For over fifteen years, x86 CPUs have shipped with a dedicated hardware instruction for carryless multiplication. It’s a small but stubborn primitive that sits underneath authenticated encryption, error-correcting codes, and modern zero-knowledge proofs.

Until now, NVIDIA GPUs lacked native support for this operation. NVIDIA CUDA 13.3 closes that gap with clmad , a new PTX instruction available on all NVIDIA Ampere and newer GPUs (SM 80+). In this post, we show what is possible when carryless multiplication is finally a hardware-accelerated GPU primitive.

We benchmark two cryptographic workloads that depend on it: GHASH, the integrity hash inside AES-GCM (the AEAD cipher behind TLS, VPN, and most data-center encryption), and the sum-check protocol, the workhorse inner loop of advanced zero-knowledge proving systems. On the NVIDIA B200, GHASH throughput reaches ~6.3 TB/s—close to DRAM read bandwidth and up to 18.8x faster than the prior bitsliced state of the art.…