A new RISC-V chip extension called HORCRUX delivers speedups of up to 129x for post-quantum cryptography operations, according to an arXiv preprint published July 16 [S1]. The devices most exposed to future quantum attacks, the billions of small embedded chips in cars and smart cards, are also the ones with the least room for new crypto. Whether HORCRUX can squeeze post-quantum protection into those tiny budgets is the question the paper sets out to answer.

Why post-quantum crypto breaks small chips

Post-quantum cryptography (PQC) is a new generation of encryption designed to resist attacks from quantum computers. The US National Institute of Standards and Technology has approved five algorithms for standardisation: ML-KEM, ML-DSA, SLH-DSA, HQC, and Falcon [S1]. These algorithms use far larger keys and more complex mathematics than the RSA and elliptic-curve encryption they are meant to replace. On a server, that overhead is barely noticeable. On a microcontroller with a few kilobytes of RAM and a coin-cell battery, it can be crippling.

HORCRUX targets this gap. It is a compact extension to the RISC-V instruction set, the open-source chip architecture used in everything from IoT sensors to custom AI accelerators. The extension adds custom instructions that run on a tightly coupled coprocessor: a small dedicated processing unit sitting alongside the main CPU core [S1]. The design is specifically optimised for embedded systems with strict energy limits and limited silicon area [S1].

The numbers that matter

The authors tested HORCRUX on a Zynq UltraScale+ FPGA, a programmable chip used to prototype designs before manufacturing. They reported speedups of up to 129x for hash-based schemes (such as SLH-DSA), 9x for lattice-based schemes (such as ML-KEM and ML-DSA), and 27x for code-based schemes (such as HQC) [S1].

The hardware cost is modest: fewer than 21,000 lookup tables and 4,400 flip-flops [S1]. A lookup table (LUT) is a basic configurable logic unit on an FPGA; a flip-flop (FF) stores a single bit of state. Those figures are small enough to suggest the design could fit on low-cost embedded chips rather than requiring a large dedicated accelerator.

The authors also report ASIC results from a postsynthesis characterisation in a 65nm CMOS process, along with power measurements to validate energy efficiency [S1]. ASIC means application-specific integrated circuit, a chip built for a fixed purpose rather than reprogrammable like an FPGA. The 65nm manufacturing node is older than today's leading-edge 3nm processes, so real-world performance on modern silicon remains an open question.

One important gap: the paper does not specify what baseline implementation the speedup multiples compare against [S1]. A 129x improvement means little without knowing the reference point.

One extension, five algorithms

Rather than building a separate hardware accelerator for each PQC algorithm, HORCRUX targets the shared computational kernels, the common mathematical operations, across all five NIST-approved schemes [S1]. This matters because NIST could revise its approved algorithms in the coming years. A single flexible extension is easier to update than five separate hardware blocks.

The extension maintains backward compatibility with standard RISC-V cores [S1]. Existing RISC-V software runs unchanged. The PQC instructions are available when needed and invisible when not.

The work comes from researchers at Politecnico di Torino and partner institutions, according to the paper's author list [P4]. The code is public on GitHub, where the repository describes HORCRUX as "an evolving lightweight Post-Quantum Cryptography RISC-V extension" [P2]. A separate project, PQCUARK from the Barcelona Supercomputing Center, takes a similar approach to PQC hardware on RISC-V [P5]. Multiple teams are converging on the same problem from different angles.

What it means

Every encrypted message, digital signature, and secure connection on the internet relies on mathematics that a sufficiently powerful quantum computer could eventually break. The world is moving to new algorithms that resist quantum attacks, but those algorithms are computationally expensive. HORCRUX is an attempt to make them run fast on the smallest, cheapest chips: the ones inside car brakes and door locks, where adding a bigger battery or more memory is not an option.

The 129x speedup for hash-based schemes is the standout. Hash-based cryptography is the most conservative, best-trusted branch of post-quantum crypto, but it is also the slowest. If HORCRUX can make hash-based signing practical on embedded devices, it widens the range of hardware that can use the safest available PQC option.

What it means for business

For hardware engineers at IoT device manufacturers, HORCRUX offers a potential design path: add a small coprocessor to a RISC-V core rather than redesigning the entire chip. The backward compatibility means existing firmware and toolchains keep working [S1].

For a two-person embedded security firm, the open-source repository [P2] means the design is available for evaluation now, not behind a vendor licence. The risk is that this is preprint-stage research with author-reported numbers and an unspecified baseline.

For companies building connected devices with long lifecycles, from industrial sensors to automotive controllers, the transition to post-quantum crypto is becoming urgent. Devices shipped today may still be in service when quantum threats materialise. An extension like HORCRUX, if it holds up to scrutiny, could let those devices upgrade through firmware rather than requiring new hardware.

What we don't know yet

The paper is an arXiv preprint and has not been peer-reviewed [S1]. All performance, area, and power claims are author-reported. The speedup figures lack a specified baseline, so direct comparison with other approaches is difficult [S1].

The FPGA and postsynthesis ASIC results do not constitute a tape-out. No chip has been manufactured, tested in silicon, or deployed in a commercial product. The extension has not been ratified or endorsed by RISC-V International as an official standard [S1].

The next milestones to watch: whether the paper passes peer review at a venue such as IEEE or IACR, and whether any commercial RISC-V core vendor integrates the HORCRUX instructions into a shipping product. The GitHub repository's last push was April 2026 [P2], so the project is active but not yet at production stage.

Subscribe to follow whether HORCRUX moves from preprint to silicon.

Sources

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.