Highly Efficient Architecture of NewHope-NIST on FPGA using Low-Complexity NTT/INTT

Abstract

NewHope-NIST is a promising ring learning with errors (RLWE)-based postquantum cryptography (PQC) for key encapsulation mechanisms. The performance on the field-programmable gate array (FPGA) affects the applicability of NewHope-NIST. In RLWE-based PQC algorithms, the number theoretic transform (NTT) is one of the most time-consuming operations. In this paper, low-complexity NTT and inverse NTT (INTT) are used to implement highly efficient NewHope-NIST on FPGA. First, both the pre-processing of NTT and the post-processing of INTT are merged into the fast Fourier transform (FFT) algorithm, which reduces N and 2N modular multiplications for N-point NTT and INTT, respectively. Second, a compact butterfly unit and an efficient modular reduction on the modulus 12289 are proposed for the low-complexity NTT/INTT architecture, which achieves an improvement of approximately 3× in the area time product (ATP) compared with the results of the state-of-the-art designs. Finally, a highly efficient architecture with doubled bandwidth and timing hiding for NewHope-NIST is presented. The implementation results on an FPGA show that our design is at least 2.5× faster and has 4.9× smaller ATP compared with the results of the state-of-the-art designs of NewHope-NIST on similar platforms.

Configurable Mixed-Radix Number Theoretic Transform Architecture for Lattice-Based Cryptography

“…(MHz). For n = 1024, the proposed NTT architecture operates approximately 9.6×, 12×, 8×, and 2× faster than that of [9], [10], [12], and [15] respectively. Xing and Li [9] proposed a ping-pong NTT architecture that used four BUs and required a large number of CCs (i.e., 1280).…”

“…Xing and Li [9] proposed a ping-pong NTT architecture that used four BUs and required a large number of CCs (i.e., 1280). Zhang et al [10] used only two parallel BUs for the iterative computation, which utilized hardware resources effectively but consumed many CCs (i.e., 2569). Although Mert et al [15] significantly reduced the number of CCs (i.e., 200) by paralleling 32 processing elements, their NTT architecture operated at lower clock frequency and required more hardware resources.…”

“…Their approach proposed to reduce the access pattern complexity but still required a large number of CCs (i.e., 1591). For n = 512, the proposed NTT architecture runs approximately 12× and 2× faster than that of [10] and [15], respectively. For n = 256, Yaman et al [11] deployed 16 BUs in high-performance unified hardware architecture and significantly reduced the CC number of the NTT operation (i.e., 69).…”

“…The ping-pong technique helped simplify the memory access operations but doubling the memory size. Zhang et al presented a low-complexity compact NTT INTT architecture for highly efficient NewHope-NIST on an FPGA device [10]. Their NTT architecture's outstanding strength came from the address conflict-free multi-bank memory access scheme, which was efficient with a small number of parallel radix-2 BUs.…”

Lattice-based Cryptosystems on FPGA: Parallelization and Comparison using HLS

“…For RLWE, our results are given for q = 7681. Our CPAsecure RLWE-1024 implementation has an execution time very close to [34] (63µs vs. 62µs), but is less optimized in term of hardware resource consumption (4 vs. 2 DSPs). This shows some potential for HLS implementation.…”