Brendan Lynskey · Portfolio home · Interactive sites
FHE Accelerator Simulators
How long does a CKKS bootstrap take on a given accelerator? Is the design bound by NTT throughput or by evaluation-key traffic? How much on-chip SRAM stops key traffic dominating, and does an optical NTT engine win once conversion energy and precision corrections are counted? Five interactive decks and a tested SimPy simulator work through these questions. They run from CKKS as a hardware workload and the anatomy of bootstrapping, through the simulator itself (live in the browser, a bit-exact JavaScript port) and optical transform engines, to design-space results, a reading list and practice questions.
Live index: https://brendanjameslynskey.github.io/FHE_Hub_Accelerator_Simulators/
Presentations in this series
| # | Title | Status | What it covers |
|---|
| 01 | FHE for Hardware Engineers: CKKS as a Workload | live | CKKS seen from the datapath, not the proof: RNS polynomials in Z_q[X]/(X^N+1), how big ciphertexts and evaluation keys really are, the five primitive kernels (NTT, modular multiply-add, automorphism, base conversion, rescale), noise and levels, and why key switching dominates. Includes a live parameter calculator. |
| 02 | Anatomy of CKKS Bootstrapping | live | ModRaise, CoeffToSlot (a homomorphic DFT evaluated with baby-step giant-step rotations), EvalMod (a polynomial approximation of modular reduction) and SlotToCoeff, with exact operation counts per stage, where the levels go, and the data-movement profile that makes bootstrapping a memory problem. |
| 03 | Simulating an FHE Accelerator | live | The modelled machine (NTT units, modular multiply-add lanes, an automorphism network, a scratchpad, HBM and key streaming), the operation-trace format and where traces come from (a scheme model, HEIR, OpenFHE), the SimPy engine, its metrics and its validation ladder, and the whole simulator running live in the browser. |
| 04 | Optical NTT Engines: Precision, Conversion and Power | live | Fourier transforms in optics, and what it takes to map an exact modular NTT onto an analogue complex FFT: digit decomposition, small-prime RNS, rounding and error correction, ENOB, DAC/ADC energy from a Walden figure of merit, and laser and thermal-tuning power. The simulator then shows when an optical engine wins and when it loses. |
| 05 | Results and the Design Space | live | What the simulator says: SRAM size against key traffic, the NTT-bound and memory-bound regimes, power and energy per bootstrap under a TDP, the algorithmic acceleration techniques, a design-space sweep, silicon area as a third axis (a three-way power, performance and area front), the model's limitations, a reading list (F1, CraterLake, BTS, ARK, SHARP, GPU work, HEIR, OpenFHE, Lattigo) and practice questions. |
Companion code
| Repo | What's inside |
|---|
| FHE_Accelerator_Sim | A SimPy discrete-event simulator of an FHE accelerator running CKKS bootstrapping: a scheme model that turns bootstrapping into NTT, base-conversion, multiply-add and automorphism kernels; NTT, MAC, automorphism and optional optical units; a scratchpad whose misses become evaluation-key, plaintext and ciphertext traffic over shared HBM; bound attribution, hot-spots, Perfetto traces; a power model with a dynamic power manager under a TDP, and DVFS; an optical precision model with a functional check; OpenFHE calibration and two recorded OpenFHE bootstrap traces it replays; a front end for the HEIR compiler with three HEIR-compiled programs; algorithm options (hoisting, Min-KS, seeded keys, on-the-fly plaintexts, OpenFHE's lazy ModDown, SlotToCoeff-first ordering); an area, yield and silicon-cost model (7 nm, calibrated from ARK's published breakdown and a CACTI sweep, illustrative); 126 tests; and the JavaScript port used live in decks 03 and SimEng 13. |
Headline results
- A baseline bootstrap on the ARK-class design takes 13.94 ms and is memory-bound: evaluation keys are 6.74 GB of the 12.44 GB of HBM traffic.
- Min-KS, seeded keys and on-the-fly plaintexts cut it to 7.19 ms (MAC-bound); on an NTT-starved design the same techniques make it slower (17.46 ms to 26.65 ms).
- Area, the third axis (7 nm, illustrative): the ARK-class die is 457.9 mm². Memory-bound, 128 MiB more SRAM saves 3.74 ms per 100 mm² added against 0.21 ms for doubling the compute.
Every number is read from examples/results.md when this README is built. Hardware coefficients are illustrative.
How to read this series
Decks 01 and 02 cover what is being simulated: CKKS as a workload, and bootstrapping stage by stage. Deck 03 is the simulator, its trace format, metrics and validation, with the live port. Deck 04 examines optical NTT engines. Deck 05 collects the results, the limitations, a reading list and practice questions. All hardware coefficients in the simulator are illustrative, and every number in the decks comes from a recorded run (examples/results.py in the code repo).
Glossary: concepts and where they are explained
Every concept the decks rely on, with links to the slides that explain it in depth (this series, the Cryptography decks, or LLM Inference Simulators). The same glossary, with anchors each deck links to, is on the live index.
| Concept | What it is | Where it is explained |
|---|
| LWE and Ring-LWE | The hard problems FHE rests on: given noisy linear equations b = a·s + e (mod q), recovering s is hard. Ring-LWE works with polynomials instead of vectors, so one sample carries N coefficients, which is what makes NTTs the core kernel. | Cryptography 08 · LWE; Cryptography 08 · Ring-LWE |
| CKKS | The FHE scheme for approximate arithmetic on real or complex vectors. Values are encoded with a scale Δ; noise is treated as rounding error; each multiplication is followed by a rescale that consumes one level. | Cryptography 08 · CKKS; FHESim 01 · noise, scale and levels |
| RNS polynomials and limbs | The ciphertext modulus Q is a product of word-sized primes, so each polynomial is stored as one row ('limb') of N residues per prime. A ciphertext at level ℓ has ℓ+1 limbs; all arithmetic stays in 64-bit words. | FHESim 01 · the data: RNS polynomials; Cryptography 08 · RNS and NTT |
| Number-theoretic transform (NTT) | The FFT over a finite field Z_q. It moves a limb between coefficient and evaluation form in (N/2) log N butterflies, so polynomial multiplication becomes element-wise. Every key switch and rescale runs NTTs. | Cryptography 08 · RNS and NTT; Cryptography 10 · the NTT; ; |
Where this fits
- FHE fundamentals: the Cryptography section of the Mathematics hub, especially Cryptography 08: Fully Homomorphic Encryption and Cryptography 10: Crypto Hardware Accelerator Design.
- Simulator methodology: the sister series LLM Inference Simulators (discrete-event simulation, metrics and validation, power and energy, accelerating simulators, PyTorch/ONNX/HEIR integration). Its code repo, Disaggregated_Inference_Sim, is the template this one follows.
- Optics for LLM inference: the sister series Fourier Optics for Inference (live) applies FHESim 04's precision and conversion-energy model to LLM inference, with a simulated optical prefill pool.
- Engineering practice: the related series Simulation Engineering Toolkit (Rust and PyO3 ports, testing frameworks, CI, specifications, memory-system and RTL co-simulation, and more).
- New to simulation? Start with Introduction to Simulation (live), an engineering-wide on-ramp from field solvers to system models.
- Indexed from the Hardware hub.
