Back to projects
September 2026

MSc Thesis: Benchmarking SQISign

A unified microarchitectural benchmark of the SQISign family of post-quantum signature schemes. I built a Rust and C test harness to profile CPU cycle latency and stack memory across six variants on Apple Silicon.

CRustJuliaSageMathAArch64Post-Quantum Crypto
Read the Thesis View Code

The Problem

A sufficiently powerful quantum computer would break the signature schemes that protect the internet today. NIST has already standardised lattice-based replacements such as ML-DSA, but their keys and signatures run to several kilobytes, which is a real cost for bandwidth-constrained systems like IoT devices. Relying on lattices for everything is also a single point of failure as one breakthrough in lattice reduction could undermine all of the new standards at once.

SQISign (Short Quaternion-Isogeny Signature) takes a different approach. It is built on isogenies between supersingular elliptic curves and produces signatures of only a few hundred bytes. The trade-off is heavy computation, thus researchers have been working on remedying this with a family of faster variants, including two-dimensional schemes (2D-West, 2D-East) and a high-dimensional one (SQISignHD).

The Challenge: Each variant was developed in isolation, in different languages, on different hardware, with different benchmarking methods. None of them plug into standard frameworks as they are experimental prototypes. As a result, nobody could say whether a reported speedup was a genuine algorithmic improvement or just an artefact of unequal testing conditions.

The Goal

My thesis set out to put the whole SQISign family on a level playing field and answer three questions:

  1. Latency: How do key generation, signing and verification compare in CPU cycles when every variant runs in the same AArch64 environment?
  2. Memory: How much stack and physical memory does each variant need at its peak?
  3. Side channels: Do the NIST Round 1 and Round 2 implementations leak key-dependent timing information under Test Vector Leakage Assessment (TVLA)?

The variants evaluated were NIST Round 1, NIST Round 2, 2D-West, 2D-West-Heuristic, 2D-East and SQISignHD, each at NIST security levels 1, 3 and 5.

The Solution

The Benchmarking Harness

I built a custom harness in two layers:

  • A Rust orchestrator automates batched runs of every variant and collects the results.
  • C telemetry binaries are compiled directly into each reference implementation. They execute warm-up runs, read hardware cycle counters on Apple Silicon, and keep timing loops free of I/O so that nothing but the cryptography is measured.

Measuring Stack Memory

Measuring peak stack usage precisely meant building a dedicated profiler. Each operation runs on a bounded thread inside its own mmap-allocated memory region, protected by a PROT_NONE guard page that traps any overflow. The region is "painted" with a known pattern beforehand, so the high-water mark of stack usage can be read back exactly afterwards.

Porting SQISignHD Verification to C

SQISignHD's verification algorithm only existed as a SageMath reference, which can't be meaningfully compared against compiled C. I ported it to C, using LLM assistance for the initial translation to meet the project timeline, and validated the result against the full SageMath test suite. To the best of my knowledge, this enabled the first microarchitectural benchmark of SQISignHD verification.

Finding an Upstream Bug

To keep runs deterministic, the harness passes each implementation a fixed seed. The SQISign reference implementation kept ignoring it and silently generating random keys instead. Tracing through the source, I found the cause in its seed parser: the first sscanf call used the %u (decimal) format specifier on a hexadecimal seed. Given a seed like 0557cd43..., it read 0557, stopped at the first letter, and reported success. That meant the correct hexadecimal parsing path never ran, and the seed was silently replaced with a different value.

Results

There is no single best SQISign variant. Each one makes a distinct trade-off:

  • SQISignHD dominates signing. It signs over 70× faster than NIST Round 1 and 3.2× faster than NIST Round 2, while using 75% less peak stack.
  • NIST Round 2 dominates verification. SQISignHD verification is 15.7× slower than Round 2.
  • NIST Round 2's speed costs memory. Its precomputed tables push stack usage past 3.4 MB at security level 3, which could rule it out for small microcontrollers.
  • Neither NIST implementation is constant-time. TVLA showed statistically significant key-dependent leakage (|t| > 4.5) in both, so more engineering work is needed before standardisation.

In practice, SQISignHD suits constrained devices that sign, such as IoT hardware, while NIST Round 2 suits high-traffic servers that verify, such as TLS endpoints.

What I Learned

This project took me from the mathematics of isogenies down to cycle counters and guard pages. The biggest lesson was how easily benchmarks mislead: compiler flags, cache state, language runtimes and even a seed-parsing bug in upstream code can all distort results. Getting trustworthy numbers took far more careful engineering than producing any numbers at all.

The thesis was supervised by Philipp Jovanovic (UCL) and Maria Corte-Real Santos (ENS de Lyon). The full harness, raw CSV datasets and extra visualisations are available in the GitHub repository.