Evaluating Communication and Architectural Overheads in NTT Accelerators for ML-KEM

The standardization of post-quantum cryptography (PQC) has led to the adoption of ML-KEM, a lattice-based key encapsulation mechanism derived from CRYSTALS-Kyber. ML-KEM heavily relies on polynomial multiplication over the Module Learning With Errors (MLWE) problem, efficiently implemented using the Number Theoretic Transform (NTT). While the NTT significantly reduces computational complexity, its irregular memory access patterns and high arithmetic intensity pose challenges for efficient software execution, especially in constrained environments. Consequently, hardware acceleration has become essential for enabling practical ML-KEM deployment in embedded and edge systems. Recent research has proposed several hardware accelerators for the NTT, but often without demonstrating their effectiveness in accelerating full matrix-vector products within ML-KEM. Designing such accelerators requires careful architectural trade-offs involving memory organization, data movement, parallelism, and system integration. The main contribution of this paper is a comprehensive assessment of communication, memory arrangement, and architectural overheads in NTT accelerators. We analyze state-of-the-art NTT acceleration techniques for ML-KEM and we propose a hardware architecture optimized for efficient matrixvector multiplication. Our NTT-based accelerator is integrated into a RISC-V System-on-Chip (SoC), and we evaluate the impact of key architectural choices (e.g., parallelism on the butterfly units, latency of communication and memory arrangement) on area and performance.