CFNTT: Scalable Radix-2/4 NTT Multiplication Architecture with an Efficient Conflict-free Memory Mapping Scheme

Abstract

Number theoretic transform (NTT) is widely utilized to speed up polynomial multiplication, which is the critical computation bottleneck in a lot of cryptographic algorithms like lattice-based post-quantum cryptography (PQC) and homomorphic encryption (HE). One of the tendency for NTT hardware architecture is to support diverse security parameters and meet resource constraints on different computing platforms. Thus flexibility and Area-Time Product (ATP) become two crucial metrics in NTT hardware design. The flexibility of NTT in terms of different vector sizes and moduli can be obtained directly. Whereas the varying strides in memory access of in-place NTT render the design for different radix and number of parallel butterfly units a tough problem. This paper proposes an efficient conflict-free memory mapping scheme that supports the configuration for both multiple parallel butterfly units and arbitrary radix of NTT. Compared to other approaches, this scheme owns broader applicability and facilitates the parallelization of non-radix-2 NTT hardware design. Based on this scheme, we propose a scalable radix-2 and radix-4 NTT multiplication architecture by algorithm-hardware co-design. A dedicated schedule method is leveraged to reduce the number of modular additions/subtractions and modular multiplications in radix-4 butterfly unit by 20% and 33%, respectively. To avoid the bit-reversed cost and save memory footprint in arbitrary radix NTT/INTT, we put forward a general method by rearranging the loop structure and reusing the twiddle factors. The hardware-level optimization is achieved by excavating the symmetric operators in radix-4 butterfly unit, which saves almost 50% hardware resources compared to a straightforward implementation. Through experimental results and theoretical analysis, we point out that the radix-4 NTT with the same number of parallel butterfly units outperforms the radix-2 NTT in terms of area-time performance in the interleaved memory system. This advantage is enlarged when increasing the number of parallel butterfly units. For example, when processing 1024 14-bit points NTT with 8 parallel butterfly units, the ATP of LUT/FF/DSP/BRAM n radix-4 NTT core is approximately 2.2 × /1.2 × /1.1 × /1.9 × less than that of the radix-2 NTT core on a similar FPGA platform.

Heterogeneous Reconfigurable Accelerator for Homomorphic Evaluation on Encrypted Data

“…If the CT butterfly with native order to bit-reversed order is used to perform NTT and the GS butterfly with inverse order to perform INTT, the bit-reversal operation can be avoided [36]. Similar to FFT, the radix-4 NTT could achieve better throughput with the same resources compared to the radix-2 NTT [38]. The signal flow graph of the radix-4 native order to bit-reversed order DIT NTT and the inverse order DIF INTT of a polynomial a(x) with n = 16 is shown in Fig.…”

“…To enable the reuse of twiddle factors, the output values of the lower three modular subtractors need to be flipped, and the location of multiplication with w 1 4 is also adjusted. The twiddle factors are precomputed and stored in the same manner as [38].…”

“…There are two commonly used data access patterns: in-place access strategy and out-of-place access strategy. The in-place access strategy utilizes 2-port SRAMs with a specific address encoding method to achieve conflict-free access [38]. The out-of-place access strategy separates read and write addresses using either dual-port SRAMs [22] or a double number of single-port SRAMs for ping-pong [44].…”

“…The in-place data access strategy is more area-efficient than the out-of-place one, but the address encoding scheme is more complex. The previous in-place strategy [38] tends to complete the address encoding before NTT computation, resulting in additional data reordering time when integrating with preceding sub-operations that adopt a sequential storage scheme, such as automorphism or ScaleDown Q→q .…”

RISE: RISC-V SoC for En/decryption Acceleration on the Edge for Homomorphic Encryption

“…To address these performance bottlenecks, there exist works that focus on accelerating sub-operations like NTT [16]- [26] in en/decryption and pseudo-random number generation (PRNG) [16]- [18] in error sampling. For accelerating the complete encryption and decryption operations, Su et al [27] and Yoon et al [28] proposed an FPGA-based and an ASIC-based accelerator, respectively, targeting Brakerski-Gentry-Vaikuntanathan (BGV) HE scheme [29].…”