libmlwe-fast | Timur Dzhesur

What it is

A Module-LWE-based key-encapsulation library written in C11. The implementation separates the public KEM API, the underlying public-key encryption scheme, and the arithmetic primitives into three layers.

Library architecture: the KEM layer sits above IND-CPA encryption, with polynomial arithmetic, NTT, sampling, modular reduction, and Keccak underneath. — Figure 3.1 · Bachelor’s thesis, p. 22 · Original figure, open to enlarge.

Implementation focus

Polynomial arithmetic and an in-place, seven-layer Number Theoretic Transform.
Division-free Montgomery and Barrett reduction, with 32-byte-aligned polynomial storage.
A C baseline and compile-time AVX2/AVX-512 variants for polynomial addition and subtraction.
Constant-time ciphertext verification and conditional key selection.

Testing and validation

Catch2 tests cover arithmetic primitives, NTT roundtrips, sampling, hashes, encryption, and KEM roundtrips. An interoperability test encapsulates with libmlwe-fast and decapsulates with the official Kyber-512 reference implementation, comparing the shared secrets byte-for-byte.

A research project, not an independently audited or certified cryptographic library. The thesis validates against Kyber-512; final ML-KEM (FIPS 203) conformance is not claimed here.

Thesis benchmarks

Reported results on an AMD Ryzen 9 7900, with 5,000 samples per configuration using Catch2. GCC 16.1.1; release builds with -O3 -march=native -mtune=native -DNDEBUG.

C baseline versus the Kyber reference implementation
Operation	Reference (µs)	C baseline (µs)	Speedup
Key generation	20.36	12.72	1.60×
Encapsulation	24.22	12.06	2.01×
Decapsulation	32.15	15.56	2.07×

Mean execution times; lower is better. Source: thesis Table 4.2, p. 38. These are measurements from one machine, not a general performance guarantee.

Key-generation benchmark: C baseline, AVX2, and AVX-512 means against the Kyber reference, with execution-time distributions. — Figure 4.1 · Bachelor’s thesis, p. 37 · Original figure, open to enlarge.

Encapsulation benchmark: C baseline, AVX2, and AVX-512 means against the Kyber reference, with execution-time distributions. — Figure 4.2 · Bachelor’s thesis, p. 38 · Original figure, open to enlarge.

Decapsulation benchmark: C baseline, AVX2, and AVX-512 means against the Kyber reference, with execution-time distributions. — Figure 4.3 · Bachelor’s thesis, p. 39 · Original figure, open to enlarge.

Manual AVX2 and AVX-512 paths brought only small additional gains, and sometimes slight slowdowns. They targeted polynomial addition and subtraction, while the more expensive NTT and hashing routines remained scalar. The analysis explores this limit through Amdahl’s law.