Paper 2021/986

Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1

Hanno Becker, Vincent Hwang, Matthias J. Kannwischer, Bo-Yin Yang, and Shang-Yi Yang


We present new speed records on the Armv8-A architecture for the lattice-based schemes Dilithium, Kyber, and Saber. The core novelty in this paper is the combination of Montgomery multiplication and Barrett reduction resulting in “Barrett multiplication” which allows particularly efficient modular one-known-factor multiplication using the Armv8-A Neon vector instructions. These novel techniques combined with fast two-unknown-factor Montgomery multiplication, Barrett reduction sequences, and interleaved multi-stage butterflies result in significantly faster code. We also introduce “asymmetric multiplication” which is an improved technique for caching the results of the incomplete NTT, used e.g. for matrix-to-vector polynomial multiplication. Our implementations target the Arm Cortex-A72 CPU, on which our speed is 1.7× that of the state-of-the-art matrix-to-vector polynomial multiplication in Kyber [Nguyen–Gaj 2021]. For Saber, NTTs are far superior to Toom–Cook multiplication on the Armv8-A architecture, outrunning the matrix-to-vector polynomial multiplication by 2.1×. On the Apple M1, our matrix-vector products run 2.1× and 1.9× faster for Kyber and Saber respectively.

Available format(s)
Publication info
A minor revision of an IACR publication in TCHES 2022
NIST PQCArmv8-ANeonDilithiumKyberSaber
Contact author(s)
hanno becker @ arm com
vincentvbh7 @ gmail com
matthias @ kannwischer eu
by @ crypto tw
nick yang @ chelpis com
2021-11-16: last of 2 revisions
2021-07-23: received
See all versions
Short URL
Creative Commons Attribution


      author = {Hanno Becker and Vincent Hwang and Matthias J.  Kannwischer and Bo-Yin Yang and Shang-Yi Yang},
      title = {Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1},
      howpublished = {Cryptology ePrint Archive, Paper 2021/986},
      year = {2021},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.