Loading…
Building Faster Cryptography with Carryless Multiplication in NVIDIA CUDA 13.3
NVIDIA Developer BlogMichelle Horton
Summary
NVIDIA CUDA 13.3 introduces clmad, a native PTX carryless multiply-accumulate instruction for Ampere and newer GPU architectures. Prior to this release, GPUs lacked dedicated hardware for carryless multiplication, requiring developers to emulate binary extension field arithmetic with ALU operations or bitsliced circuits. The new primitive performs 64-bit by 64-bit carryless multiplication into 128-bit results with accumulation, allowing full 128-bit field multiplications via Karatsuba in six instructions. Benchmarks demonstrate that clmad achieves up to 6.3 TB/s throughput for GHASH on the NVIDIA B200, representing an 18.8x improvement over bitslicing. Additionally, sum-check protocol latency in zero-knowledge proving workloads decreases by up to 13x on the B200 and 4x on the RTX 5090.
Context
NVIDIA GPUs historically lacked native hardware acceleration for carryless multiplication, a primitive central to authenticated encryption, error-correcting codes, and zero-knowledge proofs. Developers had to emulate field multiplication using sequences of bitwise AND, XOR, and shift operations or rely on bitsliced circuits, resulting in high computational overhead.
Approach / What changed
CUDA 13.3 introduces the clmad PTX instruction for carryless multiply-accumulate on Ampere and newer architectures (SM 80+). The instruction computes 64-bit halves of a 128-bit product with accumulation, enabling 256-bit multiplication in GF(2^128) using six clmad operations via Karatsuba before applying modular polynomial reduction.
Takeaways
- The clmad PTX instruction provides hardware-accelerated carryless multiply-accumulate operations across NVIDIA GPUs starting from the Ampere architecture (SM 80+).
- In GF(2^128), elements can be multiplied using the Karatsuba algorithm in six clmad instructions before applying polynomial reduction such as Barrett reduction or shift-and-XOR division.
- Hardware carryless multiplication reaches ~6.3 TB/s GHASH throughput on the B200 (up to 18.8x faster than bitslicing) and accelerates sum-check zero-knowledge proving latency by 4x to 13x.
Related reading
Hardware-Rooted AI Security That Won’t Slow You Down
NVIDIA Confidential Computing secures enterprise data, proprietary model weights, and the model itself during active AI inference. The architecture integrates silicon-level private signing keys fused during manufacturing, encrypted multi-GPU NVLink, and remote attestation through the NVIDIA Remote Attestation Service alongside CPU Trusted Execution Environments. To mitigate overhead from secure work submission latency and encrypted host-to-device transfers, software optimizations incorporate CC-safe autotuner timing in FlashInfer, asynchronous copy workers in SGLang, and piecewise CUDA graph replay. Benchmarks on an HGX B300 system running the Qwen 3.5 397B-A17B model at FP8 precision show inference performance reaches up to 98% of non-confidential baselines across tested concurrency levels.
Elizabeth GoodmanHow to Govern Autonomous Agents in Enterprise AI Factories