Recomputation with Swapped Operand (RESWO)

• RESWO is a fault detection method that recomputes modular multiplication by swapping specific bits in operands to verify Barrett reduction results.
• It employs a swap-based arithmetic adjustment and a correction term to achieve fault detection efficiencies up to 99.97% against transient and burst faults.
• Integrated into the CT‑BU of lattice-based schemes like Kyber, RESWO offers minimal overhead in area, delay, and power while boosting security.

Recomputation with Swapped Operand (RESWO) is a recomputation-based fault detection scheme introduced for Barrett reduction in the Cooley–Tukey Butterfly Unit (CT‑BU) of lattice-based post-quantum cryptographic hardware, particularly Kyber implementations on FPGA. In the formulation reported for CT‑BU, RESWO operates inside the Number Theoretic Transform (NTT) datapath, where modular multiplication by a twiddle factor is followed by Barrett reduction. Its purpose is to detect transient and permanent faults in a security-critical and latency-dominant block by recomputing an algebraically equivalent result and comparing remainders. The method was introduced alongside two adapted recomputation schemes, Recomputation with Negated Operand (RENO) and Recomputation with Shifted Operand (RESO), with RESWO reported to have similar implementation cost and lower delay under the evaluated conditions (Baidya et al., 4 Sep 2025).

1. Position within lattice-based PQC hardware

Structured lattice-based schemes such as Kyber KEM, CRYSTALS‑Dilithium, Falcon, and NTRU work over rings of the form $\mathbb{Z}_q[x]/(x^n+1)$. The reported examples include Kyber with $n=256$, $q=3329$; Dilithium with $n=256$, $q=8380417$; and Falcon/NTRU variants with $n=512$ or $2048$, $q=12289$. Polynomial multiplication is accelerated by the NTT, and the CT‑BU is the core datapath element of the transform (Baidya et al., 4 Sep 2025).

For coefficient pair $(U,\alpha[j+t])$ and twiddle factor $\omega$, the CT‑BU produces

$n=256$0

where

$n=256$1

The multiplication by $n=256$2 followed by reduction modulo $n=256$3 is typically implemented with Barrett reduction because it is efficient in hardware and avoids expensive divisions. The CT‑BU described in the source is pipelined into three stages: buffering $n=256$4 and $n=256$5; computing $n=256$6; and then computing the butterfly sum and difference.

Barrett reduction is singled out as “the most resource-intensive, latency-critical, and energy-demanding operation in the NTT transformation.” It is also security-critical, because faults in modular reduction propagate through polynomial multiplications, and single or few faulty NTT outputs can be exploited in differential fault analysis against schemes such as Kyber and Dilithium. RESWO is therefore targeted at a block that is simultaneously performance-dominant and attack-relevant (Baidya et al., 4 Sep 2025).

2. Algorithmic construction of RESWO

The reported architecture first defines a Modified Barrett Reduction for Fault Detection (MBRFD), which performs multiplication and reduction word-wise. Inputs $n=256$7 and $n=256$8 are $n=256$9-bit integers partitioned into words of size $q=3329$0 bits. For each word pair $q=3329$1, the main datapath extracts $q=3329$2 and $q=3329$3, computes the partial product $q=3329$4, aligns it by zero-padding according to the word positions, reduces it by Barrett reduction to obtain $q=3329$5, and compares that result against a recomputed remainder $q=3329$6 produced by a recomputation unit (Baidya et al., 4 Sep 2025).

RESWO is the recomputation unit specific to this design. Its defining operation is not the exchange of $q=3329$7 and $q=3329$8 as whole operands. Instead, two bit positions $q=3329$9 and $n=256$0 inside the current word of $n=256$1 are swapped to form $n=256$2. The method then computes

$n=256$3

and forms the recomputed product

$n=256$4

After the same zero-padding used in the main datapath, $n=256$5 is reduced with the same Barrett constant $n=256$6 and the same slice $n=256$7 to produce $n=256$8 (Baidya et al., 4 Sep 2025).

The central invariant is given as Lemma 1. For word segments $n=256$9 and $q=8380417$0, with swapped version $q=8380417$1 and correction term $q=8380417$2, the following identity holds: $q=8380417$3 The proof sketch reported in the source is straightforward: swapping two bits changes the numeric value of the word by exactly $q=8380417$4; multiplying the swapped value by $q=8380417$5 and then adding back $q=8380417$6 recovers the original product. Consequently, in the fault-free case, the recomputed partial product equals the main partial product, and the reduced outputs must satisfy $q=8380417$7 (Baidya et al., 4 Sep 2025).

This construction gives RESWO an algebraic equivalence test rather than a heuristic redundancy check. A mismatch between $q=8380417$8 and $q=8380417$9 is interpreted as a fault indication.

3. CT‑BU integration and micro-architecture

In the protected CT‑BU, the MBRFD block contains the main Barrett Reduction block, a ReComp block implementing one of RESWO, RENO, or RESO, and a comparator that checks $n=512$0 against $n=512$1. Polynomial coefficient memory and the associated multiplexers/demultiplexers connect the CT‑BU to the rest of the NTT and polynomial-arithmetic system. For each word, the pipeline feeds $n=512$2 and the twiddle factor into stage 2, where the main Barrett path and the recomputation path execute in parallel. If the comparator reports equality, the design accepts $n=512$3 and continues the butterfly update; otherwise, Fault = 1 is raised, and the source notes that $n=512$4 is then not used (Baidya et al., 4 Sep 2025).

The RESWO block itself contains a swap block, arithmetic for $n=512$5 and $n=512$6, multipliers for $n=512$7 and for the Barrett-reduction subcomputations, an adder that forms $n=512$8, a left shifter implementing alignment by $n=512$9, and a subtractor computing

$2048$0

The design therefore keeps the same Barrett reduction structure as the main datapath and changes only the way the recomputed product is generated (Baidya et al., 4 Sep 2025).

The implementation parameters reported for synthesis are Xilinx Artix‑7 FPGA device xc7a100tcsg324‑3, VHDL, and Vivado 22.02, with a 100 MHz baseline clock. For Kyber CT‑BU with $2048$1, $2048$2, $2048$3, and $2048$4, the baseline CT‑BU is reported as 573 slices, 972 LUTs, 239 FFs, 1 BRAM, 131 mW, and 9.39 ns. The Barrett block alone is reported as 76 slices, 254 LUTs, 89 FFs, 101 mW, and 7.18 ns. The RESWO block is reported as 52 slices, 190 LUTs, 38 FFs, 2 mW, and 9.51 ns (Baidya et al., 4 Sep 2025).

4. Comparison with RENO and RESO

RESWO is evaluated beside RENO and RESO, both adapted to Barrett reduction in the same CT‑BU setting. All three schemes share the same structural idea: apply an invertible transform, recompute, and compensate so that the recomputed result equals the original in the absence of faults. Their difference lies in the chosen transform and in the amount of correction logic required (Baidya et al., 4 Sep 2025).

RENO negates $2048$5, computes a negated product, performs a corresponding Barrett reduction, and then uses a 2’s-complement step to undo the transformation. RESO shifts both operands left by one bit, changes Barrett slice indices to account for the extra factor of $2048$6, and then right-shifts the result by two bits. RESWO, by contrast, alters only one operand locally at the bit level, uses the same Barrett slice indices as the main unit, and requires no 2’s complement or end-stage rescaling. The source attributes the lower delay of RESWO to this reduced post-processing complexity (Baidya et al., 4 Sep 2025).

Scheme	Added block metrics	CT‑BU overhead
RESWO	52 slices, 190 LUTs, 38 FFs, 9.51 ns	~9.07% area, ~2.02% delay, ~1.52% power
RENO	56 slices, 197 LUTs, 48 FFs, 9.67 ns	~9.77% area, ~2.98% delay, ~1.52% power
RESO	51 slices, 182 LUTs, 42 FFs, 9.61 ns	~8.9% area, ~2.34% delay, ~1.52% power

Within this evaluation, area is close across all three schemes, while RESWO has the shortest critical path at 9.51 ns, compared with 9.67 ns for RENO and 9.61 ns for RESO. The reported interpretation is that RESWO remains structurally closest to the plain Barrett datapath while adding only a swap block, a correction-term product, and an adder (Baidya et al., 4 Sep 2025).

5. Fault model, detection efficiency, and security role

The reported threat model includes both transient and permanent faults abstracted at logic level as single- and multi-bit flips, random faults, and burst faults. Faults may occur in either operand or both, and in intermediate registers of the Barrett reduction and recomputation datapaths. For evaluation, the study uses Python-based fault injection with $2048$7-bit operands, 1.5 million trials, and fault sizes $2048$8 under both random and burst patterns. Faults are injected into $2048$9 only, $q=12289$0 only, or both operands (Baidya et al., 4 Sep 2025).

For RESWO, Table 6 reports fault detection efficiency for $q=12289$1, $q=12289$2, and $q=12289$3. Across the tested settings, random faults in $q=12289$4 or $q=12289$5 are reported at 99.94–99.97%, burst faults at 99.94–99.98%, and faults in both operands up to 99.97%. Example values given in the source include 99.97% for a random single-bit fault in $q=12289$6 at $q=12289$7, and 99.97% for a 23-bit burst fault in both operands at $q=12289$8. The authors also state that “the fault detection efficiency of RESWO, RENO, and RESO ranges from 99.95\% to 99.97\% across different fault injection scenarios and fault modes,” and that the study of $q=12289$9 versus error detection efficiency “shows that $(U,\alpha[j+t])$0 has no effect on error detection efficiency” (Baidya et al., 4 Sep 2025).

These results support the security rationale for local checking inside the CT‑BU. Under the tested model, if a fault affects the main Barrett datapath or the recomputation path, the equality $(U,\alpha[j+t])$1 is very likely to be violated, causing Fault = 1. The intended system-level response is abort, reset, or discard of the result, thereby denying an attacker access to exploitable faulty ciphertexts or signatures. The source classifies RESWO, RENO, and RESO as Type 2 fault detection methods, meaning generic, algorithm-independent building blocks applicable to polynomial multiplication with modular reduction (Baidya et al., 4 Sep 2025).

6. Terminological clarifications, related work, and limitations

A common source of confusion is the phrase “swapped operand.” In RESWO, it does not denote swapping the two inputs of a multiplication. It denotes swapping two bits inside $(U,\alpha[j+t])$2 and then compensating algebraically through $(U,\alpha[j+t])$3. This distinction is explicit in the source and is central to the method’s invariant (Baidya et al., 4 Sep 2025).

That usage differs from the operand-swapping strategy studied in “SWAPPER: Dynamic Operand Swapping in Non-commutative Approximate Circuits for Online Error Reduction” (Traiola et al., 4 Mar 2025). SWAPPER targets hardware approximate computing, not fault detection in PQC arithmetic. It dynamically chooses between $(U,\alpha[j+t])$4 and $(U,\alpha[j+t])$5 using a 1-bit rule, performs only one evaluation, and aims to reduce approximation error in non-commutative approximate multipliers. The paper explicitly contrasts such single-pass selection with RESWO-like recomputation strategies, which conceptually involve evaluating both operand orders or otherwise using a second computation. This suggests that the acronymic overlap between RESWO and operand-swapping methods in approximate computing should not be read as methodological identity (Traiola et al., 4 Mar 2025).

The reported limitations of RESWO are tied to the evaluated model. Coverage is high but not 100%, and the source does not catalogue specific undetected patterns. The fault model is based on random and burst bit flips and does not explicitly model highly structured correlated faults that identically affect both main and recomputation paths, nor timing faults that yield the same erroneous value in both paths. The protection scope is also partial: the work addresses Barrett reduction inside CT‑BU rather than the full PQC implementation stack. Finally, while the overheads are characterized as low, they may remain relevant in highly resource-constrained settings (Baidya et al., 4 Sep 2025).

The broader applicability reported for RESWO is to Barrett units in Kyber, CRYSTALS‑Dilithium, Falcon, and NTRU, with the same recomputation scheme retained while only parameters such as $(U,\alpha[j+t])$6, $(U,\alpha[j+t])$7, and $(U,\alpha[j+t])$8 change. A plausible implication is that subsequent work may extend the same recomputation principle to other arithmetic cores, or combine it with parity, CRC, masking, or ASIC-oriented optimizations where the same locality and algebraic equivalence properties can be preserved (Baidya et al., 4 Sep 2025).