{"id":"311d0cad-c8f8-408e-a964-d44f8d4431aa","arxiv_id":"2607.18533","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"PIP-NTT reports a 200 MHz, 520-cycle Kyber NTT on FPGA by pairing coefficients across four n/4-sized memories and two pipelined butterfly units, claiming area-time efficiency gains over a selected subset of prior designs.","lead":"This paper presents PIP-NTT, an FPGA accelerator for the number-theoretic transform used in post-quantum cryptography. It uses four small memories and two pipelined butterfly units to cut the memory bottleneck, reporting fast transform times at modest hardware cost.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Paper's own Table III falsifies the headline ATP claim: [15] and [27] have lower ATP than PIP-NTT, so the 2.67×/1.48× numbers come from excluding the winning baselines.","rationale":"The most load-bearing premise of the paper is its comparative efficiency claim. The architecture, the memory-parallelization idea, and the -13 rescaling trick are interesting engineering contributions, and the DSE is a useful study. But the primary advertised result is the ATP advantage, and the paper's own Table III contains two high-speed designs ([15] and [27]) with lower ATP than PIP-NTT. The authors explicitly exclude them from the 'where PIP-NTT outperforms' subset when computing the 1.48× figure. Excluding the baselines that beat you is not a legitimate way to establish superiority; it is an internal inconsistency, not a disagreement with community standards. The SEC model also affects the comparison favorably for PIP-NTT because four 18Kb BRAMs are discounted to two 36Kb equivalents, but the selection issue is sufficient to undermine the headline claim. I therefore agree with the reader's weakest assumption. The functional-verification concern is real but secondary: if the ATP claim is revised, the paper can still be evaluated on its architectural merits. The recommended verdict remains conditional: the efficiency claims need to be recomputed against the full comparable set or explicitly scoped, and the selective comparison should be removed.","tokens_in":19513,"tokens_out":7622,"duration_ms":80071,"concrete_test":"Recompute the average-ATP comparison in Section VI-B using all FNTT/INTT-only rows of Table III (at least [15], [27], [16], [14], [11]) instead of only the subset where PIP-NTT wins, and recompute SEC with four 18Kb BRAMs counted as four 36Kb equivalents (SEC=1586). If [15] and [27] remain included, the statement '2.67× and 1.48× higher efficiency ... compared to the most high-speed accelerators' is false; the paper should either report the comparison to all designs or explicitly scope the claim to the subset where it is true.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that PIP-NTT achieves 2.67× and 1.48× higher average ATP than the most area-optimized and high-speed NTT accelerators (Abstract; Section VI-B2b) is contradicted by the paper's own Table III. PIP-NTT's Artix-7 ATP is 3084 (SEC=1186, Time=2.60 µs). The high-speed designs [15] and [27] have ATP 656 and 948, respectively, so PIP-NTT is 4.7× and 3.25× worse in ATP. Section VI-B2a admits these designs are more efficient; VI-B2b then computes the 1.48× figure only over the subset 'where PIP-NTT outperforms in ATP,' selecting [11] (ATP 4581) as the high-speed baseline while excluding [15] and [27]. That selection makes the headline comparison circular. The SEC model also favors PIP-NTT: its four 18Kb BRAMs are counted as two 36Kb equivalents; counting all four raises SEC from 1186 to 1586 and ATP to 4124, increasing the gap to 6.3× and 4.35×. The paper's own data therefore do not support the abstract's wording.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PIP-NTT, an iterative NTT/INTT accelerator for Kyber (n=256, q=3329) on FPGA. The main architectural ideas are (i) replacing the conventional two n-sized ping-pong memories with four n/4-sized dual-port BRAMs that store paired coefficients, allowing two butterfly units to run partly in parallel without increasing total memory; (ii) a design-space exploration of unified Cooley-Tukey/Gentleman-Sande butterfly units with up to 8 pipeline stages, improving frequency from 46 MHz to 298 MHz in isolation; and (iii) a multiplication-free rescaling circuit that computes a·n^{-1} mod 3329 as -13a using modular doublings and a conditional negation. The implemented PIP-NTT runs at 200 MHz, computes one FNTT/INTT in 2.60 µs (520 cycles), and the paper claims 2.67× and 1.48× better average Area-Time Product (ATP) than the most area-optimized and high-speed NTT accelerators, respectively.","tokens_in":19808,"tokens_out":7422,"duration_ms":79680,"significance":"If the ATP claim were fully supported, PIP-NTT would be a genuinely interesting area-time point for iterative NTT: it halves the cycle count relative to a single-butterfly iterative design while preserving memory footprint, and the rescaling optimization is a useful constant-multiplication trick for Kyber's n^{-1}. The paper also provides a concrete 8-point NTT case study and reports post-place-and-route results, which makes the architecture testable. However, the headline ATP comparison is not supported by the paper's own Table III: references [15] and [27] have substantially lower ATP than PIP-NTT, and the averages quoted in Section VI-B2b are computed after excluding exactly those designs. This is a load-bearing flaw that must be corrected before the paper's central quantitative claim can be accepted. The architectural ideas remain worth considering, but the paper needs a revised comparison and a consistent area metric.","major_comments":[{"comment":"The abstract claims PIP-NTT achieves 2.67× and 1.48× higher average ATP than the most area-optimized and high-speed NTT accelerators. Table III shows the opposite for the high-speed category: [15] has ATP 656 and [27] has ATP 948, while PIP-NTT has ATP 3084. Section VI-B2b explicitly restricts the average to accelerators 'where PIP-NTT outperforms in ATP,' selecting [8] and [11] and excluding [15] and [27]. This selection makes the headline claim circular. Please either compare against the full table, or explicitly rephrase the claim to name the specific baselines used (e.g., 'compared to [8] and [11]').","section":"Abstract; Section VI-B2b; Table III"},{"comment":"The SEC formula is SEC = #BRAMs×200 + #DSPs×100 + #Slices. For PIP-NTT the table lists 4 BRAMs of 18 Kb and DSPs=6, slices=186, giving 4×200+6×100+186=1586, yet the reported SEC is 1186, which corresponds to counting only 2 BRAMs. The table column header says 'BRAMs' and the row says '4 (18KB),' so the effective BRAM count is inconsistent. If all four BRAMs are counted, PIP-NTT's ATP becomes 4124, making the comparison to [15] and [27] even worse. Please define how 18 Kb BRAMs are converted to 36 Kb equivalents and apply the same rule to all rows.","section":"Table III; SEC formula (Section VI-B)"},{"comment":"The clock-cycle derivation is internally inconsistent. The text states PIP-NTT completes one FNTT/INTT in 512 cycles, computed as log2(n)×64, which is 7×64=448; adding 8 pipeline cycles gives 456, not 512. Table II reports a measured latency of 520 cycles. The missing 64 cycles presumably correspond to the rescaling step, but this is not stated. Since latency and ATP are central to the comparison, the cycle budget should be reconciled with the architecture description.","section":"Section V-D; Table II"}],"minor_comments":[{"comment":"The sentence 'For Kyber, the final coefficients emerge after stage-2 and require reordering' should presumably read 'after the final stage' or 'after stage-7.' As written it is confusing.","section":"Section IV-C"},{"comment":"The text says 'five modular doublings are needed,' but the computation 13a = 8a+4a+a uses three modular doublings (2a, 4a, 8a) and two modular additions (12a, 13a). Please correct the terminology.","section":"Section V-A2"},{"comment":"The figure uses 'n4' instead of 'n/4' in several places. Also, the coefficient-reordering step (Fig. 2d) is described only verbally; a short pseudocode or address-generation table would improve reproducibility.","section":"Section IV / Figure 2"},{"comment":"The entry for [14] lists '10.5 (36KB)' BRAMs. It is unclear how a fractional BRAM count is defined; please clarify.","section":"Table III"},{"comment":"The SEC cost weights are taken from [36], a paper with three co-authors shared with this work. This is not by itself a problem, but an independent justification or a sensitivity analysis (e.g., varying the BRAM/DSP slice-equivalent weights) would strengthen confidence in the comparisons.","section":"Section VI-B"}],"recommendation":"major_revision","confidential_remarks":"The main obstacle is the selective ATP comparison. The paper's own Table III contains baselines ([15], [27]) that beat PIP-NTT in ATP, so the abstract's 'most high-speed' claim cannot stand as written. The BRAM-count inconsistency in the SEC calculation compounds the problem. If the authors revise the comparison to be honest and the BRAM accounting is corrected, the architectural contributions—memory parallelization and the rescaling trick—could be publishable. I would not reject outright, but the headline claim must be reworked."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper builds a plausible, well-documented Kyber NTT accelerator — four n/4 dual-port BRAMs, paired coefficients, a mux-based swap network, two 8-stage pipelined butterfly units, and a neat multiplication-free rescaling using n^-1 ≡ -13 mod 3329. That is a legitimate architectural contribution, and the DSE that takes the butterfly from 46 MHz to 298 MHz is competently done. I'd send this to review on the strength of those pieces.\n\nBut the abstract's claim of 2.67× and 1.48× better average ATP over the most area-optimized and high-speed designs is not supported by the paper's own numbers. Table III lists [15] with ATP 656 and [27] with ATP 948; PIP-NTT's is 3084. The '2.67×' comes from Section VI-B2b, which explicitly restricts the comparison to \"accelerators where PIP-NTT outperforms in ATP,\" then picks [8] and [11] as representatives. That is selection after seeing the results, and it makes the headline circular. The ATP gap gets worse if you count the four 18Kb BRAMs as four BRAMs in the SEC formula; the paper uses two 36Kb equivalents, which drops PIP-NTT's SEC from 1586 to 1186. The SEC model comes from [36], co-authored by three of the same authors, so readers should treat the efficiency ranking with caution. The design might still be competitive on a fair metric, but the paper as written doesn't establish it.\n\nThe second soft spot is verification. The correctness of the paired-memory swap network and the integrated rescaling is argued only through an 8-point case study. There is no testbench, no simulation description, no repository. For a hardware paper claiming a measured 520-cycle NTT, that's a gap a referee should ask to fill. The architecture is coherent and the cycle count is plausible, but plausible isn't demonstrated.\n\nThe comparison baselines are also a mixed bag: [11] and [16] are high-speed designs with very different area budgets, so 'like-for-like' is slippery. The paper admits this for high-speed designs in VI-B2a, but the ATP summary ignores its own caveat.\n\nBottom line: this is a useful paper for PQC hardware designers, especially the DSE and the -13 rescaling. The ATP headline should be rewritten to say the design is competitive on a specific subset, not state a global efficiency win, and a referee should demand a functional testbench. I'd send it out; the core work is solid, but the framing needs a hard edit.","headline":"The memory-parallel NTT architecture and the -13 rescaling are worth a look, but the ATP headline in the abstract is undercut by the authors' own Table III.","tokens_in":20332,"tokens_out":3067,"would_cite":true,"duration_ms":33026,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a Kyber forward or inverse NTT can be computed in 520 clock cycles (2.60 µs at 200 MHz) by pairing coefficients inside four n/4-sized memories and driving two 8-stage pipelined butterfly units, plus a multiplication-fr","keywords":["number theoretic transform","post-quantum cryptography","Kyber / ML-KEM","FPGA accelerator","memory parallelization","pipelined butterfly unit","modular rescaling","area-time product"],"falsifier":"Recompute the average area-time product with all designs from the paper's Table III included (not just the area-optimized and high-speed subsets) and with the four 18Kb BRAMs counted at full slice-equivalent cost; if PIP-NTT's average ATP is no longer less than the best baseline's ATP, the central claim fails. A second check: implement PIP-NTT on a BRAM-constrained FPGA family and measure whether the 520-cycle/2.60 µs operation still fits with the claimed slice-equivalent cost.","tokens_in":19362,"feed_emoji":"🔐","tokens_out":6218,"duration_ms":64294,"temperature":0.7,"pith_summary":"The paper aims to show that an area-conscious, fully iterative NTT for Kyber can get much of the speed of parallel designs without paying in memory: store coefficients two-per-address in four n/4-sized blocks, run two deeply pipelined Cooley-Tukey/Gentleman-Sande butterfly units, and compute the inverse NTT's final rescaling with modular doublings instead of a multiplier. The headline result is 520 clock cycles, 2.60 µs per forward or inverse transform at 200 MHz on an FPGA, roughly half the cycles of a serial iterative design at the same total memory footprint. The authors report 2.67× and 1.48× better average area-time product than the most area-optimized and high-speed published NTT accelerators respectively. If those comparisons hold, PIP-NTT is a useful area-time point for lattice-based PQC hardware.","feed_headline":"Kyber NTT in 2.60 microseconds, 520 clock cycles","feed_subtitle":"Four smaller memories plus two pipelined butterflies halve the cycle count at the same total memory.","key_machinery":"The load-bearing pieces are (1) memory parallelization: four n/4-sized dual-port BRAMs with two 12-bit coefficients per address, whose total capacity equals a conventional 2×n ping-pong memory; (2) the swap network, a purely combinational multiplexer routing controlled by the stage offset δ, which pairs operands correctly across memories for both δ ≥ n/4 (full parallelism) and δ < n/4 (partial); (3) the 8SP-BU, a unified radix-2 CT/GS butterfly with eight register stages, including fine-grained registers inside Barrett mod-q reduction; and (4) the rescaling identity n^{-1} ≡ −13 (mod 3329), implemented as modular doublings plus conditional negation. Together they let the architecture process","core_discovery":"Under Kyber's parameters (n=256, q=3329), the paper claims that the two structural bottlenecks of iterative NTT — memory bandwidth and the final n^{-1} rescale — can both be removed without adding multipliers or large RAMs. The memory scheme uses four dual-port BRAMs of size n/4×24 bits, each address holding two 12-bit coefficients; a multiplexer-based swap network reorders operand pairs according to the stage offset δ, so that two butterfly units can operate concurrently for δ ≥ n/4 and with partial parallelism for smaller δ. This halves the cycle count relative to ping-pong designs: seven stages × 64 cycles, plus 8 pipeline-fill cycles, gives 520 total. Independently, the rescaling step ex","pith_inferences":["Editorial inference: the same 'split into n/4 blocks plus offset swap' pattern should extend naturally to larger ring sizes and to the higher-degree transforms used in homomorphic encryption, where NTT cost dominates and memory budgets are tight; the paper only demonstrates n=256.","Editorial inference: the rescaling trick is a special case of picking the negative residue of n^{-1} with small Hamming weight; other PQC moduli may admit similar multiplication-free rescaling if their inverse is a short shift-add chain.","Editorial inference: the reported ATP margin is sensitive to how 18Kb BRAMs are counted; using a per-bit memory cost model or including all high-speed baselines listed in the comparison table would test how stable the 2.67×/1.48× advantage really is."],"forward_implications":["One Kyber forward or inverse NTT finishes in 520 clock cycles (2.60 µs at 200 MHz), about half the ~900 cycles of serial iterative designs with a comparable memory budget.","The inverse NTT no longer needs a general multiplier for rescaling: the 13a chain plus conditional negation is smaller and faster than a 7-term shift-add circuit for q=3329.","Because the butterfly and memory pattern are controlled by a one-bit mode and parametric offsets, the same datapath can be reconfigured for Dilithium and other radix-r lattice transforms with only control/ROM width changes.","The 8-stage pipelined butterfly, including pipelined Barrett reduction, raises standalone frequency from 46 to 298 MHz at 1.32× slice area, showing where the critical path of iterative NTT actually lives."],"fun_headline_variants":["Parallel Memories Halve NTT Cycles in Kyber Hardware","Four Small Buffers Double NTT Throughput for Kyber","2.67x Efficiency Gain in NTT Accelerators via Memory Splitting","PIP-NTT: Pipelines and Four RAMs Cut Kyber NTT to 520 Cycles","No Extra RAM: Two Pipelines Double NTT Speed in PQC"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The efficiency claim depends on the comparison set and on the cost formula that counts the four 18Kb BRAMs as two 36Kb-equivalent blocks; if a different baseline set or BRAM weighting is used, the reported area-time margins shrink.","fun_headline_variants_meta":{"raw":{"variants":["Parallel Memories Halve NTT Cycles in Kyber Hardware","Four Small Buffers Double NTT Throughput for Kyber","2.67x Efficiency Gain in NTT Accelerators via Memory Splitting","PIP-NTT: Pipelines and Four RAMs Cut Kyber NTT to 520 Cycles","No Extra RAM: Two Pipelines Double NTT Speed in PQC"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000496,"raw_usage":{"total_tokens":2304,"prompt_tokens":817,"completion_tokens":1487,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":1399}},"tokens_in":561,"tokens_out":1487,"duration_ms":8246,"temperature":1.0,"reasoning_tokens":1399,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T15:06:30.489938+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the average area-time product with all designs from the paper's Table III included (not just the area-optimized and high-speed subsets) and with the four 18Kb BRAMs counted at full slice-equivalent cost; if PIP-NTT's average ATP is no longer less than the best baseline's ATP, the central claim fails. A second check: implement PIP-NTT on a BRAM-constrained FPGA family and measure whether the 520-cycle/2.60 µs operation still fits with the claimed slice-equivalent cost.","supporting_citations":[],"review_version":1}