Inside a Photonic Link Module
Part I · Today's module · Chapter 8 of 18

From a 4-point kernel to an NTT

Bit planes, the j→ω substitution and the four-step split turn a 4-point optical DFT into an exact number-theoretic transform.

An NTT assembled from the optical 4-point kerneltextbookpaper
NTT animation (loads when scrolled into view)
Every butterfly's operands go through the optical core one bit plane at a time; the FPGA recombines the planes, substitutes j → ω and applies the twiddles. All values are computed by the model in your browser and match the Python reference exactly.
xn=∑b2bxn(b)\hl{plane}{x_n = \textstyle\sum_b 2^b x_n^{(b)}}
X(b)=DFT4(x(b))\hl{kernel}{X^{(b)} = \mathrm{DFT}_4\big(x^{(b)}\big)}
ak+jbk=∑b2bXk(b)\hl{sum}{a_k + j b_k = \textstyle\sum_b 2^b X_k^{(b)}}
yk=ak+ω bk mod p\hl{omega}{y_k = a_k + \omega\, b_k \bmod p}
zk=yk wik\hl{twiddle}{z_k = y_k\, w^{ik}}

What this stage does

The optical core only ever sees 4-bit words, and it returns their 4-point DFT exactly. Three pieces of arithmetic on the FPGA turn that into a number-theoretic transform (NTT) of wide operands, the workhorse of lattice cryptography and fully homomorphic encryption.

Bit planes

A 4-point butterfly takes four operands. Bit b of each forms a 4-bit word, its b-th plane, and each plane takes one symbol slot. Because the DFT is linear, the DFT of the operands is the shift-and-add of the planes’ DFTs, and every plane’s DFT comes back as exact small integers.

Four operands as bit planestextbook
642542330514708406881612840plane b (bit b of each operand) → one symbol slot
The four operands of the first butterfly of the 16-point example, one plane per bit of the modulus; each column is one 4-bit word for the optical core.

From j to ω

The DFT uses j, a square root of −1. Modulo a prime p ≡ 1 (mod 4) there is an integer ω with ω² ≡ −1, so substituting j → −ω in X_k = Σ x_n (−j)^(nk) gives Σ x_n ω^(nk): the 4-point NTT. The decoded a + jb therefore becomes a + ω·b mod p, one multiply and one add on the FPGA.

Xk=ak+j bk  →  j → −ω    ak+ω bk mod p=∑nxn ωnk (root ω−1),ω2≡−1(modp)X_k = a_k + j\,b_k \;\xrightarrow{\;j \,\to\, -\omega\;}\; \hl{omega}{a_k + \omega\, b_k \bmod p} = \sum_n x_n\, \omega^{nk}\ (\text{root } \omega^{-1}),\qquad \omega^2 \equiv -1 \pmod p

The four-step split

A 16-point transform is a 4×4 grid: 4-point transforms down the columns, twiddle factors, 4-point transforms along the rows. A 64-point transform is a 4×4×4 cube with one more level. Radix 4 decimation in frequency does exactly this, stage by stage, and the animation’s side panel shows which axis each stage works along.

16 points as a 4×4 gridtextbook
Sixty-four points as a 4×4×4 cubetextbook

How it’s modelled

The functional layer is exact integer arithmetic: bit planes, the DFT of each plane, PAM4 with saturation, the 256-entry decode table, shift-and-add, j → ω, and radix 4 decimation-in-frequency and decimation-in-time NTTs built only from that kernel plus twiddles mod p. The simulator’s tests check the optical NTT against an independent reference up to 65,536 points (the ring dimension of the larger recorded bootstrap), and against a noisy analogue core at the default LO power. The timing layer counts symbol slots: a w-bit butterfly costs w slots on one wavelength at 14 GBd paper.

For cost, an FPGA butterfly unit is 3 textbook twiddle multiplies, 1 textbook multiply by ω and 8 textbook modular adds, with a multiply costing r adds (5 adds illustrative, swept from 3 to 10). The hybrid removes the 8 adds but pays for recombination (0.25 adds illustrative per plane and output) and its own post-processing.

What we found

At one wavelength and 14 GBd the module delivers 7.988 × 10⁸ /s full-width 4-point transforms on 17-bit operands: about 1.997 FPGA butterfly units. Even at the fastest swept point, eight times the baud on four wavelengths, it is 63.91. Keeping up with the module’s output also takes 2.924 butterfly units’ worth of FPGA post-processing.

Optical-core transform rate vs operand widthpaperillustrative
102030405010⁸10⁹10¹⁰10¹¹width (bits)4-point transforms/s
Optical-core transform rate against operand width (a w-bit butterfly costs w symbol slots), with FPGA references.
Data table
Optical-core transform rate vs operand width
width (bits)14GBd x156GBd x1112GBd x1112GBd x4FPGA k=1FPGA k=16
81.698 × 10⁹6.79 × 10⁹1.358 × 10¹⁰5.432 × 10¹⁰4 × 10⁸6.4 × 10⁹
168.488 × 10⁸3.395 × 10⁹6.79 × 10⁹2.716 × 10¹⁰4 × 10⁸6.4 × 10⁹
177.988 × 10⁸3.195 × 10⁹6.391 × 10⁹2.556 × 10¹⁰4 × 10⁸6.4 × 10⁹
245.658 × 10⁸2.263 × 10⁹4.527 × 10⁹1.811 × 10¹⁰4 × 10⁸6.4 × 10⁹
324.244 × 10⁸1.698 × 10⁹3.395 × 10⁹1.358 × 10¹⁰4 × 10⁸6.4 × 10⁹
403.395 × 10⁸1.358 × 10⁹2.716 × 10⁹1.086 × 10¹⁰4 × 10⁸6.4 × 10⁹
482.829 × 10⁸1.132 × 10⁹2.263 × 10⁹9.053 × 10⁹4 × 10⁸6.4 × 10⁹
552.469 × 10⁸9.876 × 10⁸1.975 × 10⁹7.901 × 10⁹4 × 10⁸6.4 × 10⁹

The ceiling on the gain is set by what the optics actually removes: the 8 modular adds, not the multiplies. That bounds the equal-area speed-up at 1.667× for cheap multiplies (r = 3) and 1.2× for expensive ones (r = 10). With free recombination the hybrid reaches 1.167× at r = 5 against a bound of 1.4×; at the default recombination cost it is 0.6829×, slower than one butterfly unit. Break-even needs recombination at or below 0.05882 add/plane.

Equal-area speed-up vs multiply/add costillustrative
35790.511.5r = mul/add costspeed-up (×)break-even
Equal-area speed-up of the hybrid over FPGA butterfly units against the multiply/add cost ratio. Below 1 the module loses.
Data table
Equal-area speed-up vs multiply/add cost
r = mul/add costAmdahl bound (8 adds removed)w=17, recombine 0w=17, recombine 0.25w=32, recombine 0w=32, recombine 0.25
31.6671.250.60611.250.4167
41.51.20.64861.20.4615
51.41.1670.68291.1670.5
61.3331.1430.71111.1430.5333
71.2861.1250.73471.1250.5625
81.251.1110.75471.1110.5882
91.2221.10.77191.10.6111
101.21.0910.78691.0910.6316
Energy

Per transform the hybrid at the paper’s baud spends 35,779 pJ against 56 pJ on the FPGA alone, and 35,509 pJ of that is the module’s static power (9.7 W paper) spread over too little throughput; the link adds 187.7 pJ. Even at the fastest swept point with free recombination it is 615.1 pJ. Latency tells the same story: an NTT of 65,536 points takes 484.2 µs through the module at the paper’s baud, against 328.1 µs on a single FPGA butterfly unit; at the fastest swept point with a large FPGA back end it is 9.798 µs.

Energy per full-width transformpaperdatasheetillustrative
1020304050101001,00010⁴10⁵width (bits)energy (pJ)
Energy per full-width 4-point transform: static module power charged to the work, link energy on the input bits, and FPGA adds.
Data table
Energy per full-width transform
width (bits)hybrid 14 GBd, k=1hybrid 112 GBd x4, no recombine costFPGA only
827,870314.956
1634,900581.856
1735,780615.156
2441,930848.756
3248,9701,11656
4056,0001,38256
4863,0301,64956
5569,1801,88356

For the module to pay off on NTTs, several things must change together: much higher baud × wavelengths, recombination that is nearly free (or done in the optical or analogue domain), and a static power that scales down with use. Chapter 10 explores that space on a real workload.

What would need measured data

The arithmetic is exact and needs no measurement. What needs data is cost: FPGA resource and power for the post-processing (the recombination cost per plane is the critical illustrative number), the module’s power split between laser, drivers, TIAs and heaters, and how the error rate at higher baud and more wavelengths would force retries.