RENO: Recomputation with Negated Operand

• RENO is a fault-detection technique that uses the modular complement of residues to verify Barrett reduction outputs in modular arithmetic.
• It is integrated in the Cooley–Tukey Butterfly Unit, recomputing on a negated operand to ensure high detection coverage with modest hardware overhead.
• The design employs two’s-complement normalization and dual computation paths, achieving near 99.97% fault detection in lattice-based post-quantum schemes.

Recomputation with Negated Operand (RENO) is a recomputation-based fault-detection technique for modular arithmetic hardware that exploits the modular-complement relation between the residue of $x$ and the residue of $-x$. In the context of Barrett reduction inside the Cooley–Tukey Butterfly Unit (CT-BU), RENO recomputes the reduction on a negated operand and checks consistency with the baseline result. The 2025 work on fault detection for Barrett reduction of CT-BU on FPGA instantiates RENO for Kyber and other structured lattice-based post-quantum cryptographic schemes, and states that RENO and RESO had not previously been used in Barrett reduction; within that design space, RENO provides high detection coverage with modest overhead when integrated into a pipelined FPGA implementation (Baidya et al., 4 Sep 2025).

1. Arithmetic basis and invariant structure

RENO is built on a modular arithmetic invariant: if $r$ is the canonical residue of $x$ modulo $q$, then the canonical residue of $-x$ modulo $q$ is the modular complement of $r$. The Barrett reduction used in the cited implementation computes

$$r = x - \left\lfloor \frac{x\mu}{2^k} \right\rfloor q, \qquad \mu = \left\lfloor \frac{2^k}{q} \right\rfloor.$$

For the Kyber parameterization in the reported design, the coefficient bit-width is $l = 12$, so $-x$0, and

$-x$1

If $-x$2 is the Barrett remainder of $-x$3, then $-x$4. For the negated input, $-x$5, so the recomputed remainder $-x$6 satisfies

$-x$7

Equivalently,

$-x$8

with the concrete condition

$-x$9

The cited implementation states that this can be checked either by modular-complement verification or by equality after sign normalization; the design uses equality comparison after sign normalization (Baidya et al., 4 Sep 2025).

The paper also gives a Barrett-consistent derivation for the negated input:

$r$0

Using $r$1, this yields the same complement relation for canonical residues. In hardware terms, this provides the algebraic basis for a deterministic comparator between the baseline Barrett path and the recomputation path.

2. Insertion point inside the Cooley–Tukey Butterfly Unit

In the reported architecture, the CT-BU computes the NTT butterfly over $r$2 with twiddle factor $r$3:

$r$4

and the outputs are

$r$5

Barrett reduction is applied at the modular multiplication term $r$6.

RENO is inserted precisely at this reduction point. The recomputation path negates one operand of the product; the paper negates $r$7, forming

$r$8

then computes

$r$9

followed by sign normalization so that the recomputed residue can be compared deterministically with the baseline residue. This placement is significant because the modular multiplication-and-reduction step is both latency-critical and fault-sensitive in NTT-based structured lattice cryptography.

The pipeline integration is described in three stages. Stage 1 buffers $x$0 and $x$1. Stage 2 computes $x$2 via MBRFD$x$3 and, in parallel, runs ReComp (RENO) on the negated operand. Stage 3 forms $x$4 and $x$5, gated by the fault signal. If fault = 1, the design bypasses the faulty $x$6 by recomputing through the add/sub blocks as indicated in Fig. 4 of the paper. The recomputation unit is clocked with a delayed clock so that the critical path of the main butterfly is minimally affected (Baidya et al., 4 Sep 2025).

This placement reflects the broader motivation stated in the work: Barrett reduction in the CT-BU is a point where faults can corrupt residues and propagate through the NTT, with possible implications for fault analysis and chosen-ciphertext fault injection attacks in implementations of Kyber, NTRU, Falcon, and CRYSTALS-Dilithium.

3. Implemented RENO algorithm and datapath organization

The paper gives the implemented pseudocode for RENO as follows:

1. Compute $x$7 (with $x$8 the twiddle factor).
2. Pad zeros for word-wise accumulation: $x$9.
3. Compute

$q$0

1. Normalize sign:

$q$1

2. Compare $q$2 to the baseline $q$3; raise fault if mismatch.

The hardware decomposition reported for the RENO block contains two multipliers, two two’s-complement units, a left shifter, a subtractor, and a comparator. Multiplier X3 computes $q$4. Multiplier X4 performs the two-step Barrett multiplication: $q$5 with high-bit slice extraction $q$6, and then multiplication by $q$7. The two’s-complement units have distinct roles: 2’scompl_1 forms $q$8, while 2’scompl_2 normalizes $q$9 back to the positive residue space. The left shifter applies the $-x$0 zero-padding required by the word-wise accumulation loop. The subtractor forms $-x$1 by subtracting the Barrett quotient times $-x$2. The comparator comp compares the baseline Barrett result $-x$3 with $-x$4; if unequal, fault = 1, otherwise fault = 0 (Baidya et al., 4 Sep 2025).

The same section of the work specifies the parameter-dependent extraction and padding conventions. The implementation uses word-wise Barrett reduction with word size $-x$5, and the quotient extraction takes bits $-x$6 from $-x$7, which for $-x$8 means $-x$9. Because both paths produce canonical residues in $q$0, the comparator correctness condition is tight. The design does not use the alternative check $q$1 with a special case for $q$2; instead, it transforms $q$3 back to the positive residue space and checks equality.

A plausible implication is that RENO’s implementation complexity is dominated not by additional modular arithmetic primitives but by sign handling and deterministic residue normalization. The paper makes this point explicit in comparative terms: RENO is described as conceptually the simplest invariant, but it requires two’s-complement blocks and careful sign normalization of the Barrett datapath.

4. FPGA realization and quantitative characteristics

The reported implementation targets a Xilinx Artix-7 xc7a100tcsg324-3 using Vivado 22.02, with a clock target of 100 MHz. The Kyber parameters are n = 256, q = 3329, l = 12 bits per coefficient, word size w = 4, k = 2l = 24, and μ = ⌊2^{24}/3329⌋ = 5039 (Baidya et al., 4 Sep 2025).

The baseline CT-BU and its Barrett sub-block, together with the recomputation blocks, are reported as follows.

Block	Resources and power	Delay
CT-BU baseline (Kyber)	Slices 573, LUTs 972, FFs 239, DSPs 2, BRAMs 1, Power 131 mW	9.39 ns
Barrett unit (baseline sub-block)	Slices 76, LUTs 254, FFs 89, DSPs 0, BRAMs 0, Power 101 mW	7.177 ns
RENO ReComp block	Slices 56, LUTs 197, FFs 48, DSPs 0, BRAMs 0, Power 2 mW	9.67 ns
RESO ReComp block	Slices 51, LUTs 182, FFs 42, DSPs 0, BRAMs 0, Power 2 mW	9.61 ns
RESWO ReComp block	Slices 52, LUTs 190, FFs 38, DSPs 0, BRAMs 0, Power 2 mW	9.51 ns

At the CT-BU level, the overhead percentages in Table 2 are:

Scheme	Overheads	Detection
RESWO	Area +9.07%, Delay +2.02%, Energy +1.52%	≈ 99.97%
RENO	Area +9.77%, Delay +2.98%, Energy +1.52%	≈ 99.97%
RESO	Area +8.90%, Delay +2.34%, Energy +1.52%	≈ 99.97%

These numbers support three factual comparisons. First, area is similar across the three recomputation schemes. Second, RESWO has the lowest reported delay, followed by RESO and then RENO. Third, the reported detection rates are nearly identical across the schemes. The paper’s summary therefore recommends RESWO for tight timing, RESO for slightly lower area if timing is comfortable, and RENO when the simplest mathematical check is preferred and a small delay penalty is acceptable (Baidya et al., 4 Sep 2025).

5. Fault model, injection methodology, and measured coverage

The reported evaluation uses a 1.5 million-sample Python-based fault injection campaign on Ubuntu 24.04 with randomized trials. Two fault patterns are studied: random faults, defined as uniformly distributed bit flips, and burst faults, defined as consecutive bit flips. Faults are injected into operand $q$4, into operand $q$5 (the twiddle), and into both $q$6 and $q$7. The fault range extends from single-bit flips up to 23-bit bursts, with

$q$8

The design is stated to detect both transient and permanent faults because the comparator correlates intermediate Barrett registers of the baseline path and the ReComp path. Practical hardware targets named in the description include multipliers, shifters, subtractors, two’s-complement blocks, and control/state around the Barrett pipeline.

For RENO, RESO, and RESWO, the measured detection efficiency is reported as consistently between 99.95% and 99.97% across all modes. The example RENO figures given for the table labeled fault_reno are 99.96–99.97% for single-bit and multi-bit random and burst flips in $q$9, $r$0, and $r$1 (Baidya et al., 4 Sep 2025).

Near-100% detection is therefore an empirical property of the evaluated campaigns, not an absolute guarantee. The work explicitly notes theoretically undetectable scenarios when a fault affects both the baseline Barrett path and the recomputation path in a way that preserves the invariant, such as a compensating fault that yields $r$2 and $r$3 consistent with $r$4, or a matched corruption in the quotient extraction $r$5 on both paths. The paper characterizes such simultaneous coherent faults as rare in practice, while also identifying them as a known limitation of duplication-based schemes.

6. Comparative position, applicability, and limitations

The paper’s novelty claim is specific: it states that this is the first use of RENO and RESO in Barrett reduction, in contrast to prior uses in MAC/NTT multipliers, and it introduces RESWO as a new recomputation scheme tailored to Barrett in the CT-BU. Within that framing, RENO occupies the position of the mathematically simplest of the three schemes because its check is directly derived from the complement relation of modular residues (Baidya et al., 4 Sep 2025).

The implementation context extends beyond Kyber. The work identifies the CT-BU and Barrett reduction as fundamental components in structured lattice-based post-quantum cryptographic algorithms including Kyber, NTRU, Falcon, and CRYSTALS-Dilithium. This suggests that the relevance of RENO is not confined to a single KEM implementation, but to NTT-centric modular multiplication-and-reduction pipelines more broadly. The summary explicitly states that recomputation schemes like RENO generalize readily to NTRU, Falcon, and CRYSTALS-Dilithium.

The limitations are equally explicit. Duplication-based schemes cannot detect coherent simultaneous faults that preserve the invariant across both paths. The fault-injection campaign focuses on random and burst bit flips; exhaustive formal coverage of stuck-at and timing faults is not reported, although the authors state that the method addresses both transient and permanent faults. ASIC scalability, integration with masking or parity/CRC, and coverage under combined side-channel/fault attacks are described as open engineering topics. Future work is said to include additional fault-detection algorithms for other PQC hardware blocks and broader integrations.

A common misunderstanding would be to treat RENO as a general-purpose residue check detached from architecture. The reported design indicates the opposite: RENO’s effectiveness depends on precise co-design with Barrett reduction, pipeline staging, word-wise accumulation, sign normalization, and comparator placement. In the implementation studied, its role is narrowly defined yet technically consequential: to raise a fault flag when the invariant between the baseline residue and the recomputed negated-operand residue is violated, thereby stopping residue corruption before propagation through subsequent transforms or de/encapsulation logic.