For over fifteen years, x86 CPUs have shipped with a dedicated hardware instruction for carryless multiplication. It’s a small but stubborn primitive that sits underneath authenticated encryption, error-correcting codes, and modern zero-knowledge proofs.
Until now, NVIDIA GPUs lacked native support for this operation. NVIDIA CUDA 13.3 closes that gap with clmad, a new PTX instruction available on all NVIDIA Ampere and newer GPUs (SM 80+). In this post, we show what is possible when carryless multiplication is finally a hardware-accelerated GPU primitive.
We benchmark two cryptographic workloads that depend on it: GHASH, the integrity hash inside AES-GCM (the AEAD cipher behind TLS, VPN, and most data-center encryption), and the sum-check protocol, the workhorse inner loop of advanced zero-knowledge proving systems. On the NVIDIA B200, GHASH throughput reaches ~6.3 TB/s—close to DRAM read bandwidth and up to 18.8x faster than the prior bitsliced state of the art. Sum-check over \(GF(2^{128})\) speeds up the prior state of the art by 4–13×.
Why does this matter beyond AES-GCM? Carryless multiplication is the shared kernel underneath a surprisingly wide range of cryptographic and coding-theoretic workloads. CRC and Reed–Solomon codes used in storage systems and telecom baseband processing, BCH codes for flash memory, quantum stabilizer codes, several post-quantum cryptographic schemes, and the binary-field arithmetic that underpins modern zero-knowledge proving systems such as Binius. Hardware acceleration on the GPU changes the cost structure for all these workloads, on every Ampere-or-later system already deployed.
