On-loop efficient multiplication optimization method based on sparse ternary polynomial and pre-calculation

Abstract

An on-loop efficient multiplication optimization method based on a sparse ternary polynomial and precomputation belongs to the field of cryptography and comprises the following steps: compressing a cyclic matrix of a prime order domain loop into a single row to obtain a generation operator matrix temp; storing the second column of elements in the temp in an inverted sequence; according to the sparse property of a ternary polynomial and the algebraic structure characteristic of a finite ring (Z / q) [x] / (xp-x-1), through sparse coefficient traversal, table look-up operation is carried out on non-zero coefficients of the ternary polynomial. According to the method, traditional NTT multiplication is replaced by addition and subtraction, the sparse small polynomial characteristics are combined, the theoretical complexity of polynomial multiplication is reduced to be close to O (p) from O (p2), and the operation efficiency is remarkably improved; a compression type precomputation cyclic matrix and a reverse storage strategy are adopted, memory occupation is reduced, the resource utilization rate is improved, the application scene is expanded, and flexibility and practicability are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of cryptography, and particularly relates to an efficient multiplication optimization method on a ring based on sparse ternary polynomials and precomputation. Background Art

[0002] In the field of post-quantum cryptography, lattice-based schemes are very important, especially lattice encryption algorithms with algebraic structures. Most cryptographic schemes are constructed based on algebraic lattices, especially using power-of-2 fractional ring structures such as Kyber and NTRU encryption systems, because they have simple structures and can calculate polynomial multiplication through efficient number-theoretic transforms (NTTs).

[0003] The NTRU encryption system is a public-key cryptosystem based on a polynomial ring. The security of the NTRU encryption system depends on the shortest vector problem (SVP) in a lattice, which is a mathematically difficult problem for which there is currently no algorithm that can be solved in polynomial time, making the NTRU algorithm theoretically resistant to quantum computer attacks. The core of the NTRU algorithm lies in the simplicity of its key generation method and the efficiency of its encryption and decryption speeds. Compared with well-known algorithms such as RSA, the NTRU algorithm has a significant speed advantage. The encryption process of the NTRU algorithm involves polynomial multiplication and modular operations, which not only ensure the security of data transmission but also greatly improve the execution efficiency of the algorithm. The NTRU algorithm has passed the standardization certification of the Institute of Electrical and Electronics Engineers (IEEE) and is particularly suitable for services such as smart cards, secure cellular phone systems, secure faxes, wireless secure data networks, and authentication systems. With the rapid development of information technology and the needs of some high-tech weapon equipment, communication command systems, etc., the military department will use public-key cryptography technology extensively in the future. Since RSA and ECC cannot resist quantum computing attacks, while NTRU can resist quantum computing attacks, and is fast and highly secure, it is particularly suitable for these fields, which also expands the application scope of the public-key cryptosystem. For faster encryption performance and smaller bandwidth sizes, most NTRU encryption systems today are designed and implemented based on ideal lattices. For a fixed polynomial, the corresponding circulant matrix in NTRU is represented as follows:

[0004]

[0005] where each row represents the corresponding operator of the polynomial. The advantage of this representation is that it can reduce the bandwidth size during transmission, and multiplication using polynomials can utilize acceleration techniques such as NTTs. The circulant matrix expanded should be represented as follows:

[0006]

[0007] In a cryptographic system based on the divided ring, the security disadvantages of the divided ring are mainly reflected in its structural characteristics, which make it vulnerable to various types of attacks. The divided ring has rich subfields and a small Galois group, which makes it vulnerable to subfield attacks and attacks that utilize the characteristics of the Galois group. In addition, there are a large number of ring homomorphisms in the divided ring, which provide more attack paths for attackers. Especially for the divided ring of powers of 2, its special structure enables attacks such as the S-unit attack and the CGS14 attack to be executed more efficiently, because these attacks can utilize the unit and principal ideal problems in the divided ring to find short generators or simplify the decoding problem. The CDW21 attack uses the algebraic structure of the divided ring to solve the shortest vector problem, thereby recovering the private key or completing decryption. The automorphism attack and the ring homomorphism attack use the automorphism group and ring homomorphisms of the divided ring to construct units, further threatening the security of the cryptographic system. Generally speaking, these structural characteristics of the divided ring, such as the richness of subfields, the small Galois group, the large number of ring homomorphisms, and the computational efficiency, all provide opportunities for attackers and reduce the security of the cryptographic system based on the divided ring.

[0008] To address the security issues of the ring-based cryptosystem, a domain structure similar to NTRU-Prime is usually introduced to solve the above problems. In 2016, Bernstein et al. proposed an NTRU encryption algorithm based on a prime-order number field, called NTRU Prime (Bernstein D J, Chuengsatiansup C, Lange T, et al. NTRU prime: Reducing attack surface at low cost[C] / / Selected Areas in Cryptography–SAC2017: 24th International Conference, Ottawa, ON, Canada, August 16-18, 2017, Revised Selected Papers 24. Springer International Publishing, 2018: 235-260.). The advantage of this algorithm is that it not only considers the ring structure of the original NTRU algorithm but also minimizes the characteristics of the cyclotomic polynomials, such as subfields, rotations, and ring homomorphisms, thereby reducing unnecessary algebraic structures. Although no substantial progress has been made in algebraic attacks based on the ring structure of cyclotomic polynomials, in the long run, not only the ring structure of cyclotomic polynomials but also other rings with different properties, such as rings with reduced unnecessary algebraic structures, should be studied. The NTRU Prime algorithm has been widely used in protocols such as OpenSSL and has become a de facto security standard. However, NTRU Prime has limitations in operation efficiency, which restricts its application prospects.

[0009] NTT is a special form of the fast Fourier transform (FFT) over a domain suitable for NTT. Currently, the following technical problems exist in the practical application of NTT fast polynomial multiplication:

[0010] (1) Parameter selection and parameter expansion limit the efficiency and flexibility of practical applications;

[0011] NTT fast polynomial multiplication has significant drawbacks in parameter selection and resource utilization, and these limitations directly affect the efficiency and flexibility of its practical applications.

[0012] First, the strictness of parameter design becomes its main bottleneck: the algorithm requires that the polynomial length N must be a power of 2 and satisfy N≥2p. For example, when dealing with a polynomial of degree p = 1549, N = 4096 has to be chosen. This forced expansion leads to obvious waste of memory and computation, that is, more than half of the storage space is occupied by zero coefficients, and the butterfly operations of the NTT transform still need to perform modular addition and modular multiplication on all 4096 points, even though 2547 of these points correspond to invalid zero values. This redundancy not only increases the risk of hardware cache misses but also makes the theoretically O(NlogN) complexity greatly discounted in practice due to invalid operations.

[0013] Secondly, the choice of the modulus Q needs to satisfy both q≡1mod2048 and Q≥pq simultaneously, which further exacerbates the implementation complexity. Finding a modulus Q that meets the conditions requires traversing a large number of candidate values. Especially in scenarios where large moduli are needed, the computational cost is high. For example, when Q = 8949761, its generation process not only takes time but also may increase costs due to the pursuit of formal compliance. In software, multi-precision calculations are relied on, and in hardware, complex circuits are required, significantly increasing the time or area overhead.

[0014] (2) Waste of storage space in polynomial expansion;

[0015] At the polynomial expansion level, the strategy of padding zeros at the high positions further amplifies the resource waste. Taking p = 1549 as an example, expanding the polynomial to a length of 4096 means padding 2547 zero coefficients, and the storage space waste is about 62%. These zero values occupy bandwidth during network transmission but have no information value, and still need to participate in butterfly operations during the calculation process. For example, the modular multiplication and modular addition of zero coefficients and adjacent terms, although the result is always zero, still consume computational resources. In hardware implementation, processing such large arrays requires more registers or on-chip memory, which may exceed the resource limit, forcing designers to reduce parallelism or increase latency. More contradictorily, since N must be a fixed power of 2 and cannot be dynamically adjusted according to actual needs (for example, adaptively choose N = 2048 or N = 8192), additional conversion steps are required when interacting with algorithms of other non-power-of-2 ring structures, further reducing the overall efficiency of the system.

[0016] The above problems together expose the deficiencies of the NTT fast polynomial multiplication in balancing theoretical efficiency and practical applications. Future improvements may need to combine dynamic parameter adaptation, sparse polynomial optimization, and hardware acceleration design. For example, allowing mixed-radix NTT to reduce zero padding, or developing dedicated circuits to optimize modular operations, so as to relieve the dual pressures of resource waste and implementation complexity while maintaining the advantages of the algorithm. Summary of the Invention

[0017] To avoid the parameter limitations and redundant calculations of traditional NTT fast polynomial multiplication, the present invention provides an efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre-computation. By utilizing the sparsity of small polynomials and retaining the flexibility of the original algebraic structure, the present invention achieves a multiplication-free minimalist operation acceleration.

[0018] The main improvement of the present invention is to provide an accelerated multiplication algorithm based on the polynomial multiplication properties given by the NTRU LPrime algorithm. For the rings Z[x] / (x p -x - 1), (Z / 3)[x] / (x p -x - 1), and the field (Z / q)[x] / (x p -x - 1), they are denoted as R, R / 3, and R / q respectively. Polynomials with all coefficients in {-1, 0, 1} are called small polynomials, that is, polynomials in R / 3. When implementing NTT fast polynomial multiplication based on these polynomials, for small polynomials, not only are all their elements in {-1, 0, 1}, but 0 occupies most of the coefficients. However, for traditional NTT fast polynomial multiplication, it first performs NTT transforms (Longa P, Naehrig M. Speeding up the number theoretic transform for faster ideal lattice-based cryptography[C] / / International Conference on Cryptology and Network Security. Cham: Springer International Publishing, 2016: 124 - 139.) on all polynomials on both sides of the multiplication, and small polynomials themselves are not characterized in the NTT domain. In addition, all polynomial multiplications given by the NTRU LPrime algorithm are a small polynomial multiplied by an R / q polynomial. If all of these are directly used for NTT fast polynomial multiplication, the algebraic structure given by the encryption algorithm itself will be wasted. Additionally, referring to the basic polynomial multiplication process given by the NTRU LPrime algorithm, there may be cases where the fast multiplication of NTRU LPrime can be achieved without calculating multiplication. Therefore, based on the above ideas and the polynomial properties of the NTRU LPrime algorithm itself, the present invention proposes an efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre-computation. The present invention only needs to determine whether to add or subtract according to the coefficients of the given small polynomials, and the overhead of addition and subtraction is lower than that of multiplication, which is the key to accelerating the multiplication operation, and the final result is faster than the traditional NTT fast polynomial multiplication with given parameters.

[0019] The technical solutions adopted by the present invention to solve the technical problems are as follows:

[0020] An efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre - calculation provided by the present invention includes the following steps:

[0021] Step S1: Compress the circulant matrix of the prime - order finite - field ring into a single row to obtain the pre - calculated generating operator matrix temp;

[0022] Step S2: In the generating operator matrix temp, the elements of the second column are stored in reverse order;

[0023] Step S3: Utilize the sparsity of the ternary polynomial and the algebraic - structure characteristics of the finite ring (Z / q)[x] / (x p - x - 1), and perform a look - up operation on the non - zero coefficients of the ternary polynomial by traversing the sparse coefficients.

[0024] Further, in step S1, let the coefficient polynomial g(x)=g0x 0 + g1x 1 + g2x 2 +... + g n-2 x n-2 + g n-1 x n-1 , the coefficient polynomial f(x)=f0x 0 + f1x 1 + f2x 2 + … + f n-2 x n-2 + f n-1 x n-1 , and the ring polynomial ψ(x)=x n - x - 1; all coefficients (g0, g1, g2, …, g n-2 , g n-1 ) of the polynomial g(x) are in {-1, 0, 1}, and all coefficients (f0, f1, f2, …, f n-2 , f n-1 ) of the polynomial f(x) are within the range of modulo q.

[0025] Further, by deriving the polynomials g(x), f(x), and the ring polynomial ψ(x), the following equation is obtained:

[0026] h(x)=g(x)·f(x) mod ψ(x)

[0027] =(g0x 0 + g1x 1 + … + g n-1 x n-1 )·(f0x 0 + f1x 1 + … + f n-1x n-1 ) mod ψ(x)

[0028] = g0·x 0 f(x) + g1·x 1 f(x) + … + g n-1 ·x n-1 f(x) mod ψ(x)

[0029] Assume that the ring polynomial ψ(x) is a cyclotomic polynomial, then the vector group (x 0 f(x), x 1 f(x), …, x n-1 f(x)) T is expressed as the following circulant matrix:

[0030]

[0031] where n represents the dimension of the original polynomial, N represents the dimension of the extended polynomial, and the superscript T represents the matrix transpose.

[0032] Furthermore, all elements in the first column of the circulant matrix can be found in the first row, and after removing the first row and the first column, the remaining elements are equal along the diagonal. Therefore, as long as all elements in the first row and the second column of the circulant matrix are saved, or only single-row storage is required to find the elements in the entire generation operator matrix temp;

[0033] The mathematical expression of the generation operator matrix temp is:

[0034]

[0035] Furthermore, in step S2, the reverse order storage can make the actual access order become a forward traversal.

[0036] Furthermore, in step S2, according to the corresponding relationship between the original circulant matrix and the generation operator matrix temp, a table lookup operation is performed on the original circulant matrix through the adjusted subscript mapping rule.

[0037] Furthermore, the subscript mapping rule is: First, initialize the result polynomial h to all zeros, and then process the coefficients of the small polynomial g one by one. The specific implementation process is:

[0038] (1) If g[j] = 1, then add the coefficients in the corresponding row of the pre-computed generation operator matrix temp to the polynomial h;

[0039] (2) If g[j] = -1, then perform a subtraction operation;

[0040] (3) If g[j] = 0, then skip directly.

[0041] Furthermore, in step S3, after each addition and subtraction operation, the Qnormalize function is called to constrain the result within the range of [-q / 2, q / 2].

[0042] Furthermore, in step S3, for the special structure of the cyclic polynomial ψ(x) = x p - x - 1, through the generation of the operator matrix temp, the polynomial displacement and modulo reduction operations are transformed into table look-up access.

[0043] Furthermore, in step S3, for the low-order coefficients i ≤ j, the adjustment terms are directly obtained from the generated operator matrix temp; for the high-order coefficients i > j, the algebraic rule of the ring x p ≡ x + 1 is utilized to achieve fast update by shifting the coefficients of the polynomial f(x).

[0044] The beneficial effects of the present invention are as follows:

[0045] 1. High computing performance;

[0046] By completely replacing the traditional NTT fast polynomial multiplication operation with addition and subtraction, and combining the characteristics of sparse small polynomials, the theoretical complexity of polynomial multiplication is reduced from O(p 2 ) to nearly O(p), significantly improving the operation efficiency, especially suitable for high-concurrency or resource-constrained scenarios.

[0047] 2. Lightweight memory and computing resources;

[0048] Adopting a compressed pre-computed circulant matrix and reverse storage strategy to reduce memory occupancy, and at the same time avoiding redundant calculations through a table look-up mechanism, it can be adapted to low-storage devices and improve resource utilization.

[0049] 3. Flexible parameter settings and generality;

[0050] The present invention breaks through the dependence of the traditional NTT fast polynomial multiplication on the power-of-two length and complex moduli such as Q ≡ 1 mod 2 m , supports any prime number and dynamic ring structure, and expands the applicable scenarios of the calculation.

[0051] 4. Technical comparison and flexibility breakthrough;

[0052] The present invention breaks through the parameter expansion limitation of the traditional NTT fast polynomial multiplication, realizes resource efficiency through sparsity utilization and pre-computation strategy, can directly replace the existing encryption module without modifying the underlying ring structure, and significantly improves flexibility and practicality. Description of the Drawings

[0053] Figure 1Flowchart of an efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre - calculation provided by the present invention. Detailed implementation manners

[0054] The present invention will be further described in detail below with reference to the accompanying drawings.

[0055] As Figure 1 shown, an efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre - calculation provided by the present invention specifically includes two stages, namely the pre - processing stage and the multiplication calculation stage. In the pre - processing stage, first, the circulant matrix of the prime - order finite - field ring is compressed into a single row, and then it is stored in reverse order to reduce memory occupancy and optimize cache access. In the multiplication calculation stage, first, through sparse coefficient traversal, only the non - zero coefficients of the ternary polynomial are subjected to table - look - up operations to reduce the computational amount. Then, by directly calling the pre - stored matrix row through table - look - up, the traditional term - by - term multiplication is replaced to reduce the complexity. Finally, lightweight modular reduction is performed, and the Qnormalize function is called with addition and subtraction to avoid high - overhead modulo operations and accelerate the intermediate calculation.

[0056] The key points of an efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre - calculation provided by the present invention are as follows:

[0057] (1) Lightweight multiplication mechanism based on sparse small polynomials;

[0058] For small polynomials with coefficients only in {-1, 0, 1}, the present invention proposes an operation strategy that completely replaces traditional multiplication with addition and subtraction. By directly selecting addition, subtraction, or skipping operations according to the coefficient values, the multiplication calculation is completely eliminated, significantly reducing the complexity, and it is applicable to frequent small - polynomial operation scenarios in cryptography.

[0059] (2) Pre - calculation of circulant matrix and table - look - up acceleration;

[0060] Design a compressed generation operator matrix to reduce storage overhead, pre - store the displacements and modular reduction results of polynomials in a specific ring, combine reverse - order storage to optimize cache access, and quickly obtain adjustment terms through table - look - up to reduce the real - time computational amount, which can adapt to the temporal locality characteristics of modern processors.

[0061] (3) Ring - structure - driven dynamic coefficient processing;

[0062] Utilize the characteristics of the modular polynomial x p -x + 1 to process the coefficients hierarchically: the low - order coefficients are updated through table - look - up of the pre - calculated circulant matrix, the high - order coefficients directly reference the displacement results of the original polynomial, and combined with the algebraic rule of the ring x p ≡x + 1 to achieve fast derivation.

[0063] An efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre-computation provided by the present invention has the following specific implementation process:

[0064] 1. NTRU LPRIME (one of the post-quantum encryption algorithms based on the NTRU Prime project, which adopts ProductNTRU (also known as LPR or Ring-LWE cryptosystem)) constructs a fast polynomial multiplication operator, which is a process of pre-computing and compressing the circulant matrix of the prime-order number field ring;

[0065] (1) Compress the circulant matrix of the prime-order number field ring into a single row;

[0066] For ease of description, let the coefficient polynomial g(x) = g0x 0 +g1x 1 +g2x 2 +…+g n-2 x n-2 +g n-1 x n-1 , the coefficient polynomial f(x) = f0x 0 +f1x 1 +f2x 2 +…+f n-2 x n-2 +f n-1 x n-1 and the ring polynomial ψ(x) = x n -x - 1. Among them, all coefficients (g0, g1, g2,..., g n-2 , g n-1 ) of the polynomial g(x) are in {-1, 0, 1}, while all coefficients (f0, f1, f2,…, f n-2 , f n-1 ) of the polynomial f(x) are within the range of modulo q. From this, the following equation can be deduced:

[0067] h(x) = g(x)·f(x) mod ψ(x)

[0068] =(g0x 0 +g1x 1 +…+g n-1 x n-1 )·(f0x 0 +f1x 1 +…+f n-1 x n-1 ) mod ψ(x)

[0069] =g0·x 0 f(x)+g1·x 1 f(x)+…+g n-1 ·x n-1f(x) mod ψ(x)

[0070] It is found that the key to calculating polynomial multiplication lies in obtaining the specific values of the vector group (x 0 f(x), x 1 f(x), …, x n-1 f(x)). T If the corresponding cyclotomic polynomial is a cyclotomic polynomial, the above vector group can be expressed as a circulant matrix, and for a prime order field, a similar construction can be given through derivation. The mathematical expression of the circulant matrix is as follows:

[0071]

[0072] Among them, n represents the dimension of the original polynomial, N represents the dimension of the extended polynomial, and the superscript T represents the matrix device.

[0073] All elements in the first column of the circulant matrix can be found in the first row, and after removing the first row and the first column, the remaining elements are equal along the diagonal. This indicates that as long as all elements in the first row and the second column of the circulant matrix are saved, even only single-row storage can be used to find the elements in the entire generation operator matrix temp.

[0074] Therefore, compress the circulant matrix of the prime order field ring into a single row. The following gives the compressed generation operator matrix temp, and its mathematical expression is as follows:

[0075]

[0076] The key to this step is to avoid generating the original n×n matrix, but to initialize a 2×n matrix. By observing the original circulant matrix, it is found that all elements in its first column can be deduced from the first row. If the first row and the first column are removed, the remaining elements are symmetric along the diagonal direction. This shows that as long as the specific elements in the first row and the second column are saved, the entire circulant matrix can be reconstructed.

[0077] (2) Reverse storage to reduce memory occupancy and optimize cache access;

[0078] In the generation operator matrix temp, the elements in the second column are stored in reverse order. This is because in the subsequent multiplication calculation loop, it is necessary to access this column (the second column of the generation operator matrix temp) from bottom to top.

[0079] To optimize the temporal locality of the program (i.e., memory locations recently accessed are likely to be accessed again), reverse storage can make the actual access order a forward traversal, thus making full use of the cache mechanism. When the computer runs a program, it predicts the data that may be called next and loads it into the cache in advance, significantly accelerating the data access process. If the second column of the generation operator matrix temp is stored in the original order, reverse traversal will disrupt the cache prediction and reduce efficiency.

[0080] In addition, for the finally simplified generation operator matrix temp, the implementation of matrix multiplication needs to be adjusted accordingly. Since the corresponding relationship between the original circulant matrix and the generation operator matrix temp is known, the actual call is equivalent to performing a look-up table operation on the original circulant matrix, and only the subscript mapping rule needs to be adjusted.

[0081] Furthermore, if we hope to further improve the calculation speed in the experiment, in fact, only the second column of the generation operator matrix temp needs to be stored, and the results of the first row of the generation operator matrix temp can be directly read from the coefficients of the original polynomial f(x). The above optimization is not adopted to fully display the details of the circulant matrix. In actual operation, only by replacing temp[0][i] of the generation operator matrix (temp[0][i] represents the element corresponding to the position of the i-th column in the 0-th row of the generation operator matrix temp, f[i] represents the i-th element of the original polynomial f(x), and temp[0] represents the 0-th row of the generation operator matrix temp) with f[i] and initializing the corresponding vector to all zeros can the final optimization be completed. This adjustment can further streamline the complexity of the data structure while maintaining the function.

[0082] In addition, during the calculation process, the result after addition and subtraction needs to be modulo q. However, for the present invention, each change is the addition and subtraction of two values within (-q / 2, q / 2), and the result belongs to the interval (-q, q). Then, if the result is greater than q / 2, -q (subtract q) is performed, and if it is less than -q / 2, +q (add q) is performed. Therefore, the mod q operation can be implemented by using ±q after each calculation. Through such simple addition and subtraction operations, the high cost of modulo operations is saved.

[0083] 2. Fast polynomial multiplication based on precomputation;

[0084] The core idea of this algorithm is to utilize the sparsity of ternary polynomials (coefficients only contain -1, 0, 1) and the algebraic structure characteristics of the finite ring (Z / q)[x] / (x p - x - 1) to design an efficient multiplication strategy based on precomputation and hierarchical addition and subtraction operations. Specifically, the subscript mapping rule is as follows: The algorithm first initializes the result polynomial h to all zeros, and then processes the coefficients of the small polynomial g item by item. The specific implementation process is as follows:

[0085] (1) If g[j] = 1, then accumulate the coefficients of the corresponding row in the pre-computed generator matrix temp into the polynomial h;

[0086] (2) If g[j] = -1, then perform a subtraction operation;

[0087] (3) If g[j] = 0, then directly skip it, thus avoiding redundant calculations in traditional multiplication.

[0088] For the special structure of the cyclic polynomial ψ(x) = x p -x - 1, the algorithm pre-generates a simplified 2×p generator matrix, converts polynomial displacement and modulo reduction operations into table lookups, and significantly reduces the real-time computational overhead. For low-order coefficients i ≤ j, directly obtain the adjustment term from the generator matrix temp; for high-order coefficients i > j, utilize the algebraic rule of the ring x p ≡ x + 1 to achieve fast update by shifting the coefficients of the polynomial f(x).

[0089] After each addition or subtraction operation, the algorithm calls the Qnormalize function to constrain the result within the range [-q / 2, q / 2], avoiding intermediate value overflow and reducing the burden of the final modulo operation. In addition, by storing the second row of the generator matrix temp in reverse order, the locality of cache access is optimized, further improving the memory access efficiency. This method reduces the complexity of traditional polynomial multiplication from O(p*p) to nearly O(p), especially suitable for scenarios in cryptography that frequently involve operations on sparse small polynomials, such as key generation and ciphertext calculation in the NTRU LPrime encryption scheme.

[0090] In summary, the present invention reduces the complexity of polynomial multiplication operations in a prime-order number field from O(n*n) to nearly O(n) through calculation techniques such as compressed cyclic matrix reverse storage, ternary table lookup calculation, and simplified modulo operation, significantly improving the real-time performance of the NTRU LPrime encryption scheme.

[0091] Compared with traditional NTT / FFT methods, Karatsuba divide-and-conquer algorithms, or dedicated index optimization methods based on sparse structures, NTT reduces complexity through frequency domain transformation, but needs to forcibly extend the polynomial to a power of 2 and relies on large moduli, resulting in memory waste and parameter rigidity; the Karatsuba algorithm reduces the number of multiplications through recursive splitting, but has limited optimization for sparse polynomials, and the recursive overhead may offset the performance gain; the sparse index method only processes non-zero terms, but needs to additionally maintain a coefficient position mapping table, increasing memory and logical complexity. In contrast, the present invention avoids the expansion constraints and additional overhead of the above methods through pre-computation of cyclic matrices and pure addition and subtraction operations while maintaining linear complexity, and is particularly suitable for high-sparse and low-computing power application scenarios in cryptography.

[0092] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the protection scope of the present invention.

Claims

1. An efficient multiplication optimization method on a ring based on sparse ternary polynomials and pre-computation, characterized in that It includes the following steps: Step S1: Compress the circulant matrix of the prime order field ring into a single row to obtain the pre-computed generator operator matrix temp; In the generator operator matrix temp in Step S2, the elements of the second column are stored in reverse order; Step S3: By leveraging the sparsity of the ternary polynomial and the algebraic structure characteristics of the finite ring (Z / q)[x] / (x p -x-1), through traversing the sparse coefficients, perform a table-lookup operation on the non-zero coefficients of the ternary polynomial.

2. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 1, wherein In step S1, let the coefficient polynomial g(x) = g0x 0 + g1x 1 + g2x 2 + … + g n-2 x n-2 + g n-1 x n-1 , and the coefficient polynomial f(x) = f0x 0 + f1x 1 + f2x 2 + … + f n-2 x n-2 + f n-1 x n-1 , and the ring polynomial ψ(x) = x n - x - 1; all coefficients (g0, g1, g2, …, g n-2 , g n-1 ) of the polynomial g(x) are in {-1, 0, 1}, and all coefficients (f0, f1, f2, …, f n-2 , f n-1 ) of the polynomial f(x) are within the range of modulo q.

3. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 2, wherein Derive the following equations for the polynomial g(x), the polynomial f(x), and the ring polynomial ψ(x): h(x) = g(x)·f(x) mod ψ(x) =(g0x 0 +g1x 1 +…+g n-1 x n-1 )·(f0x 0 +f1x 1 +…+f n-1 x n-1 ) mod ψ(x) = g0·x 0 f(x) + g1·x 1 f(x) + … + g n-1 ·x n-1 f(x) mod ψ(x) Assume that the cyclotomic polynomial ψ(x) is a cyclotomic polynomial, then the vector group (x 0 f(x), x 1 f(x), …, x n-1 f(x)) T is expressed as the following circulant matrix: where n represents the dimension of the original polynomial, N represents the dimension of the extended polynomial, and the superscript T represents the matrix transpose.

4. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 3, characterized in that All elements of the first column of the circulant matrix can be found in the first row, and after removing the first row and the first column, the remaining elements are equal along the diagonal. Therefore, as long as all elements of the first row and the second column of the circulant matrix are saved, or only single-row storage is required to find the elements in the entire generator operator matrix temp; The mathematical expression of the generator operator matrix temp is:

5. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 1, wherein In Step S2, the reverse storage can make the actual access order become a forward traversal.

6. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 1, wherein In Step S2, according to the correspondence between the original circulant matrix and the generator operator matrix temp, perform a look-up table operation on the original circulant matrix through the adjusted subscript mapping rule.

7. The efficient multiplication optimization method based on sparse ternary polynomials and precomputation according to claim 6, characterized in that The subscript mapping rule is: First, initialize the result polynomial h to all zeros, and then process the coefficients of the small polynomial g item by item. The specific implementation process is: (1) If g[j] = 1, then accumulate the coefficients of the corresponding row in the pre-computed generator operator matrix temp into the polynomial h; (2) If g[j] = -1, then perform a subtraction operation; (3) If g[j] = 0, then directly skip.

8. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 7, wherein In Step S3, after each addition or subtraction operation, call the Qnormalize function to constrain the result within the range of [-q / 2, q / 2].

9. The efficient multiplication optimization method based on sparse ternary polynomials and pre-computation according to claim 1, wherein In step S3, for the special structure of the cyclic polynomial ψ(x) = x p -x - 1, by generating the operator matrix temp, the polynomial displacement and modulo reduction operations are transformed into table lookup accesses.

10. The efficient multiplication optimization method based on sparse ternary polynomials and precomputation according to claim 9, characterized in that, In step S3, for the low-order coefficients i ≤ j, the adjustment term is directly obtained from the generation operator matrix temp; for the high-order coefficients i > j, the algebraic rule of the ring x p ≡ x + 1 is used to achieve fast update by shifting the coefficients of the polynomial f(x).

Images