Pith. sign in

REVIEW 3 major objections 5 minor 38 references

PIP-NTT: Towards a Scalable Memory-Parallelized Accelerator for Iterative NTT in PQC

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a Kyber forward or inverse NTT can be computed in 520 clock cycles (2.60 µs at 200 MHz) by pairing coefficients inside four n/4-sized memories and driving two 8-stage pipelined butterfly units, plus a multiplication-fr

desk verdict The memory-parallel NTT architecture and the -13 rescaling are worth a look, but the ATP headline in the abstract is undercut by the authors' own Table III. read the letter →

arxiv 2607.18533 v1 pith:EISPKYGL submitted 2026-07-20 cs.AR cs.CR

Malik Imran , Ayesha Khalid , Ciara Rafferty , Safiullah Khan , Muhammad Rashid , Maire O'Neill This is my paper · ORCID
classification cs.ARcs.CR
keywords numbertheoretictransformpost-quantumcryptographyKyber/ML-KEMFPGAacceleratormemoryparallelizationpipelinedbutterflyunitmodularrescalingarea-timeproduct
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to show that an area-conscious, fully iterative NTT for Kyber can get much of the speed of parallel designs without paying in memory: store coefficients two-per-address in four n/4-sized blocks, run two deeply pipelined Cooley-Tukey/Gentleman-Sande butterfly units, and compute the inverse NTT's final rescaling with modular doublings instead of a multiplier. The headline result is 520 clock cycles, 2.60 µs per forward or inverse transform at 200 MHz on an FPGA, roughly half the cycles of a serial iterative design at the same total memory footprint. The authors report 2.67× and 1.48× better average area-time product than the most area-optimized and high-speed published NTT accelerators respectively. If those comparisons hold, PIP-NTT is a useful area-time point for lattice-based PQC hardware.

What carries the argument

The load-bearing pieces are (1) memory parallelization: four n/4-sized dual-port BRAMs with two 12-bit coefficients per address, whose total capacity equals a conventional 2×n ping-pong memory; (2) the swap network, a purely combinational multiplexer routing controlled by the stage offset δ, which pairs operands correctly across memories for both δ ≥ n/4 (full parallelism) and δ < n/4 (partial); (3) the 8SP-BU, a unified radix-2 CT/GS butterfly with eight register stages, including fine-grained registers inside Barrett mod-q reduction; and (4) the rescaling identity n^{-1} ≡ −13 (mod 3329), implemented as modular doublings plus conditional negation. Together they let the architecture process

What would settle it

Recompute the average area-time product with all designs from the paper's Table III included (not just the area-optimized and high-speed subsets) and with the four 18Kb BRAMs counted at full slice-equivalent cost; if PIP-NTT's average ATP is no longer less than the best baseline's ATP, the central claim fails. A second check: implement PIP-NTT on a BRAM-constrained FPGA family and measure whether the 520-cycle/2.60 µs operation still fits with the claimed slice-equivalent cost.

Watch

Extended reading notes

Core claim

Under Kyber's parameters (n=256, q=3329), the paper claims that the two structural bottlenecks of iterative NTT — memory bandwidth and the final n^{-1} rescale — can both be removed without adding multipliers or large RAMs. The memory scheme uses four dual-port BRAMs of size n/4×24 bits, each address holding two 12-bit coefficients; a multiplexer-based swap network reorders operand pairs according to the stage offset δ, so that two butterfly units can operate concurrently for δ ≥ n/4 and with partial parallelism for smaller δ. This halves the cycle count relative to ping-pong designs: seven stages × 64 cycles, plus 8 pipeline-fill cycles, gives 520 total. Independently, the rescaling step ex

Load-bearing premise

The efficiency claim depends on the comparison set and on the cost formula that counts the four 18Kb BRAMs as two 36Kb-equivalent blocks; if a different baseline set or BRAM weighting is used, the reported area-time margins shrink.

Editorial extensions

If this is right

  • One Kyber forward or inverse NTT finishes in 520 clock cycles (2.60 µs at 200 MHz), about half the ~900 cycles of serial iterative designs with a comparable memory budget.
  • The inverse NTT no longer needs a general multiplier for rescaling: the 13a chain plus conditional negation is smaller and faster than a 7-term shift-add circuit for q=3329.
  • Because the butterfly and memory pattern are controlled by a one-bit mode and parametric offsets, the same datapath can be reconfigured for Dilithium and other radix-r lattice transforms with only control/ROM width changes.
  • The 8-stage pipelined butterfly, including pipelined Barrett reduction, raises standalone frequency from 46 to 298 MHz at 1.32× slice area, showing where the critical path of iterative NTT actually lives.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same 'split into n/4 blocks plus offset swap' pattern should extend naturally to larger ring sizes and to the higher-degree transforms used in homomorphic encryption, where NTT cost dominates and memory budgets are tight; the paper only demonstrates n=256.
  • Editorial inference: the rescaling trick is a special case of picking the negative residue of n^{-1} with small Hamming weight; other PQC moduli may admit similar multiplication-free rescaling if their inverse is a short shift-add chain.
  • Editorial inference: the reported ATP margin is sensitive to how 18Kb BRAMs are counted; using a per-bit memory cost model or including all high-speed baselines listed in the comparison table would test how stable the 2.67×/1.48× advantage really is.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes PIP-NTT, an iterative NTT/INTT accelerator for Kyber (n=256, q=3329) on FPGA. The main architectural ideas are (i) replacing the conventional two n-sized ping-pong memories with four n/4-sized dual-port BRAMs that store paired coefficients, allowing two butterfly units to run partly in parallel without increasing total memory; (ii) a design-space exploration of unified Cooley-Tukey/Gentleman-Sande butterfly units with up to 8 pipeline stages, improving frequency from 46 MHz to 298 MHz in isolation; and (iii) a multiplication-free rescaling circuit that computes a·n^{-1} mod 3329 as -13a using modular doublings and a conditional negation. The implemented PIP-NTT runs at 200 MHz, computes one FNTT/INTT in 2.60 µs (520 cycles), and the paper claims 2.67× and 1.48× better average Area-Time Product (ATP) than the most area-optimized and high-speed NTT accelerators, respectively.

Significance. If the ATP claim were fully supported, PIP-NTT would be a genuinely interesting area-time point for iterative NTT: it halves the cycle count relative to a single-butterfly iterative design while preserving memory footprint, and the rescaling optimization is a useful constant-multiplication trick for Kyber's n^{-1}. The paper also provides a concrete 8-point NTT case study and reports post-place-and-route results, which makes the architecture testable. However, the headline ATP comparison is not supported by the paper's own Table III: references [15] and [27] have substantially lower ATP than PIP-NTT, and the averages quoted in Section VI-B2b are computed after excluding exactly those designs. This is a load-bearing flaw that must be corrected before the paper's central quantitative claim can be accepted. The architectural ideas remain worth considering, but the paper needs a revised comparison and a consistent area metric.

major comments (3)
  1. [Abstract; Section VI-B2b; Table III] The abstract claims PIP-NTT achieves 2.67× and 1.48× higher average ATP than the most area-optimized and high-speed NTT accelerators. Table III shows the opposite for the high-speed category: [15] has ATP 656 and [27] has ATP 948, while PIP-NTT has ATP 3084. Section VI-B2b explicitly restricts the average to accelerators 'where PIP-NTT outperforms in ATP,' selecting [8] and [11] and excluding [15] and [27]. This selection makes the headline claim circular. Please either compare against the full table, or explicitly rephrase the claim to name the specific baselines used (e.g., 'compared to [8] and [11]').
  2. [Table III; SEC formula (Section VI-B)] The SEC formula is SEC = #BRAMs×200 + #DSPs×100 + #Slices. For PIP-NTT the table lists 4 BRAMs of 18 Kb and DSPs=6, slices=186, giving 4×200+6×100+186=1586, yet the reported SEC is 1186, which corresponds to counting only 2 BRAMs. The table column header says 'BRAMs' and the row says '4 (18KB),' so the effective BRAM count is inconsistent. If all four BRAMs are counted, PIP-NTT's ATP becomes 4124, making the comparison to [15] and [27] even worse. Please define how 18 Kb BRAMs are converted to 36 Kb equivalents and apply the same rule to all rows.
  3. [Section V-D; Table II] The clock-cycle derivation is internally inconsistent. The text states PIP-NTT completes one FNTT/INTT in 512 cycles, computed as log2(n)×64, which is 7×64=448; adding 8 pipeline cycles gives 456, not 512. Table II reports a measured latency of 520 cycles. The missing 64 cycles presumably correspond to the rescaling step, but this is not stated. Since latency and ATP are central to the comparison, the cycle budget should be reconciled with the architecture description.
minor comments (5)
  1. [Section IV-C] The sentence 'For Kyber, the final coefficients emerge after stage-2 and require reordering' should presumably read 'after the final stage' or 'after stage-7.' As written it is confusing.
  2. [Section V-A2] The text says 'five modular doublings are needed,' but the computation 13a = 8a+4a+a uses three modular doublings (2a, 4a, 8a) and two modular additions (12a, 13a). Please correct the terminology.
  3. [Section IV / Figure 2] The figure uses 'n4' instead of 'n/4' in several places. Also, the coefficient-reordering step (Fig. 2d) is described only verbally; a short pseudocode or address-generation table would improve reproducibility.
  4. [Table III] The entry for [14] lists '10.5 (36KB)' BRAMs. It is unclear how a fractional BRAM count is defined; please clarify.
  5. [Section VI-B] The SEC cost weights are taken from [36], a paper with three co-authors shared with this work. This is not by itself a problem, but an independent justification or a sensitivity analysis (e.g., varying the BRAM/DSP slice-equivalent weights) would strengthen confidence in the comparisons.

Circularity Check

0 steps flagged · score 2.0 of 10

No derivation-chain circularity; raw measurements are self-contained, with only a minor self-cited cost model.

full rationale

PIP-NTT's central performance figures (520 cycles, 200 MHz, 2.60 us, slice/LUT/FF/BRAM/DSP counts) are post-place-and-route measurements of the implemented Verilog, not quantities derived by fitting to an output target. Eq. 9 is unit conversion, and the cycle count is a direct consequence of the memory-parallelized datapath. The rescaling circuit uses the congruence n^-1 = 3316 ≡ -13 mod 3329, which is a mathematical identity, not an input-dependent fit. The paper's comparative ATP claims rely on the SEC cost model cited to [36]/[37]; [36] shares three co-authors with this paper, so this is a minor self-citation, but the formula is applied uniformly and [37] provides an independent citation. The more serious issue—the headline 2.67x/1.48x ATP figures are computed over the subset 'where PIP-NTT outperforms in ATP' (VI-B2b), excluding [15] and [27] which Table III lists with lower ATP—is a baseline-selection/consistency problem in the benchmark claim, not a circular derivation: the ratio is an arithmetic comparison, not a predicted quantity forced by the design equations. Hence no significant circularity.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

PIP-NTT introduces no new mathematical entities or physical postulates. The load-bearing assumptions are engineering choices: pipeline depth, SEC weighting, twiddle table correctness, and the unformalized correctness of the swap network. The free-parameter list is short because the design is not a fitted empirical model; however, the SEC weights and the BRAM counting convention are hand-chosen and affect the headline claims.

free parameters (3)
  • Butterfly pipeline depth = 8 stages
    Chosen by hand from the DSE of 2-8 stages; the authors stop at 8 because more stages only increase area. It directly determines the frequency and the +8 cycle latency.
  • SEC cost weights = BRAM = 200, DSP = 100 slices
    Taken from [36] (with co-author overlap) and [37]. The ATP ranking and the 2.67x/1.48x claims are sensitive to these weights.
  • Effective BRAM count for PIP-NTT = 2 x 36Kb equivalents
    Table III lists 4 BRAMs of 18Kb, but the SEC calculation uses 2 effective 36Kb units. Counting all 4 as full BRAMs would raise SEC from 1186 to 1586 and change the comparison.
assumptions (5)
  • standard math Cooley-Tukey and Gentleman-Sande butterfly equations (Eqs. 3-6) correctly implement the iterative FNTT and INTT
    The paper takes these equations from [34],[35] and does not re-derive them; they are the mathematical foundation of Algorithm 1.
  • domain assumption Kyber parameters n=256, q=3329, and the precomputed twiddle tables are correct
    All measurements use Kyber parameters; the correctness of zetas_fwd and zetas_inv is assumed from the ML-KEM specification and prior work.
  • ad hoc to paper The pairing, offset-swapping, and reordering scheme of Section IV correctly realizes Algorithm 1 for all 7 stages
    This is the load-bearing premise for the memory-parallelization contribution. The paper provides only an 8-point NTT case study, not a proof or a verification testbench.
  • domain assumption SEC = #BRAMs x 200 + #DSPs x 100 + #Slices is a valid area metric for fair comparison
    The metric comes from [36],[37]; [36] is co-authored by three members of this team. Different cost weights would alter the ATP conclusions.
  • domain assumption Vivado v2023.2 post place-and-route results are accurate and representative
    No synthesis logs, bitstreams, or timestamped reports are provided, so the reported frequencies and resource counts are taken at face value.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PIP-NTT: Towards a Scalable Memory-Parallelized Accelerator for Iterative NTT in PQC." pith.science (2026). https://pith.science/paper/EISPKYGL

@misc{pith2026260718533,
  author       = {Pith},
  title        = {Pith review of: PIP-NTT: Towards a Scalable Memory-Parallelized Accelerator for Iterative NTT in PQC},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EISPKYGL}},
  note         = {Machine review of arXiv:2607.18533}
}
read the original abstract

The iterative forward and inverse number theoretic transform (NTT) is a key component in lattice-based post-quantum cryptography (PQC), typically implemented using Cooley-Tukey and Gentleman-Sande butterfly units. Existing iterative NTT accelerators often rely on ping-pong memory schemes and large memory blocks tied to the cyclotomic ring, which limits overall efficiency. To overcome this, we propose a memory-parallelization strategy using four smaller n/4-sized memories for ring size n, preserving the total memory footprint of conventional designs. We also introduce a multiplication-free rescaling architecture for the inverse NTT. Building on these innovations, we perform a comprehensive hardware-based design space exploration of unified Cooley-Tukey and Gentleman-Sande butterfly units, evaluating both coarse- and fine-grained pipelining strategies. The resulting optimized butterfly unit forms the core of our proposed pipelined and memory-parallelized NTT accelerator, "PIP-NTT". It integrates two such units alongside the memory-parallelization scheme to boost computational throughput under tight area constraints. Experimental results on FPGA platforms show that PIP-NTT achieves 2.67x and 1.48x higher efficiency in average Area-Time Product compared to the most area-optimized and high-speed NTT accelerators in the literature. The design is scalable across butterfly radices and adaptable to other PQC schemes, making it a versatile solution for future cryptographic hardware

Figures

Figures reproduced from arXiv: 2607.18533 by the authors.

Figure 1
Figure 1. Summary of the DSE process. The orange blocks denote the pipeline registers. The light-brown filled boxes show the modular reduction (mod q with q = 3329). operations. These twiddle factors are complex exponential coefficients essential for transforming data between the time and NTT domains. The outputs U and T correspond to the results of Eq. 3, 4, and Eq. 5, 6. For clarity, clock, reset, and control signals (e.g.,… view at source ↗
Figure 2
Figure 2. Overview of the proposed memory parallelization approach. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Case study: example of an 8-point NTT. At stage-3, the [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: PIP-NTT: The proposed pipelined NTT design. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: shows the integrated butterfly and rescaling unit. The left side replicates the 8SP-BU architecture from Fig. 1b, with added pipeline registers after multiplexer m4 and the adder. The right side implements line 23 of Algorithm 1, which performs the rescaling step after…
Figure 6
Figure 6. Figure 6: Data path delay values. TD, RD, and LD represent the [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 4
Figure 4. Figure 4: It receives coefficient pairs from four DP-BRAMs [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 3 canonical work pages

  1. [15]

    HyperNTT: A fast and accurate NTT/INTT accelerator with multi-level pipelining and an improved K2-RED mod- ule,

    D. N. Nguyen, V . D. Tran, H. L. Pham, V . T. Duong Le, D. K. Lam, T. H. Tran, and Y . Nakashima, “HyperNTT: A fast and accurate NTT/INTT accelerator with multi-level pipelining and an improved K2-RED mod- ule,” in2024 International Technical Conference on Circuits/Systems, Computers, and Communications (ITC-CSCC), 2024, pp. 1–6

    2024

  2. [27]

    Reconfigurable and high-efficiency polynomial multiplication accelerator for CRYSTALS-Kyber,

    M. Li, J. Tian, X. Hu, and Z. Wang, “Reconfigurable and high-efficiency polynomial multiplication accelerator for CRYSTALS-Kyber,”IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 42, no. 8, pp. 2540–2551, 2023

    2023

  3. [8]

    Instruction-set accelerated implementation of CRYSTALS-Kyber,

    M. Bisheh-Niasar, R. Azarderakhsh, and M. Mozaffari-Kermani, “Instruction-set accelerated implementation of CRYSTALS-Kyber,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 68, no. 11, pp. 4648–4659, 2021. [Online]. Available: https: //doi.org/10.1109/TCSI.2021.3106639

    arXiv 2021

  4. [11]

    A hardware accelerator for polynomial multiplication operation of CRYSTALS-Kyber PQC scheme,

    F. Yaman, A. C. Mert, E. ¨Ozt¨urk, and E. Savas ¸, “A hardware accelerator for polynomial multiplication operation of CRYSTALS-Kyber PQC scheme,” in2021 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2021, Grenoble, France, pp. 1020–1025. [Online]. Available: https://doi.org/10.23919/DATE51398.2021.9474139

    arXiv 2021

  5. [36]

    Optimized schoolbook polynomial multiplication for compact lattice-based cryptography on FPGA,

    W. Liu, S. Fan, A. Khalid, C. Rafferty, and M. O’Neill, “Optimized schoolbook polynomial multiplication for compact lattice-based cryptography on FPGA,”IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 27, no. 10, pp. 2459–2463, 2019. [Online]. Available: https://doi.org/10.1109/TVLSI.2019.2922999

    arXiv 2019

  6. [16]

    Low latency FPGA implementation of NTT for Kyber,

    M. Saoudi, A. Kermiche, O. H. Benhaddad, N. Guetmi, and B. Allailou, “Low latency FPGA implementation of NTT for Kyber,” Microprocessors and Microsystems, vol. 107, p. 105059, 2024. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S0141933124000541

    2024

  7. [1]

    Hardware circuits and systems design for post-quantum cryptography—a tutorial brief,

    J. Xie, W. Zhao, H. Lee, D. B. Roy, and X. Zhang, “Hardware circuits and systems design for post-quantum cryptography—a tutorial brief,”IEEE Transactions on Circuits and Systems II: Express Briefs, vol. 71, no. 3, pp. 1670–1676, 2024. [Online]. Available: https://doi.org/10.1109/TCSII.2024.3357836

    arXiv 2024

  8. [2]

    QuickAssist Adapter 8920,

    Intel, “QuickAssist Adapter 8920,” Accessed: Aug. 14, 2024. [On- line]. Available: https://www.mouser.com/datasheet/2/612/quickassist adapter 8920 brief-1114775.pdf

    2024

Show all 38 references
  1. [3]

    IBM CEX7S/4769 PCIe cryptographic coprocessor (HSM),

    IBM, “IBM CEX7S/4769 PCIe cryptographic coprocessor (HSM),” Accessed: Aug. 21, 2024. [Online]. Available: https://public.dhe.ibm. com/security/cryptocards/pciecc4/docs/4769 Data Sheet.pdf

    2024

  2. [4]

    Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,

    P. W. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,”SIAM J. Comput., vol. 26, no. 5, p. 1484–1509, 1997. [Online]. Available: https: //doi.org/10.1137/S0097539795293172

    1997 doi

  3. [5]

    High-speed design of post quantum cryptography with optimized hashing and multiplication,

    M. Imran, A. Aikata, S. S. Roy, and S. Pagliarini, “High-speed design of post quantum cryptography with optimized hashing and multiplication,”IEEE Transactions on Circuits and Systems II: Express Briefs, vol. 71, no. 2, pp. 847–851, 2024. [Online]. Available: https://doi.org/1...

    2024

  4. [6]

    Module-lattice-based key-encapsulation mechanism stan- dard,

    FIPS-203, “Module-lattice-based key-encapsulation mechanism stan- dard,” Accessed: Mar. 3, 2025. [Online]. Available: https://doi.org/10. 6028/NIST.FIPS.203

    2025

  5. [7]

    Module-lattice-based digital signature standard,

    FIPS-204, “Module-lattice-based digital signature standard,” Accessed: Mar. 3, 2025. [Online]. Available: https://doi.org/10.6028/NIST.FIPS. 204

    2025 doi

  6. [9]

    CoHA-NTT: A configurable hardware accelerator for NTT-based polynomial multiplication,

    K. Derya, A. C. Mert, E. ¨Ozt¨urk, and E. Savas ¸, “CoHA-NTT: A configurable hardware accelerator for NTT-based polynomial multiplication,”Microprocessors and Microsystems, vol. 89, p. 104451,

  7. [10]

    KaLi: A crystal for post-quantum security using Kyber and Dilithium,

    A. Aikata, A. C. Mert, M. Imran, S. Pagliarini, and S. S. Roy, “KaLi: A crystal for post-quantum security using Kyber and Dilithium,”IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 70, no. 2, pp. 747–758, 2023. [Online]. Available: https://doi.org/10.1109/TCS...

    2023

  8. [12]

    A pure hardware implementation of CRYSTALS-Kyber PQC algorithm through resource reuse,

    Y . Huang, M. Huang, Z. Lei, and J. Wu, “A pure hardware implementation of CRYSTALS-Kyber PQC algorithm through resource reuse,”IEICE Electronics Express, vol. 17, no. 17, pp. 1–6, 2020. [Online]. Available: https://doi.org/10.1587/elex.17.20200234

    2020 doi

  9. [13]

    Towards efficient Kyber on FPGAs: A processor for vector of polynomials,

    Z. Chen, Y . Ma, T. Chen, J. Lin, and J. Jing, “Towards efficient Kyber on FPGAs: A processor for vector of polynomials,” in2020 25th Asia and South Pacific Design Automation Conference (ASP- DAC). IEEE, 2020, Beijing, China, pp. 247–252. [Online]. Available: https://doi.org/1...

    2020

  10. [14]

    A high-speed hardware architecture of an NTT accelerator for CRYSTALS-Kyber,

    J. Sun and X. Bai, “A high-speed hardware architecture of an NTT accelerator for CRYSTALS-Kyber,”Integrated Circuits and Systems, vol. 1, no. 2, pp. 92–102, 2024

    2024

  11. [17]

    Towards efficient hardware implementation of NTT for Kyber on FPGAs,

    C. Zhang, D. Liu, X. Liu, X. Zou, G. Niu, B. Liu, and Q. Jiang, “Towards efficient hardware implementation of NTT for Kyber on FPGAs,” in2021 IEEE International Symposium on Circuits and Systems (ISCAS). IEEE, 2021, Daegu, Korea, pp. 1–5. [Online]. Available: https://doi.org/1...

    2021

  12. [18]

    Efficient, error-resistant NTT architectures for CRYSTALS-Kyber FPGA accelerators,

    S. Khan, A. Khalid, C. Rafferty, Y . A. Shah, M. O’Neill, W. Lee, and S. O. Hwang, “Efficient, error-resistant NTT architectures for CRYSTALS-Kyber FPGA accelerators,” in31st IFIP/IEEE International Conference on Very Large Scale Integration, (VLSI-SoC). IEEE, 2023, Dubai, Uni...

    2023

  13. [19]

    Evaluating NTT/INTT implementation styles for post-quantum cryptography,

    M. Imran, S. Khan, A. Khalid, C. Rafferty, Y . A. Shah, S. Pagliarini, M. Rashid, and M. O’Neill, “Evaluating NTT/INTT implementation styles for post-quantum cryptography,”IEEE Embedded Systems Letters, pp. 1–1, 2024. [Online]. Available: https://doi.org/10.1109/LES.2024. 3410516

    2024 doi

  14. [20]

    Unif-NTT: A unified hardware design of forward and inverse NTT for PQC algorithms,

    A. Yahya Hummdi, A. Aljaedi, Z. Bassfar, S. Shaukat Jamal, M. Mazyad Hazzazi, and M. U. Rehman, “Unif-NTT: A unified hardware design of forward and inverse NTT for PQC algorithms,” IEEE Access, vol. 12, pp. 94 793–94 804, 2024. [Online]. Available: https://doi.org/10.1109/ACCE...

    2024

  15. [21]

    Efficient num- ber theoretic transform accelerator for CRYSTALS-Kyber,

    T. Nguyen, H. Anh, H. Nguyen, T. Hoang, and L. Tran, “Efficient num- ber theoretic transform accelerator for CRYSTALS-Kyber,”Indonesian Journal of Electrical Engineering and Computer Science, vol. 33, no. 2, pp. 795–803, 2024

    2024

  16. [22]

    High-speed NTT accelerator for CRYSTAL-Kyber and CRYSTAL- Dilithium,

    T.-H. Nguyen, B. Kieu-Do-Nguyen, C.-K. Pham, and T.-T. Hoang, “High-speed NTT accelerator for CRYSTAL-Kyber and CRYSTAL- Dilithium,”IEEE Access, vol. 12, pp. 34 918–34 930, 2024

    2024

  17. [23]

    Yet another improvement of plantard arithmetic for faster Kyber on low-end 32-bit IoT devices,

    J. Huang, H. Zhao, J. Zhang, W. Dai, L. Zhou, R. C. C. Cheung, c. K. Koc ¸, and D. Chen, “Yet another improvement of plantard arithmetic for faster Kyber on low-end 32-bit IoT devices,”Trans. Info. For. Sec., vol. 19, p. 3800–3813, feb 2024. [Online]. Available: https://doi.or...

    2024

  18. [24]

    CRYPHTOR: A memory- unified NTT-based hardware accelerator for post-quantum CRYSTALS algorithms,

    S. D. Matteo, I. Sarno, and S. Saponara, “CRYPHTOR: A memory- unified NTT-based hardware accelerator for post-quantum CRYSTALS algorithms,”IEEE Access, vol. 12, pp. 25 501–25 511, 2024

    2024

  19. [25]

    Zero-value filtering for accelerating non- profiled side-channel attack on incomplete NTT-based implementations of lattice-based cryptography,

    T. Tosun and E. Savas, “Zero-value filtering for accelerating non- profiled side-channel attack on incomplete NTT-based implementations of lattice-based cryptography,”IEEE Transactions on Information Foren- sics and Security, vol. 19, pp. 3353–3365, 2024

    2024

  20. [26]

    Split-radix based compact hardware architecture for CRYSTALS-Kyber,

    W. Guo and S. Li, “Split-radix based compact hardware architecture for CRYSTALS-Kyber,”IEEE Transactions on Computers, vol. 73, no. 1, pp. 97–108, 2024

    2024

  21. [28]

    An FPGA-based efficient NTT accelerator for post-quantum cryptography CRYSTALS-Kyber,

    J. Sun, X. Bai, and Y . Kang, “An FPGA-based efficient NTT accelerator for post-quantum cryptography CRYSTALS-Kyber,” in2023 IEEE International Conference on Integrated Circuits, Technologies and Applications (ICTA). IEEE, 2023, Hefei, China, pp. 142–143. [Online]. Available: ...

    2023

  22. [29]

    Towards a lightweight CRYSTALS-Kyber in FPGAs: an Ultra-lightweight BRAM-free NTT core,

    Z. Ni, A. Khalid, W. Liu, and M. O’Neill, “Towards a lightweight CRYSTALS-Kyber in FPGAs: an Ultra-lightweight BRAM-free NTT core,” in2023 IEEE International Symposium on Circuits and Systems (ISCAS), 2023, pp. 1–5

    2023

  23. [30]

    An area-time efficient hardware architec- ture for ML-KEM post-quantum cryptography standard,

    T.-H. Nguyen, T.-K. Dang, D.-T. Dam, K.-D. Nguyen, P.-P. Duong, C.- K. Pham, and T.-T. Hoang, “An area-time efficient hardware architec- ture for ML-KEM post-quantum cryptography standard,”IEEE Access, vol. 13, pp. 103 834–103 847, 2025

    2025

  24. [31]

    Optimized design and implementation of CRYSTALS- Kyber based on MLWE,

    S. Cheng, J. Chen, J. Li, K. Yao, S. Gao, K. Rui, and Y . Cui, “Optimized design and implementation of CRYSTALS- Kyber based on MLWE,”Security and Communication Networks, vol. 2025, no. 1, p. 7884158, 2025. [Online]. Available: https: //onlinelibrary.wiley.com/doi/abs/10.1155/...

    2025

  25. [32]

    Optimization and implementation of the number theoretic transform butterfly unit for large integer multiplication,

    S. Hua, H. Zhang, J. Zhang, and S. Wang, “Optimization and implementation of the number theoretic transform butterfly unit for large integer multiplication,”Journal of Information Security and Applications, vol. 59, p. 102857, 2021. [Online]. Available: https://www.sciencedire...

    2021

  26. [33]

    Pipelined high-throughput NTT architecture for lattice-based cryptography,

    W. Tan, A. Wang, Y . Lao, X. Zhang, and K. K. Parhi, “Pipelined high-throughput NTT architecture for lattice-based cryptography,” in2021 Asian Hardware Oriented Security and Trust Symposium (AsianHOST). IEEE, 2021, Shanghai, China, pp. 1–4. [Online]. Available: https://doi.org...

    2021

  27. [34]

    A complete beginner guide to the number theoretic transform (NTT),

    A. Satriawan, R. Mareta, and H. Lee, “A complete beginner guide to the number theoretic transform (NTT),” Cryptology ePrint Archive, Paper 2024/585, 2024. [Online]. Available: https://eprint.iacr.org/2024/585

    2024

  28. [35]

    Highly efficient architecture of NewHope-NIST on FPGA using low-complexity NTT/INTT,

    N. Zhang, B. Yang, C. Chen, S. Yin, S. Wei, and L. Liu, “Highly efficient architecture of NewHope-NIST on FPGA using low-complexity NTT/INTT,”IACR Transactions on Cryptographic ACCEPTED IN IEEE TRANSACTIONS ON EMERGING TOPICS IN COMPUTING (TETC), 2026. FINAL VERSION WILL APPEA...

    2026 doi

  29. [37]

    Highly-efficient hardware architecture for CRYSTALS-Kyber with a novel conflict-free memory access pattern,

    W. Guo and S. Li, “Highly-efficient hardware architecture for CRYSTALS-Kyber with a novel conflict-free memory access pattern,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 70, no. 11, pp. 4505–4515, 2023. Malik Imranis a Research Fellow at the Centre for ...

    2023

  30. [2022]

    Available: https://doi.org/10.1016/j.micpro.2022.104451

    [Online]. Available: https://doi.org/10.1016/j.micpro.2022.104451

    2022

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.