An Area-Efficient and Configurable Number Theoretic Transform Accelerator for Homomorphic Encryption

Abstract

Homomorphic Encryption (HE) allows for arbitrary computation of encrypted data, offering a method for preserving privacy in cloud computations. However, efficiency remains a significant obstacle, particularly with the polynomial multiplication of large parameter sets, which occupies substantial computing and memory overhead. Prior studies proposed the use of Number Theoretic Transform (NTT) to accelerate polynomial multiplication, which proved efficient, owing to its low computational complexity. However, these efforts primarily focused on NTT designs for small parameter sets, and configurability and memory efficiency were not considered carefully. This paper focuses on designing a unified NTT/Inverse NTT (INTT) architecture with high area efficiency and configurability, which is more suitable for HE schemes. We adopt the Constant-Geometry (CG) NTT algorithm and propose a conflict-free access pattern, demonstrating a 16.7% reduction in coefficients of storage capacity compared to the state-of-the-art CG NTT design. Additionally, we propose a twiddle factor generation strategy to minimize storage for Twiddle Factors (TFs). The proposed architecture offers configurability of both compile time and runtime, allowing for the deployment of varying parallelism and parameter sets during compilation while accommodating a wide range of polynomial degrees and moduli after compilation. Experimental results on the Xilinx FPGA show that our design can achieve higher area efficiency and configurability compared with previous works. Furthermore, we explore the performance difference between precomputed TFs and online-generated TFs for the NTT architecture, aiming to show the importance of online generation-based NTT architecture in HE applications.

1. Introduction

Homomorphic Encryption (HE), enabling the computation of encrypted data, is an optimal privacy-preserving solution for various scenarios, including cloud computing [1] and machine learning [2]. Unlike cryptographic methods [3,4] based on chaos theory, HE relies primarily on algebraic structures such as latticed-based mathematical theories. Over the past few decades, multiple HE schemes based on the Ring Learning With Error (RLWE) problem [5] have been proposed, among which the Brakerski–Gentry–Vaikuntanathan (BGV) scheme [6], Brakerski–Fan–Vercauteren (BFV) scheme [7], and  Cheon–Kim–Kim–Song (CKKS) scheme [8] are popular. Despite the improvements in theoretical cryptography, intensive computing and high storage requirements remain serious, i.e., thousands of times slower on unencrypted data [9] and occupying up to 512 MB of on-chip memory [10], limiting its widespread adoption.

Polynomial multiplication, as a fundamental operation in HE schemes, has become a performance bottleneck for HE applications. Using NTT can reduce the complexity of polynomial multiplication from traditional $\mathcal{O}\left(N^2\right)$ to $\mathcal{O}\left(Nlo{g}_{2}N\right)$, where N is the degree of the polynomial. Consequently, the effective implementation of NTT significantly impacts the performance of HE applications. Unlike low-degree polynomials (ranging from $2^8$ to $2^{12}$) with small moduli (i.e., 24 bit) needed in some traditional post-quantum cryptography schemes [11,12], HE schemes [13,14,15,16] require a higher polynomial degree (ranging from $2^{13}$ to $2^{17}$) and larger moduli (i.e., 1240-bit) to support multiplicative depth. Introducing a Residue Number System (RNS) to HE enables the decomposition of a large modulus into several smaller moduli with varying bit widths (e.g., 54 bit). Therefore, an NTT architecture suitable for RNS-based HE schemes is required to support a set of high-degree polynomials with diverse moduli. This implies that when accelerated in hardware, such an architecture consumes a significant amount of on-chip resources. Consequently, the building of a hardware-efficient NTT architecture for practical applications of HE is in great demand.

Area efficiency and configurability are two key metrics used to evaluate the performance of NTT designs. Area efficiency shows a negative correlation with resource and time costs. Configurability emphasizes both Compile-Time Configurability (CTC) [17] and Run-Time Configurability (RTC) [18]. CTC enables the adjustment of parameter sets at the compilation time to satisfy different schemes with a wide range of parameters. It also means that the computational parallelism of the NTT architecture can be compiled to realize the trade-off between area and speed, RTC corresponds to the ability to support various parameter sets at runtime. 

Existing NTT designs [19,20] for HE parameters tend to employ a large number of Processing Elements (PEs) to achieve high throughput, albeit at the cost of notable resource overhead and low area efficiency. Öztürk et al. [19] introduced an NTT architecture with up to 256 PEs to accelerate the LopezAlt–Tromer–Vaikuntanathan (LTV) scheme, ensuring low latency. However, the proposed architecture stores all TFs for multiple moduli in on-chip memory, leading to high memory overhead, which is challenging for polynomial degrees greater than $2^{15}$ on the target FPGA device. Similarly, Su et al. [20] deployed 168 PEs across 41 RNS channels and stored all TFs for 41 32-bit moduli in internal memory, occupying a significant amount of hardware resources. Consequently, supporting moduli with a larger bit width on the target FPGA device became impossible. Kurniawan et al. [21] reported a memory-based NTT design, presenting remarkable advantages of its low-complexity modular multiplier and optimized memory access pattern. However, it is still unsuitable for RNS-based HE schemes with multiple moduli due to the considerable storage overhead for TFs. To solve this issue, Kim et al. [22] and Duong-Ngoc et al. [23] used the twiddle factor generation strategy to avoid the storage of TFs. Furthermore, they reduced the memory bandwidth requirement during high-computational parallelism by employing the mixed-radix NTT algorithm, enhancing area efficiency. However, flexibility is limited because both designs only aim at the specific RNS-based HE parameter sets. Moreover, the number of PEs was fixed at design time, while the lack of unified data flows between NTT and INTT constrained the architectures’ adaptability.

On the other hand, some recent NTT designs [17,24,25,26,27] with configurability have restrictions on performance and area efficiency. Mert et al. [17] proposed the first NTT hardware generator that takes the desired parameters and the number of PEs as inputs. A multiplier using the word-level Montgomery algorithm could adapt to moduli of diverse bit widths without recompilation. Hu et al. [24] developed an NTT-based high-efficiency polynomial multiplier that permits the reuse of twiddle factors across different polynomial degrees. However, the two designs based on the in-place algorithm suffer from increased access complexity and lower hardware efficiency as PEs increase. To solve this problem, Banerjee et al. [28] proposed the Constant-Geometry (CG) algorithm, which exhibits superior scalability for multiple PEs, benefiting from its consistent memory access structure in each stage. However, the CG algorithm operates out of place, resulting in twice the memory overhead for coefficients compared to the in-place algorithm. Su et al. [25] and Liu et al. [26] optimized the coefficient access pattern, reducing the coefficient storage requirement from $2N$ to $1.5N$, and exploited algorithm-level optimization techniques. However, the memory bandwidth requirement remains high, which hinders its implementation on FPGA. Geng et al. [27] introduced a novel high–low iterative memory access approach to reduce the storage bandwidth required per PE, mitigating storage restrictions. However, it is worth noting that in the mentioned works with configurability, all precomputed constants are stored in the internal memory. Therefore, the memory footprint remains a major obstacle when these NTT designs are embedded into HE schemes.

Consequently, developing a unified NTT/INTT architecture with flexibility while ensuring high area efficiency for HE-based parameters remains challenging. This paper proposes an area-efficient and highly configurable architecture to accelerate CG-based NTT/INTT operations on FPGA. Reducing the storage of coefficients and twiddle factors is the core focus of this study. More specifically, our contributions are summarized as follows:

(1)

We propose a novel memory access pattern based on the CG algorithm, reducing the total coefficient capacity requirement from $1.5N$ to $1.25N$. Moreover, we minimize the required memory bandwidth per PE as much as that of the in-place-based radix-2 algorithm. The reduction in overall capacity and bandwidth significantly mitigates memory demands when compared to prior works.

(2)

We develop a flexible Twiddle Factor Generator (TFG), with a Step Generator (SG) supplying multipliers for the TFG. With this approach, only a few TF bases need to be stored, while the remaining TFs are generated on the fly. Implementation results show a 99.17% reduction of TF storage in our proposed NTT architecture with 32 PEs when the maximum polynomial degree is set to $2^{16}$.

(3)

We present a hardware-efficient and configurable unified architecture to accelerate NTT/INTT without additional modifications. The proposed design not only allows for a balanced design in terms of area and throughput based on the compiled parameters, including the number of PEs, the supported maximum number of polynomial degrees, and the maximum size of polynomial coefficients, but it also supports polynomials with varying degrees and coefficients of different sizes after compilation. In addition, although our architecture is designed for HE parameter sets, it also accommodates small parameter sets without compromising computational complexity.

(4)

We also implement a memory-based NTT/INTT architecture adopting our proposed coefficient access pattern, aiming to fairly compare it with previous NTT designs with all TFs stored in memory. The experimental results demonstrate the improved performance of the proposed memory access pattern. In the end, we conduct another comparison to investigate the performance difference between precomputed TFs and online-generated TFs for the NTT architecture. The results show the importance of the online generation-based NTT architecture in RNS-based HE applications.

The organization of this paper is outlines as follows. Section 2 provides basic knowledge about polynomial multiplication and the CG NTT algorithm. The hardware architecture is detailed in Section 3. In Section 4, the implementation results are analyzed and compared with prior works. Finally, Section 5 concludes this article.

2. Background

2.1. Polynomial Multiplication

Polynomial multiplication defined in a finite domain is considered a fundamental operation in cryptographic algorithms. It is a computational bottleneck when the polynomial degree is high, especially in HE applications. Typically, mathematical operations of polynomials are performed over a quotient ring ($R_q={\mathbb{Z}}_q\left[x\right]/(x^N+1)$, where N is a power of 2 and q is an NTT-friendly prime satisfying the condition of $q\equiv 1mod2N$). The polynomial over $R_q$ has a degree of N, with coefficients constrained to the interval of $[0,q)$. Consider two polynomials ($a\left(x\right)={\sum }_i{a}_i{x}^i$ and $b\left(x\right)={\sum }_i{b}_i{x}^i$), with $c\left(x\right)=a\left(x\right)·b\left(x\right)$ denoting the multiplication result over $R_q$. The traditional computational method requires expensive matrix-vector multiplication, resulting in computational complexity of $\mathcal{O}\left(N^2\right)$. The NTT algorithm is utilized to accelerate the process, with a complexity of $\mathcal{O}\left(Nlo{g}_{2}N\right)$, while still requiring a modulo operation of $(x^N+1)$ in the end. Employing the Negative Wrapped Convolution (NWC) [29] method can circumvent the need for zero-padding and dimension extension by introducing additional preprocessing and post-processing. Accordingly, for determined q and N, we define w and $\psi$ as the N-th and $2N$-th unit primitive roots on ${\mathbb{Z}}_q$, respectively satisfying the relation of ${\psi }^2\equiv wmodq$. The symbol ⊙ signifies element-wise multiplication. Preprocessing operations for $a\left(x\right)$ and $b\left(x\right)$ are outlined in Equation (1) [26] and Equation (2) [26], respectively.

$$\begin{array}{cc}\hfill \tilde{a}\left(x\right)& =a\left(x\right)\odot \{{\psi }^0,{\psi }^1,\cdots ,{\psi }^{N-1}\}\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill \tilde{b}\left(x\right)& =b\left(x\right)\odot \{{\psi }^0,{\psi }^1,\cdots ,{\psi }^{N-1}\}\hfill \end{array}$$

(2)

Then, polynomial multiplication is performed as follows [26]:

$$\tilde{c}\left(x\right)=INTT(NTT\left(\tilde{a}\left(x\right)\right)\odot NTT\left(\tilde{b}\left(x\right)\right))$$

(3)

The final multiplication results over $R_q$ are obtained by executing the post-processing operation for $\tilde{c}\left(x\right)$ as Equation (4) [26].

$$c\left(x\right)=\tilde{c}\left(x\right)\odot \{{\psi }^{-0},{\psi }^{-1},\cdots ,{\psi }^{-(N-1)}\}$$

(4)

2.2. Constant-Geometry NTT/INTT Algorithm

The CG algorithm is an out-of-place NTT algorithm, where access patterns at every stage remain consistent, rendering it suitable for the extension of multi-core array architectures. The CG NTT module utilizes the Cooley–Tukey (CT) algorithm [30], whereas the CG INTT module relies on the Gentleman–Sande (GS) algorithm [31]. The CT algorithm and GS algorithm are two divide-and-conquer strategies for NTT/INTT computation. Additional optimization efforts involve merging preprocessing and post-processing steps [32], along with the incorporation of the $N^{-1}$ operation into each stage of the INTT [25]. Based on the simplified CG algorithm proposed by Su et al. [25], we make some adjustments to make it applicable to scenarios with L PEs, as shown in Algorithms 1 and 2. The BitReverse function reorders elements by reversing the binary representation of their original indices, effectively rearranging the input vector.

Algorithm 1 Constant-Geometry NTT [25]

Require:  $a\left(x\right)$, q, ${\psi }^i$, where $i=0,1,\cdots ,N-1$. Ensure:  $A\left(x\right)=NTT\left(a\right(x\left)\right)$   1: $a\leftarrow BitReverse\left(a\right)$   2: for $s=1$ to $lo{g}_{2}N$ do   3:   for $j=0$ to ${\displaystyle \frac{N}{2L}}-1$ do   4:     for $l=0$ to $L-1$ do   5:       $e=jL+l$   6:       $k={\displaystyle \frac{N}{2^s}}$   7:       $A\left[e\right]=a\left[2e\right]+a[2e+1]·{\psi }^{2\lfloor {\displaystyle \frac{e}{k}}\rfloor ·k+k}modq$   8:       $A[e+{\displaystyle \frac{N}{2}}]=a\left[2e\right]-a[2e+1]·{\psi }^{2\lfloor {\displaystyle \frac{e}{k}}\rfloor ·k+k}modq$   9:       end for   10:   end for   11:   if $s\ne lo{g}_{2}N$ then   12:      $a=A$   13:   end if   14: end for   15: return  $A\left(x\right)$

Algorithm 2 Constant-Geometry INTT [25]

Require:  $A\left(x\right)$, q, ${\psi }^{-i}$, where $i=0,1,\cdots ,N-1$. Ensure:  $a\left(x\right)=INTT\left(A\right(x\left)\right)$   1: for $s=1$ to $lo{g}_{2}N$ do   2:   for $j=0$ to ${\displaystyle \frac{N}{2L}}-1$ do   3:     for $l=0$ to $L-1$ do   4:       $e=jL+l$   5:       $k=2^{s-1}$   6:       $a\left[2e\right]=(A\left[e\right]+A[e+{\displaystyle \frac{N}{2}}])·2^{-1}modq$   7:       $a[2e+1]=(A\left[e\right]-A[e+{\displaystyle \frac{N}{2}}])·{\psi }^{-(2\lfloor {\displaystyle \frac{e}{k}}\rfloor ·k+k)}·2^{-1}modq$   8:     end for   9:   end for   10:   if $s\ne lo{g}_{2}N$ then   11:     $A=a$   12:   end if   13: end for   14: $a\leftarrow BitReverse\left(a\right)$   15: return  $a\left(x\right)$

3. The Proposed Accelerator

3.1. Overall Architecture

The overall architecture of our design is illustrated in Figure 1, consisting of the following three types of components: computing, storage, and control components. The computing components comprise the PE array, TFG array, and SG. Meanwhile, the storage components include the coefficient memory, TF base memory, and step memory. The control unit receives a two-bit working mode signal as input to transition the circuit among the following three states: IDLE, NTT, and INTT. Further elaboration on the specific functionalities of each submodule follows.

(1)

PE array: The PE array is the computational component in this architecture, primarily handling butterfly operations. It consists of L PEs, where the parameter (L) is typically set to a power of two. Each PE executes either NTT or INTT operations on input polynomials, depending on the working state of the architecture.

(2)

Coefficient memory: The coefficient memory stores all polynomial coefficients during calculation. In this design, a total storage capacity of $1.25N$ for coefficients is necessary, which is 16.7% less than the prior CG storage requirement of $1.5N$. The total storage space is divided into $2L$ memory blocks to accommodate the computational bandwidth of the PE array.

(3)

TF base memory: The TF base memory holds TF bases, supplying inputs to the TFG array for the dynamic generation of remaining TFs. The overall storage capacity is contingent upon computational parallelism and the polynomial degree. When $L\ge 2$, $((lo{g}_{2}N+1)\times L/2)\times 2$ storage space is required; otherwise, $lo{g}_{2}N\times 2$ space suffices. The total storage space is divided into $\lceil L/2\rceil$ blocks to meet the computational bandwidth of the TFG array, where the symbol ⌈ represents rounding up.

(4)

Step memory: The step memory stores the inputs and outputs of the SG. The storage capacity is adjusted to match the pipeline of the SG, preventing pipeline stalls caused by mismatched data processing speeds.

(5)

SG: The SG is responsible for cyclically generating steps to supply the TFG array, thereby avoiding the need for expensive step storage.

(6)

TFG array: The TFG array consists of $\lceil L/2\rceil$ twiddle factor generators (TFGs), which take steps and TF bases as inputs and output TFs to the PE array for computations.

(7)

Control unit: The controller provides the correct read address and write address for storage components and coordinates the work of all components.

In this architecture, all memory modules are configured in simple dual-port mode, allowing for external initialization after compilation. Modular Multipliers (MMs) utilize the word-level Montgomery algorithm. With specified iterations and parameterized word size, they can accommodate moduli within a range of bit widths after compilation. The compile parameters of N and $\lceil lo{g}_2{q}_{max}\rceil$ are the maximum supported polynomial degree and the maximum supported modulus bit width, respectively. The compiled circuit can support different polynomial degrees (n; $2L\le n\le N$). Moreover, the architecture realizes the unification of NTT and INTT in the design of all components.

3.2. Unified PE

The proposed PE architecture is shown in Figure 2, consisting of a Modular Adder (MA), Modular Subtractor (MS), Modular Multiplier (MM), Modular Divider (MD), Multiplexers (Muxs), and registers. The inputs are a, b, and c, and the outputs are $Res0$ and $Res1$. The signal $mode$ determines whether the PE performs NTT or INTT. The PE executes the CG NTT operations when $mode=0$. The results are shown as follows [26]:

$$\begin{array}{cc}\hfill Res0& =a+b\times cmodq\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill Res1& =a-b\times cmodq\hfill \end{array}$$

(6)

When $mode$ is set to 1, the PE executes the CG INTT operations. The results are shown as follows [26]:

$$\begin{array}{cc}\hfill Res0& =(a+b)\times {\displaystyle \frac{1}{2}}modq\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill Res1& =(a-b)\times c\times {\displaystyle \frac{1}{2}}modq\hfill \end{array}$$

(8)

In addition, a total of $(2m+4)$ registers are inserted to balance the pipeline latency, where m is the pipeline level of the MM.

The MM applies the word-level Montgomery algorithm proposed in [33] as shown in Algorithm 3. It utilizes the equivalent expression of an NTT-friendly prime ($q=q_H\times 2^W+1$) to decompose the modular reduction operation into smaller steps. The compiled parameter (W) is usually set to $lo{g}_{2}2N$, denoting the word size. The iteration number of the “for” loop is represented by the parameter (T), where $T=\lceil lo{g}_2{q}_{max}/W\rceil$. This means splitting large-bit-width modulo reduction steps into T iterations of smaller-bit-width modular operations; therefore, fewer Digital Signal Processing (DSP) resources are needed. After compilation, the supported modulus bit width (K) is configurable at runtime within the range of $(W,\lceil lo{g}_2{q}_{max}\rceil ]$, while the traditional Barrett modular reduction algorithm [34] only supports a fixed-modulus bit width of $K=\lceil lo{g}_2{q}_{max}\rceil$ after compilation and lacks runtime configurability. For $n<N$, setting W to $lo{g}_{2}2N$ restricts the range of q for dimension n. Hence, W should be small enough to accommodate a wide range of n, yet this entails more iterations for specific $\lceil lo{g}_2{q}_{max}\rceil$. Therefore, W and T should be carefully selected to obtain the optimal trade-off between generality and complexity. In our work, we set T to 4, and W can be compiled as $\{15,16,17\}$ to match the common HE-based parameter set at $(N=2^{16},K=60)$ [23]. It is important to note that the constraint on q varies with $n<N$. Specifically, as n decreases, the range of values for q shrinks compared to the initially supported range, while it remains unchanged as n increases. For example, when $N=2^{16}$ and $W=17$, for $n=2^{15}$ or $n=2^{14}$, q theoretically only needs to satisfy the expression of NTT-friendly primes ($q=q_H\times 2^{16}+1$ or $q=q_H\times 2^{15}+1$). However, the compiled parameter (W) determines that q must adhere to the condition of $q=q_H\times 2^{17}+1$, thereby imposing a constraint on q. Even so, compared to previous work [22,23], which utilized specialized forms of modulus to reduce complexity, the proposed MM is more general for HE applications.

Algorithm 3 Word-level Montgomery Modular Multiplication [33]

Require:  $A,B,q=q_H·2^W+1$ (three K-bit positive integers, $W<K\le \lceil lo{g}_2{q}_{max}\rceil$) Ensure:  $A·B/Rmodq$, where $R=2^{4\times W}modq$   1: $X=A·B$   2: for $i=0$ to 3 do   3:   $X_H=X>>W$   4:   $X_L=Xmod{2}^W$   5:   $X_{LN}=-X_{L}mod{2}^W$ //2’s Complement of $X_L$   6:   $CIN=X_{LN}[W-1]|X_L[W-1]$   7:   $X=X_H+CIN+q_H·X_{LN}$   8: end for   9: $Y=X-q$   10: if  $(Y<0)$then   11:   $Z=X$   12: else   13:   $Z=Y$   14: end if 15: return Z

Modular division can be viewed as an inverse element multiplier. For $x/2modq$, it can be implemented using a shifter, adder, and multiplexers without multipliers. Similar to prior works [25,26], MD is designed based on Equation (9).

$${\displaystyle \frac{x}{2}}modq=\left\{\begin{array}{cc}(x\gg 1),\hfill & \mathrm{if}x\mathrm{is}\mathrm{even};\hfill \\ (x\gg 1)+{\displaystyle \frac{q+1}{2}},\hfill & \mathrm{if}x\mathrm{is}\mathrm{odd}.\hfill \end{array}\right.$$

(9)

3.3. Coefficient Memory Access Pattern

The storage overhead for coefficients on FPGA mainly depends on the following two factors: the total storage capacity and the number of required memory blocks per PE. This paper proposes a novel coefficient memory access pattern based on the CG algorithm, effectively reducing the storage demand from $1.5N$ to $1.25N$ (where N is the polynomial degree). At the same time, each PE necessitates just two memory blocks. In prior CG-based NTT studies [25,26,27], a storage capacity of $2N$ or $1.5N$ was typically allocated for coefficient storage. Su et al.’s work [25] and Liu et al.’s work [26] required 12 and 4 memory blocks per PE, respectively. Although Geng et al.’s work [27] required just two memory blocks per PE, their total storage requirement remained at $2N$. In contrast, our design minimizes the total storage capacity and bandwidth, leading to a notable decrease in Block Random Access Memory (BRAM) resource usage.

The proposed coefficient storage arrangement comprises $2L$ memory blocks to match the computational needs of L PEs. Assuming that N original coefficients are cyclically distributed across $2L$ memory blocks, the coefficient pairs ($a\left[e\right]$, $a[e+N/2]$) occupy the same block, hindering the simultaneous retrieval of both source data during INTT. Consequently, we reorganize coefficients $a[N/2]\sim a[N-1]$ in reverse order within $2L$ memory blocks, while coefficients $a\left[0\right]\sim a[N/2-1]$ are still stored sequentially. This strategy effectively segregates $a\left[e\right]$ and $a[e+N/2]$ into distinct blocks. Moreover, it is important to acknowledge that this arrangement necessitates at least $0.5N$ of additional space to ensure sufficient time for data retrieval before updates. To minimize the extra storage requirement, we further refine the layout, grouping coefficients in sets of $N/4$.

The improved coefficient arrangement is depicted in Figure 3, in which each block has a depth of $1.25N/2L$. Within each block, $N/2L$ of space is designated for storage of the original coefficients, while the remaining $N/8L$ of space is allocated for newly generated data. To facilitate explanation, we divide $2L$ blocks into five regions from top to bottom, labeled as Regions 1∼5. The arrangement of the original coefficients proceeds as follows:

• $a\left[0\right]\sim a[N/4-1]$ are placed in Region 1 sequentially;
• $a[N/4]\sim a[N/2-1]$ are placed in Region 3 sequentially;
• $a[N/2]\sim a[3N/4-1]$ are stored in reverse order at the block level, filling up Region 2;
• $a[3N/4]\sim a[N-1]$ are stored in reverse order at the block level, filling up Region 4.

More details are provided below for the loading and storing patterns of data during NTT. As shown in Algorithm 1, during the j-th iteration, coefficient pairs $\left(a\right[2(jL+l)],$$a\left[2\right(jL+l)+1])$ are loaded from blocks and transmitted to PE${\hspace{0.17em}}_l$ for computation. Then, the updated results $\left(A\right[jL+l],A[jL+l+N/2\left]\right)$ are stored in blocks. The l parameter ranges from 0 to $L-1$, indicating a total of $2L$ data being simultaneously read and stored in each computation cycle of the NTT. In the following, we describe the two initial executions of PEs in stage 1 in detail.

• At the first step in stage 1, i.e., $j=0$, PE${\hspace{0.17em}}_l$ retrieves $a\left[2l\right]$ from Block $2l$ and $a[2l+1]$ from Block $2l+1$ to execute butterfly computation. The result ($A\left[l\right]$) is stored in the first available slot in Block l, and another result ($A[N/2+l]$) is stored in the first row of Block $2L-1-l$. When L PEs operate simultaneously, coefficients in the first row of Region 1 are loaded simultaneously. $2L$ results are stored in the first vacant position of Block $0\sim L-1$ in Region 5 and the first row of Block $L\sim 2L-1$ in Region 1 (the original coefficients in the first row of Block $L\sim 2L-1$ are utilized).
• At the second step in stage 1, i.e., $j=1$, PE${\hspace{0.17em}}_l$ fetches $a\left[2\right(L+l\left)\right]$ from Block $2l$ and $a\left[2\right(L+l)+1]$ from Block $2l+1$. The output ($A[L+l]$) is stored in the first available position in Block $L+l$, and $A[L+l+N/2]$ is stored in the first row of Block $L-1-l$. When L PEs work simultaneously, coefficients in the second row of Region 1 are loaded, and the computed results are stored separately in the first vacant positions of Block $L\sim 2L-1$ in Region 5 and the first row of Block $0\sim L-1$ in Region 1 (the original coefficients in the first row of Block $0\sim L-1$ are utilized).

In the next steps of stage 1, the coefficients are loaded and stored according to the above steps. After $N/4L$ clock cycles, $a\left[0\right]\sim a[N/2-1]$ from Regions 1 and 3 are read. The newly generated $N/2$ data fill Regions 5 and 1. PEs then handle the data from Regions 2 and 4, with the results filling in Regions 2 and 3. Upon computing stage 1, Region 4 becomes available for storage in stage 2. The described operations are replicated in successive stages. After each stage’s execution, the remaining space is utilized for storage in the next stage. Subsequently, the coefficient storage arrangement reverts to its initial state at stage 6.

For a more detailed depiction of the coefficient storage access pattern, let us derive the process for a 16-point NTT employing two PEs. The load and stored data flow are illustrated in Figure 4. It is assumed that one clock cycle is required from data retrieval to the completion of computation. The left–right direction represents the progression of clock cycles within a stage. Blue denotes the read data to be transmitted to PEs, and green denotes the newly generated data to be written into memory in that cycle.

The coefficient access logic for INTT is the reverse of that used in NTT. For example, in the first step of stage 1, L PEs read coefficients $A\left[0\right]\sim A[L-1]$ from Region 1 and $A[N/2]\sim A[L-1+N/2]$ from Region 2. The newly generated data ($a\left[0\right]\sim a[2L-1]$) are written into the first row in Region 5. Subsequent steps follow a similar pattern, which is not repeated here.

It is worth noting that the preceding description is rooted in the compilation parameter (N), but the memory access structure specifically supports polynomials of n degree, which is much smaller than N. In this scenario, only the initial $5n/8L$ of space of each block is accessed, leaving the remaining $5N/8L-5n/8L$ of space unused. Moreover, our design allows for external access to arbitrary addresses in all memory blocks, enabling users to dynamically update coefficients of n-dimensional polynomials in memory blocks post compilation. This feature ensures the proposed memory access pattern with runtime configurability.

3.4. Read-after-Write Conflict Analysis

Due to the delay in accessing RAM and PE computation, data from a particular address may be needed by the next stage before it is updated by the computation of the current stage, leading to access conflict. The critical point of conflict lies in the simultaneous reading and updating of data in two consecutive stages, known as a read-after-write conflict. The following conflict analysis process refers to Geng et al.’s work [27].

We define d as the total number of clock cycles, involving the latency of RAM access and the pipeline levels of PE. Figure 5 illustrates the occurrence of conflict when $N=16$, $L=2$, and $d=2$. The notation “cycle#x” indicates the x-th clock cycle starting from the NTT computation. Cycle#0 and cycle#2 are the first read and first write cycles of stage 1, respectively. If the coefficient access operations between stages are contiguous, then at cycle#5, coefficients indexed as 6 and 7 are to be read in stage 2, while both are also updated with results from stage 1, resulting in conflict. We can observe that conflicts always arise during the final write-back operation in every stage.

In general, each stage spans $N/2L$ cycles for the retrieval of N coefficients. Coefficients with indices ranging from $N/2-L$ to $N/2-1$ are written in the final cycle of the current stage’s operation and read in the #$(N/4L-1)$-th cycle of the next stage. If $N/2L-1+d=N/2L+N/4L-1$, then coefficients with indices of $N/2-L$ to $N/2-1$ are written and read at the same time. Therefore, the condition of $N/2L-1+d<N/4L+N/2L-1$ is necessary to prevent such conflicts. The simplified condition of $L<N/4d$ indicates that the maximum level of parallelism (L) is decided by the polynomial degree (N) and the delay (d), thereby constraining the architectural flexibility. Furthermore, inserting idle periods between stages decelerates the read operation at the next stage; therefore, there are sufficient cycles to update coefficients within the current stage, effectively avoiding conflict.

Assuming that the number of inserted idle cycles is g, the next stage waits for the additional g cycles to start reading after the current stage completes reading. Therefore, we have

$${\displaystyle \frac{N}{2L}}-1+d<{\displaystyle \frac{N}{2L}}+{\displaystyle \frac{N}{4L}}-1+g$$

(10)

The minimum number of inserted idle cycles ($g_{min}$) is expressed as follows:

$$g_{min}=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}L<{\displaystyle \frac{N}{4d}},\hfill \\ d+1-{\displaystyle \frac{N}{4L}},\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(11)

The NTT operation takes an additional $g_{min}\times (lo{g}_{2}N-1)$ clock cycles, in total, to avoid conflict. In the end, through the strategic insertion of idle cycles between stages, we achieve a conflict-free memory access architecture.

3.5. TF Generation Strategy

The TF online generation strategy can be classified into two categories, i.e., data-dependent and data-independent, based on whether the generated TFs are utilized in the next generation. We take Figure 6 as an example to illustrate the difference between these generation methods. In Figure 6a,b, the required TFs for each stage are listed according to Algorithm 1. Columns 2 and 3 represent the factors allocated to two PEs, and column 4 indicates the frequency of repeated reading by PEs for each row’s factors. For example, in stage 1, ${\psi }^8$ is used by PEs and lasts for four clock cycles.

For the case of data dependence, TFs labeled in black are obtained through the modular multiplication of TFs generated in the preceding operation and the corresponding step labeled in red. Therefore, the pre-stored constants include the TF bases marked in blue and the steps marked in red. Considering that MMs usually take several cycles to perform calculations, it is necessary to cache more TF bases for each stage to avoid pauses of the MM. The total number of stored TF bases is directly proportional to the pipeline levels of the MM. Kim et al. [22] and Duong-Ngoc et al. [23] employed this method to generate TFs on the fly. In the scenario of data independence, the update of TFs relies on TF bases (labeled in blue) and steps, as depicted in Figure 6b. The total number of pre-stored TF bases is determined by compilation parameters (N and L), regardless of the pipeline levels in the MM. However, the varying steps within a stage pose a new challenge in terms of storage. In this paper, we focus on the data-independent TF generation strategy and propose a step generation method to avoid storing steps.

3.5.1. Step Generation

As shown in Algorithm 1, L PEs must execute $N/2L$ iterations to complete coefficient transformation for one stage. For a new stage, assume that the j-th parallel execution of L PEs occurs in cycle#j. Then, according to line 7 in Algorithm 1, the required TFs for PEs are {${\psi }^{2\lfloor {\displaystyle \frac{l}{k}}\rfloor ·k+k}|l\in [0,L-1]$} at cycle#0 and {${\psi }^{2\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor ·k+k}|l\in [0,L-1]$} at cycle#j, where l represents the index of PE. So, for PE${\hspace{0.17em}}_l$, the required step is computed as follows:

$${\displaystyle \frac{{\psi }^{2\lfloor \frac{jL+l}{k}\rfloor ·k+k}}{{\psi }^{2\lfloor \frac{l}{k}\rfloor ·k+k}}}={\psi }^{2k(\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor -\lfloor {\displaystyle \frac{l}{k}}\rfloor )}$$

(12)

We can represent $jL+l$ and l in binary form as Equation (13) and Equation (14), respectively.

$$\begin{array}{cc}\hfill {(jL+l)}_2& =\{j_{(lo{g}_2{\displaystyle \frac{N}{2L}}-1)},\cdots ,j_0,l_{(lo{g}_{2}L-1)},\cdots ,l_0\}\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill {\left(l\right)}_2& =\{l_{(lo{g}_{2}L-1)},\cdots ,l_0\}\hfill \end{array}$$

(14)

Since k is a power of 2, when $lo{g}_{2}k<lo{g}_{2}L$, $\lfloor {\displaystyle \frac{l}{k}}\rfloor$ is equivalent to the right shifting of l by $lo{g}_{2}k$ bits. Similarly, the derivations for $\lfloor {\displaystyle \frac{jL}{k}}\rfloor$ and $\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor$ follow a similar pattern as follows:

$$\begin{array}{cc}\hfill {\lfloor {\displaystyle \frac{l}{k}}\rfloor }_2& =\{l_{(lo{g}_{2}L-1)},\cdots ,l_{lo{g}_{2}k}\}\hfill \end{array}$$

(15)

$$\begin{array}{cc}\hfill {\lfloor {\displaystyle \frac{jL}{k}}\rfloor }_2& =\{j_{(lo{g}_2{\displaystyle \frac{N}{2L}}-1)},\cdots ,j_0,\underset{(lo{g}_{2}L-lo{g}_{2}k)-\mathrm{bit}}{\underbrace{0,\cdots ,0}}\}\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill {\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor }_2& =\{j_{(lo{g}_2{\displaystyle \frac{N}{2L}}-1)},\cdots ,j_0,l_{(lo{g}_{2}L-1)},\cdots ,l_{lo{g}_{2}k}\}\hfill \end{array}$$

(17)

Hence, the following formula is valid.

$$\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor =\lfloor {\displaystyle \frac{jL}{k}}\rfloor +\lfloor {\displaystyle \frac{l}{k}}\rfloor$$

(18)

When $lo{g}_{2}k\ge lo{g}_{2}L$, the proof of Equation (18) follows a similar trend. At cycle#j, the required step sequence is

$${\psi }^{2k(\lfloor {\displaystyle \frac{jL+l}{k}}\rfloor -\lfloor {\displaystyle \frac{l}{k}}\rfloor )}={\psi }^{2k\lfloor {\displaystyle \frac{jL}{k}}\rfloor }$$

(19)

It can be observed that ${\psi }^{2k\lfloor {\displaystyle \frac{jL}{k}}\rfloor }$ is independent of l, indicating that the L TFGs use the same step to generate TFs for cycle#j. When $k=1$, i.e., in the final stage, the required step sequence follows the pattern of $\left\{{\psi }^{2jL}\right|j\in [0,N/2L)\}$. For other stages, the steps only update to ${\psi }^{2jL}$ at cycle#$(tk/L)$ (where t is an integer) while maintaining consistency with the previous cycle. In general, based on the derivation presented above, we can draw the following three conclusions:

• The shared step across L TFGs for generating the TFs of the next cycle suggests that only one step generator needs to be designed to provide steps for L TFGs.
• The total number of unique steps is $N/2L$ because the steps required for the final stage can be reused by the remaining stages.
• For the specified stage (s), the required unique steps ($\left\{{\psi }^{2jL}\right|j=tk/L,t\in Z\}$) are solely determined by j, implying that the step generation logic can be uniform across all stages.

The proposed step generator is an MM with two inputs, aiming to provide steps for L TFGs. To generate the unique step sequence $\left\{{\psi }^{2jL}\right|j\in [0,N/2L)\}$ in a pipelined manner, M steps must be pre-stored in the step memory, where M is the total number of cycles involving the delay of the MM and an extra cycle. The steps in the step memory are continuously refreshed as the clock cycle increments, as shown in Figure 7. At cycle#0 of stage 1, the SG fetches the first step from address 0 and the constant ${\psi }^{2ML}$ to generate the result (${\psi }^{2ML}$) at cycle#$(M-1)$. The result is written to the same address at the same time. Similarly, the second result of the SG is written to the second address of the step memory at cycle#M. Once the SG handles M pre-stored steps sequentially, it circles back to fetch the step from address 0 as the input at cycle#M. Continuing along the same lines, in the last cycle, we obtain the ultimate unique step (${\psi }^{N-2L}$), which also means that the complete set of steps ($\{{\psi }^0,{\psi }^{2L},\cdots ,{\psi }^{N-2L}\}$) is generated within the previous $N/2L$ cycles. It is worth noting that the constant should be adjusted to ${\psi }^{N+2ML}$ at cycle#$(N/2L-M)$, aiming to replicate the generation of the same step sequence in the next stage. For L TFGs, at the #$(tk/L)$-th cycle of each stage, the required step is retrieved from the step memory to contribute to the generation of new TFs.

For better comprehension, we provide the timeline of the SG when $N=16$, $L=2$, and $M=2$, as shown in Figure 8. The data with blue background represent the steps pre-stored in the step memory. At cycle#0 of stage 1, the SG reads the step (${\psi }^0$) located at address 0 and the constant (${\psi }^8$) for modular multiplication. The result (${\psi }^8$) is written to the same address at cycle#1. In the same cycle, the SG reads the step (${\psi }^4$) located at address 1 for a new calculation. The result (${\psi }^{12}$) is stored at the same address at cycle#2. In the same cycle, the SG fetches the updated step (${\psi }^8$) from address 0 and the second constant (${\psi }^{24}$) to generate ${\psi }^0$ for the next stage. Similarly, at cycle#3, the SG fetches the updated step (${\psi }^{12}$) from address 1 to produce the next step. The steps masked in red represent steps that need to be transmitted to TFGs, occurring at cycle#$(tk/L)$, where t is an integer.

In conclusion, the proposed step generator reduces the total step storage from $N/2L$ down to M and supports INTT mode through the dynamic modification of two constants and the step memory.

3.5.2. TF Generation

The TFGs take the step from the step memory and the TF bases from the TF base memory as inputs to generate the remaining TFs for PEs. This means that the number of TFGs and PEs should be equal to maximize the computational capacity, leading to a doubling of computational resource overhead. Therefore, we conduct optimization to reduce the number of TFGs to $\lceil L/2\rceil$ at the cost of several additional clock cycles. The optimization strategy is not applied when one PE and one TFG exist. When $L\ge 2$, we can observe that, except for the final stage, at least two TFGs generate the same TF in the same cycle. Consequently, halving the total number of TFGs only slows down the operational efficiency of the last stage, requiring an extra $N/2L$ cycles to generate TFs for the final stage. But it proves to be cost-effective, reducing the total computational resources by approximately 25%.

The proposed architecture for online TF generation, as illustrated in Figure 9, comprises one SG, $\lceil L/2\rceil$ TFGs, the TF base memory, and step memory. The total capacity of the TF base memory is, at most, $(lo{g}_{2}N+1)\lceil L/2\rceil \times 2$ for one modulus, where the multiplication by 2 is due to the difference between TF bases in NTT and INTT. The total capacity of the step memory is M. Despite the expense of including additional $N/2L$ clock cycles, it significantly diminishes the storage demands for TFs and steps, achieving enhanced area efficiency.

4. Evaluation

4.1. Experimental Environment and Methodology

We implement the proposed NTT architecture with the 2021.1 Xilinx Vivado tools. To ensure a fair comparison, the design is placed and routed on different FPGA platforms, in accordance with previous works. We conduct a thorough presentation and comparative analysis of the performance of the proposed accelerator in the following sections.

In Section 4.2, we present some details about our architecture, including resource, latency, and evaluation metrics. Subsequently, our comparison and analysis are divided into three subsections. In Section 4.3, we conduct a detailed comparison with existing works designed for HE parameters. In Section 4.4, utilizing the coefficient memory access pattern proposed in this paper, we develop a memory-based NTT/INTT architecture that stores all TFs on chip, enabling a fair comparison with works optimized for small parameter sets. Finally, in Section 4.5, we explore the area efficiency of memory-based and online generation-based NTT architectures under RNS-based HE parameter sets.

4.2. Experimental Results

First,

Table 1. Resource breakdown of architecture with the compilation parameter set ($N=2^{16}$, $L=32$, and $\lceil lo{g}_2{q}_{max}\rceil$ = 60) on a Zynq Ultrascale+ ZCU102 board.

Module	LUT (%)	FF (%)	DSP (%)	BRAM (%)
Controller	6210	113	0	0
Coef Mem	4032	128	0	192
TF base Mem	0	0	0	16
Step Mem	166	0	0	0
PE Array	51,168	75,136	576	0
⌊ PE	1599	2348	18	0
⌊ MM	690	1388	18	0
TFG Array	9008	22,784	288	0
⌊ TFG	563	1424	18	0
SG	626	1346	18	0
Total	71,210 (26.0)	99,507 (18.15)	882 (35)	208 (22.8)

shows the hardware resource breakdown of our NTT architecture under the compilation parameter set ($N=2^{16}$, $L=32$, and $\lceil lo{g}_2{q}_{max}\rceil$ = 60). We primarily focus on the BRAM and DSP overhead. In our design, each MM employs 18 DSP slices, and the PE array consumes 576 ($=18\times 32$) DSP slices for 32 MMs. Moreover, the TFG array consumes 288 ($=18\times 16$) DSP slices for 16 MMs. We including an additional MM to construct the SG, resulting in a total of 882 ($=576+288+18$) DSP slices. Coefficient storage consumes $2L$ coefficient memory blocks with a depth of $5N/8L$, while TF base storage consumes $\lceil L/2\rceil$ memory blocks with a depth of, at most, $(lo{g}_{2}N+1)\times 2$ for one modulus. The step memory is implemented using Look-Up Table (LUT) resources, thereby avoiding the consumption of any BRAM. All BRAMs are configured in simple dual-port mode, with a total of 208 BRAMs used (i.e., 192 BRAMs for coefficients and 16 BRAMs for TF bases). Furthermore, to illustrate the reduction in storage capacity,

Table 2. The total storage capacity required for the NTT/INTT design.

Item	Coefficients			TF Bases
	[26]	Ours	Reduction	[23]	Ours	Reduction
Capacity	98,304	81,920	16.7%	24,000	17,408	27.5%

compares the coefficient storage overhead with the state-of-the-art CG NTT design [26] for $N=2^{16}$. It also compares the total number of pre-stored TF bases for 32 RNS moduli with the design proposed in [23], which also optimizes the TF generator. The results indicate that our architecture reduces memory overhead for both coefficients and TFs in CG-based NTT designs.

Secondly, for the timing information, the coefficient conversion across $lo{g}_{2}N$ stages requires $lo{g}_{2}N\times N/2L$ Clock Cycles (CCs). Moreover, when $L\ge 2$, optimization of the TF generation strategy introduces an extra $N/2L$ cycle. To avoid access conflict, a minimum of $g_{min}$ idle cycles are inserted between stages, allowing adequate time for the previous stage’s results to be written back. Finally, considering the delay of the SG denoted by M and that of the PE denoted by d, the total CCs and latency of NTT/INTT operations are as depicted in Equations (20) and (21) [23], where $f_{max}$ represents the maximal clock frequency achievable on the target FPGA platform.

$$\mathrm{CCs}=\left\{\begin{array}{c}\mathrm{if}L>1,\hfill \\ (lo{g}_{2}N+1)\times {\displaystyle \frac{N}{2L}}+M+d+g_{min}\times (lo{g}_{2}N-1)\hfill \\ \\ \mathrm{otherwise},\hfill \\ lo{g}_{2}N\times {\displaystyle \frac{N}{2}}+M+d+g_{min}\times (lo{g}_{2}N-1)\hfill \end{array}\right.$$

(20)

$$\mathrm{Latency}\left(\mathrm{us}\right)={\displaystyle \frac{\mathrm{CCs}}{f_{max}\left(\mathrm{MHz}\right)}}$$

(21)

The data throughput can be measured as the maximum number of data bits processed by the NTT/INTT module per second, as depicted in Equation (22) [23].

$$\mathrm{Throughput}\left(\mathrm{Mbps}\right)={\displaystyle \frac{\mathrm{Number}\mathrm{of}\mathrm{bits}}{\mathrm{Latency}\left(\mathrm{us}\right)}}$$

(22)

Moreover, when the proposed architecture is extended to support p moduli, the data movement overhead of multiple polynomials with diverse moduli is not considered, similar to prior works [20,23]. Therefore, the total number of CCs and the maximal number of data bits supported by the architecture increase by a factor of p.

Finally, a larger number of PEs results in shorter latency and higher throughput but requires more resources. Therefore, comparing only the resource usage or throughput is one-sided. For a configurable architecture, area efficiency is a more comprehensive and fair performance evaluation standard. Commonly used metrics for quantifying area efficiency include “Area × Time” Products (ATP) [35] and “Throughput Per Slice” (TPS) [36], which differ in how they equate area. Lower ATP and higher TPS indicate better area efficiency. In our comparison, we calculate both metrics, considering the diversity of platforms and resources.

4.3. Comparison to Works Considering HE Parameters

In this part, our NTT performance results are compared with those reported in related works [19,20,21,22,23], as shown in

Table 3. Our implementation results and comparison with prior works considering HE parameter sets. The bold text indicates better results.

Work	Platform ${\hspace{0.17em}}^{\mathit{d}}$	N ${\hspace{0.17em}}^{\mathit{b}}$	q ${\hspace{0.17em}}^{\mathit{b}}$	p	Timing		Resource				Efficiency Indicators		Configurability ${\hspace{0.17em}}^{\mathit{c}}$
					Freq (MHz)	Latency (us)	LUT	FF	DSP	BRAM	ATP ${\hspace{0.17em}}^{\mathit{a},\mathit{r}}$/1000	TPS ${\hspace{0.17em}}^{\mathit{t},\mathit{r}}$	CTC	RTC
[19] ${\hspace{0.17em}}^{g,†}$	V690	15	32	41	250	2086.9	219.2k	90.8k	768	193	978.5k	0.08	✗	✗
[22] ${\hspace{0.17em}}^s$	VU190	17	62	42	200	3760	365k	335k	1.3k	2.3k	4420.3k	0.19	✗	✗
[20] ${\hspace{0.17em}}^{g,†}$	V1140	15	32	41	250	245.8	194.1k	153.1k	1.7k	1.8k	218.7k	0.26	✓	✗
[23] ${\hspace{0.17em}}^s$	ZU102	16	60	32	200	2684.2	148.5k	90.9k	564	137	660.4k	0.59	✗	✗
[21] ${\hspace{0.17em}}^s$	VU37	16	60	1	250	66.5	74.5k	61.4k	288	315	13.2k	0.92	✗	✓
Our ${\hspace{0.17em}}^{g,†}$	V690 ${\hspace{0.17em}}^1$	15	32	41	240	1405.3	35.6k	51.2k	392	88	142.3k (14.54%)	0.41 (5.17×)	✓	✓
	VU190 ${\hspace{0.17em}}^1$	17	62	42	145	10,687.7	75.4k	105.8k	1.4k	368	3452.4k (78.1%)	0.25 (1.28×)
	V1140 ${\hspace{0.17em}}^2$	15	32	41	164	520.5	130.1k	201.6k	1.5k	224	183.3k (83.83%)	0.31 (1.20×)
	ZU102 ${\hspace{0.17em}}^1$	16	60	32	285	1958.4	71.2k	99.5k	882	240	453.2k (68.62%)	0.73 (1.25×)
	VU37 ${\hspace{0.17em}}^1$	16	60	1	295	59.1	72.7k	99.6k	882	208	13.2k (100%)	0.79 (0.86×)

${\hspace{0.17em}}^d$: V690: Virtex-7 XC7VX690T; VU190: Virtex Ultrascale XCVU190; V1140: Virtex-7 XC7VX1140T; ZU102: Zynq Ultrascale+ ZCU102; VU37: Virtex Ultrascale+ XCVU37P; ${\hspace{0.17em}}^b$: the bit width of the N or q parameter; ${\hspace{0.17em}}^a$: ATP = Equ. LUT × latency, in which, Equ. LUT = (LUT + 100 × DSP + 300 × BRAM) [35]; ${\hspace{0.17em}}^t$: TPS = Throughput (Mbps) /Equ. slice, in which, for 7 series, Equ. slice ≈ (LUT/4 + FF/8) × 0.97 + 102.4 × DSP + 232.4 × BRAM; for ultrascale series, Equ. slice ≈ (LUT/8 + LUT/16) × 0.97 + 51.2 × DSP + 116.2 × BRAM [36,37]; ${\hspace{0.17em}}^r$: the ratio calculated by dividing our ATP or TPS by the ATP or TPS of other works; ${\hspace{0.17em}}^c$: the symbol ✗ indicates no support for the corresponding configurability, while ✓ indicates support; ${\hspace{0.17em}}^g$: general modulus; ${\hspace{0.17em}}^s$: specific form of modulus; ${\hspace{0.17em}}^1$: 32 PEs; ${\hspace{0.17em}}^2$: 128 PEs; ${\hspace{0.17em}}^{†}$: the unified architecture supporting NTT and INTT.

. Our design offers the highest level of configurability while achieving optimal area efficiency, with lower ATP and higher TPS compared to other works, except for [21].

Öztürk et al. [19] reported a block-level NTT architecture for partial HE schemes. Large amounts of on-chip memory and multipliers are utilized for TF storage and computation, respectively, leading to inefficient hardware utilization. Compared with the design proposed in [19], our design achieves higher throughput, with 5.17× higher TPS values, and the ATP decreases by 85.46%. The architecture proposed in [22] enables a full pipeline by deploying many PEs in series. However, this comes at the cost of high memory capacity and bandwidth expenses due to the presence of five intermediate buffers for coefficient reordering, which is impractical for memory-bound homomorphic evaluations. In contrast, our proposed coefficient access strategy significantly reduces memory overhead. Specifically, when performing a $2^{17}$-point NTT operation with a modulus bit width of 62, their architecture requires at least 10,080 KB of memory resources for coefficients, while ours only requires 1440 KB. In all, our design considers optimal hardware efficiency through configurable parallelism, and Table 3 shows that the proposed NTT architecture outperforms that proposed in [22] in terms of both performance metrics. Su et al. [20] proposed a multi-channel and multi-PE architecture based on the CG algorithm. Their design requires 1.49× more LUTs than ours, achieving 2× higher throughput. However, due to our optimized memory access pattern and TF generation strategy, our design decreases BRAM resources by 7.85×. The results in terms of ATP and TPS indicate that our design has a higher area efficiency. In comparison with the design proposed in [23], our architecture decreases ATP by 31.38% and obtains 1.25× higher TPS. Due to the advantage of the carefully designed pipelined architecture of PE, our NTT can run at a higher clock frequency with the same parallelism and, thus, obtain 1.6× higher throughput. Although the compared design uses less BRAM thanks to the optimized coefficient memory bandwidth based on the mixed-radix algorithm, it is worth noting that our design requires less memory for TF bases, including capacity and bandwidth. Furthermore, when supporting 32 RNS moduli, the compared design requires 24,000 pre-stored TF bases, whereas 17,408 are required in ours. In addition, due to its inconsistent design, TF bases for NTT and INTT are stored in different memory blocks, while our unified architecture does not require extra TF base memory blocks for INTT. Kurniawan et al. [21] proposed a memory-based NTT architecture that supports RTC, achieving superior area efficiency. This improvement in area efficiency is primarily attributed to the low DSP consumption resulting from the use of a specific modulus form, which allows for minimal equivalent area. However, in terms of throughput, our design achieves a 1.12× improvement with the same level of computational parallelism while also offering significantly higher configurability and allowing for more RNS moduli.

In addition, among the aforementioned works, only [22,23] implemented an online generation strategy for TFs, which is closer to impractical HE applications. In comparison with the compared designs, when supporting multiple moduli, our architecture incurs only a slight increase in BRAM usage for storage of the TF bases of different moduli. However, the compared designs not only require additional BRAM but also necessitate an increase in LUT resources. This is because the compared MM designs are optimized for specific sets with low Hamming weights, utilizing shifters for lightweight integer multiplication. Consequently, each additional supported modulus leads to increases in shifters and multiplexers. Instead, the bit-width range of the moduli supported by our MM at runtime is (W, $\lceil lo{g}_2{q}_{max}\rceil$]. When $\lceil lo{g}_2{q}_{max}\rceil =62$ and $W=17$, our architecture accommodates moduli ranging from 18 to 62 bits, which covers all RNS moduli proposed in prior works, without incurring any additional computation overhead. Furthermore, the designs proposed in [22,23] only support a fixed number of PEs, lacking configurability for architecture parallelism. In contrast, our design supports both CTC and RTC. We provide a unified architecture for NTT and INTT, avoiding redundant design efforts.

In all, our NTT/INTT module achieves improvements in terms of area efficiency and configurability. These advancements establish it as a practical NTT accelerator for RNS-based HE applications.

4.4. Comparison with Works Considering Small Parameters

For small parameter sets, NTT designs typically use on-chip storage for TFs due to their less stringent storage constraints. To ensure a fair comparison with literature works, we use the TF storage strategy proposed in [26], combined with our optimized coefficient memory access method, to create a memory-based NTT design. The comparison results between our memory-based NTT and prior works considering small parameters are shown in

Table 4. Our implementation results and comparison with prior works considering small parameter sets. The bold text indicates better results.

Work ${\hspace{0.17em}}^{\mathit{d}}$	N ${\hspace{0.17em}}^{\mathit{b}}$	q ${\hspace{0.17em}}^{\mathit{b}}$	PE	Timing		Resource				ATP				ATP ${\hspace{0.17em}}^{\mathit{a},\mathit{k}}$	Configurability ${\hspace{0.17em}}^{\mathit{c}}$
				Freq (MHz)	Latency (us)	LUT	FF	DSP	BRAM	LUT ${\hspace{0.17em}}^{\mathit{k}}$	FF ${\hspace{0.17em}}^{\mathit{k}}$	DSP	BRAM		CTC	RTC
[38] ${\hspace{0.17em}}^{†,i}$	12	24	1	185	132.88	802	525	4	7	106.6	69.8	532	930	438.8	✓	✗
			4 × 2	157	19.61	5.7k	3.2k	33	8.5	111.1	62.5	647	167	225.8
			8 × 2	121	12.75	14.6k	6.5k	80	12	186.1	82.5	1020	153	334
our ${\hspace{0.17em}}^{†,o}$	12	24	1	243	101	1.1k	1.1k	6	7	107.2	113.7	607	708	380.4	✓	✓
			8	219	14.11	5.8k	5.3k	48	16	82.4	75.1	677	226	217.9
			16	216	7.19	11.3k	10.2k	96	24	81.1	73.3	691	173	202
[27] ${\hspace{0.17em}}^{†,o}$	10	32	8	244	2.67	9.5k	4.7k	64	12	25.3	12.6	171	32	52.1	✓	✗
	12	32	4	244	25.2	5k	2.8k	32	14	126	70.6	806	353	312.5
[39] ${\hspace{0.17em}}^{†,i}$	12	32	-	200	2.3	70k	-	599	129	161	-	296.7	1377.7	387.8	✓	✗
our ${\hspace{0.17em}}^{†,o}$	10	32	8	233	2.82	7.4k	7.1k	64	12	21	20	181	34	49.3	✓	✓
	12	32	4	245	25.15	4.2k	3.9k	32	14	105.8	97.5	805	352	291.9
[26] ${\hspace{0.17em}}^{†,o}$	12	60	1	154	159.6	1.9k	1.8k	42	17	303.2	287.3	6703	2713	1787.5	✓	✓
			8	150	20.54	14.1k	12.5k	336	41	289.7	256.8	6901	842	1232.4
			32	133	5.8	52k	47k	1300	160	301.6	272.6	7540	928	1334
[24] ${\hspace{0.17em}}^{†,i}$	12	60	1	144	170.8	2.6k	2.5k	26	14	444	426.9	4440	2390.7	1605.2	✓	✓
			8	141	21.89	22.1k	19.5k	208	32	483.7	426.8	4552.4	700.4	1149
			32	130	6.02	89.9k	77.2k	832	96	540.8	464.4	5004.8	577.5	1214.5
[17] ${\hspace{0.17em}}^i$	12	60	64	125	7.8	338k	138k	1984	768	2636.4	1076.4	15475	5990	5981	✓	✗
our ${\hspace{0.17em}}^{†,o}$	12	60	1	198	124.2	2.2k	2.7k	28	17	269.4	323.5	3478	2111	1250.6	✓	✓
			8	180	17.16	15k	13.4k	224	32	258.1	230.2	3843	549	807.1
			32	137	5.74	60k	54.4k	896	96	344	312.4	5141	551	1023.2
			64	120	3.35	118.4k	108.1k	1792	192	396.8	362.3	6003	643	1190.1

${\hspace{0.17em}}^d$: Based on Xilinx’s Virtex-7 series of FPGAs; ${\hspace{0.17em}}^b$: the bit-width of the N or q parameter; ${\hspace{0.17em}}^a$: ATP = Equ. LUT × latency, in which, Equ. LUT = (LUT + 100 × DSP + 300 × BRAM) [35]; ${\hspace{0.17em}}^k$: the ATP value divided by 1000; ${\hspace{0.17em}}^c$: the symbol ✗ indicates no support for the corresponding configurability, while ✓ indicates support; ${\hspace{0.17em}}^{†}$: the unified architecture supporting NTT and INTT; ${\hspace{0.17em}}^i$: in place; ^o: out of place.

.

The designs proposed in [17,24,26,27,38] support the configuration of parameters N, $\lceil lo{g}_2{q}_{max}\rceil$, and L at compile time, and that proposed in [24,26] also supports diverse polynomial degrees at runtime. In comparison, our design offers greater scalability, with three compilable parameters, namely N, $\lceil lo{g}_2{q}_{max}\rceil$, and L, further enabling runtime adjustments of N and different sizes of q. Furthermore, compared to the design proposed in [38], our architecture demonstrates poorer ATP in LUT when $L=1$ but higher LUT efficiency for larger values of L. Moreover, our overall ATP exhibits superior performance due to its lower latency. In comparison with the design proposed in [27], BRAM consumption is the same because each PE requires two memory blocks for coefficient storage and one block for twiddle factor storage in both designs. But it is worth noting that the actual storage consumption in our design only slightly exceeds $2.25N$, whereas that of the compared design is approximately $3N$. Mert et al. [39] employed a fully parallelized architecture based on the four-step algorithm to speed up NTT but at the cost of significant resources. In comparison, our design is more area-efficient. Liu et al. [26] proposed a configurable NTT/INTT accelerator that supports both CTC and RTC while decreasing the actual memory overhead to $2.5N$. Their design consumes considerably fewer LUT resources because of its simplified memory access pattern. However, our design is more area-efficient thanks to its lower BRAM usage. Our architecture also outperforms the designs proposed in [24] and [17] in terms of ATP.

In general, benefiting from the proposed coefficient memory pattern, our design can fully exploit storage resources and obtain higher LUT and BRAM efficiencies than many previously proposed architectures.

4.5. Comparison between Memory-Based NTT and Online Generation-Based NTT

In the preceding discussion, we learned that there are two methods to provide TFs for PE arrays, namely (i) memory-based, and (ii) online generation-based methods. This part presents a theoretical analysis of how these methods impact area efficiency.

To simplify the analysis, let us assume that all operations occur on the chip to remove the impact of data movement. This implies that storing the TFs for (i) and the TF bases for (ii) across multiple moduli in the internal memory is necessary. Moreover, we assume that only one RNS channel with one NTT core is deployed, consisting of L PE units. Consequently, the total constant storage capacity increases linearly with multiple moduli. The NTT/INTT domain transformations of polynomials across p moduli must be executed serially.

For method (i), according to [26], L memory blocks with a depth of $(N/L+lo{g}_{2}L-1)\times p$ are required for TFs. Method (ii) requires $\lceil L/2\rceil$ memory blocks for TF bases, each with a maximum depth of $({log}_{2}N+1)\times 2\times p$.

Table 5. BRAM consumption of the proposed memory-based NTT and online generation-based NTT with the parameter set of ($N=2^{16}$, $\lceil {log}_2{q}_{max}\rceil =60$, $p=32$) on a Xilinx ZCU102.

L	2	4	8	16	32	64
Method (i)	3592	3604	3616	3648	3712	3840
Method (ii)	139	146	156	184	240	352
Ratio	25.84×	24.68×	23.18×	19.83×	15.47×	10.91×

presents the BRAM consumption of the proposed memory-based and online generation-based NTT architectures on a Xilinx ZCU102 FPGA when the parameter set of (N, $\lceil lo{g}_2{q}_{max}\rceil$, p) is set as ($2^{16}$, 60, 32). Notably, the BRAM overhead for method (i) is approximately 10.91×∼ 25.84× more than that required for method (ii).

In addition to the variances in BRAM occupancy, distinctions exist in latency and the overhead of LUT and DSP resources in both approaches. Therefore, we provide the ATP values of our proposed NTT architectures under the parameter set of ($N=2^{16}$, $\lceil lo{g}_2{q}_{max}\rceil =60$, $p=32$), as shown in Figure 10. The required operating frequency of the architecture for latency computation is considered to be consistent to the maximum operating frequency under a single modulus. It is observed that under the same computational parallelism, the online generation-based NTT architecture significantly outperforms the memory-based architecture in terms of area efficiency. Furthermore, the ATP of the memory-based architecture gradually decreases as L increases, indicating that expanding computation units can mitigate performance limitations resulting from storage requirements. Meanwhile, the ATP of the online generation-based architecture reaches its minimum when L = 32. This suggests that the primary factor influencing performance enhancement is the availability of computational resources when $L<32$. However, when $L\ge 32$, performance improvement becomes constrained due to the increasing storage bandwidth.

In general, our comparison results highlight the necessity of generating TFs on the fly in RNS-based HE applications. Moreover, in high-dimensional polynomials, NTT designs with high parallelism are advantageous for enhancing area efficiency.

5. Conclusions and Future Works

This paper proposes an area-efficient and flexible NTT architecture suitable for RNS-based HE evaluations. The proposed conflict-free and low-complexity memory access pattern reduces the total coefficient storage requirements in CG-based NTT design. And the carefully designed twiddle factor generator saves a significant amount of memory for large sets of prime moduli. Furthermore, the proposed unified architecture offers CTC, which can be configured with various numbers of computational units and support multiple polynomial degrees and various sizes of moduli after compilation. We evaluated the proposed design under a wide range of parameters to demonstrate its advantages in terms of performance and configurability.

Future work will utilize the proposed NTT architecture to develop more complex HE operations, such as bootstrapping and key switching. Additionally, when the proposed accelerator is integrated into a system, the data transfer overhead for various moduli should also be considered.