A finite field modular operation acceleration implementation method for a RISC-V processor

Abstract

A method for accelerating finite-field modular arithmetic on RISC-V processors is disclosed. The method includes: 1. Constructing a non-saturated multi-limb representation model of finite-field elements in the processor's 64-bit general-purpose registers; 2. Designing an instruction scheduling strategy that interleaves computation and memory access based on the execution latency characteristics of multiplication instructions in the RISC-V processor; 3. Employing a latency correction mechanism within the general-purpose registers to decouple carry propagation and modular reduction path scheduling; 4. For modular square operations, constructing an instruction-level reduction path within the processor's instruction set environment, and implementing cross-limb carry processing through logical shift instructions and unsigned comparison instructions; 5. Utilizing the redundant bit width of the non-saturated representation, implementing a latency accumulation and mask correction mechanism for modular addition and subtraction operations at the register level. This invention achieves a computational speedup several times greater than existing implementations by optimizing processor register resources and instruction scheduling without altering the original mathematical structure of cryptographic algorithms.

Description

Technical Field

[0001] This invention relates to the field of engineering implementation and processor architecture optimization technology of post-quantum cryptography algorithms, specifically a method for accelerating finite field modular arithmetic for RISC-V processors. Background Technology

[0002] With the rapid iteration and maturation of quantum computing technology, traditional public-key cryptography algorithms based on large integer factorization and discrete logarithm problems will face fatal security challenges under the computational power of future quantum computers. As a core technology for ensuring secure information transmission, the quantum-resistant upgrade of public-key cryptography is urgently needed, and post-quantum cryptography algorithms have thus gradually become a core direction for cryptographic system research and engineering implementation. Among them, digital signature algorithms, as a fundamental supporting technology for key scenarios such as identity authentication, data integrity verification, and non-repudiation, directly determine the practical application value of post-quantum cryptography systems by balancing quantum resistance and engineering implementation efficiency.

[0003] However, current mainstream post-quantum digital signature algorithms exhibit significant limitations in engineering implementation. Taking the SQIsign algorithm as an example, this algorithm, based on the homologous elliptic curve problem, possesses a natural advantage in bandwidth-constrained embedded communication scenarios due to its extremely short signature length and public key size. However, in the core signature and verification process, it suffers from performance bottlenecks when performing numerous finite field operations on RISC-V processors, including modular addition, modular subtraction, modular multiplication, and modular squaring. These operations often constitute the main computational overhead of the algorithm, and their implementation efficiency directly determines the applicability of the SQIsign algorithm in scenarios with high real-time requirements, becoming a core bottleneck restricting its large-scale application.

[0004] Besides the inherent limitations of the algorithm's computational characteristics, the insufficient adaptability of the underlying processor architecture exacerbates the implementation challenges. In recent years, the RISC-V architecture, with its open-source nature, customizability, and low power consumption, has been widely adopted in embedded systems and security chips, becoming the preferred hardware platform for post-quantum cryptography algorithms. However, the existing RISC-V general-purpose instruction set is primarily geared towards standard integer arithmetic scenarios, lacking dedicated instruction support for ultra-wide finite-field arithmetic operations. This makes it difficult for compiler-generated code to balance computational efficiency and real-time requirements. At the underlying implementation level, key aspects such as register resource allocation, carry propagation mechanisms, and instruction-level scheduling still lack optimized designs for the characteristics of the RISC-V architecture, requiring systematic engineering optimization.

[0005] Patent CN109525393A discloses a digital signature method, verification method, and system resistant to quantum computing attacks. Its core relies on a novel signature and verification mechanism design, constructing a technical solution around quantum-resistant security attributes and functional integrity, focusing on solving the security problem of digital signatures in a quantum environment. However, this patent only describes the overall implementation idea at the algorithm and protocol level, treating finite field operations as abstract mathematical operations. It does not involve the implementation details of underlying arithmetic operations on specific processor architectures, particularly lacking optimization designs for register utilization, carry propagation, and instruction scheduling. Furthermore, it does not adapt to the characteristics of the RISC-V architecture, nor does it conduct underlying optimizations for the computational efficiency issues of specific hardware platforms.

[0006] The patent with publication number "CN114662122A" discloses a functionally secure building block for key encapsulation and digital signatures that is effective against quantum attacks. It uses cryptographic construction methods such as dedicated register state design and data path planning to ensure functional security and system reliability in quantum-resistant scenarios. However, its technical solution focuses on functional safety and dedicated hardware logic design, relying on customized building blocks. It does not perform software optimization for low-level finite field arithmetic operations on the general-purpose RISC-V processor architecture, nor does it address core technologies such as finite field element partitioning, general-purpose register resource allocation, and instruction-level scheduling. Furthermore, it does not optimize memory access overhead and instruction issuance on the standard resource-constrained RISC-V platform.

[0007] Furthermore, existing related technologies generally suffer from a disconnect between algorithm design and hardware adaptation. Most solutions either focus on optimizing the security properties of post-quantum algorithms or rely on dedicated hardware for efficient computation, lacking pure software-level alignment optimizations for general-purpose RISC-V architectures. For computationally intensive post-quantum signature algorithms like SQIsign, a comprehensive optimization scheme covering data representation, register mapping, and instruction scheduling has not yet been developed, making it difficult to balance quantum security, hardware compatibility, and computational efficiency.

[0008] Therefore, in the face of the security threats brought by quantum computing and the application requirements of the RISC-V architecture, there is an urgent need to develop a finite field arithmetic implementation scheme that can adapt to the characteristics of the RISC-V architecture and perform underlying optimizations for the core operations of the SQIsign algorithm. Through pure software-level technical innovation, the bottleneck of computational efficiency can be broken, providing efficient and scalable technical support for the engineering implementation of post-quantum signature algorithms on the RISC-V architecture platform. Summary of the Invention

[0009] The purpose of this invention is to propose a method for accelerating finite field modular arithmetic for RISC-V processors. By reconstructing the data representation structure of finite field elements and establishing a fixed mapping relationship with the processor's general-purpose registers, and combining a delayed carry propagation mechanism with unified modular reduction path planning, the invention achieves coordinated scheduling of data representation, register allocation, carry processing, and modular reduction processes. This shortens critical execution paths at the structural level, reduces intermediate memory access dependencies, and improves overall computational efficiency while maintaining constant-time execution characteristics.

[0010] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0011] This invention provides a method for accelerating finite field modulo arithmetic for RISC-V processors, comprising the following steps:

[0012] S1. Construct a non-saturated multi-limb representation model of finite field elements in the 64-bit general-purpose register of the RISC-V processor, decompose the finite field elements into multiple data limbs, and establish a fixed mapping relationship between the data limbs and the general-purpose registers, so that the core operation data remains resident in the register throughout the entire operation cycle, thereby reducing memory access operations.

[0013] S2. Based on the multiplication instruction execution latency characteristics of RISC-V processors, an instruction scheduling strategy with computation and memory access interleaving is designed, and combined with the loop full unrolling technique, the limb multiplication-accumulation operation is linearly unrolled to improve instruction-level parallelism and reduce branch jump overhead.

[0014] S3. A delay correction mechanism is adopted in the general-purpose register to decouple carry propagation from the simplified path scheduling and complete the implicit correction under the register-level data layout. Carry extraction and propagation are realized through a branchless instruction sequence to shorten the critical path delay.

[0015] S4. For modular square operation, an instruction-level reduction path is constructed in the RISC-V processor instruction set environment. Cross-limb carry processing is achieved through logical shift instructions and unsigned comparison instructions to reduce the number of multiplication instruction issuances.

[0016] S5. Utilizing the redundant bit width of the non-saturated representation, a delayed accumulation and mask correction mechanism for modulo addition and subtraction operations is implemented at the register level. Conditional branches are replaced by data masks to achieve constant-time execution characteristics.

[0017] As a further improvement, the unsaturated multi-limb representation model in step S1 adopts a 51-bit unsaturated data limb representation method, which splits the finite field element into multiple 51-bit unsaturated data limbs, preferably n is 5 data limbs, and a 13-bit carry buffer space is reserved in the high bits of the 64-bit register. The formula for the 51-bit unsaturated multi-limb representation is as follows:

[0018] ;

[0019] Where A is a 256-bit finite field element, and n is the number of data segments. For unsigned integers stored in a 64-bit register, only the lower 51 bits are valid, while the higher 13 bits are the carry buffer. For the index number of the data limb, Used to identify the first digit arranged from least significant to most significant. A 51-bit data segment.

[0020] As a further improvement, the data limb bit width is smaller than the general-purpose register bit width to form a redundant bit space for delayed carry processing.

[0021] As a further improvement, the register mapping in step S1 maps the multiplicand data limb of the finite field element to the first preset register group, maps the multiplier data limb to the second preset register group, maps the accumulator data to an independent register group, and sets the mask register to preload a 51-bit all-one mask.

[0022] As a further improvement, the register mapping in step S1 is completed during the operation function initialization phase, and all data limbs of the multiplicand and multiplier are loaded into the preset register group at once, so that the core operation data remains resident in the register throughout the entire operation cycle, thereby avoiding memory read and write operations in the intermediate process.

[0023] As a further improvement, the computation and memory access interleaving scheduling in step S2 is to immediately schedule the next multiplication prefetch or accumulation operation that has no direct data dependency after the limb sub-product multiplication instruction is issued, using instruction-level parallelism to mask the 3-4 cycle execution delay of the RISC-V multiplication instruction.

[0024] As a further improvement, the computation and memory access interleaving scheduling in step S2 enables the processor's multiplication unit and arithmetic logic unit to work in parallel.

[0025] As a further improvement, the instruction scheduling in step S2 adopts a fully expanded loop accumulation strategy, expanding all limb multiplication and addition operations into a linear instruction sequence, eliminating arithmetic operations and conditional jump instructions related to loop control.

[0026] As a further improvement, the branchless carry propagation in step S3 is performed column by column according to the following steps:

[0027] Step 1: Use logical AND instruction to mask the current accumulator and extract the lower 51 bits as the result body;

[0028] Step 2: Use logical right shift instructions to extract the carry information from the high-order bits of the accumulator;

[0029] Step 3: The extracted carry is directly injected into the next column of accumulators, without relying on condition judgments or branch control instructions.

[0030] As a further improvement, the branchless carry propagation is executed immediately after all sub-accumulations of the current column are completed, without waiting for the full accumulation to be completed.

[0031] As a further improvement, the modulo reduction in step S3 adopts a folding strategy, which extracts the overflow part of the highest bit data segment through a shift instruction and feeds it back to the lowest bit data segment and the highest bit data segment to achieve fast reduction of the modulus of the SQIsign algorithm.

[0032] As a further improvement, the instruction-level reduction path and implicit carry processing logic in step S4 are as follows:

[0033] Step 1: Perform instruction-level scheduling of the modulo-square operation at the register execution level, based on diagonal and off-diagonal terms;

[0034] Step 2: Use logical left shift instructions to replace general multiplication or high-precision addition operations to double the value of off-diagonal terms;

[0035] Step 3: Use logical right shift instructions to extract cross-limb carry, and use logical left shift instructions and bitwise OR instructions to complete the overall shift operation of the high-order data. Use unsigned comparison instructions to capture the addition overflow carry and inject it into the accumulator.

[0036] As a further improvement, the modulus addition and subtraction non-saturated accumulation and branchless mask correction in step S5 are as follows:

[0037] Step 1: Execute addition or subtraction instructions for all data digits consecutively, allowing intermediate results to temporarily exceed the 51-bit valid range or enter a borrow state;

[0038] Step 2: Generate a mask register of all 0s or all 1s by performing arithmetic expansion on the sign bit or carry bit of the highest bit.

[0039] Step 3: Use logical AND instructions to perform a bitwise AND operation between the correction constant and the mask, and then use addition or subtraction instructions to normalize the result to eliminate conditional jump instructions.

[0040] As a further improvement, the correction constant in step S5 is a corresponding finite field modulus-related constant, and is dynamically applied to the result register according to the mask value.

[0041] As a further improvement, steps S1 to S5 are not executed independently, but form a unified scheduling framework under the same register data layout and delay correction mechanism, so that finite field arithmetic operations can share data flow paths and carry control logic among different operation types.

[0042] As a further improvement, the modular squared optimization reduces the number of multiplication instruction issuances and lowers the processor pipeline utilization through an instruction reduction strategy.

[0043] As a further improvement, the modulo reduction is executed immediately after carry propagation, so that carry resolution and modulo reduction are completed in the same register data layout, thus shortening the instruction latency of critical computation paths.

[0044] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention has significant advantages in terms of computational efficiency, security features, and engineering adaptability. Regarding computational efficiency, this invention reduces memory accesses and masks multiplication latency through a register-resident model and interleaving scheduling strategy, achieving significant performance improvements in typical implementation environments and effectively enhancing the overall processing efficiency of the algorithm. Regarding security features, this invention achieves constant-time characteristics where the execution path is independent of the input data through branchless carry propagation and mask correction mechanisms, which is beneficial for enhancing resistance to timing side-channel attacks. Regarding engineering adaptability, this invention is implemented based on the RISC-V general-purpose integer instruction set, without relying on specific dedicated extension instructions, possessing good compatibility and portability, and can be applied to various finite-field computation scenarios, including but not limited to the core arithmetic operations in post-quantum signature algorithms. Without changing the original mathematical structure of the cryptographic algorithm, this invention optimizes processor register resources and instruction scheduling, achieving several times the computational speedup of existing implementations and reducing processor dynamic power consumption. Attached Figure Description

[0045] Figure 1 A schematic diagram of an architecture for accelerating finite field modulo operations on RISC-V processors;

[0046] Figure 2 A schematic diagram illustrating the logic of co-optimization between carry propagation and modulo reduction;

[0047] Figure 3 This is a schematic diagram of performance test results under a typical parameter set. Detailed Implementation

[0048] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention:

[0049] like Figure 1-2As shown, this invention provides a method for accelerating finite field modulo arithmetic for RISC-V processors, comprising the following steps:

[0050] S1. Construct a non-saturated multi-limb representation model of finite field elements in the 64-bit general-purpose register of the RISC-V processor, decompose the finite field elements into multiple data limbs, and establish a fixed mapping relationship between the data limbs and the general-purpose registers, so that the core operation data remains resident in the register throughout the entire operation cycle, thereby reducing memory access operations.

[0051] S2. Based on the multiplication instruction execution latency characteristics of RISC-V processors, an instruction scheduling strategy with computation and memory access interleaving is designed, and combined with the loop full unrolling technique, the limb multiplication-accumulation operation is linearly unrolled to improve instruction-level parallelism and reduce branch jump overhead.

[0052] S3. A delay correction mechanism is adopted in the general-purpose register to decouple carry propagation from the simplified path scheduling and complete the implicit correction under the register-level data layout. Carry extraction and propagation are realized through a branchless instruction sequence to shorten the critical path delay.

[0053] S4. For modular square operation, an instruction-level reduction path is constructed in the RISC-V processor instruction set environment. Cross-limb carry processing is achieved through logical shift instructions and unsigned comparison instructions to reduce the number of multiplication instruction issuances.

[0054] S5. Utilizing the redundant bit width of the non-saturated representation, a delayed accumulation and mask correction mechanism for modulo addition and subtraction operations is implemented at the register level. Conditional branches are replaced by data masks to achieve constant-time execution characteristics.

[0055] Step S1 is as follows:

[0056] The finite field element is split into multiple 51-bit non-saturated data segments, preferably 5 data segments, and a 13-bit carry buffer is reserved in the high bits of the 64-bit register, as defined below:

[0057] ;

[0058] Where A is a 256-bit finite field element. The data limbs stored in the 64-bit unsigned register occupy only the lower 51 bits of valid space. The upper 13 bits of the register are reserved as carry buffer space to accommodate carry / borrow from intermediate operations and avoid frequent normalization operations.

[0059] The multiplicand data segments of the finite field elements are mapped to a set of preset RISC-V general-purpose registers, the multiplier data segments are mapped to another set of preset general-purpose registers, the accumulator data is mapped to an independent register set, and a 51-bit all-one mask is set to preload the mask register. The register mapping is completed during the operation function initialization phase, and all data segments of the multiplicand and multiplier are loaded into the preset register set at once, so that the core operation data remains resident in the register throughout the entire operation cycle, thereby avoiding memory read and write operations in the intermediate process.

[0060] In this embodiment, the multiplicand data limb is mapped to registers t0–t4, the multiplier data limb is mapped to registers s0–s4, and the accumulator uses registers t5–t6.

[0061] Step S2 is as follows:

[0062] A software pipeline execution model that intertwines computation and memory access:

[0063] Modular multiplication follows the principle of columnar accumulation. Considering the 3-4 cycle execution latency of the RISC-V multiplication instruction (mul), a software pipeline model intertwining computation and memory access is constructed:

[0064] Calculate the product of limb sub-products by issuing multiplication instructions (e.g.) Simultaneously, the next multiplication prefetch or accumulation operation that has no direct data dependency on the current computation is immediately scheduled. For example, while waiting for the computation result to be written back to the pipeline, some multiplication instructions are issued in parallel, enabling the processor's multiplication unit (M-Extension) and arithmetic logic unit (ALU) to work in parallel. By statically rearranging the instruction execution order, the execution latency of multiplication instructions is effectively hidden, improving the overall instruction throughput.

[0065] Register-level non-loop accumulation execution mode:

[0066] Instead of relying on loop structures to traverse limb arrays as in high-level languages, a register-level accumulation strategy using full loop unrolling is adopted:

[0067] By expanding the sublimb multiply-accumulate operation into a linear instruction sequence, arithmetic operations (such as i++) and conditional jump instructions related to loop control are eliminated, thereby reducing the number of instructions and avoiding the impact of branch prediction failure on the pipeline.

[0068] In this execution mode, the product results of each column are directly accumulated into the corresponding register accumulator (t5, t6). Thanks to the 13-bit redundant width reserved in the non-saturated representation, multiple sub-product results are allowed to be accumulated continuously without immediate carry-over, breaking the inefficient mode of "carry-over with every multiplication" in the traditional implementation.

[0069] Branchless carry propagation method with column-by-column interleaving:

[0070] To prevent register accumulator overflow and maintain pipeline continuity, this embodiment employs a strategy of interleaving column-by-column computation with carry processing:

[0071] After accumulating all subproducts of the current column, immediately perform carry fetch and propagation in the register:

[0072] Step 1: Use the mask instruction (andi) to extract the lower 51 bits of the current accumulator as the result body;

[0073] Step 2: Use the shift instruction (srli) to extract the carry information from the high bit;

[0074] Step 3: Inject the carry directly into the accumulator of the next column.

[0075] Step S3 is as follows:

[0076] Construction of intermediate results with delayed carry:

[0077] In the main computation phase of modular addition, modular subtraction, or modular multiplication in a finite field, the arithmetic results of all parts are directly written into the corresponding registers;

[0078] Thanks to the aforementioned 51-bit non-saturated representation, the high 13 bits of each 64-bit register are reserved as carry buffer space;

[0079] Adopt a delayed correction strategy:

[0080] When performing consecutive addition or subtraction operations, the carry-clear instruction is not executed immediately. Instead, intermediate results are allowed to temporarily overflow the 51-bit valid range. For example, in the modadd implementation, after completing the addition operation of 5 consecutive parts, all part results are still temporarily stored in the register group. At this time, by utilizing the reserved buffer space, the value is strictly controlled within the range that the 64-bit hardware can represent, and no arithmetic overflow occurs, thus providing a data foundation for subsequent unified batch processing.

[0081] Register-level batch carry propagation mechanism:

[0082] After completing the main calculation step, this embodiment performs a uniform branchless carry propagation operation on all limb registers. Specifically, the following steps are completed using a defined sequence of arithmetic instructions:

[0083] Step 1: Use the arithmetic right shift instruction (srai) to extract the carry information of the current limb;

[0084] Step 2: Use the AND instruction to extract the lower 51 bits of valid data from the preloaded mask register;

[0085] Step 3: Use the addition instruction (add) to directly accumulate the fetched carry into the adjacent high-order byte register;

[0086] Cooperative scheduling method with modular reduction operation:

[0087] After carry propagation is completed, intermediate results may still exceed the modulus of the finite field. Therefore, this embodiment designs the modulo reduction operation to be executed immediately after the carry propagation stage, so that carry resolution and modulo reduction are completed under the same register data layout.

[0088] Taking advantage of the special structure of the SQIsign algorithm modulus, this embodiment adopts a folding strategy:

[0089] The overflow portion of the highest bit (Limb4) is extracted by shift instructions and fed back to the lowest bit (Limb0) and the highest bit, thereby achieving rapid reduction of the modulus. This collaborative method avoids repeatedly interspersing complex reduction logic and further shortens the instruction latency of the critical calculation path.

[0090] Modular reduction employs a folding strategy, utilizing the special structure of the SQIsign algorithm's modulus. The instruction sequence is as follows:

[0091] Extract the highest overflow bit: srli t7,t4,51 (extract the overflow carry of Limb4);

[0092] Feedback to lower limbs: add t0,t0,t7 (Limb0 accumulates overflow portion);

[0093] Extract valid data: andi t0,t0,a0, andi t4,t4,a0 (extract 51 bits of valid data from Limb0 and Limb4 respectively) to achieve fast resolution of the modulus p.

[0094] Step S4 is as follows:

[0095] Directed reduction strategy for multiplication instructions:

[0096] Modulo square calculation formula:

[0097] ;

[0098] in, A For 256-bit finite field elements, R In this embodiment, the base of the non-saturated representation is... In the formula The first one stored in the 64-bit unsigned register One data limb, as base R Weighting factors.

[0099] The logical left shift instruction (slli) of RISC-V is used to replace the general multiplication or 128-bit addition in the C++ implementation to double the value;

[0100] Cross-limb shift carry processing based on SLTU instructions:

[0101] 128-bit shift logic:

[0102] It abandons the traditional addition-left shift method that relies on the carry flag;

[0103] This embodiment uses the logical right shift instruction (srli) to accurately extract the highest bit of the lower 64 bits as a cross-bit carry, and combines it with the logical left shift (slli) and bitwise OR instructions to efficiently complete the overall left shift of 128 bits of data in a general-purpose register;

[0104] Implicit carry accumulation:

[0105] When accumulating the multiplication result into the intermediate result register, the unsigned comparison instruction (sltu) is used to capture the overflow carry generated by the addition.

[0106] The generated carry flag (0 or 1) is directly used as numerical input and injected into the next column accumulator via the add instruction;

[0107] The entire process does not require any branch jumps, avoiding the risk of pipeline stalls and achieving constant-time execution of the modulo-square operation.

[0108] Step S5 is as follows:

[0109] Unsaturated accumulation and overflow tolerance:

[0110] When performing finite field addition or subtraction, this invention makes full use of the buffer space reserved in the high 13 bits of the register, allowing intermediate results to temporarily exceed the range of the standard finite field modulus (for addition) or enter a borrow state (for subtraction).

[0111] In the specific implementation of the modadd or modsub function, the add or sub instructions of all 5 limbs are executed continuously without any carry detection. Since the buffer space is sufficient to accommodate the complete cumulative error of a single linear operation, the safety of intermediate values ​​is ensured.

[0112] Branchless modulus correction based on bitmask:

[0113] Mask generation:

[0114] By performing arithmetic expansion on the sign bit or carry bit of the highest-order limb (e.g., using the sub instruction to generate a mask register of all 0s or all 1s), the logical judgment of "whether correction is needed" is transformed into a mask value at the data level.

[0115] Logical correction:

[0116] The correction constant (such as a specific two's complement constant) and the mask are bitwise ANDed using the logical AND instruction, and then the result is applied directly to the result register via addition and subtraction instructions.

[0117] To verify the effectiveness of the method of the present invention, the following test configuration was performed:

[0118] Test environment configuration:

[0119] Hardware platform: RISC-V 64-bit processor core;

[0120] Software benchmark: Based on the official open-source implementation of SQIsign, with mini-gmp as the underlying large number library;

[0121] Comparison objects: Reference implementation (Ref, pure C language), general optimization (Generic, official C language, compiler-O3 level optimization), and embodiment of this invention (assembly optimized implementation);

[0122] like Figure 3 As shown, the assembly language solution proposed in this invention achieves significant performance improvements compared to the general compiler optimization implementation under the same hardware environment: In terms of core performance, during the most computationally demanding signing stage, the official C language optimized version (Generic) takes approximately 4.36 seconds (4357.35 ms), while this invention further compresses it to 1.03 seconds (1029.47 ms) through underlying assembly optimization; In terms of overall process synergy, by comprehensively reconstructing the basic arithmetic paths such as modular multiplication, modular squaring, modular addition and subtraction, and carry propagation, the execution path length is further shortened, and pipeline utilization is improved; In terms of extreme optimization in the verification stage, this invention, through a fixed register resident mechanism and a delayed carry unified processing strategy, enables multiple consecutive arithmetic operations to complete data flow at the register level, avoiding frequent memory access and conditional branch interference between function calls.

[0123] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any modifications or equivalent changes made based on the technical essence of the present invention shall still fall within the scope of protection claimed by the present invention.

Claims

1. A method for accelerating finite field modular arithmetic on RISC-V processors, characterized in that, Includes the following steps: S1. Construct a non-saturated multi-limb representation model of finite field elements in the 64-bit general-purpose register of the RISC-V processor, decompose the finite field elements into multiple data limbs, and establish a fixed mapping relationship between the data limbs and the general-purpose register. The unsaturated multi-limb representation model in step S1 adopts a 51-bit unsaturated data limb representation method, which splits the finite field element into multiple 51-bit unsaturated data limbs; the bit width of the data limb is smaller than the bit width of the general-purpose register to form a redundant bit space for delayed carry processing; the formula for the 51-bit unsaturated multi-limb representation is as follows: ； Where A is a 256-bit finite field element, and n is the number of data segments. For unsigned integers stored in a 64-bit register, only the lower 51 bits are valid, while the higher 13 bits are the carry buffer. For the index number of the data limb, Used to identify the first digit arranged from least significant to most significant. A 51-bit data segment; S2. Based on the multiplication instruction execution latency characteristics of RISC-V processors, an instruction scheduling strategy with computation and memory access interleaving is designed, and combined with the loop full unrolling technique, the limb multiplication-accumulation operation is linearized and unrolled. S3. A delay correction mechanism is adopted in the general-purpose register to decouple carry propagation from the modular reduction path scheduling, and implicit correction is completed under the register-level data layout. Carry extraction and propagation are realized through a branchless instruction sequence. S4. For modular square operation, an instruction-level reduction path is constructed in the RISC-V processor instruction set environment, and cross-limb carry processing is achieved through logical shift instructions and unsigned comparison instructions. S5. Utilizing the redundant bit width of the non-saturated representation, a delayed accumulation and mask correction mechanism for modulo addition and subtraction operations is implemented at the register level. Conditional branches are replaced by data masks to achieve constant-time execution characteristics.

2. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, The register mapping in step S1 involves mapping the multiplicand data of the finite field elements to the first preset register group, mapping the multiplier data to the second preset register group, mapping the accumulator data to an independent register group, and setting a mask register to preload a 51-bit all-one mask. The register mapping is completed during the operation function initialization phase, loading all the data of the multiplicand and multiplier into the first preset register group and the second preset register group at once, so that the core operation data remains resident in the registers throughout the entire operation cycle, thereby avoiding memory read and write operations in the intermediate process.

3. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, The computation and memory access interleaving scheduling in step S2 involves immediately scheduling the next multiplication prefetch or accumulation operation without direct data dependency after issuing the limb sub-product multiplication instruction. This utilizes instruction-level parallelism to mask the 3-4 cycle execution delay of RISC-V multiplication instructions. The computation and memory access interleaving scheduling enables the processor's multiplication unit and arithmetic logic unit to work in parallel. The instruction scheduling adopts a fully expanded loop accumulation strategy, expanding all limb multiplication and accumulation operations into a linear instruction sequence, eliminating arithmetic operations and conditional jump instructions related to loop control.

4. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, In step S3, the branchless carry propagation is performed column by column according to the following steps: Step 1: Use logical AND instruction to mask the current accumulator and extract the lower 51 bits as the result body; Step 2: Use logical right shift instructions to extract the carry information from the high-order bits of the accumulator; Step 3: The extracted carry is directly injected into the next column accumulator, without relying on condition judgment or branch control instructions. The branchless carry propagation is executed immediately after all sub-accumulations of the current column are completed, without waiting for the full accumulation to be completed.

5. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, In step S3, the modulo reduction adopts a folding strategy. The overflow part of the highest bit data segment is extracted by shifting instructions and fed back to the lowest bit data segment and the highest bit data segment to achieve fast reduction of the modulus of the finite field.

6. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, In step S3, modulo reduction is performed immediately after carry propagation, so that carry resolution and modulo reduction are completed in the same register data layout.

7. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, The instruction-level reduction path and implicit carry processing logic in step S4 are as follows: Step 1: Perform instruction-level scheduling of the modulo-square operation at the register execution level, based on diagonal and off-diagonal terms; Step 2: Use logical left shift instructions to replace general multiplication or high-precision addition operations to double the value of off-diagonal terms; Step 3: Use logical right shift instructions to extract cross-limb carry, and use logical left shift instructions and bitwise OR instructions to complete the overall shift operation of the high-order data. Use unsigned comparison instructions to capture the addition overflow carry and inject it into the accumulator.

8. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, The modulo-addition / subtraction non-saturated accumulation and branchless mask correction in step S5 are as follows: Step 1: Execute addition or subtraction instructions for all data digits consecutively, allowing intermediate results to temporarily exceed the 51-bit valid range or enter a borrow state; Step 2: Generate a mask register of all 0s or all 1s by performing arithmetic expansion on the sign bit or carry bit of the highest bit. Step 3: Use logical AND instructions to perform a bitwise AND operation between the correction constant and the mask, and then use addition or subtraction instructions to normalize the result to eliminate conditional jump instructions. The correction constant is a constant related to the modulus of the corresponding finite field, and it is dynamically applied to the result register according to the mask value.

9. The method for accelerating finite field modular arithmetic for RISC-V processors according to claim 1, characterized in that, Steps S1 to S5 are not executed independently, but form a unified scheduling framework under the same register data layout and delay correction mechanism, so that finite field arithmetic operations can share data flow paths and carry control logic among different operation types.

Images