ML-DSA / Dilithium NTT Accelerator

mldsa_ntt is the number-theoretic transform (NTT) core at the heart of post-quantum ML-DSA (Dilithium, FIPS 204) signatures — a bare compute engine with a coefficient-RAM load/read port, not a bus peripheral, so it drops into an accelerator datapath with no protocol layer of its own.

Key Features

• Bare compute-core interface — coefficient-RAM load/read (wr_en/wr_sel/wr_addr/wr_data, rd_addr/rd_data) plus op/start/busy/done, no bus protocol, so it drops into any accelerator datapath as one engine
• Three ops on one Montgomery butterfly: OP_NTT (forward Cooley-Tukey, 8 layers), OP_INTT (inverse Gentleman-Sande + invntt_tomont scale), OP_POINTWISE (r[i] = a[i]·b[i]·R⁻¹) — a·b mod (x²⁵⁶+1) = INTT(POINTWISE(NTT a, NTT b))
• Its own 32-bit ring exactly per Dilithium (q = 8380417, R = 2³², QINV = q⁻¹ mod 2³², 512th root 1753) — distinct from ML-KEM’s 16-bit q = 3329 ring, so it cannot silently reuse mlkem_ntt’s arithmetic
• Proven in system context: the ML-DSA top-level orchestrator instantiates it as engine E_NT on a shared load→run→read driver for the KeyGen matrix-vector product t = A·ŝ1 + s2, one OP_POINTWISE call per matrix element
• Verified bit-exact against a golden model ported line-for-line from the pq-crystals dilithium reference (montgomery_reduce, ntt, invntt_tomont), self-verifying the negacyclic-convolution property before RTL comparison — 256/256 coefficients, forward/round-trip/full-multiply (make mldsa_ntt)
• Continuously-live control-FSM duplicate-DMR shadow catches a corrupted layer/j/k/len sequence -> err_code 9; a dedicated fault-injection hook proves out the op-sequence-parity reporting path -> err_code 1
• ASIL-B SEooC (informational preview): SPFM 92.12%, LFM 94.97%, PMHF 3.86×10⁻⁸/h; coefficient-RAM SECDED is a documented Assumption of Use (wrap in ecc_sram)

Standards & Compliance

NIST FIPS 204 (Module-Lattice-Based Digital Signature Algorithm, ML-DSA/Dilithium); ISO 26262 ASIL-B SEooC (informational preview) — SPFM 92.12%, LFM 94.97%, PMHF 3.86×10⁻⁸/h, all passing the ASIL-B thresholds

Functional Safety

ASIL-B (SEooC) · SPFM 92.12% · LFM 94.97% · PASS

ISO 26262:2018 · FMEDA available · Safety Manual included

Register Map

See datasheet for full register reference.

Getting Started

// Minimal instantiation
mldsa_ntt #(
  .ADDR_W(6)
) u_mldsa_ntt (
  .clk       (clk),
  .rst_n     (rst_n),
  // APB4
  .p_paddr   (paddr),
  .p_psel    (psel),
  .p_penable (penable),
  .p_pwrite  (pwrite),
  .p_pwdata  (pwdata),
  .p_prdata  (prdata),
  .p_pready  (pready),
  // Safety
  .err_clear (1'b0),
  .err_valid (err_valid),
  .err_code  (err_code)
);

Configure via the CTRL register after reset to enable the IP and set operating parameters. Monitor err_valid / err_code for any safety faults reported by the built-in safety monitor.