Modular reduction is a crucial operation in many post-quantum cryptographic schemes, including the Kyber key exchange method or Dilithium signature scheme. However, it can be computationally expensive and pose a performance bottleneck in hardware implementations. To address this issue, we propose a novel approach for computing modular reduction efficiently in hardware for arbitrary static moduli. Unlike other commonly used methods such as Barrett or Montgomery reduction, the method does not require any multiplications. It is not dependent on properties of any particular choice of modulus for good performance and low area consumption. Its major strength lies in its low area consumption, which was reduced by 60% for optimized and up to 90% for generic Barrett implementations for Kyber and Dilithium. Additionally, it is well suited for parallelization and pipelining and scales linearly in hardware resource consumption with increasing operation width. All operations can be performed in the bit-width of the modulus, rather than the size of the number being reduced. This shortens carry chains and allows for faster clocking. Moreover, our method can be executed in constant time, which is essential for cryptography applications where timing attacks can be used to obtain information about the secret key.

翻译：模约减是许多后量子密码方案（包括Kyber密钥交换方法和Dilithium签名方案）中的关键操作。然而，该操作在硬件实现中可能计算开销巨大，并成为性能瓶颈。针对此问题，我们提出了一种新颖方法，可在硬件中针对任意静态模数高效实现模约减。与巴雷特约减或蒙哥马利约减等常用方法不同，本方法无需任何乘法运算。其性能优势与低面积消耗不依赖于特定模数选取。该方法的核心优势在于极低的面积消耗——针对Kyber与Dilithium的优化巴雷特实现可降低60%面积，通用巴雷特实现甚至可降低90%面积。此外，该方法天然支持并行化与流水线设计，硬件资源消耗随运算位宽线性增长。所有操作可在模数位宽范围内完成，而非受被约减数位宽限制，从而缩短进位链并支持更高时钟频率。更重要的是，本方法可在恒定时间内执行，这对防范利用计时攻击窃取密钥信息的密码学应用至关重要。