standardized security levels. Hybrid operations, such as dual-signature schemes (ECDSA + ML-DSA) and combined key exchange (ECDH + ML-KEM) are supported via programmable control logic, allowing cryptographic agility based on security policy or operational mode.

A modular architecture includes high-speed arithmetic units: a patented modular multiplier for classical cryptography operations, an NTT engine for lattice-based PQC, and optimized hash accelerators for shared use across classical and PQC algorithms. This hardware reuse strategy achieves a balanced trade-off between performance, silicon area, and power consumption.

To support secure deployment in high-assurance applications, physical attack protections are available for sensitive operations involving private keys or intermediate values. These features support FIPS 140-3 and Common Criteria certification pathways.

Engineered to support secure boot, firmware validation, secure communications, and long-lifecycle devices, FortifyIQ’s Hybrid Cryptography IP core enables seamless transition to post-quantum security without sacrificing interoperability, efficiency, or certification readiness.

External Dependencies

  • Requires an external cryptographically secure random number generator (CSPRNG)

Deliverables

  • SystemVerilog source code or netlist
  • Testbench, input vectors, and expected results
  • Sample timing constraints, synthesis, and simulation scripts
  • Hardware Abstraction Layer (HAL) reference implementation
  • Integration, configuration, and usage manuals
  • Firmware code
  • Software library
  • Security documentation
FortifyIQ AES Algorithm
AVA_VAN.5 Evaluation & Validation Summary
SGS Brightsight Common Criteria Laboratory
Summary. The leakage analysis (Welch t-test) on over 30 million traces did not show statistically significant first- and second-order differences between trace sets with fixed and random inputs. The template-based DPA analysis, on the pseudo-random trace set for the profiling phase (15 million traces) and on a sub-set of 300k fix input traces for matching phase targeting the first-round S-box output, and template attack on ciphertext, did not indicate any potential information leakage.”
“The results for the soft IP presented in the report were obtained on the TOE which is the basic hardware implementation of the soft IP without additional levels of security (e.g. that are present in a secure silicon layout). Therefore the internal strength of the soft IP itself was evaluated. This indicates that the investigated features and parameters of the soft IP implementation should be robust against SCA and fault injection attacks in different implementations including ASIC. Nevertheless, according to the Common Criteria rules, the strength of the final composite product must be evaluated on its own
Request Technical Details