Reducing LUT utilization in a Vivado HLS design (RSA cryptosystem using montgomery multiplication)

Question

A question/problem for anyone experienced with Xilinx Vivado HLS and FPGA design:

I need help reducing the utilization numbers of a design within the confines of HLS (i.e. can't just redo the design in an HDL). I am targeting the Zedboard (Zynq 7020).

I'm trying to implement 2048-bit RSA in HLS, using the Tenca-koc multiple-word radix 2 montgomery multiplication algorithm, shown below (More algorithm details here):

I wrote this algorithm in HLS and it works in simulation and in C/RTL cosim. My algorithm is here:

#define MWR2MM_m 2048  // Bit-length of operands
#define MWR2MM_w 8     // word size
#define MWR2MM_e 257   // number of words per operand

// Type definitions
typedef ap_uint<1> bit_t;             // 1-bit scan
typedef ap_uint< MWR2MM_w > word_t;     // 8-bit words
typedef ap_uint< MWR2MM_m > rsaSize_t;  // m-bit operand size


/*
 * Multiple-word radix 2 montgomery multiplication using carry-propagate adder
 */
void mwr2mm_cpa(rsaSize_t X, rsaSize_t Yin, rsaSize_t Min, rsaSize_t* out)
{
    // extend operands to 2 extra words of 0
    ap_uint<MWR2MM_m + 2*MWR2MM_w> Y = Yin; 
    ap_uint<MWR2MM_m + 2*MWR2MM_w> M = Min;
    ap_uint<MWR2MM_m + 2*MWR2MM_w> S = 0;

    ap_uint<2> C = 0; // two carry bits
    bit_t qi = 0;     // an intermediate result bit

    // Store concatenations in a temporary variable to eliminate HLS compiler warnings about shift count
    ap_uint<MWR2MM_w> temp_concat=0; 

    //  scan X bit-by bit
    for (int i=0; i<MWR2MM_m; i++)
    {
        qi = (X[i]*Y[0]) xor S[0];

        // C gets top two bits of temp_concat, j'th word of S gets bottom 8 bits of temp_concat
        temp_concat = X[i]*Y.range(MWR2MM_w-1,0) + qi*M.range(MWR2MM_w-1,0) + S.range(MWR2MM_w-1,0);
        C = temp_concat.range(9,8);
        S.range(MWR2MM_w-1,0) = temp_concat.range(7,0);

        // scan Y and M word-by word, for each bit of X
        for (int j=1; j<=MWR2MM_e; j++)
        {
            temp_concat = C + X[i]*Y.range(MWR2MM_w*j+(MWR2MM_w-1), MWR2MM_w*j) + qi*M.range(MWR2MM_w*j+(MWR2MM_w-1), MWR2MM_w*j) + S.range(MWR2MM_w*j+(MWR2MM_w-1), MWR2MM_w*j);
            C = temp_concat.range(9,8);
            S.range(MWR2MM_w*j+(MWR2MM_w-1), MWR2MM_w*j) = temp_concat.range(7,0);

            S.range(MWR2MM_w*(j-1)+(MWR2MM_w-1), MWR2MM_w*(j-1)) = (S.bit(MWR2MM_w*j), S.range( MWR2MM_w*(j-1)+(MWR2MM_w-1), MWR2MM_w*(j-1)+1));
        }
        S.range(S.length()-1, S.length()-MWR2MM_w) = 0;
        C=0;
    }

    // if final partial sum is greater than the modulus, bring it back to proper range
    if (S >= M)
        S -= M;

    *out = S;
}

Unfortunately, the LUT utilization is huge.

This is problematic because I need to be able to fit multiple of these blocks in hardware as axi4-lite slaves.

Could someone please provide a few suggestions as to how I can reduce the LUT utilization, WITHIN THE CONFINES OF HLS?

I've already tried the following:

• Experimenting with different word lengths
• switching the top level inputs to arrays so they are BRAM (i.e. not using ap_uint<2048>, but instead ap_uint foo[MWR2MM_e])
• Experimenting with all sorts of directives: compartmentalizing into multiple inline functions, dataflow architecture, resource limits on lshr, etc.

However, nothing really drives the LUT utilization down in a meaningful way. Is there a glaringly obvious way that I could reduce the utilization that is apparent to anyone?

In particular, I've seen papers on implementations of the mwr2mm algorithm that (only use one DSP block and one BRAM). Is this even worth attempting to implement using HLS? Or is there no way that I can actually control the resources that the algorithm is mapped to without describing it in HDL?

Thanks for the help.