High-Performance NTT Accelerators for PQC leveraging Unified Redundant Arithmetic and Fine-Tuned Microarchitecture

Abstract: Post-quantum cryptography and privacy-preserving technologies are expected to play a central role in future secure communication systems. Lattice-based PQC schemes such as ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium) rely heavily on large-degree polynomial arithmetic, making the Number Theoretic Transform (NTT) a key computational primitive. Although existing hardware accelerators exploit parallelism and pipelining to support both NTT and INTT, their efficiency is often limited by the overhead of modular reduction and correction steps, inverse-transform scaling operations, and suboptimal FPGA implementations. This work addresses these limitations by proposing parallel iterative NTT/INTT accelerators based on optimized unified butterfly units. We introduce a novel redundant number representation that eliminates conditional corrections for both Montgomery modulo multiplication and combined subtract-multiply operations, and integrate inverse-transform scaling into existing arithmetic hardware to avoid dedicated scaling units. Furthermore, we design hierarchical Montgomery multipliers that map efficiently onto FPGA DSP resources, reducing hardware cost while enabling high operating frequencies. FPGA-based experimental results demonstrate higher clock frequencies, reduced execution times, and competitive resource utilization, supporting efficient NTT acceleration for PQC and related privacy-preserving applications.

• The paper introduces unified redundant Montgomery arithmetic, eliminating conditional correction bottlenecks and enabling both NTT and INTT modes in a single datapath.
• It integrates precomputed twiddle factors for INTT scaling by merging modular addition with division-by-two, streamlining the computational process.
• Experimental results demonstrate up to 2.5× frequency improvement and 35%-73% runtime reduction, making these accelerators highly effective for lattice-based PQC.

High-Performance NTT Accelerators for PQC via Unified Redundant Arithmetic and Microarchitectural Optimizations

Introduction and Motivation

The number-theoretic transform (NTT) is indispensable in lattice-based post-quantum cryptography (PQC), underpinning schemes such as ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium). These protocols require efficient high-degree polynomial arithmetic, for which NTT provides near-linear complexity and is central to achieving feasible implementations for real-world workloads. Despite extensive use of parallel and pipelined FPGA accelerators, conventional NTT hardware is limited by the cost of modular reductions, conditional correction steps, and the dedicated logic required for INTT scaling. This paper introduces architectural and arithmetic innovations to address these performance bottlenecks, focusing on unified redundant Montgomery arithmetic and fine-tuned microarchitectural techniques to enhance both frequency and resource efficiency of NTT accelerators for PQC.

Fundamental NTT Operations and Accelerator Models

NTT translates polynomial multiplication in modular rings to efficient element-wise operations in the frequency domain, reducing computational complexity and enabling tractable cryptographic polynomial multiplications. The NTT employs FFT-like butterfly networks for recursive decomposition.

Figure 1: Fast NTT computation following the Fast-Fourier Transform recursive paradigm.

Accelerators are classified into parallel and pipelined architectures. In parallel models, arrays of processing elements (PEs) execute butterfly operations concurrently, supported by multi-banked memory to sustain high throughput and avoid contention.

Figure 2: Parallel NTT accelerator that computes NTT iteratively using an array of PEs (effectively butterfly units) and multiple parallel memory banks.

The linear pipelined (SDF, MDC) architectures align data flows to minimize stalling but require careful delay management to maintain hardware efficiency.

Unified Redundant Arithmetic: Elimination of Modular Correction Bottlenecks

Traditional modular arithmetic in NTT butterflies introduces significant latency and logic complexity due to repeated reduction steps. This work generalizes and extends existing redundant Montgomery representations, leveraging a widened dynamic range for all intermediate values to eliminate conditional corrections after both Montgomery multiplication and subtract-multiply operations. This unification is critical to supporting both NTT and INTT modalities in a single butterfly datapath.

Figure 3: Unified Butterfly that can operate in NTT and INTT modes.

The architecture evolves the classical design (as in [zhang2020highly]) by removing modulo corrections after modular multiplication and subtraction, validated via formal range analysis that shows correctness for $R > 8q$, substantially improving logic depth and pipeline frequency.

Figure 4: The Unified butterfly unit structure proposed in [zhang2020highly], with attention to required modulo correction steps.

Figure 5: The unified butterfly unit covering both NTT and INTT operating on an extended redundant dynamic range $[0, 2q-1]$ for all Montgomery-form arguments with radix $R > 8q$.

This result ensures every arithmetic unit operates on values within an extended range, thereby allowing for the elimination of sequential conditional corrections that traditionally dominate critical-path delay.

Integration and Optimization of INTT Scaling

INTT requires division-by-two scaling, conventionally implemented via additional hardware units. The proposed method eliminates one division operation by offline precomputation of scaled twiddle factors, and merges the remaining scaling into a single modular addition unit, exploiting range and parity analysis to avoid serial computation latency.

Figure 6: The cascaded structure of modular addition, used in both NTT and INTT modes, and scaling by two, which is activated only in INTT mode. Range and parity checks allow merging into one datapath.

The logic for combined modular addition and division-by-two is derived to select the appropriate representative without additional correction cycles, balancing output range and output parity.

Figure 7: The proposed unified butterfly unit supports both NTT and INTT computations. Only a single modular correction is required at the final subtraction for NTT mode.

DSP-centric Montgomery Multiplier Mapping and FPGA Implementation

The paper provides a detailed strategy to hierarchically decompose Montgomery multipliers such that sub-blocks naturally align with FPGA DSP primitives, maximizing efficiency, minimizing required LUT/FF resources, and enabling pipelining without excessive latency.

Figure 8: Mapping Montgomery multiplication to DSP blocks for inputs of 17 bits as needed by most PQC applications.

For larger (e.g., 34-bit) operands, the architecture combines several DSP blocks in a hierarchical manner, enabling support for moduli required by all relevant PQC schemes at negligible increase in frequency penalty.

Figure 9: Mapping Montgomery multiplication to DSP blocks for 34-bit inputs to support all PQC applications via hierarchical arrangement of DSP block multipliers.

Latency, Area, and Frequency Results

The paper's experimental evaluation demonstrates that proposed butterfly function units (BFUs) achieve up to 2.5× higher frequency versus prior works, enabling reduced execution times for full NTT transforms without exceeding resource budgets relative to comparable implementations. Notably, end-to-end NTT runtimes are reduced by 35%–73% for runtime-programmable moduli and both 1D and 2D PE array organizations, while supporting broader configurability and retaining low area. These frequency improvements persist even for highly parallel or scalable accelerator designs, making the solution applicable to a wide class of parameter sets in PQC and privacy-preserving applications.

Practical and Theoretical Implications

From a practical systems perspective, the architecture yields NTT/INTT cores with runtime modulus programmability at minimal area and critical path cost penalties. This increases applicability across evolving PQC protocols, facilitating rapid adoption and hardware-upgrade compatibility as cryptographic standards evolve. Theoretically, the paper underscores the utility of arithmetic/microarchitecture co-design: expanding representational range and arithmetic units' core datapaths can achieve meaningful reductions in both logic complexity and pipeline depth, with correctness ensured by a principled range analysis.

Notably, the unified approach leads to a contradiction with prior assumptions that separate, canonical reduction is mandatory after every modular operation. By rigorously bounding intermediate values and leveraging FPGA-optimized Math units, the architecture circumvents these traditional performance inhibitors.

The paper also highlights that mitigation of computational overhead should be complemented by future work in side-channel resistance and physical attack countermeasures, crucial for PQC hardware in adversarial environments.

Conclusion

This work advances the design of high-performance NTT hardware by systematically eliminating correction bottlenecks in arithmetic units via unified redundant Montgomery representations, merging INTT scaling operations into core datapaths, and fine-tuning DSP-based multipliers for FPGAs to minimize area and maximize attainable clock frequency. The approach demonstrates robust latency reductions and resource efficiency for both fixed and runtime-programmable PQC parameter sets. The methodology exemplifies how careful joint optimization of arithmetic representation and microarchitecture unlocks substantial gains in domain-specialized accelerators for post-quantum cryptography. Future directions should address integrating physical security to ensure these accelerators withstand adversarial deployment scenarios.