Ring-Learning-with-Errors (RLWE) has emerged as the foundation of many important techniques for improving security and privacy, including homomorphic encryption and post-quantum cryptography. While promising, these techniques have received limited use due to their extreme overheads of running on general-purpose machines. In this paper, we present a novel vector Instruction Set Architecture (ISA) and microarchitecture for accelerating the ring-based computations of RLWE. The ISA, named B512, is developed to meet the needs of ring processing workloads while balancing high-performance and general-purpose programming support. Having an ISA rather than fixed hardware facilitates continued software improvement post-fabrication and the ability to support the evolving workloads. We then propose the ring processing unit (RPU), a high-performance, modular implementation of B512. The RPU has native large word modular arithmetic support, capabilities for very wide parallel processing, and a large capacity high-bandwidth scratchpad to meet the needs of ring processing. We address the challenges of programming the RPU using a newly developed SPIRAL backend. A configurable simulator is built to characterize design tradeoffs and quantify performance. The best performing design was implemented in RTL and used to validate simulator performance. In addition to our characterization, we show that a RPU using 20.5mm2 of GF 12nm can provide a speedup of 1485x over a CPU running a 64k, 128-bit NTT, a core RLWE workload

翻译：环学习误差（Ring-Learning-with-Errors, RLWE）已成为诸多提升安全性与隐私性的重要技术（包括同态加密和后量子密码学）的基础。尽管前景广阔，但由于在通用计算设备上运行时存在极高的开销，这些技术的应用仍十分有限。本文提出了一种新型向量指令集架构（ISA）及其微架构，用于加速基于环的RLWE计算。该ISA名为B512，旨在满足环处理负载的需求，同时平衡高性能与通用编程支持能力。采用ISA而非固定硬件设计，可在芯片制造后持续改进软件，并适应不断演进的负载需求。基于此，我们提出了环处理单元（RPU），即B512的高性能模块化实现。RPU原生支持大整数模算术运算，具备极宽并行处理能力，并配备大容量高带宽暂存器以满足环处理需求。我们通过新开发的SPIRAL后端解决了RPU的编程挑战。设计并构建了可配置模拟器以评估设计权衡并量化性能，最终将最优设计实现为寄存器传输级（RTL）并验证了模拟器性能。除特性分析外，我们还证明，采用20.5mm² GF 12nm工艺制造的RPU在运行核心RLWE负载（64k位128位NTT）时，相较于CPU可实现1485倍加速。