Area–Power–Performance Trade-Offs in Lightweight Non-Pipelined and Pipelined NTT Accelerators for CRYSTALS-Dilithium
TL;DR
This article investigates two lightweight field-programmable gate array (FPGA) implementations of an iterative NTT-based polynomial multiplication accelerator through non-pipelined and 4-stage pipelined architectures, showing that the non-pipelined architecture provides reduced hardware overhead and lower power consumption, whereas the pipelined architecture improves timing scalability and successfully operates at 280 MHz.
Abstract
Number Theoretic Transform (NTT)-based polynomial multiplication is a computationally intensive operation in lattice-based post-quantum cryptography (PQC) schemes such as CRYSTALS-Dilithium. Existing hardware accelerators optimize area and timing performance, without focusing on evaluating trade-offs among hardware utilization, execution latency, operating frequency, and power consumption. This article investigates such trade-offs through two lightweight field-programmable gate array (FPGA) implementations of an iterative NTT-based polynomial multiplication accelerator, namely non-pipelined and 4-stage pipelined architectures. Both implementations employ a single butterfly unit based on Cooley–Tukey and Gentleman–Sande configurations to compute the forward NTT (FNTT), inverse NTT (INTT), and coefficient-wise multiplication (CWM). The 4-stage pipelined architecture employs pipeline registers in the modular multiplication and Barrett reduction datapaths to maximize the operating frequency. Both architectures are implemented on an Artix-7 FPGA and evaluated across operating frequencies ranging from 10 MHz to 280 MHz. The results show that the non-pipelined architecture provides reduced hardware overhead and lower power consumption, whereas the pipelined architecture improves timing scalability and successfully operates at 280 MHz. At the maximum operating frequency, the pipelined implementation utilizes 1115 slices and achieves execution times of 4.58 μs, 0.93μs, and 4.58μs for FNTT, CWM, and INTT computations, respectively, with an average power consumption of 133 mW. The Area–Time Product (ATP) and Energy–Delay Product (EDP) evaluations demonstrate that the pipelined architecture achieves improved overall efficiency within the proposed lightweight single-butterfly-based polynomial multiplication architecture at higher operating frequencies, obtaining an ATP of 7.74×103 Slice-μs and EDP of 1501.52 nJ-μs.