Fpga evaluation of ntt arithmetic for postquantum ml kem key establishment
Implementation and Evaluation of NTT Arithmetic for ML-KEM on a CGLA
Hardware Architecture
Summary
Post-quantum key establishment methods need fast and precise polynomial multiplication. The authors study how to implement the number-theoretic transform (NTT) arithmetic for ML-KEM on a special hardware design called a CPU-Grounded Linear Array (CGLA). They split complex calculations into smaller parts to fit the hardware constraints, tested their implementation on an FPGA, and projected performance on ASIC chips. Their work shows a method to efficiently implement parts of the ML-KEM polynomial multiplication on this hardware, measuring speed and energy usage.
What this means in practice
- •For hardware engineers: Design specialized accelerators for post-quantum cryptographic tasks using NTT arithmetic on programmable linear arrays.
- •For embedded system developers: Integrate efficient ML-KEM polynomial multiplication implementations into low-latency secure communication modules on FPGA or ASIC platforms.
- •For network security teams: Deploy cryptographic hardware with optimized post-quantum key exchange support to enhance security against future quantum attacks.$Commercial implications: Enables production of security appliances offering quantum-resistant key establishment with measured low latency and energy.
Authors
Takuto Ando, Yasuhiko Nakashima
Abstract
FIPS 203 standardizes ML-KEM for post-quantum key establishment. Its polynomial multiplication relies on NTT butterflies with exact modular arithmetic over q = 3329. Dedicated NTT accelerators minimize latency with fixed modular arithmetic and stage schedules. A CPU-Grounded Linear Array (CGLA) reuses one programmable linear datapath across several workloads. Mapping the transform to this datapath requires exact FP32 reconstruction and explicit stage transitions across the ARM-to-CGLA interface. We implement an eight-stage cyclic radix-2 driver over the ML-KEM modulus by splitting each twiddle into 8-bit and 4-bit parts before modular reduction. This driver differs from the standardized seven-layer incomplete negacyclic NTT and does not implement the full ML-KEM polynomial multiplication path. The arithmetic sequence keeps every integer below 2^24. One 41-PE call fuses the first two radix-2 stages, and six 47-PE calls execute the remaining stages while scattering outputs into next-stage records. Across four cohorts, 105 FPGA runs match all 817152 output coefficients. At batch size 64, measured FPGA end-to-end latency is 27.5 us per NTT, and the ASIC projection is 6.74 us. With PE gating, projected ASIC system energy is 10.1 uJ per NTT at batch size 8 and 58.9 uJ at batch size 64.