Two birds, one mask: side-channel-resistant unified hardware for ML-DSA and ML-KEM

We present the first unified hardware implementation of the post-quantum schemes Module-Lattice-Based Digital Signature Algorithm (ML-DSA) and Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) protected against side-channel attacks using first-order masking. Rather than proposing new masking gadgets, we focus on hardware-optimized instantiations and integration of state-of-the-art masked components, including masked domain conversions, sampling, and message decoder. In addition, we propose an optimized masked decomposition algorithm with a formal security proof, reducing the number of required operations compared to prior approaches. The complete implementation was functionally verified against the reference software implementations and evaluated on an Field Programmable Gate Array (FPGA) platform. Side-channel resistance was assessed using the Test Vector Leakage Assessment (TVLA) methodology, showing no first-order leakage under the tested conditions. To facilitate reproducibility and further research, we publicly release the full hardware source code together with the collected side-channel trace datasets.