# Building Faster Cryptography with Carryless Multiplication in NVIDIA CUDA 13.3

[NVIDIA Developer Blog](https://yomu.fyi/company/nvidia-developer-blog) · Michelle Horton · Jul 15, 2026

**Type:** Announcement

## Summary

NVIDIA CUDA 13.3 introduces clmad, a native PTX carryless multiply-accumulate instruction for Ampere and newer GPU architectures. Prior to this release, GPUs lacked dedicated hardware for carryless multiplication, requiring developers to emulate binary extension field arithmetic with ALU operations or bitsliced circuits. The new primitive performs 64-bit by 64-bit carryless multiplication into 128-bit results with accumulation, allowing full 128-bit field multiplications via Karatsuba in six instructions. Benchmarks demonstrate that clmad achieves up to 6.3 TB/s throughput for GHASH on the NVIDIA B200, representing an 18.8x improvement over bitslicing. Additionally, sum-check protocol latency in zero-knowledge proving workloads decreases by up to 13x on the B200 and 4x on the RTX 5090.

## Context

NVIDIA GPUs historically lacked native hardware acceleration for carryless multiplication, a primitive central to authenticated encryption, error-correcting codes, and zero-knowledge proofs. Developers had to emulate field multiplication using sequences of bitwise AND, XOR, and shift operations or rely on bitsliced circuits, resulting in high computational overhead.

## Approach / What changed

CUDA 13.3 introduces the clmad PTX instruction for carryless multiply-accumulate on Ampere and newer architectures (SM 80+). The instruction computes 64-bit halves of a 128-bit product with accumulation, enabling 256-bit multiplication in GF(2^128) using six clmad operations via Karatsuba before applying modular polynomial reduction.

## Takeaways

- The clmad PTX instruction provides hardware-accelerated carryless multiply-accumulate operations across NVIDIA GPUs starting from the Ampere architecture (SM 80+).
- In GF(2^128), elements can be multiplied using the Karatsuba algorithm in six clmad instructions before applying polynomial reduction such as Barrett reduction or shift-and-XOR division.
- Hardware carryless multiplication reaches ~6.3 TB/s GHASH throughput on the B200 (up to 18.8x faster than bitslicing) and accelerates sum-check zero-knowledge proving latency by 4x to 13x.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Performance](https://yomu.fyi/topic/performance)

[Read original post](https://developer.nvidia.com/blog/building-faster-cryptography-with-carryless-multiplication-in-nvidia-cuda-13-3)