Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

@NTT: Algorithm-Targeted NTT hardware acceleration via Design-Time Constant Optimization

Mohammed Nabeel, Mahmoud Hafez, Michail Maniatakos

TL;DR

Post-quantum cryptography relies on lattice-based schemes where the NTT is a major computation bottleneck. The authors introduce @NTT, an end-to-end RTL generation framework that leverages design-time constants for fixed ring parameters to convert constant multipliers into minimal shift-add networks and to merge twiddle-factor logic, enabling an $N$-point NTT per clock with compact area. This approach preserves the fundamental NTT advantage by reducing complexity from $O(N^2)$ to $O(N log N)$ and supports iNTT through modular inverse input. Hardware evaluations on ASIC (TSMC 28 nm) at 1 GHz and FPGA (XCU50) report substantial gains: large area reductions for Kyber and Dilithium on ASIC, plus LUT reductions and DSP elimination on FPGA, with throughput improvements up to $5.2x$ for Dilithium and $8.5x$ for Kyber, achieving up to 305k NTT/ms and 451k NTT/ms respectively. Overall, @NTT demonstrates a practical RTL design flow for high-throughput, area-efficient NTT accelerators tailored to PQC parameters.

Abstract

The Number Theoretic Transform (NTT) is a critical computational bottleneck in many lattice-based postquantum cryptographic (PQC) algorithms. By leveraging the Fast Fourier Transform (FFT) algorithm, the NTT of a polynomial of degree N - 1 can be computed with a time complexity of O(N log N). Hardware implementation of NTT is generally preferred over software ones, as the latter are significantly slower due to complex memory access patterns and modular arithmetic operations. Achieving maximum throughput in hardware, however, typically demands a prohibitively large number of butterfly unit instantiations. In this work, we propose @NTT, which exploits the fact that the ring parameters in these algorithms are fixed, enabling design-time constant optimization and achieving the maximum throughput of N-point NTT per clock cycle with a compact hardware footprint. Our case study on the Dilithium NTT, implemented using the TSMC 28 nm library, operates at a clock frequency of 1.0 GHz with an area of 1.45 mm^2. On FPGA, the design achieves a throughput-per-LUT that is 5.2x higher than the state-of-the-art implementation.

@NTT: Algorithm-Targeted NTT hardware acceleration via Design-Time Constant Optimization

TL;DR

Post-quantum cryptography relies on lattice-based schemes where the NTT is a major computation bottleneck. The authors introduce @NTT, an end-to-end RTL generation framework that leverages design-time constants for fixed ring parameters to convert constant multipliers into minimal shift-add networks and to merge twiddle-factor logic, enabling an -point NTT per clock with compact area. This approach preserves the fundamental NTT advantage by reducing complexity from to and supports iNTT through modular inverse input. Hardware evaluations on ASIC (TSMC 28 nm) at 1 GHz and FPGA (XCU50) report substantial gains: large area reductions for Kyber and Dilithium on ASIC, plus LUT reductions and DSP elimination on FPGA, with throughput improvements up to for Dilithium and for Kyber, achieving up to 305k NTT/ms and 451k NTT/ms respectively. Overall, @NTT demonstrates a practical RTL design flow for high-throughput, area-efficient NTT accelerators tailored to PQC parameters.

Abstract

The Number Theoretic Transform (NTT) is a critical computational bottleneck in many lattice-based postquantum cryptographic (PQC) algorithms. By leveraging the Fast Fourier Transform (FFT) algorithm, the NTT of a polynomial of degree N - 1 can be computed with a time complexity of O(N log N). Hardware implementation of NTT is generally preferred over software ones, as the latter are significantly slower due to complex memory access patterns and modular arithmetic operations. Achieving maximum throughput in hardware, however, typically demands a prohibitively large number of butterfly unit instantiations. In this work, we propose @NTT, which exploits the fact that the ring parameters in these algorithms are fixed, enabling design-time constant optimization and achieving the maximum throughput of N-point NTT per clock cycle with a compact hardware footprint. Our case study on the Dilithium NTT, implemented using the TSMC 28 nm library, operates at a clock frequency of 1.0 GHz with an area of 1.45 mm^2. On FPGA, the design achieves a throughput-per-LUT that is 5.2x higher than the state-of-the-art implementation.
Paper Structure (7 sections, 3 figures, 5 tables)

This paper contains 7 sections, 3 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Background
  3. NTT
  4. Butterfly operation
  5. @NTT Framework
  6. Evaluation
  7. Conclusion

Figures (3)

  • Figure 1: NTT Flow. 8-point NTT flow. Each of the $log_28$ stages involves $\frac{8}{2}$ radix-2 butterfly operations. For the fastest execution, one needs to implement all these radix-2 butterflies.
  • Figure 2: Radix-2 Butterfly. Computes $A + B\cdot$w$\pmod Q$ and $A - B \cdot$w$\pmod Q$. $A,B \in \mathbb{Z}_Q$; $n = \lceil \log_2 Q \rceil$; $R = \lfloor 4^n / Q \rfloor$
  • Figure 3: @NTT flow.