Hierarchical Montgomery Multipliers

• Hierarchical Montgomery multipliers are modular multiplication architectures that decompose operations into recursively composed submodules, enabling truncated reductions and performance gains.
• They employ strategies like Karatsuba recursion, DSP-aligned submultipliers, and recursive residue number systems for efficient modular arithmetic.
• Applications span high-performance computing, FPGA NTT/INTT accelerators, and scalable quantum circuits, optimizing throughput and resource usage.

Hierarchical Montgomery multipliers are modular multiplication organizations in which a Montgomery product is realized by composing smaller arithmetic units, recursive submultipliers, lower-layer modular engines, or reversible submodules rather than by a single flat datapath. In recent software work, the hierarchy appears as a size-dependent composition of Schoolbook, Karatsuba, and truncated high-half reduction stages; in FPGA NTT accelerators it appears as DSP-aligned submultipliers assembled into wider Montgomery units; in Recursive Residue Number Systems it appears as a layer-$L$ Montgomery multiplier invoking layer-$(L-1)$ multipliers; and in reversible quantum arithmetic it appears as a three-stage composition of accumulation, REDC, and ancilla uncomputation (Didier et al., 2024, Alexakis et al., 1 Jul 2026, Hollmann et al., 2018, Rines et al., 2018).

1. Formal definition and arithmetic basis

Montgomery multiplication computes a residue $u \equiv a b R^{-1} \pmod{N}$ for a modulus $N$ coprime to the radix $R$. In the one-limb convention, the standard algorithm is

$$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$

followed by a conditional subtraction if $u \ge N$. In the $R$-based convention used in the AVX512 batch implementation,

$$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$

again followed by a conditional subtraction when needed. For FPGA NTT/INTT accelerators, the same operation is written in canonical Montgomery form as

$$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$

which is algebraically equivalent when $(L-1)$0 is a power of two. In reversible arithmetic, the reduction is expressed through an estimation variable $(L-1)$1, so that $(L-1)$2 and $(L-1)$3 is exact; this requires $(L-1)$4 to be odd because $(L-1)$5 (Didier et al., 2024, Alexakis et al., 1 Jul 2026, Rines et al., 2018).

The adjective “hierarchical” refers to the way this arithmetic is assembled. In one setting it denotes a hierarchy of sub-multipliers created by Karatsuba recursion and truncated reduction; in another it denotes a modular-multiply engine built from several small, DSP-friendly submultipliers; in RRNS it denotes virtual RNS layers whose Montgomery arithmetic is executed by the layer below; and in reversible arithmetic it denotes top-level, middle-level, and leaf submodules with explicit interfaces. A common thread is that the reduction step is not treated as an isolated scalar primitive, but as a structured composition whose subproblems can be optimized, omitted, or recursively delegated (Alexakis et al., 1 Jul 2026, Hollmann et al., 2018, Rines et al., 2018).

2. Truncated and hierarchical software realizations

The AVX512 software formulation treats Montgomery multiplication in a limb-wise, batch-SIMD setting with radix $(L-1)$6. Operands are written as $(L-1)$7, $(L-1)$8, and $(L-1)$9, with $u \equiv a b R^{-1} \pmod{N}$0. The batch implementation is “non-interleaved”: it computes the full product $u \equiv a b R^{-1} \pmod{N}$1 using Schoolbook or Karatsuba, then performs a single $u \equiv a b R^{-1} \pmod{N}$2-based Montgomery reduction by accumulating $u \equiv a b R^{-1} \pmod{N}$3 into $u \equiv a b R^{-1} \pmod{N}$4, and finally executes the exact right shift by $u \equiv a b R^{-1} \pmod{N}$5. Because $u \equiv a b R^{-1} \pmod{N}$6, the reduced value can be written as

$u \equiv a b R^{-1} \pmod{N}$7

where $u \equiv a b R^{-1} \pmod{N}$8 is a single carry bit from the low-half addition. In the 52-bit-limb formulation,

$u \equiv a b R^{-1} \pmod{N}$9

so the low half contributes only through a lane-wise OR of low words. The paper proves a partial-product omission theorem: $N$0 can be computed using only the partial products whose weights are at least $N$1, and all partial products with $N$2 can be omitted (Didier et al., 2024).

This truncated reduction induces a distinct hierarchy. At the leaf level, elementary products are realized by SIMD fused multiply-add accumulators across 52-bit limbs using madd52lo and madd52hi. At higher levels, Schoolbook accumulators or Karatsuba combiners assemble these leaf products. The paper reports that Schoolbook multiplication has complexity $N$3, while Karatsuba has complexity $N$4, and that the recursion forms an explicit hierarchy of sub-multipliers. Two Karatsuba stages are used for approximately 4154-bit operands, producing a hierarchy of 9 leaf multipliers of approximately 1040 bits. Empirically, Schoolbook is faster up to approximately 4108 bits, whereas Karatsuba becomes advantageous for approximately 4154-bit sizes, especially for batch squaring and truncated Montgomery multiplication with large operands (Didier et al., 2024).

The hierarchy is tightly coupled to the AVX512 word-slicing organization. Each 512-bit zmm register holds eight 64-bit lanes, each lane storing a single 52-bit limb with 12 spare bits for carry headroom. The layout is column-major across operands, so line $N$5 contains the $N$6-th 52-bit limb for all 8 operands simultaneously. This supports batch multiplications, squarings, modular multiplications, modular squarings, and constant time modular exponentiations of 8 values. Constant-time fixed-window exponentiation uses window tables $N$7 in Montgomery domain and masked moves for table selection, with no secret-dependent branches. In many workloads, the final conditional subtraction is deferred or elided because bounds ensure $N$8 and the code returns $N$9 in $R$0, occasionally following the subsequent-step strategy described for Gueron’s RSA_Z (Didier et al., 2024).

Performance results emphasize the practical value of the truncated hierarchy. The paper states that the truncated Montgomery modular multiplication improvement offers speed gains of almost $R$1 over conventional non-truncated versions. More detailed results report that truncated Schoolbook Montgomery multiplication and squaring improve by approximately $R$2 and up to approximately $R$3, while Karatsuba truncated multiplication improves approximately $R$4–$R$5 at large sizes. Compared to GMP and OpenSSL, modular multiplications and squarings are more than $R$6 faster in many cases. For fixed-window exponentiation, the batch-of-8 AVX512 implementation achieves speedups versus OpenSSL BN_mod_exp_mont_consttime of $R$7 at 1024 bits, $R$8 at 2048 bits, and $R$9 at 4096 bits; against BN_mod_exp_mont_consttimex2, the corresponding gains are $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$0 at 1024 bits and $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$1 at 2048 bits, while the 256-bit batch-of-4 version gives $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$2 and $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$3 (Didier et al., 2024).

3. FPGA DSP hierarchies in unified NTT and INTT butterflies

In FPGA NTT accelerators, a hierarchical Montgomery multiplier is the modular-multiply engine inside each unified NTT/INTT butterfly, built by composing several small, DSP-friendly submultipliers into wider blocks. The hierarchy aligns operand partitions to the native multiplier widths of FPGA DSP slices, so that small PQC moduli with 12–17-bit operands after redundancy map one multiply per DSP block, while wide moduli with up to 31-bit operands after redundancy are realized by a 2-level decomposition into 17-bit halves assembled with carry-save and add-accumulate structures. This organization is used to reduce LUT-based arithmetic, maximize DSP utilization, simplify pipelining, and raise $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$4, while allowing a single multiplier template to scale across Kyber-, NewHope-, Falcon-, and Dilithium-class moduli (Alexakis et al., 1 Jul 2026).

A central architectural feature is bounded-redundant Montgomery representation. Operands are allowed to lie in $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$5, and the design extends Pu et al.’s redundancy to cover both the NTT multiply-by-twiddle and the INTT subtract–multiply. Two invariants are established. First, if $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$6 and $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$7, then the Montgomery product $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$8 remains in $$\begin{aligned} t &= a \cdot b,\ m &= (t \cdot N') \bmod \beta,\ u &= \frac{t + m \cdot N}{\beta}, \end{aligned}$$9, so the post-multiply correction can be skipped. Second, in INTT mode the difference is formed as $u \ge N$0, multiplied by the twiddle, and bounded so that selecting $u \ge N$1 yields $u \ge N$2. In practice, $u \ge N$3 is chosen as the next power of two strictly greater than $u \ge N$4, which adds three bits to the datapath width: $u \ge N$5 The result is that no correction is needed after Montgomery multiplication in INTT mode, and the subtractor’s intermediate result can remain in $u \ge N$6 because the product returns to $u \ge N$7 (Alexakis et al., 1 Jul 2026).

For wide moduli, the hierarchy is concrete at the level of schoolbook decomposition and DSP mapping. With $u \ge N$8 and

$u \ge N$9

schoolbook multiplication gives

$R$0

Each $R$1 product maps to one DSP block configured as a signed multiplier. Cross terms are formed in parallel and summed via carry-save addition, while a single carry-propagate adder in LUT fabric finalizes the product. The complete Montgomery unit contains three conceptual products: $R$2, $R$3, and $R$4. Because $R$5, the most significant $R$6 subproduct in the mod-$R$7 multiply is discarded, so that stage uses three DSPs instead of four. In the 17-bit path, each Montgomery submultiply fits one DSP and the full Montgomery unit uses 3 DSPs. In the 34-bit path, the hierarchical Montgomery unit uses 11 DSPs total: 4 DSPs for $R$8, 3 DSPs for $R$9, and 4 DSPs for the multiply–add accumulation of $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$0 and $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$1 (Alexakis et al., 1 Jul 2026).

Path	Montgomery-unit DSPs	Virtex-7 BFU $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$2
17-bit	3	437 MHz
34-bit	11	391 MHz

Pipeline structure is part of the hierarchy rather than an afterthought. Each DSP block uses two internal pipeline stages; the full multiplier uses six stages end-to-end; and the unified butterfly allocates a total of eight pipeline stages per processing element, leaving two for addition/subtraction paths and alignment registers. Per-BFU results on Virtex-7 are 8 cycles, 3 DSPs, 209 LUTs, 194 FFs, and $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$3 MHz for the 17-bit BFU, and 8 cycles, 11 DSPs, 580 LUTs, 481 FFs, and $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$4 MHz for the 34-bit BFU. On Alveo U200, the corresponding isolated BFU results are 8 cycles, 3 DSPs, 225 LUTs, 162 FFs, and $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$5 MHz for 17-bit, and 8 cycles, 11 DSPs, 572 LUTs, 501 FFs, and $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$6 MHz for 34-bit. The paper also reports full-accelerator examples, including $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$7, $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$8, $$\begin{aligned} t &= a \cdot b,\ q &= (t \cdot N') \bmod R,\ u &= \frac{t + q \cdot N}{R}, \end{aligned}$$9, with 336 cycles, $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$0 MHz, 1.2 $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$1, 9942 LUT, 5131 FF, 48 DSP, and 12 BRAM, and $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$2, $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$3, $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$4, with 168 cycles, $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$5 MHz, 0.9 $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$6, 158,141 LUT, 14,289 FF, 352 DSP, and 48 BRAM (Alexakis et al., 1 Jul 2026).

The hierarchical multiplier is integrated directly into the radix-2 butterfly equations

$$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$7

In NTT mode it computes $$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$8 using redundant inputs, and in INTT mode it computes the fused subtract–multiply

$$m = \frac{ab + q \left([ab\mu]_R\right)}{R}, \quad \mu \equiv -q^{-1} \pmod{R},$$9

in Montgomery form. The unified butterfly of Zhang et al. (2020) performs per-butterfly scaling by 2 in INTT; the later design removes dedicated scaling units by precomputing $(L-1)$00 offline and by merging the second divide-by-2 with the adder’s correction through range and parity analysis. Relative to Mu et al. and to NTTGen/AutoNTT, the reported BFU-level clock frequencies are $(L-1)$01 versus $(L-1)$02 MHz and $(L-1)$03 versus $(L-1)$04 MHz on Virtex-7, and $(L-1)$05 versus $(L-1)$06 MHz and versus $(L-1)$07 MHz on Alveo U200; accelerator-level runtime improvements include $(L-1)$08 versus $(L-1)$09 for $(L-1)$10, $(L-1)$11, $(L-1)$12, and up to $(L-1)$13 runtime reduction versus Mert et al. at the same $(L-1)$14 with matching PE counts (Alexakis et al., 1 Jul 2026).

4. Recursive Residue Number Systems as hierarchical Montgomery multiplication

The RRNS formulation gives a different meaning to hierarchy: a higher-layer Montgomery multiplier is implemented by invoking a full RNS Montgomery multiplier on the layer below. A bottom RNS layer uses small moduli, for example 8-bit moduli, and one or more virtual layers are added above it. Each non-bottom layer defines a left RNS base $(L-1)$15, a right RNS base $(L-1)$16, and a redundant modulus $(L-1)$17. Modular arithmetic modulo any modulus $(L-1)$18 on that layer is then realized via a Montgomery multiplier with radix equal to the product $(L-1)$19 of the left RNS moduli of that layer, while all arithmetic required modulo the layer moduli $(L-1)$20 is itself implemented by calling the lower-layer Montgomery multiplier whose radix is the lower-layer left product $(L-1)$21. Arithmetic is therefore deferred recursively to the bottom layer, where it can be implemented exactly, preferably by table lookup (Hollmann et al., 2018).

This construction relies on the full-RNS Bajard–Imbert Montgomery algorithm extended to pseudo-residues. In the generalized setting, a pseudo-residue $(L-1)$22 of $(L-1)$23 modulo $(L-1)$24 lies in $(L-1)$25, where $(L-1)$26 for standard residues or $(L-1)$27 for symmetric residues. A constructive CRT statement gives

$(L-1)$28

with explicit bounds on the integer $(L-1)$29. A corollary shows that $(L-1)$30 can be recovered modulo the redundant modulus $(L-1)$31 as long as $(L-1)$32 is large enough, namely $(L-1)$33 in the standard case or $(L-1)$34 in the symmetric case. These facts underpin base extension under pseudo-residues and make it possible to perform complete RNS Montgomery reduction without leaving the residue domain (Hollmann et al., 2018).

At a given layer, the algorithm has three main components. Algorithm 1 computes $(L-1)$35 by performing per-modulus Montgomery multiplication at the lower layer. Algorithm 2 chooses $(L-1)$36 such that $(L-1)$37, computes

$(L-1)$38

reconstructs $(L-1)$39 in the right base, and base-extends it back to the left base using $(L-1)$40. On non-bottom layers, multiply-accumulate steps can be executed lazily by aggregating products and applying one lower-layer Montgomery reduction at the end, provided that the bounds for postponed reduction are satisfied. The formal theorem states that, under constraints such as

$(L-1)$41

and with sufficient $(L-1)$42, the representation remains valid and the output is a correct Montgomery product (Hollmann et al., 2018).

A distinctive property of the RRNS hierarchy is that it is carry-free. Every arithmetic operation is performed per residue modulo an independent small modulus channel; there are no carry chains, neither within channels nor across layers. The paper explicitly links this to resistance against cryptographic attacks that exploit carries. It also quantifies the complexity. If $(L-1)$43, $(L-1)$44, $(L-1)$45, and $(L-1)$46 denote counts of lower-layer additions, multiplications, Montgomery reductions, and full Montgomery multiplications needed for one higher-layer Montgomery product, the paper gives recurrences for these quantities and derives, for a three-layer design, the asymptotic estimate

$(L-1)$47

With $(L-1)$48-bit top moduli and $(L-1)$49-bit bottom tables, minimizing this yields

$(L-1)$50

The architecture admits massive parallelism because the bottom-layer residue channels are independent (Hollmann et al., 2018).

The paper provides a concrete 2048-bit configuration. At the bottom layer, 19 moduli are used: one redundant modulus $(L-1)$51; 12 largest primes below 256; and 6 composites, all mutually coprime. The functional moduli are split into left and right bases with $(L-1)$52, giving

$(L-1)$53

At the middle layer, $(L-1)$54. A non-parallelized C++ implementation using byte tables achieves approximately $(L-1)$55 s for 500-bit modular exponentiation under a 2048-bit $(L-1)$56 on a laptop, and one top-layer Montgomery multiplication takes approximately 160,000 table lookups. The same approach is presented as suitable for 2048-bit or even 4096-bit RSA (Hollmann et al., 2018).

5. Reversible and quantum hierarchies

In reversible arithmetic, the hierarchical Montgomery multiplier is organized as an exact modular-by-design circuit whose submodules can be reused and swapped. The architecture is divided into three stages. Stage 1 performs partial-product accumulation into a “compressed” product: $(L-1)$57 so that $(L-1)$58 and fits in $(L-1)$59 bits with $(L-1)$60. Stage 2 is the Montgomery reduction itself, split into estimation and correction. In estimation, the circuit iterates

$(L-1)$61

for $(L-1)$62, reversibly extracting the bits of $(L-1)$63. In correction, because

$(L-1)$64

a single conditional addition of $(L-1)$65 restores the value to $(L-1)$66. Stage 3 uncomputes the ancillary $(L-1)$67-bit register $(L-1)$68 using precomputed classical constants. The resulting mapping

$(L-1)$69

is one-to-one for $(L-1)$70, with exact ancilla cleanup at the end (Rines et al., 2018).

The hierarchy is explicit at three levels. The top level contains modules such as MonMul_out_of_place and MonMul_qq. The middle level contains PartialProductGen, Accumulate_n, REDC_Estimate, REDC_Correct, and Uncompute_qtilde. The leaf level contains the adder families: ripple, prefix, prefix-ripple, and Fourier-basis adders, as well as the select-undo in-place adder. The paper emphasizes that the only quadratic-size stage is the partial-product accumulation; REDC uses only $(L-1)$71 in-place subtractions plus one correction, and uncomputation acts on an $(L-1)$72-bit register. This is why the overall asymptotic resource complexity matches that of a single non-modular multiplier (Rines et al., 2018).

The resource analysis is detailed and extends to 2048-bit inputs. For binary-basis implementations with logarithmic-depth prefix adders, the leading terms are 5$(L-1)$73 qubits, $(L-1)$74 Toffoli “gates”, and depth $(L-1)$75. With ripple-carry adders, the leading terms are 3$(L-1)$76 qubits, $(L-1)$77 Toffoli gates, and depth $(L-1)$78. For Fourier-basis implementations, the paper reports 2$(L-1)$79 qubits, $(L-1)$80 two-qubit rotations, and depth $(L-1)$81 without precision truncation, and 2$(L-1)$82 qubits, $(L-1)$83 leading-order gates, and depth $(L-1)$84 with standard truncation of exponentially small rotations. For $(L-1)$85, the corresponding leading-order estimates are approximately depth $(L-1)$86k and $(L-1)$87 million Toffoli-equivalents for the prefix-adder binary design, and depth approximately $(L-1)$88k with approximately $(L-1)$89–$(L-1)$90 million rotations for the Fourier-basis design (Rines et al., 2018).

The fault-tolerant analysis further refines the hierarchy’s trade-offs. With a restricted Clifford+$(L-1)$91 style setting, the paper models Toffoli as approximately 40, $(L-1)$92 as approximately 10, and controlled-$(L-1)$93 decomposition with cost approximately $(L-1)$94. The Fourier-basis design gains an additive depth overhead of approximately $(L-1)$95, but the overall depth remains linear in $(L-1)$96 up to an additive $(L-1)$97; the authors report that Fourier Montgomery depth remains within approximately $(L-1)$98 of the prefix-adder implementation while using approximately $(L-1)$99 fewer qubits. The design is exact for all binary input values, reversible without Bennett-style full uncomputations, and applicable up to 2048-bit operands in the empirical study (Rines et al., 2018).

6. Comparative patterns, misconceptions, and design trade-offs

Across the literature, “hierarchical Montgomery multiplier” does not denote a single algorithmic template. It denotes at least four distinct but related constructions: a truncated high-half reduction over SIMD leaf multipliers; a DSP-aligned decomposition inside unified NTT/INTT butterflies; a recursive RNS stack in which one Montgomery layer calls another; and a reversible circuit hierarchy of accumulation, REDC, and ancilla cleanup. This suggests that the term is best understood as an architectural pattern for structuring Montgomery arithmetic, rather than as a single canonical datapath (Didier et al., 2024, Alexakis et al., 1 Jul 2026, Hollmann et al., 2018, Rines et al., 2018).

Setting	Hierarchical composition	Characteristic optimization
AVX512 software	Schoolbook/Karatsuba plus truncated reduction	Omit low-weight $u \equiv a b R^{-1} \pmod{N}$00 partial products
FPGA NTT/INTT	DSP-sized submultipliers into 17-bit or 34-bit units	Eliminate post-multiply corrections with redundancy
RRNS	Layer-$u \equiv a b R^{-1} \pmod{N}$01 Montgomery via layer-$u \equiv a b R^{-1} \pmod{N}$02 Montgomery	Defer arithmetic to small-modulus channels
Reversible arithmetic	Accumulate, REDC, and uncompute submodules	Keep REDC and ancilla handling $u \equiv a b R^{-1} \pmod{N}$03-wide

A common misconception is that hierarchy is only a matter of recursive multiplication, for example Karatsuba. The RRNS and reversible constructions show that hierarchy can instead mean recursion across arithmetic layers or disciplined modular decomposition of subroutines. Another misconception is that Montgomery multiplication intrinsically requires an immediate final correction after every product. The AVX512 implementation sometimes defers or elides the final conditional subtraction because bounds ensure $u \equiv a b R^{-1} \pmod{N}$04; the FPGA NTT/INTT design proves that the conditional test “If $u \equiv a b R^{-1} \pmod{N}$05 then $u \equiv a b R^{-1} \pmod{N}$06” is unnecessary in its bounded-redundant regime; the reversible construction still uses a single correction stage; and RRNS avoids the issue through full-RNS arithmetic and pseudo-residue bounds rather than through a word-level conditional subtraction (Didier et al., 2024, Alexakis et al., 1 Jul 2026, Hollmann et al., 2018, Rines et al., 2018).

The main trade-offs also differ by domain. In AVX512 software, batch size 8 increases throughput linearly at the cost of per-batch latency when operands are few. In FPGA designs, hierarchical 34-bit multipliers consume 11 DSPs per BFU, so large PE arrays for 31-bit moduli can be DSP-heavy, although 2D arrays reduce pressure while retaining high throughput. In RRNS, the main costs are base extension via the redundant modulus and the need to control pseudo-residue expansion; postponed reduction requires balanced moduli to maintain bounds. In reversible arithmetic, the central trade-off is between qubits, gate count, and depth across prefix, ripple, and Fourier-basis adder families. These differences do not negate the commonality of the concept: in every case, the hierarchy is used to localize expensive operations, shorten or eliminate correction paths, and make Montgomery reduction compatible with the dominant substrate, whether SIMD lanes, FPGA DSPs, residue channels, or reversible gates (Didier et al., 2024, Alexakis et al., 1 Jul 2026, Hollmann et al., 2018, Rines et al., 2018).