Hardware architecture for number theoretic transform operations

Abstract

Performing an operation, comprising a plurality of butterfly units BF(n), a plurality of commutator units 100, and a plurality of multiplexers 210. Each commutator unit comprises at least one delay buffer (100, figure 1a) and a switch unit (120, figure 1a). Each of the plurality of multiplexers are configured to arrange the plurality of commutator units and the plurality of butterfly units in either a first configuration or a second configuration, where the first configuration or the second configuration is selected based on a type associated with the operation. The processing operation is performed on Number Theoretic Transform (NTT) input or an inverse-NTT (iNTT) input. The first and second configurations may configure the commutators and butterfly units into first and second orders respectively so as to perform NTT and iNTT operations respectively. The delay buffer and switch of a commutator unit may be sized based on position within the configuration.

Description

Technical Field The present invention relates to an apparatus, and to a computer program for controlling a data processing apparatus, for performing a Number Theoretic Transform (NTT) operation. More particularly, the apparatus and the computer program are configured to perform both NTT and inverse-NTT (iNTT) operations. Background The NTT is a mathematical transform that allows polynomial multiplication to be efficiently computed in the context of finite fields. Unlike traditional polynomial multiplication methods, such as the Fast Fourier Transform (FFT), which operate in the complex number domain, NTT operates in the finite field domain, making it particularly suitable for applications where arithmetic must be performed modulo a prime number. Efficient implementation of NTT polynomial multiplication is crucial for achieving high-performance computing systems, especially in resource-constrained environments such as hardware security modules or applications requiring real-time processing and other high speed applications. Consequently, there is a growing demand for hardware-based solutions capable of delivering superior performance and efficiency. Existing hardware architectures for NTT polynomial multiplication often face challenges related to resource utilization, scalability, and power efficiency, while offering high-performance acceleration. Addressing these challenges requires innovative hardware design methodologies that leverage the latest advancements in computer architecture, digital signal processing, and field-programmable gate array (FPGA) technology. Summary According to a first aspect of the present invention, there is provided an apparatus for performing an operation, the apparatus comprising a plurality of butterfly units; a plurality of commutator units, each commutator unit comprising at least one delay buffer; and a switch unit; and a plurality of multiplexers, wherein the multiplexers are configured to arrange the plurality of commutator units and the plurality of butterfly units in either a first configuration or a second configuration, where the first configuration or the second configuration is selected based on a type associated with the operation. This enables the same apparatus to perform different types of operation in different configurations, thereby reducing hardware resource requirements (e.g., a reduction of silicon real estate) and also reducing hardware usage such as reducing the number of external read / writes to memory, thereby increasing efficiency. Optionally, in the first configuration, the plurality of commutator units and the plurality of butterfly units are configured in a first order to perform a number theoretic transform, NTT, operation; and in the second configuration, the plurality of commutator units and the plurality of butterfly units are configured in a second order to perform an inverse number theoretic transform, iNTT, operation. The arrangement of the commutator and butterfly units in a given order enables the same apparatus to be used for either NTT or iNTT operations. The at least one delay buffer and the switch unit of a given commutator unit may be sized based on a position of the given commutator unit in the first configuration or the second configuration. The sizing of the delay buffers and switch units enables the commutator units to be arranged in an order. This removes the need for oversized hardware components to be used, further increasing silicon real-estate efficiency. Optionally the apparatus further comprises an input module for receiving an NTT or iNTT input, where the NTT input and the iNTT input are polynomial inputs. This enables the NTT or iNTT inputs to be received at the necessary components in the hardware architecture. The polynomial input may comprise two coefficients, and each butterfly unit is configured to process the two coefficients. Each of the plurality of commutator units may comprise two delay buffers, and where a first delay buffer is arranged to receive a first of the two coefficients, and the switch unit of the given commutator unit is arranged to receive a second of the two coefficients and to output two results, where the first result is provided to a second delay buffer. This enables the reuse of hardware units, thereby ensuring the efficient management of silicon real estate by only implementing the necessary hardware components. Optionally, the apparatus comprises eight butterfly units and seven commutator units. This enables the implementation of 256-point polynomials using Radix-2 Multipath Delay Commutator units. The polynomial input may comprise four coefficients, and the butterfly unit is configured to process the four coefficients. Each of the plurality of commutator units comprises six delay buffers, and where a first group of delay buffers comprises three of the six delay buffers, and a second group of delay buffers comprises a different three of the six delay buffers, such that each delay buffer of the first group receives one of the four coefficients; and the switch unit of the given commutator unit is arranged to receive a fourth of the four coefficients not received by any one of the first group of delay buffers and to output four results, where three of the four results are provided to the delay buffers of the second group of delay buffers. This enables the reuse of hardware units, thereby ensuring the efficient management of silicon real estate by only implementing the necessary hardware components. Optionally, the apparatus comprises four butterfly units and three commutator units. This enables the implementation of 256-point polynomials using Radix-4 Multipath Delay Commutator units. A given butterfly unit, of the plurality of butterfly units, may be configured to output a result of the operation and may comprise a bypass input arranged to facilitate the bypassing of the given butterfly unit in the processing of the operation. The bypass input may indicate that the operation is implemented for a Kyber or ML-KEM scheme. This enables the implementation of Kyber and / or ML-KEM operations using the same hardware, removing the need for duplicated hardware components. The apparatus may be implemented on a field programmable gate array or as part of an application-specific integrated circuit. Optionally, the plurality of butterfly units are either a Cooke-Turkey (CT) butterfly unit; or a Gentleman-Sande (GS) butterfly unit. This reduces the critical path and lowers the area of the silicon real estate, thereby increasing efficiency. Optionally, the apparatus further comprises a pre-processing module configured to apply at least one pre-processing operation to an input to the operation when the plurality of butterfly units are GS butterfly units. The apparatus may also comprise a post-processing module configured to apply at least one post-processing operation to an output of the operation when the plurality of butterfly units are CT butterfly units. This reduces the amount of hardware required for an NTT engine configured to implement both NTT and iNTT operations. According to a second aspect of the present invention, there is provided a computer program for controlling a data processing apparatus to provide an instruction execution environment comprising instruction decoding circuitry to decode an operation; processing circuitry to perform data processing on the NTT input or the iNTT input in response to the operation, wherein the processing circuitry is configured to provide at least a plurality of butterfly units; a plurality of commutator units, each commutator unit comprising at least one delay buffer; and a switch unit; and a plurality of multiplexers, wherein the multiplexers are configured to arrange the plurality of commutator units and the plurality of butterfly units in either a first configuration or a second configuration, where the first configuration or the second configuration is selected based on a type associated with the operation. This enables the same apparatus to perform different types of operation in different configurations, thereby reducing hardware resource requirements (e.g., a reduction of silicon real estate) and also reducing hardware usage such as reducing the number of external read / writes to memory, thereby increasing efficiency. Brief Description of the Drawings Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Figure la shows schematically a commutator unit according to a first example; Figure lb shows schematically a commutator unit according to a second example; Figure 2 shows schematically a hardware configuration for performing both an NTT and iNTT operation according to an example; Figure 3a shows schematically a data flow for performing an NTT operation using the example hardware of Figure 2 Figure 3b shows schematically a data flow for performing an iNTT operation using the example hardware of Figure 2. Detailed Description Polynomial multiplication is a computationally intensive operation commonly encountered in diverse fields such as digital signal processing, error correction coding, and cryptography. Polynomial multiplication is used, for example, in post-quantum cryptographic algorithms such as Dilithium, Kyber, ML-KEM as defined in FIPS 203 (see http: / / csrc.nist.gov / pubs / fips / 203 / ipd) and ML-DSA as defined in FIPS 204 (see http: / / csrc.nist.gov / pubs / fips / 204 / ipd) amongst others, especially in the lattice-based cryptography implementations. Existing methods for polynomial multiplication suffer from inefficiencies, particularly when dealing with large polynomial degrees, in resource-constrained environments, or as part of a high-speed application. NTT and iNTT are mathematical transforms that can be used in the computation of polynomial multiplications modulo a prime number in a computationally efficient manner. The NTT works by transforming the coefficients of a polynomial into another domain for evaluation and allows for the performance of pointwise multiplication. Following the multiplication, the results of the multiplication are then transformed, via iNTT, back into coefficients of the polynomial domain. The elements of a finite field, from which the coefficients of the polynomial function are determined, depend on a prime numberp and a primitive root w. The prime number determines the finite field over which the calculations will be performed, and the primitive root is an element whose powers all generate non-zero elements of the field. The selection of the primitive root, w, is responsible for the efficiency of the NTT operation. A polynomial A(x) is evaluated at A points, where the A points are powers of the primitive root of unity, w, such that wk represent the points where k = 0, 1, ... N-J. That is: A(wkj = ak The NTT operation can then calculate the coefficients A(wk) by multiplying each coefficient aj with the corresponding power of w as well as cp, such that w = (p2 and summing them modulo p: N—l dk = (p^ ■ aj ■ wjk mod p j=o Pointwise multiplication can then be undertaken for two transformed polynomials A(x) and 5(x): C(wk) = dk ■ bk mod p Once the multiplication of the coefficients has been performed, the iNTT operation can be used to transform the resulting coefficients back into the polynomial domain. This is achieved by: w-i Cj = — ■ (p~J C(wk) ■ mod p fc=O The result of the iNTT operation may then be processed further, such as performing a modular reduction for each coefficient Cj, to ensure they are within the range / 0. p-1]. The below description relates to an apparatus and a computer program for performing the NTT and iNTT transforms, which may be used for a polynomial multiplication. It will be appreciated that the NTT and the iNTT transforms may be used as part of the computation of other operations. A main hardware component when performing NTT and iNTT operations is a butterfly unit. Butterfly units are used to assist in the performance of the computationally intensive operations used to perform NTT and iNTT operations. The butterfly unit takes an input and applies an NTT and / or iNTT transform to the inputs, in an efficient way by performing multiple computations in parallel, thereby reducing the overall complexity of an NTT or iNTT operation. NTT and iNTT are often processed in sequential order, and in such examples, the combination and sequencing of butterfly units, especially when input and output coefficients are not provided or sent in order, can have a negative effect on the efficiency of the overall operation. This is particularly the case due to scheduling and control overheads, thereby increasing computation cost and delay due to the need to reorder the coefficients. Processing the NTT and iNTT in such a way also resulted in increased memory requirements needed to store the intermediate values. Furthermore, for hardware to undertake both NTT and iNTT operations, additional hardware is required to enable the different sequencing of the butterfly units. To overcome this, one solution is to utilize a plurality of multiplexers alongside a plurality of commutator units, as will be described in further detail below. Figures la and lb show schematically commutator units 100a, 100b comprising a plurality of delay buffers 110a, 110b, 110c, 1 lOd and a switch unit 120, 130. The commutator units 100a, 100b are used to implement a parallel and pipelined NTT or iNTT operation. Figure la shows a Radix-2 Multipath Delay Commutator (MDC) unit 100a, herein referred to as an R2MDC, comprising two delay buffers 110a and 110b on the switch unit's 120 input and output. The delay buffers 110a, 110b and switch 120 are sized according to the position in the pipeline as will be described in further detail below with reference to Figure 2. For example, in an 8-stage NTT engine, the delay buffers 110b (both on the input and output of the switch unit 120) of a second stage of the engine may be configured to buffer 64 blocks of data whereas the other delay buffers 110a (both on the input and output of the switch unit 120) may be configured not to buffer any blocks of an input, or may be absent in the hardware architecture. The buffer 110a, 110b has a depth of 64, which means that the buffer 110a, 110b delays outputting an input block of data (which may be of any bit width) by 64 cycles. This may be implemented in a First in First Out (FIFO) architecture, for example. The width of the switch unit 120 is sized according to the width of the expected inputs. For example, a switch having a width of at least 12 bits is required for Kyber or ML-KEM inputs, whereas a switch having a width of at least 23 bits is required for Dilithium or ML-DSA inputs. To provide maximum compatibility, a 23-bit width switch may be used to ensure any of those inputs may be processed. This architectural layout enables the R2MDC unit 100a to process 2 coefficients for an NTT or iNTT operation in parallel. As such, an 8-stage NTT engine, of the type which will be described below in relation to Figure 2, will allow for a 256-point polynomial calculation to be undertaken in parallel. That is, an input in the form of: ...x[2] x[l] -> x[0] ...x

[130] x

[129] x

[128] may be processed, such that two coefficients (e.g., x[0] and x

[128] ) maybe processed in parallel to increase efficiency. Figure lb shows a Radix-4 Multipath Delay Commutator (MDC) unit 100b, herein referred to as an R4MDC, comprising four delay buffers 110a, 110b, 110c and 1 lOd on both the switch unit’s 130 input and output. As with the R2MDC, the delay buffers 110a, 110b, 110c and 1 lOd, and the switch unit 130 are sized according to their position in the pipeline, as will be described in further detail below with reference to Figure 2. For example, in a 4-stage NTT engine, the delay buffers 110b, 110c and 1 lOd (on both the input and output of the switch unit 130) of a second stage of the engine may be configured to buffer 16-, 32- and 48-blocks of data respectively, whereas the delay buffer 110a (on both the input and the output of the switch unit 130) may be configured not to buffer any bits of an input, or may be absent in the hardware architecture. The switch unit is sized accordingly, and so in the second stage example described above, the switch unit is a 12-bit or 23-bit switch unit depending on the input width. This architectural layout enables the R4MDC unit 100b to process 4 coefficients for an NTT or iNTT operation in parallel. As such, a 4-stage NTT engine, of the type which will be described below in relation to Figure 2, will allow for a 256-point polynomial calculation to be undertaken in parallel. That is, an input in the form of: ...x[2] x[l] x[0] ...x

[66] x

[65] x

[64] ...x

[130] x

[129] x

[128] ...x

[194] x

[193] -> x

[192] may be processed, such that four coefficients (e.g., x / 0 / , x

[64] , x

[128] , and x

[192] ) are processed in parallel to increase efficiency. Figure 2 shows schematically an architecture layout of an NTT engine 200 configured to perform both NTT and iNTT operations, depending on a configuration. The engine 200 comprises a plurality of stages ST(1), ST(2)...ST(n), and a plurality of multiplexers 210a, 210b, 210c, 21 Od configured to enable the performance of either an NTT or an iNTT operation as will be explained in further detail below with reference to Figures 3a (NTT operation) and 3b (iNTT operation). Each stage ST(1), ST(2), ..., ST(n) comprises abutterfly unitBF(l), BF(2), ..., BF(n). As described above, butterfly units are used to assist in the performance of the computationally intensive operations used to perform NTT and iNTT operations. The butterfly unit takes an input and applies an NTT and / or iNTT transform to the inputs, in an efficient way by performing multiple computations in parallel, thereby reducing the overall complexity of, for example, a polynomial multiplication. There are a number of different types of butterfly unit configurations, for example, Cooley-Tukey (CT) butterfly configurations which are used for NTT computations and Gentleman-Sande (GS) butterfly configurations which are used for iNTT computations. In order to perform both NTT and iNTT computations, a general-purpose NTT engine must therefore comprise both types of butterfly unit configurations. This results in a doubling of hardware resources alongside additional multiplexers for the selection of a respective data path. In some examples, this may be required, however, it will be appreciated that such a doubling may lead to additional inefficiencies. Therefore, where additional efficiencies are required, the butterfly units BF(1), BF(2), ..., BF(n) may be of a single type, such as a CT butterfly unit, and configured for use in the computation of both NTT and iNTT operations. It will be appreciated that other butterfly unit configurations, such as GS butterfly unit configurations could be used, or in some examples a mixture of CT and GS butterfly units. To facilitate the additional efficiencies (i.e., a reduction in hardware requirements / chip surface area), further processing may be required to undertake a pre-processing and / or a post-processing step. Whilst this requires additional hardware in the form of a pre-processing module 240 (for NTT operations when a GS butterfly unit is used) or a post-processing module 260 (for iNTT operations when a CT butterfly unit is used) the additional hardware realestat e / processing required for such pre- and post-processing steps is minimal when compared to duplication of the butterfly units for performance of both NTT and iNTT operations. The pre- and post-processing steps may comprise applying different algorithms to the input 230 (in the case of NTT) or to the output 270 (in the case of iNTT). For example, the pre-processing module 240, may apply a multiplication of the input 230 by powers of (p, whereas the post-processing module 260 may apply a multiplication of the output 270 by the powers of <p-1. In this case, CT butterfly units may be used for both NTT and iNTT operations. When using CT butterfly units, the pre-processing may be merged with the multiplication of w in the CT butterfly unit and therefore, pre-processing by the pre-processing module 240 is not required. Conversely, when using GS butterfly units, the post-processing may be merged with the multiplication with w-1 in the GS butterfly unit, and so no additional post-processing by the post-processing module 260 may be required. In another example, for NTT operations, a decimation-in-time (DiT) algorithm may be applied to the input 230 and for iNTT operations a decimation-in-frequency (DiF) algorithm may be applied to generate an iNTT output 270. The DiT algorithm may take an input in a normal order and outputs a bit-reversed order (DiTno^bo) whereas the DiF algorithm takes an input in a bit-reversed order and provides an output in a normal order (DiFbo->no). As such, the use of the preprocessing module 240 and post-processing module 260 has a reduced critical path and requires fewer hardware resources. It will be appreciated that the pre- and post-processing modules 240, 260 may also apply other computations to the input 230 and / or output 270, such as multiplication by n'1 when performing an iNTT operation. By undertaking such pre- and postprocessing steps, a single data path, requiring no additional multiplexers and control signals can be used for both NTT and iNTT data-path selection (see Figures 3a and 3b described below) with a single type of butterfly unit. In some examples, as described above, the pre-processing module 240 may not be required, and the pre-processing step may be merged with the computations undertaken by the butterfly units BF(1), BF(2), ..., BF(n), when CT butterfly units are used. The post-processing module 260 is still required since the post-processing cannot be merged with the multipliers of a CT butterfly unit. This results in even simpler hardware, as only a single additional multiplier is required to form the post-processing module 260. Returning to the NTT engine 200 of Figure 2, as described above, the engine 200 is configured to perform both NTT and iNTT operations using a plurality of stages ST(1), ST(2), ..., ST(n). The number of stages is dependent on both the size of the butterfly units BF(1), BF(2), ..., BF(n), and the configuration of the commutator units 100, such as the R2DMC 100a and R4DMC 100b commutator units previously described with reference to Figures laand lb. As described below in relation to Figures 3a and 3b, the data path is dependent on the operation being computed, either an NTT or an iNTT operation, and will receive the respective inputs. When performing an NTT operation, the input 230 is received (optionally via a pre-processing module 240) at ST(1), whereas when performing an iNTT operation, the input 250 is received at ST(n). The plurality of multiplexers 210a, 210b, 210c, 210d are used to select which operation is being performed. That is, the control (not shown) of the multiplexers 210a, 210b, 210c, 210d will indicate whether an NTT operation (data path ‘0’ of the multiplexers) is being performed or whether an iNTT operation (data path ‘ 1 ’ of the multiplexers in Figure 2) is being performed. Using the multiplexers 210a, 210b, 210c, 210d enables a more efficient hardware configuration for the engine 200, enabling the engine 200 to undertake both NTT and iNTT operations using the same hardware modules. This removes the need for duplication of hardware for performing both NTT and iNTT data paths. In the NTT data path, the stages ST(1), ST(2),..., ST(n) are undertaken in order, whereas in the iNTT data path, the stages ST(1), ST(2), ..., ST(n) are undertaken in a reverse order, as indicated by the respective inputs 230 (NTT), 250 (iNTT). A first stage ST( 1) (or last stage if performing an iNTT operation) comprises only a butterfly unit BF(1), whereas each of the other stages comprises a commutator unit 100a, 100b and a butterfly unit BF(2).. BF(n), alongside a multiplexer 220a, 220b controllable to indicate the data path being performed (i.e., NTT or iNTT) as will become apparent in the description of the data paths in Figures 3a and 3b. The number of stages in the NTT engine 200 is dependent on the configuration of the butterfly units and the commutator units 100a, 100b. For example, where an R2DMC unit, such as the R2DMC unit 100a described above in relation to Figure la is used, and the engine 200 is configured to process two coefficients in parallel for a 256-point polynomial per clock cycle. In such an example, there may be eight stages made up of ST(1) comprising only a butterfly unit BF(1), and ST(2) - ST(8) each comprising the R2DMC units 100a and butterfly units BF(2) - BF(8). Each stage ST(1) - ST(8) may be predicated by a multiplexer 210a, 210b, 210c, 21 Od to indicate the type of operation to undertake. When an input, such as an NTT input 230 or an iNTT input 250 is received, the multiplexers are configured to arrange stages ST(1) - ST(8) such that the desired data path can be used, and the same hardware used to perform either the NTT or the iNTT operation and provide an output 270. In another example, where an R4DMC unit, such as the R4DMC unit 100b described above in relation to Figure lb is used, the engine 200 is configured to process four coefficients in parallel for a 256-point polynomial per clock cycle. In such an example, there may be four stages made up of ST(1) comprising only a butterfly unit BF(1), and ST(2) - ST(4) each comprising the R4DMC units 100b and butterfly units BF(2) - BF(4). Each stage ST(1) - ST(4) may be predicated by a multiplexer 210a, 210b, 210c, 210d to indicate the type of operation to undertake. When an input, such as an NTT input 230 or an iNTT input 250 is received, the multiplexers are configured to arrange stages ST(1) - ST(4) such that the desired data path can be used, and the same hardware used to perform either the NTT or the iNTT operation and provide an output 270. As described above in relation to the R2DMC unit 100a and R4DMC unit 100b of Figures la and lb, the delay buffers 110a, 110b, 110c, 1 lOd and the switch 120, 130 may be sized according to the position in the processing pipeline. For example, in ST(2), the delay buffers 100a, 100b of an R2DMC unit 100a may be sized appropriately. That is delay buffer 110b (both at the input and output of the switch 120) may be sized for a 64-blocks of delay (width equal to the size of the input 230) whilst the buffer 110a is sized for a O-bit delay or is not present, and the switch 120 is sized for processing 12-bit or 23-bit inputs. In ST(3), delay buffer 110b (both at the input and output of the switch 120) may be sized for a 32-blocks of delay (sized according to the input 230), whilst the buffer 110a is sized for a O-bit delay or is not present. The switch 120 of ST(3) may also be sized for processing 12-bit or 23-bit inputs (or based on the size of an input received at the switch 120 of ST(3)). In the example, described above where R2DMC units 100a are used for processing two coefficients in parallel, the delay buffer 110b sizes and the switch 120 size for each of the stages may be as set out in Table 1. A similar configuration is present when using R4DMC units 100b. For example, in ST(2), the delay buffers 100a, 100b, 100c, lOOd of an R4DMC unit 100b may be sized appropriately. That is delay buffer 110b, 100c, and lOOd (both at the input and output of the switch 120) may be sized to provide a delay having a total size equal to 16 times the size of the input 230 whilst the buffer 110a is sized for a O-bit delay or is not present, and the switch 130 sized for processing 12-bit or 23-bit inputs as described above. In ST(3), delay buffer 110b, 100c, and lOOd (both at the input and output of the switch 120) may be sized for a 4-bit, 8-bit, and 12-bit delay, whilst the buffer 110a is sized for a O-bit delay or is not present. The switch 130 of ST(3) may also be sized for processing 12 bits or 23 bits as described above. In the example, described above where R4DMC units 100b are used for processing four coefficients in parallel, the delay buffer 110b, 100c, lOOd sizes and the switch 130 size for each of the stages may be as set out in Table 2. Stage Delay buffer (110b) size Switch (120) size ST(1) N / A N / A ST(2) 64-cycle delay 12 / 23-bits ST(3) 32-cycle delay 12 / 23-bits ST(4) 16-cycle delay 12 / 23-bits ST(5) 8-cycle delay 12 / 23-bits ST(6) 4-cycle delay 12 / 23-bits ST(7) 2-cycle delay 12 / 23-bits ST(8) 1-cycle delay 12 / 23-bit Table 1 - R2DMC Switch and Buffer Sizes Stage Delay buffer (110b) size Delay buffer (110c) size Delay buffer (llOd) size Switch (130) size ST(1) N / A N / A N / A N / A ST(2) 16-cycle delay 32-cycle delay 48-cycle delay 12 / 23-bits ST(3) 4-cycle delay 8-cycle delay 12-cycle delay 12 / 23-bits ST(4) 1-cycle delay 2-cycle delay 3-ycle delay 12 / 23-bits Table 2 - R4DMC Switch and Buffer Sizes The use of R2DMC 100a or R4DMC 100b alongside the butterfly units BF(1), BF(2), . .., BF(n) enables a fully unrolled and parallel design, such that in-order output coefficients 270 are produced (for NTT) and in-order input 250 is used for (iNTT). This also means that there is no requirement for storing the coefficients between the stages for onward processing, reducing the need for first-in-first-out operation calls to memory by 50% and simplifying control and scheduling overheads. In addition to the hardware benefits, such as a reduction in the hardware resources required, the engine 200 is also capable of implementing different algorithms for performing NTT and iNTT operations, such as Dilithium, ML-KEM, ML-DSA, and Kyber. In some examples, the hardware implementation of the engine 200 enables implementation of the Kyber algorithm supporting 128th root-of-unity and requires processing up to seven stages (when using R2DMC). To indicate that the output is to be taken at the seventh stage a ‘Kyber, or ML-KEM bypass’ 280 may be used to indicate that the output 270 is to be taken after the seventh stage, enabling the last butterfly unit BF(n) to be bypassed. As mentioned above, the hardware implementation of the engine 200 may be configured for performing both NTT and iNTT operations. Figure 3a shows schematically the engine 200 configured to undertake an NTT operation. As described above, the engine comprises a plurality of stages ST(1), ST(2), ..., ST(n), comprising a plurality of butterfly units BF(1), BF(2), ..., BF(n), and some of the stages ST(2)... ST(n) comprising commutator units 100 such as the R2DMC 100a or R4DMC 100b units described above in relation to Figures la and lb. When performing an NTT operation, the multiplexers 210a, 210b, 210c, 2 lOd, 220a, 220b are configured for the NTT data path (indicated by path ‘0’ in the example of Figure 3a). This configuration arranges the data flow, such that the stages are taken in order, that is ST(1) first, followed by ST(2), and so on. An input 230 is received, possibly via a pre-processing module (not shown), as described above, into a first of the multiplexers 210a which passes the input through to the first stage ST(1) for processing by the corresponding butterfly unit B F(1). The output of butterfly unit BF( 1) is then passed through another multiplexer 210b into the second stage ST(2). At the second stage ST(2), a commutator unit 100 (either an R2DMC 100a, or R4DMC100b) applies the necessary delays and passes the output through another multiplexer 220a to the second stage’s ST(2) butterfly unit BF(2). The output of the second stage’s ST(2) butterfly unit BF(2) is then passed onto a third stage ST(3) - not shown - and so on. The output of a penultimate stage ST(n-l) - not shown is passed through a multiplexer 210c into the last stage ST(n). At the last stage ST(n), a commutator unit 100 (either an R2DMC 100a, or R4DMC100b) applies the necessary delays and passes the output through another multiplexer 220b to the last stage’s ST(n) butterfly unit BF(n). The output of the last stage’s ST(n) butterfly unit BF(n) is then passed through a final multiplexer 210d and output 270. As described above, the number of stages ST(1), ST(2), ..., ST(n), and as such, the number of multiplexers 210a, 210b, 210c, 210d, 220a, 220a is dependent on the type of commutator units 100 used, and the respective sizes of the delays and switch units contained therein. Figure 3b shows schematically the engine 200 configured to undertake an iNTT operation. As described above, the engine comprises a plurality of stages ST(1), ST(2), ..., ST(n), comprising a plurality of butterfly units BF(1), BF(2).. BF(n), and some of the stages ST(2)...ST(n) comprising commutator units 100 such as the R2DMC 100a or R4DMC 100b units described above in relation to Figures la and lb. When performing an iNTT operation, the multiplexers 210a, 210b, 210c, 210d, 220a, 220b are configured for the iNTT data path (indicated by path ‘ 1’ in the example of Figure 3b). This configuration arranges the data flow, such that the stages are taken in a reverse order, that is ST(n) first, followed by ST(n-l), and so on. An input 250 is received at the multiplexer 220b of the last stage ST(n) and passed to the respective butterfly unit BF(n). The output of the butterfly unit BF(n) is then passed through multiplexer 210a into the commutator unit 100 (either an R2DMC 100a, or R4DMC100b) of the last stage ST(n). The commutator unit 100 of the last stage ST(n) applies the necessary delays and passes the output to the multiplexer of the penultimate stage ST(n-l) - not shown. The output from the butterfly unit BF(n-l) of the penultimate stage ST(n-l) - not shown - is then passed to the preceding stage and so on. The output of the third stage’s ST(3) butterfly unit BF(3) - not shown is then passed through the multiplexer 220a of the second stage ST(2) for processing by the second stage’s ST(2) butterfly unit BF(2). The output of the second stage’s ST(2) butterfly unit BF(2) is then passed through multiplexer 210b to be processed by the second stage’s commutator unit 100 which applies the necessary delays and passes the output through another multiplexer 210a to the first stage ST(1) for processing by the first stage’s butterfly unit BF(1). The output of the first stage’s ST(1) butterfly unit BF(1) is then provided to multiplexer 21 Od (possibly through a post-processing module - not shown) to be output 270. It will be appreciated that the functions and operations described above may be implemented in software, hardware or a combination of software and hardware. At least some aspects of the examples described herein, with reference to Figures 1^3, comprise computer processes performed in processing systems or processors. However, in some examples, the disclosure also extends to computer programs, particularly computer programs on or in an apparatus, adapted for putting the disclosure into practice. The program may be in the form of non-transitory source code, object code, a code intermediate source and object code such as in partially compiled form, or in any other non-transitory form suitable for use in the implementation of processes according to the disclosure. The apparatus may be any entity or device capable of carrying the program. For example, the apparatus may comprise a storage medium, such as a solid-state drive (SSD) or other semiconductor-based RAM; a ROM, for example, a CD ROM or a semiconductor ROM; a magnetic recording medium, for example, a floppy disk or hard disk; optical memory devices in general; etc. In the preceding description, for purposes of explanation, numerous specific details of certain examples are set forth. Reference in the specification to "an example" or similar language means that a particular feature, structure, or characteristic described in connection with the example is included in at least that one example, but not 5 necessarily in other examples. The above examples are to be understood as illustrative examples of the disclosure, and whilst the description relates to the performance of NTT and iNTT operations for use in polynomial multiplication, it will be appreciated that the NTT and iNTT operations described may be used as a part of other operations. Further examples 10 of the disclosure are envisaged. It is to be understood that any feature described in relation to any one example may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the example, or any combination of any other of the examples. Furthermore, equivalents and modifications not described above may also be employed without 15 departing from the scope of the disclosure, which is defined in the accompanying claims.

Claims

1. An apparatus for performing an operation, the apparatus comprising:a plurality of butterfly units;a plurality of commutator units, each commutator unit comprising:at least one delay buffer; anda switch unit; anda plurality of multiplexers, wherein the multiplexers are configured to arrange the plurality of commutator units and the plurality of butterfly units in either a first configuration or a second configuration, where the first configuration or the second configuration is selected based on a type associated with the operation.

2. The apparatus for performing an operation according to claim 1, wherein:in the first configuration, the plurality of commutator units and the plurality of butterfly units are configured in a first order to perform a number theoretic transform, NTT, operation, andin the second configuration, the plurality of commutator units and the plurality of butterfly units are configured in a second order to perform an inverse number theoretic transform, iNTT, operation.

3. The apparatus for performing an operation according to any previous claim, where the at least one delay buffer and the switch unit of a given commutator unit are sized based on a position of the given commutator unit in the first configuration or the second configuration.

4. The apparatus for performing an operation according to any previous claim, further comprising an input module for receiving an NTT input or iNTT input, where the NTT input and the iNTT input are polynomial inputs.

5. The apparatus for performing an operation according to claim 4, where the polynomial input comprises two coefficients, and where each butterfly unit is configured to process the two coefficients.

6. The apparatus for performing an operation according to claim 5, wherein each of the plurality of commutator units comprises two delay buffers, and where:a first delay buffer is arranged to receive a first of the two coefficients; andthe switch unit of the given commutator unit is arranged to receive a second of the two coefficients and to output two results, where a first result is provided to a second delay buffer.

7. The apparatus for performing an operation according to claim 5 or claim 6, where the apparatus comprises eight butterfly units and seven commutator units.

8. The apparatus for performing an operation according to claim 4, where the polynomial input comprises four coefficients, and the butterfly unit is configured to process the four coefficients.

9. The apparatus for performing an operation according to claim 8, wherein each of the plurality of commutator units comprises six delay buffers, and where:a first group of delay buffers comprises three of the six delay buffers, and a second group of delay buffers comprises a different three of the six delay buffers, such that each delay buffer of the first group receives one of the four coefficients; andthe switch unit of the given commutator unit is arranged to receive a fourth of the four coefficients not received by any one of the first group of delay buffers and to output four results, where three of the four results are provided to the delay buffers of the second group of delay buffers.

10. The apparatus for performing an operation according to claim 8 or claim 9, where the apparatus comprises four butterfly units and three commutator units.

11. The apparatus according to any previous claim, wherein a given butterfly unit, of the plurality of butterfly units, that is configured to output a result of the operation comprises a bypass input arranged to facilitate the bypassing of the given butterfly unit in the processing of the operation.

12. The apparatus according to claim 11, wherein the bypass input indicates that the operation is implemented for a Kyber or ML-KEM scheme.

13. The apparatus according to any previous claim, where the apparatus is implemented on a field programmable gate array.

14. The apparatus according to any previous claim, where the apparatus is implemented as part of an application-specific integrated circuit.

15. The apparatus according to any previous claim, wherein all of the plurality of butterfly units supporting either:a Cooley-Tukey butterfly unit; or a Gentleman-Sande butterfly unit.

16. The apparatus according to claim 15, further comprising a pre-processing module configured to apply at least one pre-processing operation to an input to the operation when the plurality of butterfly units are Gentleman-Sande butterfly units.

17. The apparatus according to claim 15, further comprising a post-processing module configured to apply at least one post-processing operation to an output of the operation when the plurality of butterfly units are Cooley-Tukey butterfly units.

18. A computer program for controlling a data processing apparatus to provide an instruction execution environment comprising:instruction decoding circuitry to decode an operation;processing circuitry to perform data processing on the NTT input or the iNTT input in response to the operation, wherein the processing circuitry is configured to provide at least:a plurality of butterfly units;a plurality of commutator units, each commutator unit comprising: at least one delay buffer; anda switch unit; anda plurality of multiplexers, wherein the multiplexers are configured to arrange the plurality of commutator units and the plurality of butterfly units in either a first configuration or a second configuration, where the first5 configuration or the second configuration is selected based on a type associatedwith the operation.

Images