A Fully Pipelined FIFO Based Polynomial Multiplication Hardware Architecture Based On Number Theoretic Transform

TL;DR

The paper tackles accelerating polynomial multiplication for Ring-LWE-based cryptography on FPGAs by designing a fully pipelined NTT-based multiplier that uses FIFO buffers to process two $n$-degree polynomials in $n/2$ clock cycles. The core approach decomposes the transform into weighting, NTT, element-wise multiplication, inverse NTT, and weight removal, augmented with Ka-based multipliers and Barrett reduction to optimize the critical path. Key contributions include a FIFO-based, fully pipelined NTT architecture for $N=256$ and $M=1{,}049{,}089$ that achieves significantly reduced throughput latency while maintaining similar or lower resource usage compared with the fastest prior work. The FPGA implementation demonstrates a competitive 0.56 $\mu$s delay and 128 clock cycles for degree-256 polynomial multiplication, enabling higher encryption throughput in PQC/FHE contexts with hardware accelerators.

Abstract

This paper presents digital hardware for computing polynomial multiplication using Number Theoretic Transform (NTT), specifically designed for implementation on Field Programmable Gate Arrays (FPGAs). Multiplying two large polynomials applies to many modern encryption schemes, including those based on Ring Learning with Error (RLWE). The proposed design uses First In, First Out (FIFO) buffers to make the design fully pipelined and capable of computing two n degree polynomials in n/2 clock cycles. This hardware proposes a two-fold reduction in the processing time of polynomial multiplication compared to state-of-the-art enabling twice as much encryption in the same amount of time. Despite that, the proposed hardware utilizes fewer resources than the fastest-reported work.

Figures (7)

• Figure 1: Polynomial multiplication using NTT and negative wrapped convolution could be divided into five steps.
• Figure 2: (a) Performing naive NTT implementation over the polynomial $a=(a_{15} a_{14} ... a_1 a_0)$. At clock one at stage 1, coefficients $a_0$ and $a_8$ are read from memory, butterfly operation is performed, and the result is stored in memory. (b) $si\_ak$ indicates the result of butterfly operation on polynomial coefficients $ak$ in stage $si$. Stage 1 takes eight clock cycles to complete. After this stage is completed, stage 2 performs butterfly on $s1\_a0$ and $s1\_a_4$. Computing NTT needs a total of 32 clock cycles to complete.
• Figure 3: Total number of clock cycles required for naive and proposed optimized pipelined implementation of NTT. In the case of pipelined NTT, total number of clock cycles required to perform NTT on the first polynomial is higher as coefficients have to move through the pipeline. For the following polynomials, it only takes N/2 clock cycles to perform NTT on a degree n polynomial. (b) Total number of registers required to implement naive and proposed optimized pipelined NTT.
• Figure 4: Pipelined computation in NTT. In each stage, butterfly operations can start as soon as the operands become available. At stage 1, butterfly operations start immediately as $a0$ and $a8$ in this stage are original polynomial coefficients and are available. It was assumed that result of butterfly operation on polynomial coefficient $ak$ at stage ($si$) called $si\_ak$ as shown in (b) for the example of $a0$ and $a8$. Stage 2 starts when $s1\_a0$ and $s1\_a4$ are available which takes 5 clock cycles. When fully pipelined, NTT takes 8 clock cycles to complete.
• Figure 5: Splitting the binary multiplication of $\phi_i$ and $a_i$ using ka algorithm to increase speed and frequency. First, multiplicand are captured in register $r_0$ and $r_1$. $\phi_i$ and $a_i$ then split into two parts of $L$, $H$ and stores in registers $r2$ to $r5$. In next three clock cycles (each dash line represent a clock cycle) smaller sub-multiplications in ka are performed. Last clock cycle construct the multiplication by shifting and adding sub-multiplications results.