Ring-Learning-with-Errors (RLWE) has emerged as the foundation of many important techniques for improving security and privacy, including homomorphic encryption and post-quantum cryptography. While promising, these techniques have received limited use due to their extreme overheads of running on general-purpose machines. In this paper, we present a novel vector Instruction Set Architecture (ISA) and microarchitecture for accelerating the ring-based computations of RLWE. The ISA, named B512, is developed to meet the needs of ring processing workloads while balancing high-performance and general-purpose programming support. Having an ISA rather than fixed hardware facilitates continued software improvement post-fabrication and the ability to support the evolving workloads. We then propose the ring processing unit (RPU), a high-performance, modular implementation of B512. The RPU has native large word modular arithmetic support, capabilities for very wide parallel processing, and a large capacity high-bandwidth scratchpad to meet the needs of ring processing. We address the challenges of programming the RPU using a newly developed SPIRAL backend. A configurable simulator is built to characterize design tradeoffs and quantify performance. The best performing design was implemented in RTL and used to validate simulator performance. In addition to our characterization, we show that a RPU using 20.5mm2 of GF 12nm can provide a speedup of 1485x over a CPU running a 64k, 128-bit NTT, a core RLWE workload

翻译：环错误学习（Ring-Learning-with-Errors, RLWE）已成为提升安全性与隐私保护的诸多关键技术（包括同态加密和后量子密码学）的基础。尽管前景广阔，这些技术因在通用计算设备上运行时存在极高的开销而应用受限。本文提出一种新型向量指令集架构（ISA）及其微架构，用于加速RLWE中的环计算。该ISA命名为B512，旨在满足环处理工作负载需求的同时，兼顾高性能与通用编程支持能力。相较于固定硬件架构，采用ISA可在制造后持续改进软件，并适应不断演进的工作负载。基于此，我们提出了环形处理单元（RPU），作为B512的高性能模块化实现方案。RPU具备原生大整数模运算支持、超宽并行处理能力，以及大容量高带宽暂存器，充分满足环处理需求。我们通过新开发的SPIRAL后端解决了RPU的编程挑战，并构建了可配置模拟器以表征设计权衡及量化性能。最优设计方案已通过寄存器传输级（RTL）实现并用于验证模拟器性能。除性能表征外，我们证明采用20.5mm² GF 12nm工艺的RPU在运行64k位128位NTT（RLWE核心工作负载）时，相比CPU可取得1485倍加速比。