[Paper Review] Frobenius Additive Fast Fourier Transform

Wen-Ding Li, Ming-Syan Chen⋆+3 more|arXiv (Cornell University)|Feb 12, 2018

Coding theory and cryptography14 references3 citations

TL;DR

This paper introduces the Frobenius Additive Fast Fourier Transform (FAFFT), a novel FFT-based method for efficient binary polynomial multiplication in small degrees by leveraging the Frobenius map in finite fields. It achieves a record-low bit-operation count—29,005 for degree <256—surpassing Karatsuba and prior FFT methods, marking the first time FFT-based multiplication outperforms Karatsuba at such low degrees in terms of bit operations.

ABSTRACT

In ISSAC 2017, van der Hoeven and Larrieu showed that evaluating a polynomial P in GF(q)[x] of degree

Motivation & Objective

• To overcome the conventional wisdom that FFT is inefficient for small-degree polynomial multiplication due to high hidden constants.
• To generalize the Frobenius FFT technique from multiplicative roots of unity to additive FFT structures based on Cantor and Gao-Mateer.
• To reduce the number of bit operations in binary polynomial multiplication, especially for small degrees relevant to cryptography and coding theory.
• To demonstrate that FFT-based multiplication can outperform Karatsuba-like algorithms in terms of bit-operation count at degrees as low as 256.
• To provide a practical code generator for FAFFT-based multiplication, publicly available for deployment in embedded and cryptographic systems.

Proposed method

• The method extends the Frobenius FFT framework to additive FFT structures, using the Frobenius map to exploit symmetries in finite field extensions.
• It applies the additive FFT algorithm of Cantor and Gao-Mateer, which uses polynomial division over Artin-Schreier extensions in characteristic 2.
• The Frobenius map is used to reduce the number of operations by leveraging field automorphisms that fix the base field 𝔽₂.
• The algorithm is optimized for binary polynomials by operating in 𝔽₂^d and using a basis adapted to the additive structure of the extension field.
• A code generator is implemented to automatically produce optimized procedures for polynomial multiplication using FAFFT.
• For large-degree multiplication on modern CPUs, the method is adapted to use PCLMULQDQ instructions by restricting evaluation points to a subset of 𝔽₂^128.

Experimental results

Research questions

• RQ1 Can the Frobenius FFT technique be generalized from multiplicative to additive FFT structures in finite fields?
• RQ2 Can FAFFT achieve lower bit-operation counts than Karatsuba-like algorithms for binary polynomial multiplication at small degrees?
• RQ3 Does the Frobenius additive FFT outperform existing FFT-based methods such as Kronecker or standard additive FFT in terms of bit operations?
• RQ4 Can FAFFT be efficiently adapted for use on modern CPUs with specialized instructions like PCLMULQDQ?
• RQ5 What is the performance ceiling of FFT-based multiplication in terms of bit operations for small-degree binary polynomials?

Key findings

• For polynomial degree <256, the FAFFT method requires only 29,005 bit operations, setting a new record and outperforming the prior best result of 33,397.
• At degree 128, the method achieves 11,556 bit operations, only 0.78% slower than the previous best of 11,466, demonstrating near-optimality.
• The method outperforms Kronecker-based FFT implementations by a factor of approximately 2 in bit-operation count, consistent with theoretical expectations from Frobenius FFT.
• On Intel Skylake architecture, the FAFFT variant using PCLMULQDQ outperforms all prior implementations (e.g., FDFT, ADFT, gf2x) for degrees up to 2^23.
• For Koblitz curves (e.g., sect233k1, sect239r1, BBE251), the FAFFT reduces bit operations compared to prior methods, enabling faster arithmetic in binary elliptic curve cryptography.
• This work is the first to show that FFT-based multiplication can outperform Karatsuba-like algorithms in bit-operation count at such low degrees, challenging prior assumptions.