Constant geometric structure-based radix-4NTT hardware architecture and memory access method thereof

Abstract

The invention discloses a radix-4NTT hardware architecture based on a constant geometric structure and a memory access method thereof, and belongs to the technical field of lattice passwords. In order to improve the calculation speed of the NTT operation unit in the lattice password, the device comprises a control unit, an address generator, a twiddle factor memory, a coefficient memory, a multiplexer and a PE operation unit, the control unit is connected with the address generator, the address generator is respectively connected with the twiddle factor memory and the coefficient memory, the twiddle factor memory is connected with the PE operation unit, and the coefficient memory is connected with the PE operation unit through the multiplexer; a memory bank is arranged in the coefficient memory; and a radix-4 butterfly operation unit is arranged in the PE operation unit. According to the invention, an efficient storage scheme is designed, so that 8 coefficients can be read in one period, and the calculation speed of the NTT operation unit in the lattice password is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of lattice cryptography, and in particular relates to a radix-4NTT hardware architecture based on a constant geometric structure and a memory access method thereof. Background Art

[0002] With the rapid development of quantum computing technology, traditional public key cryptographic algorithms are at risk of being cracked by Shor's quantum algorithm. The National Institute of Standards and Technology (NIST) identified four post-quantum cryptographic algorithms in 2022, three of which are based on difficult mathematical problems on lattices. In lattice cryptography based on the module learning with errors (MLWE) problem, the NTT computing unit consumes a lot of computing resources.

[0003] NTT is a method that uses a divide-and-conquer strategy to quickly calculate the Discrete Fourier Transform (DFT). The core idea is to select N unit primitive roots and evaluate them under the integer ring modulo p, and convert the polynomial coefficient representation into a point value representation. N-point NTT is defined as:

[0004]

[0005] The vector (a0, a1, ... a N-1 ) are polynomial coefficients, (A0,A1,...,A N-1 ) is the result of NTT transformation, ω N is the rotation factor. NTT in the polynomial ring field On operation, represents all polynomials with coefficients in the ring of integers modulo p. In the MLWE-based lattice cipher, the modulo polynomial f(x) is x n +1, the Negative-Wrapped Convolution (NWC) method can be used to avoid zero padding, but the prime number p needs to satisfy p≡1mod2N. This method requires preprocessing the input vector before performing the NTT transformation. The preprocessing formula is:

[0006]

[0007] In the formula is the square root of the rotation factor. This method increases the amount of modular multiplication operations. In order to reduce the computational complexity, the preprocessing operation can be incorporated into NTT. The formula is as follows:

[0008]

[0009] Radix-2NTT groups the above formulas according to the parity of the input vector subscripts, and then simplifies them by using the reducibility, symmetry, and periodicity of the rotation factors. It takes log2N stages to complete the radix-2NTT of N points, and a total of (N / 2)log2N modular multiplications, modular additions, and modular subtractions. Radix-2NTT is characterized by its simple structure and flexible configuration, but when multiple radix-2 butterfly units operate in parallel, a higher memory bandwidth is required. It takes log4N stages to complete the radix-4NTT of N points, and a total of Nlog4 N The radix-4NTT algorithm introduces constant coefficient multiplication, which can be implemented using shift and addition operations, thereby reducing the overhead of hardware resources. The radix-4NTT algorithm is characterized by high operation speed, but the control logic and data flow are complex.

[0010] There are two main data flow structures for NTT. NTT based on in-situ computing structure does not require additional storage space when implemented in hardware, and has the same input and output addresses, but the coefficient reading mode is different in each stage. NTT based on constant geometry structure has consistent data flow within each stage and between stages, which simplifies the coefficient reading mode, but usually requires double the storage space. Summary of the invention

[0011] The problem to be solved by the present invention is to improve the calculation speed of the NTT operation unit in the lattice cipher, and propose a radix-4NTT hardware architecture based on a constant geometric structure and a memory access method thereof.

[0012] To achieve the above object, the present invention is implemented through the following technical solutions:

[0013] A base-4NTT hardware architecture based on a constant geometry structure, including a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit;

[0014] The control unit is connected to an address generator, the address generator is respectively connected to a rotation factor memory and a coefficient memory, the rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit through a multiplexer; a storage body is arranged in the coefficient memory; and a radix-4 butterfly operation unit is arranged in the PE operation unit.

[0015] Furthermore, the control unit generates the number of stages S, the number of steps C, the number of groups G, the number of rounds T and the rotation factor storage address in the NTT operation process, where S = 1, 2..., log4N-1, C = 0, 1,..., N / 8-1, G = 0, 1, 2, 3, T = 0, 1,..., N / 32-1, N is the total number of unit primitive roots, and the control unit also generates an enable signal for the coefficient memory and the rotation factor memory.

[0016] Furthermore, the coefficient memory is used to store polynomial coefficients, and the coefficient memory includes four storage bodies, namely the zeroth storage body Bank0, the first storage body Bank1, the second storage body Bank2, and the third storage body Bank3, and is implemented using a dual-port Block RAM in an FPGA device; the number of storage addresses of each storage body is 7N / 32, and one address stores two coefficients; each stage reads N / 8 steps of data from the storage body, and each step reads two coefficients from one address of the four storage bodies, and these 8 data are calculated by a radix-4 butterfly operation unit and then written back to the corresponding address of each storage body.

[0017] Furthermore, the address generator is used to generate a storage body original address, a storage body new address and a storage body enable signal.

[0018] Furthermore, the rotation factor memory is used to store the rotation factors pre-calculated during the NTT operation.

[0019] Furthermore, the multiplexers are two groups of multiplexers. The four multiplexers in the first group are used to control the reading of polynomial coefficients from the corresponding storage body, and the four multiplexers in the second group are used to control the writing of the corresponding reorganized data back to the storage body.

[0020] Furthermore, two parallel radix-4 butterfly operation units are provided in the PE operation unit for completing NTT calculation;

[0021] Each radix-4 butterfly operation unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, using K 2 -RED algorithm improves modular multiplication operation, K 2 The first step of the -RED algorithm multiplies the two input operands, and then performs two K-RED operations on the product Z;

[0022] In K-RED operation, set the modulus p = k·2 m +1, k is an odd number, and 2 m > k, assuming that the high and low bits of the product result are Z h and Z l , then Z l =Zmod2 m , Z h =Z / 2 m The final output result is R = kZ l -Z h; The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the value combination of sign1 and sign2 is used for verification in the verifier, and the obtained verification value is added to the numerical bit of the second K-RED output result to obtain the final modular multiplication result.

[0023] Further, the radix-4 NTT method based on constant geometry structure provided in each radix-4 butterfly operation unit comprises the following steps:

[0024] S1. Set the input parameter to the polynomial coefficient a∈R p , the square root of the rotation factor The total number of primitive roots of unity N, modulus p;

[0025] S2. Set the first variable s, the second variable k, the third variable J and the fourth variable j, where the value of the first variable s ranges from 0 to log4N-1, J=4 s , the value of the second variable k is 0 to N / (4J)-1, the value of the fourth variable j is 0 to J-1, and the polynomial coefficients of each butterfly unit input are controlled by variables s, k, J and j;

[0026] S3. Set i = 2bit-reversed(k) + 1, then the corresponding 4 rotation factors included in a base-4 butterfly operation unit first generate the basic rotation factor ω m , the expression is:

[0027]

[0028] Then the calculation expression of the rotation factor in the asynchronous operation is:

[0029]

[0030]

[0031]

[0032] is a constant coefficient;

[0033] S4. Set the radix-4 butterfly operation unit to two layers of operation. The expression of the first layer of operation is:

[0034] T0=(a[kJ+j]+a[kJ+j+2N / 4]·ω2)mod p

[0035] T1=(a[kJ+j]-a[kJ+j+2N / 4]·ω2)mod p

[0036] T2=(a[kJ+j+N / 4]ω1+a[kJ+j+3N / 4]·ω3)mod p

[0037] T3=(a[kJ+j+N / 4]ω1-a[kJ+j+3N / 4]·ω3)mod p

[0038] The expression of the second layer operation is:

[0039] A[4kJ+4j]=(T0+T2)mod p

[0040]

[0041] A[4kJ+4j+2]=(T0-T2)modp

[0042]

[0043] S5. The base-4NTT method based on constant geometry generates N / 4 step indexes in each stage. Four coefficient indexes need to be generated in each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is N / 4-1. At the same time, the difference between the indexes in each step is N / 4; then the difference between the 4 positions stored after the data calculation is 1, and the difference between the asynchronous first positions is 4. The output result is finally stored in a position different from the coefficient reading.

[0044] A memory access method based on a base-4NTT hardware architecture with a constant geometry structure is implemented by relying on the base-4NTT hardware architecture with a constant geometry structure, and comprises the following steps:

[0045] Step 1. The prerequisite for setting the non-conflicting address access mode is that N is greater than 16 and is a power of 4;

[0046] Step 2. The read address rule of the non-conflicting address access mode is: read the same address from the four memory banks in each step, read the memory bank addresses sequentially between each step, and when the last address of the memory bank is read, the first address of the memory bank is read in the next step. Then the address read from each memory bank in step number C is expressed as:

[0047] Cmod7N / 32

[0048] Step 3. Set the write address rule of the conflict-free address access mode as follows: If the N / 8 steps in each stage are divided into 4 groups, each group has N / 32 rounds, then the address offset between the rounds in the group is 4. When the address space is insufficient, it continues to the first address for subsequent offsets. The N / 8 addresses written back to the storage body by each group are the same, and the addresses of the same round data written back to the same storage body by different groups are different. Then the new address of the data of round number T of group number G in the Sth stage written back to the sth storage body is:

[0049] (4T+(sG)mod4+N·S / 8)mod7N / 32.

[0050] Beneficial effects of the present invention:

[0051] The radix-4 NTT hardware architecture based on a constant geometry structure described in the present invention reduces the clock cycle of the NTT operation unit in the lattice cipher by combining preprocessing operations and eliminating reordering operations.

[0052] The present invention discloses a base-4 NTT hardware architecture based on a constant geometry structure, designs an efficient storage solution, realizes the reading of 8 coefficients in one cycle, and improves the calculation speed of the NTT operation unit in the lattice cipher.

[0053] The invention discloses a base-4NTT hardware architecture based on a constant geometry structure, and designs an efficient non-conflicting address access mode. Compared with the traditional ping-pong storage method, the storage space is reduced from Reduced to Reduced memory usage by 12.5% ​​and reduced hardware resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a structural schematic diagram of a base-4NTT hardware architecture based on a constant geometry structure according to the present invention;

[0055] Figure 2 This is a schematic diagram of the base-4 butterfly unit structure of the present invention;

[0056] Figure 3 Schematic diagram of the base-4NTT memory access method based on constant geometric structure of 1024 points of the present invention, in which (a) is the first memory bank, (b) is the second memory bank, (c) is the third memory bank, and (d) is the fourth memory bank;

[0057] Figure 4 Schematic diagram of a modular multiplication operation unit with a modulus p=12289 according to the present invention;

[0058] Figure 5 It is a schematic diagram of the checker of the present invention;

[0059] Figure 6Pseudocode for the base-4NTT algorithm based on constant geometry. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0061] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0062] In order to further understand the content, features and effects of the present invention, the following specific implementation methods are given as examples, and the attached Figure 1 -Attached Figure 6 The detailed instructions are as follows:

[0063] Embodiment 1:

[0064] A base-4NTT hardware architecture based on a constant geometry structure, including a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit;

[0065] The control unit is connected to an address generator, the address generator is respectively connected to a rotation factor memory and a coefficient memory, the rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit through a multiplexer; a storage body is arranged in the coefficient memory; and a radix-4 butterfly operation unit is arranged in the PE operation unit.

[0066] Furthermore, the control unit generates the number of stages S, the number of steps C, the number of groups G, the number of rounds T and the rotation factor storage address in the NTT operation process, where S = 1, 2..., log4N-1, C = 0, 1,..., N / 8-1, G = 0, 1, 2, 3, T = 0, 1,..., N / 32-1, N is the total number of unit primitive roots, and the control unit also generates an enable signal for the coefficient memory and the rotation factor memory.

[0067] Furthermore, the coefficient memory is used to store polynomial coefficients, and the coefficient memory includes four storage bodies, namely the zeroth storage body Bank0, the first storage body Bank1, the second storage body Bank2, and the third storage body Bank3, and is implemented using a dual-port Block RAM in an FPGA device; the number of storage addresses of each storage body is 7N / 32, and one address stores two coefficients; each stage reads N / 8 steps of data from the storage body, and each step reads two coefficients from one address of the four storage bodies, and these 8 data are calculated by a radix-4 butterfly operation unit and then written back to the corresponding address of each storage body.

[0068] Furthermore, the total storage capacity of the coefficient memory is

[0069] Furthermore, the address generator is used to generate a storage body original address, a storage body new address and a storage body enable signal.

[0070] Further, the original address of the storage body is the address to be read from the storage body, and the new address of the storage body is the address written back to the storage body after the butterfly unit operation;

[0071] Furthermore, the rotation factor memory is used to store the rotation factors pre-calculated during the NTT operation.

[0072] Furthermore, the multiplexers are two groups of multiplexers. The four multiplexers in the first group are used to control the reading of polynomial coefficients from the corresponding storage body, and the four multiplexers in the second group are used to control the writing of the corresponding reorganized data back to the storage body.

[0073] Furthermore, Figure 1 The left MUXs in the figure contain 4 multiplexers, which are used to control the reading of polynomial coefficients from the corresponding storage body. Then, the data at the output of each selector is decomposed and sent to the corresponding input of the two butterfly operation units. The specific decomposition process is that the high-order data at the output of the Lth selector is sent to the Lth input of the first butterfly unit, and the low-order data is sent to the Lth input of the second butterfly unit (L=1, 2, 3, 4). The control signals of the first group of 4 selectors are c%4, (c+1)%4, (c+2)%4 and (c+3)%4, respectively. c starts from 0 and increases by 1 after each step of data is read. When the data at the output of the butterfly unit is reorganized, Figure 1The four multiplexers on the right side of the MUXs in are used to control the corresponding reorganized data to be written back to the storage body. The specific reorganization process is the data splicing of the first and third output ends of the first butterfly unit, the data splicing of the second and fourth output ends of the first butterfly unit, the data splicing of the first and third output ends of the second butterfly unit, and the data splicing of the second and fourth output ends of the second butterfly unit. The control signals of the second group of four selectors are b%4, (b+1)%4, (b+2)%4 and (b+3)%4, respectively. b starts from 0, and b decreases by 1 after each N / 32 steps of data are written. The output data of the first selector is written back to Bank0, the output data of the second selector is written back to Bank1, the output data of the third selector is written back to Bank2, and the output data of the fourth selector is written back to Bank3.

[0074] Furthermore, two parallel radix-4 butterfly operation units are provided in the PE operation unit for completing NTT calculation;

[0075] Furthermore, the base-4NTT algorithm is derived as follows:

[0076] According to the input index subscript, the original sequence is divided into four parts, the formula is as follows:

[0077]

[0078] According to the properties of the rotation factor, the formula can be simplified to obtain:

[0079]

[0080] In the formula According to the above method, the formula is disassembled and reassembled, so that the matrix multiplication process is split into two layers of operations. The first layer of operations includes and The second layer of operations includes A i =(T0+T2)modp, A i+2N / 4 =(T0-T2)modp and Radix-4 butterfly unit such as Figure 2 As shown, N-point base-4NTT requires radix-4 butterfly operation unit;

[0081] Each radix-4 butterfly operation unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, using K 2 -RED algorithm improves modular multiplication operation, K 2 The first step of the -RED algorithm multiplies the two input operands, and then performs two K-RED operations on the product Z;

[0082] In K-RED operation, set the modulus p = k·2 m +1, k is an odd number, and 2 m > k, assuming that the high and low bits of the product result are Z h and Z l , then Z l =Zmod2 m , Z h =Z / 2 m The final output result is R = kZ l -Z h ; The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the value combination of sign1 and sign2 is used for verification in the verifier, and the obtained verification value is added to the numerical bit of the second K-RED output result to obtain the final modular multiplication result.

[0083] Furthermore, the output result after two consecutive K-RED operations is not the modular multiplication result A·Bmodp, but A·B·k 2 modp, so in order to ensure the correct output of the modular multiplication result, the pre-calculated rotation factor needs to be multiplied by k -2 ;

[0084] In order to further reduce the clock cycle, the NTT operation order is adjusted to avoid reordering the input data, thus realizing the NTT algorithm with input order and output reverse order. In order to simplify the coefficient access method, the radix-4 NTT algorithm based on constant geometry structure is adopted.

[0085] Further, the radix-4 NTT method based on constant geometry structure provided in each radix-4 butterfly operation unit comprises the following steps:

[0086] S1. Set the input parameter to the polynomial coefficient a∈R p , the square root of the rotation factor The number of points involved in the NTT operation, N, modulus p;

[0087] S2. Set the first variable s, the second variable k, the third variable J and the fourth variable j, where the value of the first variable s ranges from 0 to log4N-1, J=4 s , the value of the second variable k is 0 to N / (4J)-1, the value of the fourth variable j is 0 to J-1, and the polynomial coefficients of each butterfly unit input are controlled by variables s, k, J and j;

[0088] S3. Set i = 2bit-reversed(k) + 1, then the corresponding 4 rotation factors included in a base-4 butterfly operation unit first generate the basic rotation factor ω m , the expression is:

[0089]

[0090] Then the calculation expression of the rotation factor in the asynchronous operation is:

[0091]

[0092]

[0093]

[0094]

[0095] S4. Set the radix-4 butterfly operation unit to two layers of operation. The expression of the first layer of operation is:

[0096] T0=(a[kJ+j]+a[kJ+j+2N / 4]·ω2)mod p

[0097] T1=(a[kJ+j]-a[kJ+j+2N / 4]·ω2)mod p

[0098] T2=(a[kJ+j+N / 4]ω1+a[kJ+j+3N / 4]·ω3)mod p

[0099] T3=(a[kJ+j+N / 4]ω1-a[kJ+j+3N / 4]·ω3)mod p

[0100] The expression of the second layer operation is:

[0101] A[4kJ+4j]=(T0+T2)mod p

[0102]

[0103] A[4kJ+4j+2]=(T0-T2)mod p

[0104]

[0105] S5. The base-4NTT method based on constant geometry generates N / 4 step indexes in each stage. Four coefficient indexes need to be generated in each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is N / 4-1. At the same time, the difference between the indexes in each step is N / 4; then the difference between the 4 positions stored after the data calculation is 1, and the difference between the asynchronous first positions is 4. The output result is finally stored in a position different from the coefficient reading.

[0106] The following is an example of specific password parameters, using the parameters of modulus p = 12289, N = 1024:

[0107] 1) The control unit generates the number of stages S (S = 1, 2, 3, 4, 5), the number of steps C (C = 0, 1, ..., 127), the number of groups k1 (k1 = 0, 1, 2, 3), the number of rounds k2 (k2 = 0, 1, ..., 31) and the rotation factor storage address in the NTT operation process, and generates an enable signal for the coefficient memory and the rotation factor memory.

[0108] 2) The coefficient memory includes four memory banks, each of which has 224 storage addresses and one address stores two coefficients, so the total storage capacity is 6272 bits.

[0109] 3) It takes 5 stages to complete the 1024-point constant geometry-based base-4NTT, each stage requires 128 steps, and each step reads 8 data from 4 memory banks.

[0110] 4) The rotation factor memory is used to store the pre-calculated rotation factors during the NTT operation. The rotation factor values ​​can be obtained from Table 1. In order to ensure the output of the correct modular multiplication result, the pre-calculated rotation factor needs to be multiplied by 3 -2 .

[0111] 5) It takes 5 stages to complete the 1024-point constant geometry-based radix-4 NTT algorithm, and each stage requires 256 radix-4 butterfly unit operations. Taking the first step of the first stage as an example, the first layer of operations of the first radix-4 butterfly operation unit includes:

[0112]

[0113]

[0114]

[0115]

[0116] The second level of operations of the first radix-4 butterfly unit includes:

[0117] (T0+T2)mod12289

[0118] (T0-T2)mod12289

[0119]

[0120]

[0121] The first level of operations of the second radix-4 butterfly unit includes:

[0122]

[0123]

[0124]

[0125]

[0126] The second layer of operations of the second radix-4 butterfly operation unit includes:

[0127] (T0+T2)mod12289

[0128] (T0-T2)mod12289

[0129]

[0130]

[0131] The modular multiplication operation in the butterfly unit is performed by K 2 -RED algorithm is completed as Figure 4 and Figure 5 As shown. Since the modulus satisfies p = 12289 = 3·2 12 +1, so K can be used 2 -RED algorithm. This algorithm needs to perform K-RED twice. First, the two 14-bit input operands are multiplied to obtain a 28-bit product result. The upper 16 bits and lower 12 bits of the product result are recorded as Ch and Cl respectively. Then 3Cl-Ch is calculated to obtain a 17-bit signed number (the first sign bit is recorded as sign1). Then, a second K-RED is performed. The 16-bit numerical bit of the first K-RED output result is divided into the upper 4 bits and the lower 12 bits, recorded as Ch' and Cl' respectively. Then 3Cl'-Ch' is calculated to obtain a 15-bit signed number (the first sign bit is recorded as sign2). Finally, the combination of the values ​​of sign1 and sign2 is verified in the verifier, and the obtained verification value is added to the lower 14 bits of the second K-RED output result to obtain the final modular multiplication result.

[0132] 6) Two groups of multiplexers are needed in total. The four multiplexers in the first group are used to control the reading of polynomial coefficients from the corresponding storage body, and then the data at the output of each selector is decomposed and sent to the corresponding input of the two butterfly operation units. The control signals of the first group of four selectors are c%4, (c+1)%4, (c+2)%4 and (c+3)%4, respectively. c starts from 0 and increases by 1 each time until 639. After the data at the output of the butterfly unit is reorganized, the second group of four multiplexers are used to control the corresponding reorganized data to be written back to the storage body. The control signals of the second group of four selectors are b%4, (b+1)%4, (b+2)%4 and (b+3)%4, respectively. b starts from 0 and decreases by 1 every time 32 steps of data are written. The output data of the first selector is written back to Bank0, the output data of the second selector is written back to Bank1, the output data of the third selector is written back to Bank2, and the output data of the fourth selector is written back to Bank3.

[0133] Embodiment 2:

[0134] A memory access method based on a base-4NTT hardware architecture with a constant geometry structure is implemented based on a base-4NTT hardware architecture with a constant geometry structure described in Example 1, and includes the following steps:

[0135] Step 1. The prerequisite for setting the non-conflicting address access mode is that N is greater than 16 and is a power of 4;

[0136] Step 2. The read address rule of the non-conflicting address access mode is: read the same address from the four memory banks in each step, read the memory bank addresses sequentially between each step, and when the last address of the memory bank is read, the first address of the memory bank is read in the next step. Then the address read from each memory bank in step number C is expressed as:

[0137] Cmod7N / 32

[0138] Step 3. Set the write address rule of the conflict-free address access mode as follows: If the N / 8 steps in each stage are divided into 4 groups, each group has N / 32 rounds, then the address offset between the rounds in the group is 4. When the address space is insufficient, it continues to the first address for subsequent offsets. The N / 8 addresses written back to the storage body by each group are the same, and the addresses of the same round data written back to the same storage body by different groups are different. Then the new address of the data of round number T of group number G in the Sth stage written back to the sth storage body is:

[0139] (4T+(sG)mod4+N·S / 8)mod7N / 32.

[0140] Further examples are as follows:

[0141] Since the data flow structure of each stage is the same, base-4 only discusses the conflict-free memory access mode of the first stage. Figure 3 As shown. For ease of description, the 128 steps in the first stage are divided into 4 groups, each with 32 rounds. In step 0 of the first stage, the polynomial coefficients a[0] and a[1], a

[256] and a

[257] , a

[512] and a

[513] , a

[768] and a

[769] are taken out from address 0 of Bank0, Bank1, Bank2, and Bank3 in parallel. After these 8 coefficients are calculated by the butterfly unit, the new data A[0] and A[1] are written back to address 128 of Bank0, A[2] and A[3] are written back to address 129 of Bank1, A[4] and A[5] are written back to address 130 of Bank2, and A[6] and A[7] are written back to address 131 of Bank3. Until the 31st step of the first stage (i.e. the 31st round of group 0), the polynomial coefficients a

[318] and a

[319] , a

[574] and a

[575] , a

[830] and a

[831] , a

[62] and a

[63] are taken out from the 31st address of Bank0, Bank1, Bank2 and Bank3 in parallel. After the 8 coefficients are calculated by the butterfly unit, the new data A

[248] and A

[249] are written back to the 28th address of Bank0, A

[250] and A

[251] are written back to the 29th address of Bank1, A

[252] and A

[253] are written back to the 30th address of Bank2, and A

[254] and A

[255] are written back to the 31st address of Bank3. In the subsequent steps of the first stage, according to the above storage rules, the addresses read from the storage body in each step are read sequentially and continuously, and each group is written back to the same address, but the addresses of the same round of data written back to the same storage body in different groups are different. For example, the 127th step of the first stage (i.e., the 31st round of the 3rd group) parallelly extracts the polynomial coefficients a

[510] and a

[511] , a

[766] and a

[767] , a

[1022] and a

[1023] , a

[254] and a

[255] from the 127 addresses of Bank0, Bank1, Bank2, and Bank3 respectively. After the eight coefficients are calculated by the butterfly unit, the new data A

[1018] and A

[1019] are written back to address 29 of Bank0, A

[1020] and A

[1021] are written back to address 30 of Bank1, A

[1022] and A

[1023] are written back to address 31 of Bank2, and A

[1016] and A

[1017] are written back to address 28 of Bank3. At this point, the first stage of calculation is completed. The remaining four stages are consistent with the read and write memory access rules of the first stage.

[0142] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0143] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and parts thereof may be replaced with equivalents without departing from the scope of the present application. In particular, as long as there is no structural conflict, the various features in the specific embodiments disclosed in the present application may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A base-4NTT hardware architecture based on a constant geometry structure, characterized in that: It includes a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit; The control unit is connected to an address generator, the address generator is respectively connected to a rotation factor memory and a coefficient memory, the rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit through a multiplexer; a storage body is arranged in the coefficient memory; and a radix-4 butterfly operation unit is arranged in the PE operation unit.

2. The base-4NTT hardware architecture based on constant geometry according to claim 1, characterized in that: The control unit generates the number of stages S, the number of steps C, the number of groups G, the number of rounds T and the rotation factor storage address in the NTT operation process, where S = 1, 2..., log4N-1, C = 0, 1,..., N / 8-1, G = 0, 1, 2, 3, T = 0, 1,..., N / 32-1, N is the number of points involved in the NTT operation, and the control unit also generates an enable signal for the coefficient memory and the rotation factor memory.

3. A base-4NTT hardware architecture based on constant geometry according to claim 1 or 2, characterized in that: The coefficient memory is used to store polynomial coefficients. The coefficient memory includes four storage bodies, namely the zeroth storage body Bank0, the first storage body Bank1, the second storage body Bank2, and the third storage body Bank3, and is implemented using a dual-port Block RAM in an FPGA device; the number of storage addresses of each storage body is 7N / 32, and one address stores two coefficients; each stage reads N / 8 steps of data from the storage body, and each step reads two coefficients from one address of the four storage bodies. These 8 data are calculated by a radix-4 butterfly operation unit and then written back to the corresponding address of each storage body.

4. The base-4NTT hardware architecture based on constant geometry according to claim 3, characterized in that: The address generator is used to generate a storage body original address, a storage body new address and a storage body enable signal.

5. The base-4NTT hardware architecture based on constant geometry according to claim 4, characterized in that: The rotation factor storage is used to store the pre-calculated rotation factors during the NTT operation.

6. The base-4NTT hardware architecture based on constant geometry according to claim 5, characterized in that: The multiplexers are two groups of multiplexers. The four multiplexers in the first group are used to control the reading of polynomial coefficients from the corresponding storage body, and the four multiplexers in the second group are used to control the writing of the corresponding reorganized data back to the storage body.

7. The base-4NTT hardware architecture based on constant geometry according to claim 5, characterized in that: The PE computing unit is provided with two parallel radix-4 butterfly computing units for completing NTT calculations; Each radix-4 butterfly operation unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, using K 2 -RED algorithm completes the modular multiplication operation, K 2 The first step of the -RED algorithm multiplies the two input operands, and then performs two K-RED operations on the product Z; In K-RED operation, set the modulus p = k·2 m +1, k is an odd number, and 2 m > k, assuming that the high and low bits of the product result are Z h and Z l , then Z l =Zmod2 m , Z h =Z / 2 m The final output result is R = kZ l -Z h ; The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the value combination of sign1 and sign2 is used for verification in the verifier, and the obtained verification value is added to the numerical bit of the second K-RED output result to obtain the final modular multiplication result.

8. The base-4NTT hardware architecture based on constant geometry according to claim 6, characterized in that: The constant geometry radix-4 NTT method provided in each radix-4 butterfly operation unit comprises the following steps: S1. Set the input parameter to the polynomial coefficient a∈R p , the square root of the rotation factor The number of points involved in the NTT operation, N, modulus p; S2. Set the first variable s, the second variable k, the third variable J and the fourth variable j, where the value of the first variable s ranges from 0 to log4N-1, J=4 s , the value of the second variable k is 0 to N / (4J)-1, the value of the fourth variable j is 0 to J-1, and the polynomial coefficients of each butterfly unit input are controlled by variables s, k, J and j; S3. Set i = 2bit-reversed(k) + 1, then the corresponding 4 rotation factors included in a base-4 butterfly operation unit first generate the basic rotation factor ω m , the expression is: Then the calculation expression of the rotation factor in the asynchronous operation is: is a constant coefficient; S4. Set the radix-4 butterfly operation unit to two layers of operation. The expression of the first layer of operation is: T0=(a[kJ+j]+a[kJ+j+2N / 4]·ω2)mod p T1=(a[kJ+j]-a[kJ+j+2N / 4]·ω2)mod p T2=(a[kJ+j+N / 4]ω1+a[kJ+j+3N / 4]·ω3)mod p T3=(a[kJ+j+N / 4]ω1-a[kJ+j+3N / 4]·ω3)mod p The expression of the second layer operation is: A[4kJ+4j]=(T0+T2)mod p A[4kJ+4j+2]=(T0-T2)modp A[4kJ+4j+3]=(T1-T3 ω4 1 )modp; S5. The base-4NTT method based on constant geometry generates N / 4 step indexes in each stage. Four coefficient indexes need to be generated in each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is N / 4-1. At the same time, the difference between the indexes in each step is N / 4; then the difference between the 4 positions stored after the data calculation is 1, and the difference between the asynchronous first positions is 4. The output result is finally stored in a position different from the coefficient reading.

9. A memory access method based on a base-4NTT hardware architecture with a constant geometry structure, implemented by a base-4NTT hardware architecture with a constant geometry structure according to any one of claims 1 to 8, characterized in that: The steps include: Step 1. The prerequisite for setting the non-conflicting address access mode is that N is greater than 16 and is a power of 4; Step 2. The read address rule of the non-conflicting address access mode is: read the same address from the four memory banks in each step, read the memory bank addresses sequentially between each step, and when the last address of the memory bank is read, the first address of the memory bank is read in the next step. Then the address read from each memory bank in step number C is expressed as: Cmod7N / 32 Step 3. Set the write address rule of the conflict-free address access mode as follows: If the N / 8 steps in each stage are divided into 4 groups, each group has N / 32 rounds, then the address offset between the rounds in the group is 4. When the address space is insufficient, it continues to the first address for subsequent offsets. The N / 8 addresses written back to the storage body by each group are the same, and the addresses of the same round data written back to the same storage body by different groups are different. Then the new address of the data of round number T of group number G in the Sth stage written back to the sth storage body is: (4T+(sG)mod4+N·S / 8)mod7N / 32.

Images