3-D Design Space Exploration of NTT/INTT Hardware Accelerators for ML-KEM and ML-DSA

WU Po; RUAN Chong; ZHANG Qian; WANG Dan; ZHANG Rui; TAO Yang

doi:10.11999/JEIT260611

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2025 >

WU Po, RUAN Chong, ZHANG Qian, WANG Dan, ZHANG Rui, TAO Yang. 3-D Design Space Exploration of NTT/INTT Hardware Accelerators for ML-KEM and ML-DSA[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260611

Citation:

WU Po, RUAN Chong, ZHANG Qian, WANG Dan, ZHANG Rui, TAO Yang. 3-D Design Space Exploration of NTT/INTT Hardware Accelerators for ML-KEM and ML-DSA[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT260611

Citation:

PDF( 1042 KB)

3-D Design Space Exploration of NTT/INTT Hardware Accelerators for ML-KEM and ML-DSA

doi: 10.11999/JEIT260611 cstr: 32379.14.JEIT260611

1.
State Grid Henan Electric Power Research Institute, Zhengzhou 450000, China
2.
Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100085, China
3.
State Grid Henan Electric Power Company, Zhengzhou 450000, China

Funds: State Grid Henan Electric Power Company Science and Technology Project (52170225001N)

Received Date: 2026-05-15
Accepted Date: 2026-09-14
Rev Recd Date: 2026-08-28

Available Online: 2026-09-20

Abstract

Abstract

Objective The rapid development of quantum computing poses a serious threat to traditional public-key cryptosystems, making Post-Quantum Cryptography (PQC) a critical research area. The Module-Lattice-based Key-Encapsulation Mechanism (ML-KEM) and Module-Lattice-based Digital Signature Algorithm (ML-DSA), standardized by the National Institute of Standards and Technology (NIST), rely on polynomial multiplication using the Number Theoretic Transform (NTT) and Inverse Number Theoretic Transform (INTT). The efficiency of NTT/INTT hardware accelerators directly affects the real-time performance and power consumption of these algorithms. Diverse application scenarios, ranging from resource-constrained to resource-rich environments, require different trade-offs between hardware resources and computational throughput. Furthermore, efficiently supporting both ML-KEM and ML-DSA on a single hardware platform remains a significant engineering challenge. To address these issues, this paper proposes a configurable NTT/INTT hardware accelerator design methodology that systematically explores the design space across three dimensions. Methods The design space is modeled according to three dimensions: modular multiplication implementation strategy (Digital Signal Processing (DSP)-intensive vs. Look-Up Table (LUT)-intensive), memory interface strategy (two-read-one-write vs. two-read-two-write), and pipeline depth (2-stage to 4-stage). For modular multiplication, two variants of the Barrett reduction are implemented. The DSP-intensive variant uses dedicated DSP slices for multiplication and accumulation, whereas the LUT-intensive variant uses only LUT resources and shift-add operations without consuming DSP resources. For the memory interface, the Two-Read-Two-Write (R2W2) mode fully utilizes the dual-write-port capability of Block RAM (BRAM) to eliminate write conflicts, achieving one butterfly operation per cycle. The Two-Read-One-Write (R2W1) mode requires two write cycles per butterfly operation, reducing throughput by 50%. For pipelining, four pipeline stages are inserted into the LUT-intensive Barrett modular multiplier to shorten the critical path: stage 1 performs multiplication, stage 2 calculates the intermediate sum, stage 3 computes the difference, and stage 4 completes the reduction through a correction multiplexer. A write-valid auto-delay mechanism is designed to align write-enable signals with the pipeline depth, simplifying control logic. The unified architecture supports algorithm configurability through an Alg_MODE parameter, which selects ML-KEM or ML-DSA, and dynamic NTT/INTT switching through an NTT_MODE signal. The proposed design is synthesized on a Xilinx Artix-7 FPGA (xc7a200t) using Vivado 2017.4 and ISE 14.4 for comparison. Results and Discussions Comprehensive evaluations are conducted on the modular multiplier, memory interface, pipeline stages, and the complete NTT/INTT accelerator. For the modular multiplier (Table 2), the LUT-intensive Barrett implementation reduces Equivalent LUT (ELUT) area by 55.3% for ML-KEM (from 928 to 415) and by 75.1% for ML-DSA (from 3 105 to 773) compared with the DSP-intensive implementation. The Equivalent Area-Delay Product (EADP) is reduced by 41.89% for ML-KEM and by 83.23% for ML-DSA, demonstrating improved resource efficiency, especially for large bit widths. For the memory interface (Table 3), the R2W2 mode achieves 100% higher NTT throughput than the R2W1 mode, with slightly lower LUT and register counts due to simplified control logic. For pipeline optimization (Table 4), the 4-stage pipeline reduces the critical path delay of the ML-DSA modular multiplier from 15.114 ns to 4.359 ns (71% reduction) and that of ML-KEM from 17.252 ns to 4.052 ns (76.5% reduction). The Area-Delay Product (ADP) decreases by 73.4% for ML-KEM and 71.3% for ML-DSA. At the complete accelerator level (Table 8), the 4-stage pipeline achieves an area-time product (ATP) of 1.782 kLUT·μs for ML-KEM and 3.073 kLUT·μs for ML-DSA. Compared with the 3-stage pipeline, the 4-stage pipeline reduces power consumption by 4.8% for ML-KEM and 12.9% for ML-DSA (Table 9). The power breakdown (Fig. 5) shows that the modular reduction unit power share decreases from 47% (3-stage) to 38% (4-stage) for ML-DSA. Compared with state-of-the-art single-butterfly designs (Table 10), the proposed accelerator reduces ATP by 25.15% for ML-KEM and by 1.44% for ML-DSA while using fewer LUTs and BRAMs. Conclusions This paper presents a systematic three-dimensional design space exploration method for configurable NTT/INTT hardware accelerators targeting ML-KEM and ML-DSA. By abstracting the design space into modular multiplication strategy, memory interface strategy, and pipeline depth, the quantitative trade-offs among resources (LUT, DSP, BRAM), timing (frequency and delay), and power consumption are analyzed. The optimal configuration is determined as LUT-intensive Barrett modular multiplication, a two-read-two-write memory interface, and a 4-stage pipeline. Experimental results on FPGA demonstrate that this configuration achieves a balance between resource efficiency and performance, with ATP values of 1.782 kLUT·μs for ML-KEM and 3.073 kLUT·μs for ML-DSA. The proposed methodology can be extended to other NTT-based PQC algorithms and provides data-driven guidelines for flexible hardware accelerator design targeting both edge devices and cloud servers. Future work will explore efficient polynomial multiplication based on this NTT/INTT accelerator and extend the method to additional domestic and international standardization algorithms.

FullText(HTML)

References(21)

References

[1]	MOODY D, PERLNER R, REGENSCHEID A, et al. Transition to post-quantum cryptography standards: Initial public draft[R]. NIST Internal Report NIST IR 8547 ipd, 2024.
[2]	SCHWABE P, AVANZI R. J, BOS J, et al. Crystals-kyber[C]. NIST Post-Quantum Cryptography Standardization Round 3 Submissions, Gaithersburg, USA, 2022.
[3]	LYUBASHEVSKY V, DUCAS L, KILTZ E, et al. Crystals-dilithium[C]. NIST Post-Quantum Cryptography Standardization Round 3 Submissions, Gaithersburg, USA, 2022.
[4]	National Institute of Standards and Technology. FIPS 203 Module-lattice-based key-encapsulation mechanism standard[S]. Washington: U. S. Department of Commerce, 2024. doi: 10.6028/NIST.FIPS.203.
[5]	National Institute of Standards and Technology. FIPS 204 Module-lattice-based digital signature standard[S]. Washington: U. S. Department of Commerce, 2024. doi: 10.6028/NIST.FIPS.204.
[6]	刘冬生, 邹雪城, 张聪, 等. 后量子密码芯片设计[M]. 北京: 电子工业出版社, 2023. LIU Dongsheng, ZOU Xuecheng, ZHANG Cong, et al. Chip Design for Post-Quantum Cryptography[M]. Beijing: Publishing House of Electronics Industry, 2023.
[7]	XING Yufei and LI Shuguo. An efficient implementation of the NewHope key exchange on FPGAs[J]. IEEE Transactions on Circuits and Systems I: Regular Papers, 2020, 67(3): 866–878. doi: 10.1109/TCSI.2019.2956651.
[8]	赵旭阳, 梁志闯, 胡跃, 等. NTT架构研究及其FPGA硬件优化实现[J]. 计算机学报, 2023, 46(12): 2670–2686. doi: 10.11897/SP.J.1016.2023.02670. ZHAO Xuyang, LIANG Zhichuang, HU Yue, et al. NTT architecture research and its FPGA hardware optimization implementation[J]. Chinese Journal of Computers, 2023, 46(12): 2670–2686. doi: 10.11897/SP.J.1016.2023.02670.
[9]	NGUYEN T H, KIEU-DO-NGUYEN B, PHAM C, et al. High-speed NTT accelerator for CRYSTAL-Kyber and CRYSTAL-Dilithium[J]. IEEE Access, 2024, 12: 34918–34930. doi: 10.1109/ACCESS.2024.3371581.
[10]	BANERJEE U, UKYAB T S, and CHANDRAKASAN A P. Sapphire: A configurable crypto-processor for post-quantum lattice-based protocols[J]. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2019, 2019(4): 17–61. doi: 10.46586/tches.v2019.i4.17-61.
[11]	MANDAL S and ROY D B. KiD: A hardware design framework targeting unified NTT multiplication for CRYSTALS-Kyber and CRYSTALS-Dilithium on FPGA[C]. 2024 37th International Conference on VLSI Design and 2024 23rd International Conference on Embedded Systems (VLSID), Kolkata, India, 2024: 455–460. doi: 10.1109/VLSID60093.2024.00082.
[12]	LU Jiahao, ZHANG Jiaming, LUO Zhixiang, et al. An efficient and configurable hardware architecture of polynomial modular operation for CRYSTALS-Kyber and Dilithium[C]. 2024 IEEE 67th International Midwest Symposium on Circuits and Systems (MWSCAS), Springfield, USA, 2024: 29–32. doi: 10.1109/MWSCAS60917.2024.10658892.
[13]	SALARIFARD R and SOLEIMANY H. An efficient hardware accelerator for NTT-based polynomial multiplication using FPGA[J]. Journal of Cryptographic Engineering, 2024, 14(2): 415–426. doi: 10.1007/s13389-024-00357-1.
[14]	NI Ziying, KHALID A, LIU Weiqiang, et al. Towards a lightweight CRYSTALS-Kyber in FPGAs: An ultra-lightweight BRAM-free NTT core[C]. IEEE International Symposium on Circuits and Systems (ISCAS 2023), Monterey, USA, 2023: 1–5. doi: 10.1109/ISCAS46773.2023.10181340.
[15]	YAMAN F, MERT A C, ÖZTÜRK E, et al. A hardware accelerator for polynomial multiplication operation of CRYSTALS-KYBER PQC scheme[C]. 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE), Grenoble, France, 2021: 1020–1025. doi: 10.23919/DATE51398.2021.9474139.
[16]	ZHAO Yanrui, LIU Xiaofan, HU Yue, et al. Design of an efficient NTT/INTT architecture with low-complex memory mapping scheme[J]. IEEE Transactions on Circuits and Systems II: Express Briefs, 2024, 71(1): 400–404. doi: 10.1109/TCSII.2023.3296492.
[17]	ZHAO Yinqiao, XIE Zilong, ZHAN Ruidian, et al. NTT-LSU: Tightly coupled architecture for efficient NTT implementation on RISC-V processor[J]. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 45(6): 2952–2961. doi: 10.1109/TCAD.2025.3627145.
[18]	CUI Yijun, ZHONG Junjie, WANG Bei, et al. High-performance hardware implementation of crystals-dilithium based on improved MDC-NTT[J]. IEEE Transactions on Computers, 2025, 74(9): 2896–2908. doi: 10.1109/TC.2025.3576934.
[19]	陈韬, 赵旺鹏, 别梦妮, 等. 格基后量子密码双域可重构多项式乘法运算单元架构研究[J]. 电子与信息学报, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929. CHEN Tao, ZHAO Wangpeng, BIE Mengni, et al. Research on the architecture of dual-field reconfigurable polynomial multiplication unit for lattice-based post-quantum cryptography[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1646–1658. doi: 10.11999/JEIT250929.
[20]	郑集文, 赵石磊, 张子悦, 等. 面向格密码的高面积效率基-4快速数论变换硬件架构与无访存冲突优化设计[J]. 电子与信息学报, 2026, 48(2): 855–865. doi: 10.11999/JEIT250687. ZHENG Jiwen, ZHAO Shilei, ZHANG Ziyue, et al. High area-efficiency radix-4 number theoretic transform hardware architecture with conflict-free memory access optimization for lattice-based cryptography[J]. Journal of Electronics & Information Technology, 2026, 48(2): 855–865. doi: 10.11999/JEIT250687.
[21]	赵毅强, 孔金笛, 付玉成, 等. 面向模块化格基密钥封装机制算法多项式乘法的侧信道安全防护关键技术研究[J]. 电子与信息学报, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292. ZHAO Yiqiang, KONG Jindi, FU Yucheng, et al. Research on key technologies of side-channel security protection for polynomial multiplication in ML-KEM/Kyber algorithm[J]. Journal of Electronics & Information Technology, 2025, 47(9): 3126–3136. doi: 10.11999/JEIT250292.