StealthCores Launches StealthPQ Post-Quantum Cryptography IP With Side-Channel and Glitch Protection
CNSA 2.0 compliant IP core for FPGAs and ASICs provides full hardware offload of ML-KEM and ML-DSA
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
Gainesville, FL, Nov. 02, 2026 (GLOBE NEWSWIRE) — StealthCores today announced the launch of StealthPQ, a post-quantum cryptography IP core for FPGAs and ASICs. StealthPQ provides full hardware offload of ML-KEM and ML-DSA, the NIST post-quantum standards for key establishment and digital signatures. It supports all six parameter sets of FIPS 203 and FIPS 204. These include ML-KEM-1024 and ML-DSA-87, the parameter sets required for CNSA 2.0 compliance. The optional countermeasure configuration adds protection against side-channel, fault and glitch attacks.
Post-quantum algorithms protect against the threat of quantum computers, but they do not protect the hardware that runs them. Side-channel attacks recover secret keys from the power consumption or electromagnetic emissions of a device. Glitch attacks disturb a device during an operation to force errors that expose keys or bypass security checks. Researchers have demonstrated both types of attack against implementations of post-quantum algorithms. These attacks target the implementation, so the defense must be built into the implementation.
StealthCores designed the StealthPQ countermeasure configuration to provide this protection. It applies cryptographic masking to all secret-dependent operations. The countermeasure configuration also includes over 30 specific fault and glitch attack protections, such as a dual-lockstep controller. A detected fault locks the core until all keys are erased.
“The new algorithms solve the quantum problem, but they do not solve the implementation problem. An attacker with physical access can still go after the keys through side-channel and glitch attacks. Defending against those attacks takes protection designed into the hardware, and that has always been the focus of StealthCores. StealthPQ brings that expertise to post-quantum cryptography.”
Stuart Audley, President of StealthCores
The Need for Post-Quantum Cryptography
A large-scale quantum computer would break the public-key algorithms that protect most systems today. Encrypted data captured now could be decrypted once such a machine exists. Digital signatures could be forged. Systems built on FPGAs and ASICs often stay in service for decades, so their cryptography must be ready before they ship. U.S. national security systems are already on a fixed schedule. Under NSA guidance, new acquisitions for those systems are expected to support CNSA 2.0 from January 2027.
Key Features and Capabilities
StealthPQ performs each operation in full, from key generation through signing and decapsulation. The host starts an operation through a single AXI4-Lite interface and reads the result when the core signals completion. Private keys are generated in secure internal key slots and remain there. Software refers to each key by its slot number. The shared secret of a key establishment leaves the core on a dedicated output. That output connects directly to StealthKey or another key store.
StealthPQ is NIST ACVTS ready. ACVTS is NIST’s Automated Cryptographic Validation Testing System. An ACVP harness with validation support is available as an option.
“StealthPQ makes hardware-level post-quantum cryptography an integration task rather than a complex cryptographic design and verification task,” added Audley.
Performance and Integration
The Fast configuration completes up to 12,400 ML-KEM-768 encapsulations and 5,190 ML-DSA-65 verifications per second at 200 MHz. At the highest security level, it completes up to 9,270 ML-KEM-1024 encapsulations and 3,640 ML-DSA-87 verifications per second. These figures apply to the configurations without the countermeasure option.
Customers can also select a configuration with ML-KEM or ML-DSA alone. StealthPQ is delivered in Verilog or VHDL for every major FPGA family and for ASIC implementation. Software support includes the StealthAPI library, a Linux driver and wolfSSL integration.
Full CNSA 2.0 Security Suite
StealthPQ completes the CNSA 2.0 Security Suite from StealthCores. The suite provides CNSA 2.0 compliant AES-256 with StealthAES, SHA-384 and SHA-512 with StealthSHA, and ML-KEM-1024 and ML-DSA-87 with StealthPQ. The cores share common interfaces and one software library.
Two new cores join the suite. StealthKey is a hardware key manager that generates, derives, wraps and delivers keys for the other cores. It takes the StealthPQ shared secret directly in hardware. Software therefore never holds the session keys. StealthEC is an optional addition. It provides ECDSA signing and verification and ECDH key agreement on the NIST P-384 and P-256 curves in a compact design. It supports CNSA 1.0 systems during the transition. It also supplies the classical half of a hybrid key exchange alongside ML-KEM.
Target Applications
StealthPQ targets key establishment for TLS 1.3, IPsec IKEv2 and MACsec. It also serves firmware and code signing, secure boot verification, signing servers and hardware security modules, and device identity and provisioning.
The Standard and Fast configurations of StealthPQ are available now for FPGA and ASIC implementations. For detailed specifications, performance data and integration support, contact the StealthCores team at info@stealthcores.com.
About StealthCores
StealthCores develops advanced security IP for FPGAs and ASICs, delivering practical, high-performance cryptographic solutions with built-in countermeasures against side-channel attacks. Backed by decades of industry experience and purpose-built IP, StealthCores enables customers to secure critical systems with confidence. Learn more at www.stealthcores.com or contact us at info@stealthcores.com.
Media Contact
StealthCores
info@stealthcores.com
(352) 297-2244
Media gallery
