Plantard Reduction

Thomas Plantard's technique, published in 2021, is the newest of the three and shaves roughly one pipeline stage off Montgomery on modern FPGA fabric.

Its prerequisites are that $q$ fits in a machine word of 16 or 32 bits, and that a single-cycle word-sized multiplication is available. Both hold for ML-KEM and ML-DSA.

01.The idea

Plantard combines the two earlier tricks. It uses Barrett's scaling idea together with Montgomery's precomputed modular inverse, arranged so the answer falls into a symmetric range $[-q, q)$ directly, without Montgomery's separate step to force divisibility by $R$.

Take $R = 2^w$ for the word size $w$, and precompute

$$\tilde{q} \;=\; -q^{-1} \bmod R^2 ,$$

a signed $2w$-bit constant. Given $x$ in a signed range around zero:

P1. $u = x \cdot \tilde{q} \bmod R^2$, taken as a signed $2w$-bit integer. One multiplication with the high bits discarded.

P2. $t = (u \cdot q) \gg w$, taking the high word of the product.

P3. A fixed correction, and optionally one conditional add, moves $t$ into $[0, q)$.

After P2 the value already lies in $[-q, q)$. Only the final move into a non-negative range needs any correction at all.

02.Why it is faster

Count the steps that touch a multiplier.

Montgomery has three: computing $u$, computing $uq$, and adding $T$ back before the shift.

Plantard has two: computing $u$ and computing $uq$. The arrangement makes the wanted bits land in the high word directly, so the add-then-shift of Montgomery's step M2 disappears.

On AMD UltraScale+ and Intel Stratix-10 fabric, published results report maximum-frequency improvements in the ten to twenty percent range against Montgomery at comparable area. That is a clock-frequency gain rather than a cycle-count gain, which is exactly the kind of improvement the critical-path argument from the overview predicts.

03.Why it is worth flagging as an opportunity

The technique is recent, and the published hardware-accelerator literature for ML-KEM and ML-DSA is still dominated by Montgomery. Most designs predate Plantard or were derived from ones that did.

So a unified transform datapath built on a Plantard butterfly is a genuinely underexplored design point rather than a solved problem. Combined with the shared-datapath question from Chapter 4, of whether one engine can serve both a length-128 incomplete transform and a length-256 complete one, that is the concrete research opening this book exists to support.

Two honest caveats, since this is the one place the chapter points at unpublished work.

The improvement is fabric-dependent. A gain of ten to twenty percent on one vendor's DSP arrangement does not automatically transfer to another vendor, and it may not transfer to an ASIC at all, where the multiplier is not a fixed hard block. Any claim has to be measured on the target technology rather than cited.

And the constant-time requirement applies unchanged. Plantard's output range is symmetric around zero, which means the final correction involves a conditional add on a sign bit. That is the same hazard as the conditional subtraction in the other two methods, with the same branchless remedy, and getting it wrong costs the key regardless of how fast the arithmetic is.