Towards efficient polynomial multiplication for lattice-based cryptography

Ring learning with errors (Ring-LWE) is the basis of various lattice based cryptosystems. The most critical and computationally intensive operation of Ring-LWE based cryptosystems is polynomial multiplication over rings. In this paper, we introduce several optimization techniques to build an efficient polynomial multiplier with the number theoretic transform (NTT). We propose a technique to optimize the bit-reverse operation of NTT and inverse-NTT. With additional optimizations, our polynomial multiplier reduces the required clock cycles from (8n+1.5n lg n) to (2n+1.5n lg n). By exploiting the relationship of the constant factors, our polynomial multiplier is able to reduce the number of constant factors from 4n to 2.5n, which saves about 37.5% ROM storage. In addition, we propose a novel memory access scheme to achieve maximum utilization of the butterfly operator. With these techniques, our polynomial multiplier is capable to perform 57304/26913 polynomial multiplications per second for dimension 256/512 on a Spartan-6 FPGA.