CUDA 13.3 introduces a new PTX instruction, clmad, that provides hardware-accelerated carryless (carry-free) multiplication on all NVIDIA Ampere and newer GPUs (SM 80+). Carryless multiplication has been available on x86 CPUs for over fifteen years and underlies a variety of cryptographic and coding tasks; its arrival on NVIDIA GPUs enables substantial speedups for several GF(2^n) workloads.
Why carryless multiplication matters
Carryless multiplication is the core operation for arithmetic in binary extension fields GF(2^n), where addition is XOR and multiplication is polynomial multiplication modulo an irreducible polynomial. This primitive appears in many areas:
- GHASH, the authentication hash used in AES-GCM (the AEAD cipher used in TLS, VPNs, and many data-center encryption deployments);
- CRC and Reed–Solomon codes for storage and telecom baseband processing;
- BCH codes for flash memory;
- quantum stabilizer codes and parts of some post-quantum schemes;
- and binary-field arithmetic inside modern zero-knowledge proving systems.
Before clmad, NVIDIA GPU implementations relied on software techniques like bitslicing to accelerate these operations. Native hardware support changes the cost model on every Ampere-or-later system.
The clmad instruction: basics
- Instruction: clmad (carryless multiply-accumulate) as PTX.
- Function: performs a carryless multiplication of two 64-bit inputs to produce a 128-bit result, with .lo and .hi variants that compute the lower and upper 64 bits respectively while adding a 64-bit accumulator.
- Availability: hardware-accelerated on NVIDIA GPUs with Ampere (sm_80) or later streaming multiprocessors.
Larger-field multiplications (for example GF(2^128)) can be implemented via Karatsuba decomposition using six 64×64→128 clmad calls to produce a 256-bit intermediate result, followed by polynomial reduction (Barrett-style or shift-and-XOR long-division) back to 128 bits.
GHASH acceleration and measurements
GHASH, which multiplies an accumulator by a hash key H in GF(2^128) for each 128-bit block of input, maps efficiently to clmad plus modular reduction (the field polynomial is X^128 + X^7 + X^2 + X + 1). Benchmarks reported for clmad-based GHASH implementations include:
- NVIDIA B200: peak GHASH throughput around 6,335 GB/s (~6.3 TB/s), close to DRAM read bandwidth and up to 18.8× faster than the prior bitsliced state of the art.
- NVIDIA GeForce RTX 5090: peak GHASH throughput about 1,300 GB/s, roughly 2× higher than the bitsliced implementation on that card.
On the B200 the bitsliced baseline was slower than the RTX 5090 (fewer SMs and lower clocks), but clmad hardware acceleration gives the B200 very high GHASH performance.
Zero-knowledge proving: sum-check protocol
The sum-check protocol is a building block for many zero-knowledge proving systems. It requires many binary-field multiplications: in each of n rounds, the prover interpolates polynomials, forms product-sums of lists of field elements, and evaluates at random points chosen by the verifier. These operations are highly parallelizable and dominated by GF(2^128) multiplications when the underlying representations are bitwise.
Comparing a clmad-based linear-time, linear-space sum-check implementation to a bitsliced implementation (the Irreducible bitsliced baseline) shows significant improvements:
- NVIDIA GeForce RTX 5090: measured speedups of about 3–4× over the bitsliced approach.
- NVIDIA B200: measured speedups up to about 13×, with the advantage growing modestly as polynomial and composition sizes increase.
(The article also quotes a 4–13× overall improvement range in places; the concrete per-device measurements above reflect the reported RTX 5090 and B200 numbers.)
Implications and intended audience
Adding hardware-accelerated carryless multiplication to NVIDIA GPUs affects a wide range of cryptographic and coding-theoretic workloads. Systems performing large-input authenticated encryption (AES-GCM) or binary-field zero-knowledge proofs can expect substantially lower GPU runtime costs on Ampere-or-later hardware.
The coverage is aimed at CUDA developers integrating cryptography into GPU pipelines and researchers working on security, privacy, and zero-knowledge protocols that rely on binary-field arithmetic.
Practical notes
- To reproduce the examples, install CUDA 13.3; inline PTX snippets can be embedded directly into kernels.
- Ampere or later GPUs (SM 80+) are required to benefit from clmad hardware acceleration.
- NVIDIA also points users targeting post-quantum or cryptographic workloads to the cuPQC SDK and telecommunication developers to NVIDIA Aerial documentation for related toolchains.
Conclusion
CUDA 13.3 fills a long-standing gap by making carryless multiplication a native GPU primitive via clmad. Benchmarked workloads—GHASH and the sum-check protocol—show dramatic speedups (GHASH up to 18.8× on B200; sum-check up to ~13× on B200), highlighting immediate benefits for large-scale authenticated encryption and binary-field zero-knowledge proving on Ampere-or-later NVIDIA GPUs.
