Toeplitz Matrix-vector Product Research Articles

A Survey of Polynomial Multiplications for Lattice-Based Cryptosystems

We survey various mathematical tools used in software works multiplying polynomials in ℤ q [ x ] ⟨ x n − α x − β ⟩ . In particular, we survey implementation works targeting polynomial multiplications in lattice-based cryptosystems Dilithium, Kyber, NTRU, NTRU Prime, and Saber with instruction set architectures/extensions Armv7-M, Armv7E-M, Armv8-A, and AVX2. There are three emphases in this paper: (i) modular arithmetic, (ii) homomorphisms, and (iii) vectorization. For modular arithmetic, we survey Montgomery, Barrett, and Plantard multiplications. For homomorphisms, we survey (a) various homomorphisms such as Cooley–Tukey FFT, Good–Thomas FFT, Bruun's FFT, Rader's FFT, Karatsuba, and Toom–Cook; (b) various algebraic techniques for adjoining nice properties to the coefficient rings, including localization, Schönhage's FFT, Nussbaumer's FFT, and coefficient ring switching; and (c) various algebraic techniques related to the polynomial moduli, including twisting, composed multiplication, evaluation at ∞ , truncation, incomplete transformation, striding, and Toeplitz matrix-vector product. For vectorization, we survey the relations between homomorphisms and vector arithmetic. We then go through several case studies: We compare the implementations of modular multiplications used in Dilithium and Kyber, explain how the matrix-to-vector structure was exploited in Saber, and review the design choices of transformations for NTRU and NTRU Prime with vectorization. Finally, we outline several interesting implementation projects.

A fast NTRU software implementation based on 5-way TMVP

The fast and efficient operation of post-quantum cryptographic algorithms has become an important research topic, especially with the recent developments and the process of the PQC Standardization Project by NIST. Various algorithms based on lattices are chosen to be finalists in this project. Number Theoretic Transform (NTT), Toom–Cook, Karatsuba, and Toeplitz matrix–vector product (TMVP) are considered in order to efficiently perform multiplications in quotient polynomial rings required by the cryptographic schemes based on lattices. In this paper, we propose a 5-way split TMVP-based algorithm for multiplication in polynomial quotient rings and determine its computational complexity. The new algorithm is derived from a 5-term polynomial multiplication algorithm using 13 multiplications with coefficients of only 1 or -1 that provide efficiency. We also implement it for all parameter sets of NTRU. The results show that we have up to 34%, 35%, and 157% speed-up against Toom4-Karatsuba implementation in key generation, encapsulation, and decapsulation, respectively.

High-Throughput Polynomial Multiplier for Accelerating Saber on FPGA

Saber was once one of the most promising candidates for the post-quantum cryptography standardization, which relies on lattice-based hard mathematical problems. Polynomial multiplication is time-consuming within the Saber architecture and there is still a lack of designs targeting the high throughput applications whose parameters support Schoolbook polynomial multiplier. In this brief, we propose a high-performance Schoolbook polynomial multiplier with a balanced hardware efficiency. The Schoolbook algorithm is transformed into a Toeplitz matrix-vector product, and its symmetry is exploited to reconstruct the Schoolbook multiplier to satisfy the need for high parallelism. Combined with compact data loading structure and a centralizing multiplication, the multiplier achieves 3.33× higher throughput and 1.58× higher throughput-per-slice compared with the state-of-the-art implementation of polynomial multiplier for Saber on Xilinx FPGA. The experimental results also demonstrate that the proposed structure provides a better trade-off between performance and area.

Faster NTRU on ARM Cortex-M4 With TMVP-Based Multiplication

This paper focuses on speeding up NTRU - one of the lattice-based finalists of the NIST PQC competition - by improving the ring multiplication. The Number Theoretic Transform (NTT), Toom-Cook, and Karatsuba are the most commonly used algorithms for implementing NTRU. In this paper, we propose Toeplitz matrix-vector product (TMVP) based algorithms for multiplication for all parameter sets of NTRU. We implement the proposed algorithms on ARM Cortex-M4. The results show that the TMVP-based multiplication algorithms we propose are more efficient than the others in the literature in most cases. Our algorithm for <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ntruhps2048509</i> outperform the Toom-Cook and NTT methods in the literature by 25.4% and 21.5%. We also observe the impact of these improvements on the overall performance of NTRU. We speed up the key generation, encryption, decryption, encapsulation, and decapsulation algorithms of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ntruhps2048509</i> by 12.5%, 14.3%, 17.7%, 3.9%, and 14.7%, respectively, compared to state-of-the-art implementation. Moreover, our algorithms require less stack space than the others.

Novel Systolization of Subquadratic Space Complexity Multipliers Based on Toeplitz Matrix–Vector Product Approach

Systolic finite field multiplier over $GF(2^{m})$ , because of its superior features such as high throughput and regularity, is highly desirable for many demanding cryptosystems. On the other side, however, obtaining high-performance systolic multiplier with relatively low hardware cost is still a challenging task due to the fact that the systolic structure usually involves large area complexity. Based on this consideration, in this paper, we propose to carry out two novel coherent interdependent efforts. First, a new digit-serial multiplication algorithm based on polynomial basis over binary field $(GF(2^{m}))$ is proposed. Novel Toeplitz matrix–vector product (TMVP)-based decomposition strategy is employed to derive an efficient subquadratic space complexity. Second, The proposed algorithm is then innovatively mapped into a low-complexity systolic multiplier, which involves less area-time complexities than the existing ones. A series of resource optimization techniques also has been applied on the multiplier which optimizes further the proposed design (it is the first report on digit-serial systolic multiplier based on TMVP approach covering all irreducible polynomials, to the best of our knowledge). The following complexity analysis and comparison confirm the efficiency of the proposed multiplier, that is, it has lower area-delay product (ADP) than the existing ones. The extension of the proposed multiplier for bit-parallel implementation is also considered in this paper.

Subquadratic Space Complexity Multiplier Using Even Type GNB Based on Efficient Toeplitz Matrix-Vector Product

Multiplication schemes based on Toeplitz matrix-vector product (TMVP) have been proposed by many researchers. TMVP can be computed using the recursive two-way and three-way split methods, which are composed of four blocks. Among them, we improve the space complexity of the component matrix formation (CMF) block. This result derives the improvements of multiplication schemes based on TMVP. Also, we present a subquadratic space complexity $GF(2^m)$ multiplier with even type Gaussian normal basis (GNB). In order to design the multiplier, we formulate field multiplication as a sum of two TMVPs and efficiently compute the sum. As a result, for type 2 and 4 GNBs, the proposed multipliers outperform other similar schemes. The proposed type 6 GNB is the first subquadrtic space complexity multiplier with its explicit complexity formula.

Faster Residue Multiplication Modulo 521-bit Mersenne Prime and an Application to ECC

We present faster algorithms for the residue multiplication modulo 521-bit Mersenne prime on 32- and 64-bit platforms by using Toeplitz matrix-vector product. The total arithmetic cost of our proposed algorithms is less than that of existing algorithms, with algorithms for 64- and 32-bit residue multiplication giving the best timing results on our test machine. The transition from 64- to 32-bit implementation is full of challenges because the number of limbs doubles and the limbs’ bitlengths are cut in half. Without using any intrinsics or SIMD/assembly instructions in our implementation on an Intel(R) Core i5 – 6402P CPU @ 2.80GHz, we find 136 and 550 cycles for our 64-and 32-bit residue multiplications, respectively. In addition, we implement constant-time variable- and fixed-base scalar multiplication for the standard NIST curve P-521 and Edwards curve E-521.

Efficient multiplier based on hybrid approach for Toeplitz matrix–vector product

We propose a hybrid approach for a Toeplitz matrix–vector product (TMVP) of size k⋅2i3j, where k≥1 and i,j≥0. It is possible to make trade-offs between time and space complexities for a TMVP by choosing values k, i, and j properly. We show that the multiplier based on the proposed hybrid TMVP approach has lower space as well as time complexities than other subquadratic space complexity multipliers for five fields recommended by NIST. Moreover, for those five fields, the space complexities of the proposed multiplier are reduced by a minimum 59% and a maximum 77% compared with quadratic space complexity multiplier.

Decomposition of symmetric matrix–vector product over GF (2 m )

Toeplitz matrix–vector product (TMVP) decomposition is an important approach for designing and implementing subquadratic multiplier. In this Letter, a symmetric matrix (SM), which is the sum of a symmetric TM and Hankel matrix, is proposed. Applying the symmetry property, 2-way, 3-way and n-way splitting methods of SMVP is presented. On the basis of 2-way splitting method, the recursive formula of SMVP is presented. Using the two cases n = 4 and 8, the SMVP decomposition approach has less space complexity than 2-way TMVP, TMVP block recombination and symmetric TMVP for even-type Gaussian normal basis multiplication.

Gaussian normal basis multiplier over GF(2m) using hybrid subquadratic‐and‐quadratic TMVP approach for elliptic curve cryptography

In recent years, subquadratric‐and‐quadratric Toeplitz matrix–vector product (TMVP) computations are widely used for the implementation of binary field multiplication in elliptic curve cryptography. Pure subquadratric TMVP structure involves significantly less space complexity and long computational delay, while quadratric TMVP structure involves larger space complexity and less computation delay. To optimise the tradeoff between time and space complexities, this study presents a novel hybrid multiplier for Gaussian normal basis (GNB) in GF(2m) which combines subquadratic and quadratic structures. From the theoretical analysis, it is shown that the proposed hybrid multiplier can save ∼18% space complexity and 12% time complexity than the existing GNB multiplier with pure TMVP decomposition.

Low-Complexity Digit-Serial Multiplier Over $GF(2^{m})$ Based on Efficient Toeplitz Block Toeplitz Matrix–Vector Product Decomposition

In this paper, we have shown that a regular Toeplitz matrix-vector product (TMVP) can be transformed into a Toeplitz block TMVP (TBTMVP) using a suitable permutation matrix. Based on the TBTMVP representation, we have proposed a new $(a,b)$ -way TBTMVP decomposition algorithm for implementing a digit-serial multiplication. Moreover, it is shown that, based on iterative block recombination, we can improve the space complexity of the proposed TBTMVP decomposition. From the synthesis results, we have shown that the proposed TBTMVP-based multiplier involves less area, less area-delay product, and higher throughput compared with the existing digit-serial multipliers.

Fast permutation preconditioning for fractional diffusion equations.

In this paper, an implicit finite difference scheme with the shifted Grünwald formula, which is unconditionally stable, is used to discretize the fractional diffusion equations with constant diffusion coefficients. The coefficient matrix possesses the Toeplitz structure and the fast Toeplitz matrix-vector product can be utilized to reduce the computational complexity from {mathcal {O}}{(N^{3})} to {mathcal {O}}{(N log N)}, where N is the number of grid points. Two preconditioned iterative methods, named bi-conjugate gradient method for Toeplitz matrix and bi-conjugate residual method for Toeplitz matrix, are proposed to solve the relevant discretized systems. Finally, numerical experiments are reported to show the effectiveness of our preconditioners.

Area-Delay Efficient Digit-Serial Multiplier Based on &lt;inline-formula&gt; &lt;tex-math notation="LaTeX"&gt;$k$ &lt;/tex-math&gt; &lt;/inline-formula&gt;-Partitioning Scheme Combined With TMVP Block Recombination Approach

Shifted polynomial basis (SPB) and generalized polynomial basis (GPB) are two efficient bases of representation in binary extension fields, and are widely studied. In this paper, we use the GPB formulation to derive a new modified SPB (MSPB) representation for arbitrary irreducible trinomials and pentanomials. It is shown that the basis conversion from the MSPB to the SPB for trinomials is free of hardware cost. We have shown that multiplication based on SPB and MSPB representations can make use of Toeplitz matrix–vector product (TMVP) formulation. The existing TMVP block recombination (TMVPBR) approach is used here to derive an efficient $k$ -partitioning TMVPBR decomposition for digit-serial double basis multiplication that can achieve subquadratic space complexity. From synthesis results, we have shown that the proposed multiplier has less area and less area-delay product compared with the existing digit-serial multipliers. We also show that the proposed multiplier using $k$ -partitioning TMVPBR decomposition can provide a better tradeoff between time and space complexities.

GF(2n) Redundant Representation Using Matrix Embedding for Irreducible Trinomials

By embedding a Toeplitz matrix-vector product (MVP) of dimension n into a circulant MVP of dimension [Formula: see text], where δ can be any nonnegative integer, we present a GF(2n) multiplication algorithm. This algorithm leads to a new redundant representation, and it has two merits: (1) The flexible choices of δ make it possible to select a proper N such that the multiplication operation in ring [Formula: see text] can be performed using some asymptotically faster algorithms, e.g. the Fast Fourier Transformation (FFT)-based multiplication algorithm; (2) The redundant degrees, which are defined as N/n, are smaller than those of most previous GF(2n) redundant representations, and in fact they are approximately equal to 2 for all applicable cases.

Comments on “Multiway Splitting Method for Toeplitz Matrix Vector Product”

We propose block decompositions for the Toeplitz matrix-vector product (TMVP) using the $k$ -way splitting method presented in the above paper. As a result, we show that the space complexity for TMVP can be improved.

Explicit formulae for Mastrovito matrix and its corresponding Toeplitz matrix for all irreducible pentanomials using shifted polynomial basis

We propose explicit formulae of the Mastrovito matrix M and its corresponding Toeplitz matrix T for an arbitrary irreducible pentanomial using shifted polynomial basis. We also give the complexity of the Toeplitz matrix for a pentanomial. This yields the complexity of a multiplier based on Toeplitz matrix–vector product (TMVP) for an arbitrary irreducible pentanomial for the first time. Moreover, we introduce a new type of pentanomials for which a multiplier based on TMVP is efficiently implemented. We show that the complexity of a subquadratic space complexity multiplier for such a special type of pentanomials is comparable with that for trinomials.

Area-Efficient Subquadratic Space-Complexity Digit-Serial Multiplier for Type-II Optimal Normal Basis of &lt;formula formulatype="inline"&gt;&lt;tex Notation="TeX"&gt;$GF(2^{m})$&lt;/tex&gt; &lt;/formula&gt; Using Symmetric TMVP and Block Recombination Techniques

The type-II optimal normal basis (ONB) is popularly used to represent $GF(2^{m})$ for elliptic curve cryptosystems. It is shown in the literature that multiplication in binary fields, including those represented by type-II ONB, shifted polynomial basis, and dual basis, can be transformed into non-symmetric Toeplitz matrix-vector product (TMVP) formulation. In this paper, we show that type-II ONB multiplication can be realized by two symmetric TMVPs (STMVP). Moreover, we have proposed a novel folded TMVP block recombination (TMVPBR) for the computation of STMVP. Based on the proposed folded TMVPBR approach, we have proposed a new digit-serial structure for type-II ONB multiplication, while traditional parallel ONB multipliers are based on non-symmetric TMVPBR approach to achieve subquadratic space complexity architecture. The proposed digit-serial structure also involves subquadratic space complexity. By the theoretical analysis as well as from synthesis result, however, we find that the proposed architecture has significantly less area and less area-delay product compared to the existing digit-serial type-II ONB multipliers.

Subquadratic space complexity Gaussian normal basis multipliers overGF(2m) based on Dickson–Karatsuba decomposition

Gaussian normal basis (GNB) of the even-type is popularly used in elliptic curve cryptosystems. Efficient GNB multipliers could be realised by Toeplitz matrix-vector decomposition to realise subquadratic space complexity architectures. In this study, Dickson polynomial representation is proposed as an alternative way to represent an GNB of characteristic two. The authors have derived a novel recursive Dickson–Karatsuba decomposition to achieve a subquadratic space-complexity parallel GNB multiplier. By theoretical analysis, it is shown that the proposed subquadratic multiplier saves about 50% bit-multiplications compared with the corresponding subquadratic GNB multiplication using Toeplitz matrix-vector product approach.

Fast iterative solvers for numerical simulations of scattering and radiation on thin wires

The method of moments for the simplified scattering and radiation on thin wire models can lead to the large-scale linear systems with non-Hermitian Toeplitz-like coefficient matrices. Since such reduced linear systems are typically dense and ill conditioned, iterative solvers are rarely considered to deal with the discretized linear systems in these electromagnetic model simulations. However, utilizing the Toeplitz-like structure of coefficient matrices, we can use the fast Toeplitz matrix-vector product (MVP) to refresh iterative solvers for the discretized linear systems. Compared with the traditional solvers, the fast numerical method can reduce the computational cost from to and the storage from to without using any lossy compression. Due to the Toeplitz-like structure of coefficient matrices, circulant preconditioners are considered to further accelerate the convergence of iterative solvers. Since the circulant matrices can be diagonalized via fast Fourier transforms (FFTs), the fast Toeplitz MVP is utilized to retain the total computational complexity of the proposed methods at , where is the number of spatial grid nodes. Theoretical analyses of the spectra of the preconditioned linear systems are also preliminarily investigated. Finally, extensive numerical experiments involving both scattering and radiation issues are employed to demonstrate the effectiveness of the proposed methods in aspects of the number of iterations and CPU time elapsed.

Reduction of space complexity based on symmetric TMVP

Toeplitz matrix–vector product (TMVP) decomposition is one of the high-precision multiplication algorithms. A symmetric TMVP (STMVP) decomposition is presented and theoretical analysis shows that the space complexity of the proposed STMVP scheme is less compared with the traditional TMVP approach. Gaussian normal basis (GNB) multiplication based on the proposed architecture can be used to reduce the space complexity.