Abstract: A method comprises receiving a modulus for a number-theoretic transform of a polynomial and selecting a plurality of prime moduli whose product forms the modulus for the number-theoretic transform, wherein the plurality of prime moduli are selected by giving preference to prime moduli having fewer ones in a binary representation of the prime moduli. For each prime modulus in the plurality of prime moduli: dividing a coefficient of the polynomial into segments and performing modular reduction of the segments relative to the prime modulus. Performing the modular reduction of at least one segment comprises implementing a multiplication of a value by a modular reduction of a base value relative to the prime modulus using a shift-add-unit having a smaller area requirement than a modular multiplier. A modular reduction of the coefficient relative to the prime modulus is determined based on the modular reductions of the segments.