Shared ntt hardware optimization method in mixed application scenarios of quantum-resistant password ml-kem and ml-dsa

Abstract

This invention discloses a hardware optimization method for shared NTT in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA. For the three core basic operators in the NTT module—modular addition, modular subtraction, and modular multiplication—this invention redesigns the corresponding hardware implementation structure. Based on the design of ML-KEM with a smaller modulus bit length, it supports large-bit-width NTT operations by time-division multiplexing small-width arithmetic units, effectively reducing the hardware overhead of the underlying operators. For ML-DSA NTT operations, this invention proposes a dedicated pipeline structure that matches the improved operators. This structure optimizes register overhead through reasonable design of data flow paths and multiplexing mechanisms, further reducing system resource costs. This invention achieves compatibility support for multiple NTT parameters, thereby enabling the simultaneous completion of NTT operation tasks under different algorithms or parameter sets on the same hardware platform.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a hardware optimization implementation method, system, and product for shared NTT (Number Theoretic Transform) in a hybrid application scenario of quantum-resistant cryptography ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) and ML-DSA (Module-Lattice-Based Digital Signature Algorithm). Background Technology

[0002] With the rapid development of quantum computing technology, the security of traditional public-key cryptosystems is facing unprecedented challenges, making quantum-resistant cryptography, capable of resisting quantum computer attacks, a current research hotspot. In 2024, the National Institute of Standards and Technology (NIST) officially released its first batch of quantum-resistant cryptography standards, including the lattice-based key encapsulation mechanism ML-KEM and the digital signature algorithm ML-DSA. In practical applications such as servers, embedded devices, and IoT terminals, these two algorithms typically need to be deployed and executed efficiently on the same hardware platform for performance, power consumption, and system integration considerations. Since the core computational processes of ML-KEM and ML-DSA heavily rely on computationally complex number-theoretical transformations (NTTs), relying solely on general-purpose processors often fails to meet their throughput and energy efficiency requirements. Therefore, dedicated hardware acceleration has become the mainstream implementation method. Furthermore, the NTT operations of the two algorithms are highly similar at the hardware implementation level, possessing significant reuse potential. Designing separate NTT acceleration modules for ML-KEM and ML-DSA would inevitably introduce additional resource overhead. Against this backdrop, how to simultaneously support the parameter requirements of two algorithms through a unified NTT hardware unit, while avoiding redundant hardware overhead and balancing performance and implementation cost, has become one of the key technical challenges in building efficient quantum-resistant cryptographic systems. Existing research has made significant progress in high-performance implementation, typically employing a highly parallel NTT architecture to improve computational throughput. However, such solutions often come at the cost of high hardware costs, making them unsuitable for resource-constrained embedded and edge devices. Summary of the Invention

[0003] To address the high cost of deploying post-quantum cryptography algorithms in resource-constrained embedded and edge devices, this invention proposes a shareable number-theoretic transform (NTT) hardware acceleration architecture for post-quantum cryptosystems, applicable to lattice-based cryptographic algorithms with different parameter configurations. Designed with small bit-width computation requirements as the benchmark, this architecture achieves compatibility support for multiple NTT parameters through unified abstraction and reconstruction of butterfly operation units, modular multiplication computation paths, and storage access logic. This allows for the simultaneous completion of NTT computation tasks with different algorithms or parameter sets on the same hardware platform.

[0004] The technical solution adopted by the present invention is: a shared NTT hardware optimization method for a mixed application scenario of quantum cryptography ML-KEM and ML-DSA. In the modulus addition unit, a structure consisting of two adders with configurable bit widths is adopted, and modulus reduction and subtraction operations are completed by combining a subtractor and a sign bit arbitration mechanism, thereby ensuring that the operation result is always within the legal modulus range; at the same time, adaptive scheduling of the ML-KEM and ML-DSA operation processes is realized by using selection signals and state control signals: in ML-KEM mode, the two adders perform independent addition operations in parallel; in ML-DSA mode, the addition operation stage and the addition reduction and subtraction stage are completed in two clock cycles by time-division multiplexing, and modulus reduction and subtraction judgment is realized by combining constant operands.

[0005] Preferably, the molding unit includes: The first input port group is used to receive the low-order part a1 of the first operand and the low-order part b1 of the second operand; The second input port group is used to receive the high-order part ah of the first operand and the high-order part bh of the second operand. The first constant input port is used to receive the first constant value 12'hFFF; The second constant input port is used to receive the second constant value 12'h801; The first multiplexer group consists of a first multiplexer and a second multiplexer arranged in parallel. The first input terminal of the first multiplexer receives the a1 signal, the first input terminal of the second multiplexer receives the b1 signal, and the second input terminals of the first multiplexer and the second multiplexer jointly receive the first constant value 12'hFFF. The first multiplexer and the second multiplexer perform input selection according to the first selection control signal sel. The first adder is a 12-bit adder, with its first input terminal coupled to the output terminal of the first multiplexer and its second input terminal coupled to the output terminal of the second multiplexer, for performing the first addition operation; The first register has its input coupled to the output of the first adder and its output coupled to the second input of the first multiplexer. It is used to store intermediate results and support accumulation operations. The third multiplexer has a first input terminal receiving a constant 0, and a second input terminal coupled to the output terminal of the first adder, which performs input selection according to the third selection control signal sel; its output terminal is coupled to the third input terminal of the second adder, which is used to input the carry of the first adder into the second adder to form a 24-bit adder. The second multiplexer group consists of a fourth multiplexer and a fifth multiplexer. The first input terminal of the fourth multiplexer receives the bh signal, and its second input terminal receives the second constant value 12'h801. The first input terminal of the fifth multiplexer receives the ah signal, and its second input terminal receives the second constant value 12'h801. The fourth and fifth multiplexers perform input selection according to the second selection control signal sel. The first selection control signal sel and the second selection control signal sel are the same control signal. The second adder is a 12-bit adder. Its first input is coupled to the output of the fourth multiplexer, and its second input is coupled to the output of the fifth multiplexer. It is used to perform the second addition operation. The second register, whose input is coupled to the output of the second adder and whose output is fed back to the second input of the fifth multiplexer, is used to store intermediate results and support accumulation operations. The first output port is coupled to the output of the first adder and is used to output the low-order operation result cl. The second output port is coupled to the output of the second adder and is used to output the high-order bit operation result ch.

[0006] As a preferred approach, the modular multiplication unit employs a reconfigurable structure consisting of two 12×12-bit multipliers. Simultaneously, a unified 24-bit data representation and scheduling mechanism is used to achieve compatibility with different modulus and bit width requirements. Specifically, in ML-KEM mode, multiple butterfly multiplications within a single cycle are achieved by splitting the 24-bit operands into high and low 12-bit parallel operations. In ML-DSA mode, the 24×24-bit multiplication is decomposed into multiple 12×12 sub-multiplications and completed in cycles, thereby balancing throughput and timing performance within a limited hardware scale.

[0007] Preferably, the modular multiplication unit includes: The first multiplier (Multiplier0) and the second multiplier (Multiplier1) are arranged in parallel and share the same weighted input signal W. The first input port is used to receive the first input data i and provide it to the first input terminal of the first multiplier; The second input port is used to receive the second input data i and provide it to the first input terminal of the second multiplier; The weight input port is used to receive weight data W and provide it to the second input terminals of the first multiplier and the second multiplier, respectively. A first data path is coupled to the output of the first multiplier. The first data path includes a cascaded third register and a fourth register. The output of the third register is coupled to the first input of the sixth multiplexer, the input of the fourth register, and the first input of the fourth adder. The output of the fourth register is coupled to the first input of the third adder. The output of the fourth adder is coupled to the third input of the third adder via a second shifter. The second data path is coupled to the output of the second multiplier. The second data path includes a cascaded fifth register and a sixth register. The output of the fifth register is coupled to the second input of the third adder, the input of the sixth register, and the second input of the sixth multiplexer via a first shifter. The output of the third adder is coupled to the third input of the sixth multiplexer; The sixth multiplexer selects one of the first input terminal, the second input terminal, and the third input terminal as the final output signal O according to the selection control signal.

[0008] As a preferred approach, a unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA is constructed. Through configurable operator scheduling and time-sharing multiplexing mechanisms, the overhead of registers and computing resources is significantly reduced while ensuring timing performance. The unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA includes: The first processing channel, ML-KEM-NTT, performs number-theoretical transformation operations of the ML-KEM algorithm; The second processing channel, ML-KEM-INTT, performs the inverse number theory transformation operation of the ML-KEM algorithm. The third processing channel, ML-DSA-NTT, performs number-theoretical transformation operations of the ML-DSA algorithm; The fourth processing channel, ML-DSA-INTT, performs the inverse number theory transformation operation of the ML-DSA algorithm; A global clock distribution network is used to provide synchronous clock signals for the first processing channel, the second processing channel, the third processing channel, and the fourth processing channel; A shared memory interface, coupled to the BRAM data read module of the third and fourth processing channels, is used to read computational data from external block memory; A data path selector is used to select and activate the first processing channel, the second processing channel, the third processing channel, or the fourth processing channel according to the algorithm configuration signal.

[0009] As a preferred option, for ML-KEM operations, the pipeline uses a single clock cycle as the basic scheduling unit; The first processing channel includes a first-level 12-bit multiplication unit, a first-level modular reduction simple unit, a second-level modular reduction simple unit, a third-level modular addition and subtraction unit, and a fourth-level modular addition and subtraction unit. Each level is cascaded through a pipelined register. Two 12-bit coefficients enter the modular multiplication unit in parallel to complete the modular multiplication operation, and then pass through the modular reduction and subtraction unit and the modular addition and subtraction unit in sequence to complete the butterfly operation. The second processing channel includes a first-level modular subtraction unit, a second-level modular subtraction unit, a third-level 12-bit multiplication unit, a fourth-level modular addition unit, a fifth-level modular addition unit, a sixth-level reduction and addition unit, and a seventh-level modular half-operation unit. Each level is cascaded through a pipelined register. Modular addition and modular subtraction are performed first, followed by modular multiplication and reduction, and the results are output synchronously through path alignment.

[0010] As a preferred approach, for ML-DSA operations, a dual-state pipeline mechanism based on a single-bit state identifier is designed to abstract two consecutive clock cycles into one operation cycle, and to perform multiple 12-bit sub-operations in a time-sharing manner on the same hardware resources, thereby realizing the splitting and recombination of large-bit-width operations. The third processing channel includes a BRAM data read module, a 24-bit × 24-bit multiplier array, a 48-bit modulo-reduction simple unit, and a 24-bit modulo-addition and modulo-subtraction unit. The multiplier array adopts a three-stage pipeline structure, with each multiplier stage coupled to a corresponding modulo-reduction simple unit. Multiplication, modulo-reduction, and modulo-addition and modulo-subtraction operations are executed sequentially across multiple operation cycles, and the number of intermediate registers is reduced by utilizing the inherent delay introduced by state switching. The fourth processing channel includes a BRAM data reading module, a 24-bit modular subtraction operation unit, a 24-bit × 24-bit multiplier array, a modular reduction and addition unit, and a modular half operation unit. The multiplier array adopts a three-stage pipeline structure. By allocating the modular addition and modular subtraction-modular multiplication paths to different operation cycles, critical path alignment and data synchronization are achieved, thereby avoiding additional synchronization logic.

[0011] As a preferred approach, in terms of arithmetic operations, DSP resources are explicitly disabled during the synthesis stage, and lookup tables are used to implement small-width multiplication operations. In terms of storage resources, BRAM is avoided from being used to store the rotation factor. Instead, it is fixed as a logical constant, and an equivalent read-only memory structure is constructed using lookup tables and registers, thereby effectively eliminating the resource waste caused by idle BRAM space.

[0012] The technical solution adopted by the system of this invention is: a shared NTT hardware optimization system for a hybrid application scenario of quantum cryptography ML-KEM and ML-DSA, comprising: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the shared NTT hardware optimization method in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA.

[0013] The technical solution adopted by the product of the present invention is: a shared NTT hardware optimization product for a mixed application scenario of quantum cryptography ML-KEM and ML-DSA, including computer program instructions, which, when the computer program instructions are run on a computer, cause the computer to execute the shared NTT hardware optimization method for a mixed application scenario of quantum cryptography ML-KEM and ML-DSA.

[0014] Compared with the prior art, the beneficial effects of the present invention include: (1) In the hardware implementation of this invention, the high isomorphism between adders and subtractors in circuit structure and operation path is fully utilized. By bitwise inversion of the input operands and carry control, a unified design of modular addition and modular subtraction functions is achieved. The modular addition unit adopts a structure composed of two configurable bit-width basic adders, and combines a subtractor with a sign bit arbitration mechanism to complete the modular reduction operation, thereby ensuring that the operation result is always within the legal modulus range.

[0015] (2) To address different algorithm requirements, this invention introduces algorithm selection signals and state control signals to achieve adaptive scheduling of the ML-KEM and ML-DSA operation processes. In the ML-KEM mode, two adders perform independent addition operations in parallel. In the ML-DSA mode, the addition and reduction stages are completed within two clock cycles through time-division multiplexing, and modulo reduction judgment is achieved by combining constant operands. This design effectively reduces the hardware resource overhead of adders and related logic while ensuring timing correctness and functional integrity, improves the resource utilization of the modulo addition and reduction modules and the hardware efficiency of the overall architecture, and the structure can also be directly applied to the implementation of the modulo reduction unit.

[0016] (3) This invention addresses the high overhead in area and timing of multiplication and modular reduction modules in NTT operations by proposing a unified lightweight implementation scheme for ML-KEM and ML-DSA. In the modular multiplication unit, a reconfigurable structure consisting of two 12×12-bit multipliers is adopted, combined with a unified 24-bit data representation and scheduling mechanism to achieve compatibility with different modulus and bit width requirements: In ML-KEM mode, multiple butterfly multiplications are achieved in a single cycle by splitting the 24-bit operands into high and low 12-bit parallel operations; in ML-DSA mode, the 24×24-bit multiplication is decomposed into multiple 12×12 sub-multiplications and completed by cycle-based calculation, thereby balancing throughput and timing performance under limited hardware scale. In the modular reduction unit, the Mersenne prime-like structure characteristics of the ML-KEM and ML-DSA moduli are fully utilized, and the complex modular operation is transformed into shift and addition operations based on the Barrett reduction algorithm, and time-division multiplexing is achieved by combining idle cycles in the pipeline. Furthermore, the combination of large-width multiplication results is postponed until the modulo reduction module is completed, and the 24-bit addition operation required for the preprocessing stage of reduction and the postprocessing stage are designed in a unified manner, so that constant addition and subtraction operations reuse the same adder resources.

[0017] (4) This invention proposes a unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA. Through configurable operator scheduling and time-division multiplexing mechanisms, it significantly reduces register and computational resource overhead while ensuring timing performance. For ML-KEM operations, the pipeline uses a single clock cycle as the basic scheduling unit. Two 12-bit coefficients enter the multiplication unit in parallel to complete the modular multiplication operation, and then pass through the modular reduction and addition / subtraction units to complete the butterfly operation. In the INTT process, modular addition and subtraction are performed first, followed by modular multiplication and modular reduction, and the results are output synchronously through path alignment. For ML-DSA operations, due to its large bit-width arithmetic requirements, this invention introduces a dual-state pipeline mechanism based on a single-bit state identifier, which abstracts two consecutive clock cycles into one operation cycle, and performs multiple 12-bit sub-operations in time-division multiple times on the same hardware resources, realizing the splitting and recombination of large bit-width operations. In the NTT process, multiplication, modular reduction and subtraction, and modular addition and subtraction operations are executed sequentially across multiple operation cycles, and the number of intermediate registers is reduced by utilizing the inherent delay introduced by state switching. In the INTT process, critical path alignment and data synchronization are achieved by allocating the modular addition and modular subtraction-modular multiplication paths to different operation cycles, thereby avoiding additional synchronization logic.

[0018] (5) In terms of arithmetic operations, given that the multiplication bit width supported by the FPGA's built-in DSP unit is much larger than the 12×12-bit basic multiplication scale required in this architecture, directly using the DSP would result in significant resource waste. Therefore, DSP resources are explicitly disabled during the synthesis stage, and a lookup table is used to implement small-bit-width multiplication operations. Although this method extends the multiplication operation path to some extent, the overall architecture can still maintain a high operating frequency and stable timing performance due to the small multiplication bit width and reasonable pipeline organization.

[0019] (6) In terms of storage resources, considering that the rotation factor required by ML-KEM and ML-DSA is significantly smaller than the minimum configuration capacity of a single BRAM in FPGA, this invention avoids using BRAM to store the rotation factor, but instead fixes it as a logic constant and uses lookup tables and registers to construct an equivalent read-only storage structure, thereby effectively eliminating the waste of resources caused by idle BRAM space. Attached Figure Description

[0020] The technical solutions of the present invention will be further illustrated below using embodiments and specific implementation methods. In addition, some accompanying drawings are used in the description of the technical solutions. Those skilled in the art can obtain other drawings and the intent of the present invention from these drawings without any creative effort.

[0021] Figure 1 This is a schematic diagram of the overall logical structure of an embodiment of the present invention; Figure 2 This is a schematic diagram of the module addition unit structure according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the modular multiplication unit structure according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the production line structure according to an embodiment of the present invention. Detailed Implementation

[0022] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0023] Please see Figure 1This embodiment provides a hardware optimization method for shared NTT in a quantum-resistant cryptographic ML-KEM and ML-DSA hybrid application scenario. For the three core basic operators in the NTT module—modular addition, modular subtraction, and modular multiplication—the corresponding hardware implementation structures are redesigned. Based on the ML-KEM with a smaller modulus bit length, small-bit-width arithmetic units are time-division multiplexed to support large-bit-width NTT operations, effectively reducing the hardware overhead of the underlying operators. For the NTT operations of ML-DSA, a dedicated pipeline structure matching the improved operators is proposed. This structure optimizes register overhead through reasonable design of data flow paths and multiplexing mechanisms, further reducing system resource costs.

[0024] The modular addition, subtraction, and multiplication operators are based on the ML-KEM with a small modular bit length, and support large-bit-width NTT operations by time-division multiplexing small-bit-width arithmetic units. A dedicated pipeline structure matching the improved operators exists, where each stage of the ML-DSA operation requires two clock cycles to complete. Further implementations include LUTs (Look-Up Tables) for DSPs (Digital Signal Processors) and BRAMs (Block Random Access Memory).

[0025] In one implementation, the hardware implementation of this invention fully utilizes the high isomorphism of adders and subtractors in circuit structure and operation path. By bitwise inversion of the input operands and carry control, a unified design for modular addition and subtraction functions is achieved. The modular addition unit adopts a structure consisting of two configurable bit-width basic adders, and combines a subtractor with a sign bit arbitration mechanism to complete modular reduction operations, thereby ensuring that the operation result is always within the valid modulus range. To address different algorithm requirements, this invention introduces algorithm selection signals and state control signals to achieve adaptive scheduling of the ML-KEM and ML-DSA operation processes: in ML-KEM mode, the two adders perform independent addition operations in parallel; in ML-DSA mode, the addition and reduction stages are completed within two clock cycles using time-division multiplexing, and modular reduction judgment is achieved using constant operands. While ensuring timing correctness and functional integrity, this design effectively reduces the hardware resource overhead of adders and related logic, improves the resource utilization of the modular addition and subtraction modules and the hardware efficiency of the overall architecture, and the structure can also be directly applied to the implementation of modular subtraction units.

[0026] In one implementation, please see Figure 2 The molding unit includes: The first input port group is used to receive the low-order part a1 of the first operand and the low-order part b1 of the second operand; The second input port group is used to receive the high-order part ah of the first operand and the high-order part bh of the second operand. The first constant input port is used to receive the first constant value 12'hFFF; The second constant input port is used to receive the second constant value 12'h801; The first multiplexer group consists of a first multiplexer 110 and a second multiplexer 120 arranged in parallel. The first input terminal of the first multiplexer 110 receives the a1 signal, and the first input terminal of the second multiplexer 120 receives the b1 signal. The second input terminals of the first multiplexer 110 and the second multiplexer 120 jointly receive the first constant value 12'hFFF. The first multiplexer 110 and the second multiplexer 120 perform input selection according to the first selection control signal sel. The first adder 130 is a 12-bit adder, with its first input terminal coupled to the output terminal of the first multiplexer 110 and its second input terminal coupled to the output terminal of the second multiplexer 120, for performing the first addition operation; The first register 140 has its input terminal coupled to the output terminal of the first adder 130, and its output terminal is fed back coupled to the second input terminal of the first multiplexer 110, for storing intermediate results and supporting accumulation operations; The third multiplexer 150 has a first input terminal receiving a constant 0, and its second input terminal coupled to the output terminal of the first adder 130, which performs input selection according to the third selection control signal sel; its output terminal is coupled to the third input terminal of the second adder 180, which is used to input the carry of the first adder 130 into the second adder 180 to form a 24-bit adder. The second multiplexer group consists of a fourth multiplexer 160 and a fifth multiplexer 170. The first input terminal of the fourth multiplexer 160 receives the bh signal, and its second input terminal receives the second constant value 12'h801. The first input terminal of the fifth multiplexer 170 receives the ah signal, and its second input terminal receives the second constant value 12'h801. The fourth multiplexer 160 and the fifth multiplexer 170 perform input selection according to a second selection control signal sel. The first selection control signal sel and the second selection control signal sel are the same control signal. The second adder 180 is a 12-bit adder. Its first input is coupled to the output of the fourth multiplexer 160, and its second input is coupled to the output of the fifth multiplexer 170. It is used to perform a second addition operation. The second register 190 has its input terminal coupled to the output terminal of the second adder 180, and its output terminal is fed back coupled to the second input terminal of the fifth multiplexer 170. It is used to store intermediate results and support accumulation operations. The first output port is coupled to the output of the first adder 130 and is used to output the low-order operation result cl. The second output port is coupled to the output of the second adder 180 and is used to output the high-order operation result ch.

[0027] The first constant value 12'hFFF is a 12-bit all-one mask used to perform bitwise inversion or masking operations; the second constant value 12'h801 is a characteristic constant of the modulo reduction operation, used in the modulo reduction step in quantum-resistant cryptographic algorithms.

[0028] In one implementation, the first adder 130 and the second adder 180 are both 12-bit binary two's complement adders, supporting two-input addition and three-input accumulation operation modes.

[0029] In one implementation, the first register 140 and the second register 190 are edge-triggered D flip-flops used to implement pipelined registers and accumulation feedback functions.

[0030] In one implementation, the first selection control signal, the second selection control signal, and the third selection control signal are the same control signal or independent control signals, used to configure different operation modes of the circuit.

[0031] In modulo reduction mode, the first multiplexer group selects al and bl for addition; in mask mode, 12'hFFF is selected to perform bitwise operations with the operand. After the first adder 130 performs the addition, the result can be fed back and accumulated through the first register 140, or selected to pass through 0 or output to the cl port through the third multiplexer 150.

[0032] The second input of the third multiplexer 150 receives the addition result of the left channel, and its output cl and the output ch of the right channel form a complete 24-bit result or an independent dual 12-bit result.

[0033] This embodiment achieves multiple modular operations required by quantum cryptography algorithms in a single circuit through a dual-channel parallel structure and constant hard-coding optimization. Compared with general multiplier schemes, it significantly reduces hardware area and computational latency, and is suitable for NTT acceleration engine design of algorithms such as ML-KEM and ML-DSA.

[0034] In one implementation, this invention addresses the high area and timing overhead of multiplication and modular reduction modules in NTT operations by proposing a unified lightweight implementation scheme for ML-KEM and ML-DSA. In the modular multiplication unit, a reconfigurable structure consisting of two 12×12-bit multipliers is employed, combined with a unified 24-bit data representation and scheduling mechanism to achieve compatibility with different modulus and bit width requirements: In ML-KEM mode, multiple butterfly multiplications are achieved within a single cycle by splitting the 24-bit operands into high and low 12-bit parallel operations; in ML-DSA mode, the 24×24-bit multiplication is decomposed into multiple 12×12 sub-multiplications and completed in cycles, thereby balancing throughput and timing performance within a limited hardware scale. In the modular reduction unit, the Mersenne prime-like structural characteristics of the ML-KEM and ML-DSA moduli are fully utilized. Complex modular operations are transformed into shift and addition operations based on the Barrett reduction algorithm, and time-division multiplexing is achieved by combining idle cycles in the pipeline. Furthermore, the combination of large-width multiplication results is postponed to the modular reduction module, and the 24-bit addition operation required for the preprocessing and postprocessing stages of reduction is designed in a unified manner, so that constant addition and subtraction operations reuse the same adder resources. This allows the result normalization to be completed without increasing the additional hardware area, significantly improving the resource utilization efficiency of the modular multiplication and reduction modules and the hardware friendliness of the overall architecture.

[0035] In one implementation, please see Figure 3 The modular multiplication unit includes: The first multiplier (Multiplier0) and the second multiplier (Multiplier1) are arranged in parallel and share the same weighted input signal W. The first input port is used to receive the first input data i and provide it to the first input terminal of the first multiplier; The second input port is used to receive the second input data i and provide it to the first input terminal of the second multiplier; The weight input port is used to receive weight data W and provide it to the second input terminals of the first multiplier and the second multiplier, respectively. A first data path is coupled to the output of the first multiplier. The first data path includes a cascaded third register 210 and a fourth register 220. The output of the third register 210 is coupled to the first input of the sixth multiplexer 250, the input of the fourth register 220, and the first input of the fourth adder 280, respectively. The output of the fourth register 220 is coupled to the first input of the third adder 240. The output of the fourth adder 280 is coupled to the third input of the third adder 240 via a second shifter 290. The second data path is coupled to the output of the second multiplier. The second data path includes a cascaded fifth register 260 and a sixth register 270. The output of the fifth register 260 is coupled to the second input of the third adder 240, the input of the sixth register 270, and the second input of the sixth multiplexer 250 via the first shifter 230, respectively. The output of the third adder 240 is coupled to the third input of the sixth multiplexer 250; The sixth multiplexer 250 selects one of the first input terminal, the second input terminal, and the third input terminal as the final output signal O according to the selection control signal.

[0036] In one embodiment, the first shifter and the second shifter are left shifters, used to perform a fixed-width arithmetic left shift operation on the input data.

[0037] In one implementation, the third and fourth adders are two's complement adders used to perform addition operations on signed numbers.

[0038] In one implementation, the third, fourth, fifth, and sixth registers are edge-triggered D flip-flops used for pipelined storage of the data path.

[0039] In one implementation, the first multiplier and the second multiplier are fixed-point multipliers used to perform multiplication operations between input data i and weight data W.

[0040] This embodiment achieves the reuse of multiple operation modes in a single circuit structure through a cross-connected path structure and a configurable output mechanism, which significantly improves the utilization of hardware resources and reduces chip area and power consumption.

[0041] In one implementation, this invention proposes a unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA. Through configurable operator scheduling and time-division multiplexing mechanisms, it significantly reduces register and computational resource overhead while ensuring timing performance. For ML-KEM operations, the pipeline uses a single clock cycle as the basic scheduling unit. Two 12-bit coefficients enter the multiplication unit in parallel to perform modular multiplication, followed by modular reduction and addition / subtraction units to complete butterfly operations. In the INTT process, modular addition and subtraction are performed first, followed by modular multiplication and reduction, and the results are output synchronously through path alignment. For ML-DSA operations, due to its large bit-width arithmetic requirements, this invention introduces a dual-state pipeline mechanism based on a single-bit state identifier. This abstracts two consecutive clock cycles into one operation cycle, performing multiple 12-bit sub-operations in a time-division manner on the same hardware resources, thus realizing the splitting and recombination of large bit-width operations. In the NTT flow, multiplication, modular reduction, and modular addition / subtraction operations are executed sequentially across multiple operation cycles, and the number of intermediate registers is reduced by utilizing the inherent latency introduced by state switching. In the INTT flow, critical path alignment and data synchronization are achieved by allocating the modular addition and modular subtraction-modular multiplication paths to different operation cycles, thereby avoiding additional synchronization logic. This pipeline organization method effectively compresses trigger resources, reuses existing data paths, and improves the area efficiency and implementation friendliness of the overall architecture while uniformly supporting ML-KEM and ML-DSA.

[0042] In one implementation, please see Figure 4 The unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA includes: The first processing channel, ML-KEM-NTT, performs number-theoretical transformation operations of the ML-KEM algorithm; The second processing channel, ML-KEM-INTT, performs the inverse number theory transformation operation of the ML-KEM algorithm. The third processing channel, ML-DSA-NTT, performs number-theoretical transformation operations of the ML-DSA algorithm; The fourth processing channel, ML-DSA-INTT, performs the inverse number theory transformation operation of the ML-DSA algorithm; A global clock distribution network is used to provide synchronous clock signals for the first processing channel, the second processing channel, the third processing channel, and the fourth processing channel; A shared memory interface, coupled to the BRAM data read module of the third and fourth processing channels, is used to read computational data from external block memory; A data path selector is used to select and activate the first processing channel, the second processing channel, the third processing channel, or the fourth processing channel according to the algorithm configuration signal.

[0043] For ML-KEM operations, the pipeline uses a single clock cycle as the basic scheduling unit. The first processing channel includes a first-level 12-bit multiplication unit, a first-level modular reduction simple unit, a second-level modular reduction simple unit, a third-level modular addition and subtraction unit, and a fourth-level modular addition and subtraction unit. Each level is cascaded through a pipelined register. Two 12-bit coefficients enter the modular multiplication unit in parallel to complete the modular multiplication operation, and then pass through the modular reduction and subtraction unit and the modular addition and subtraction unit in sequence to complete the butterfly operation. The second processing channel includes a first-level modular subtraction unit, a second-level modular subtraction unit, a third-level 12-bit multiplication unit, a fourth-level modular addition unit, a fifth-level modular addition unit, a sixth-level reduction and addition unit, and a seventh-level modular half-operation unit. Each level is cascaded through a pipelined register. Modular addition and modular subtraction are performed first, followed by modular multiplication and reduction, and the results are output synchronously through path alignment.

[0044] For ML-DSA operations, a dual-state pipeline mechanism based on a single-bit state identifier is designed to abstract two consecutive clock cycles into one operation cycle, and to perform multiple 12-bit sub-operations in time-division on the same hardware resources, thereby realizing the splitting and recombination of large-bit-width operations. The third processing channel includes a BRAM data read module, a 24-bit × 24-bit multiplier array, a 48-bit modulo-reduction simple unit, and a 24-bit modulo-addition and modulo-subtraction unit. The multiplier array adopts a three-stage pipeline structure, with each multiplier stage coupled to a corresponding modulo-reduction simple unit. Multiplication, modulo-reduction, and modulo-addition and modulo-subtraction operations are executed sequentially across multiple operation cycles, and the number of intermediate registers is reduced by utilizing the inherent delay introduced by state switching. The fourth processing channel includes a BRAM data reading module, a 24-bit modular subtraction operation unit, a 24-bit × 24-bit multiplier array, a modular reduction and addition unit, and a modular half operation unit. The multiplier array adopts a three-stage pipeline structure. By allocating the modular addition and modular subtraction-modular multiplication paths to different operation cycles, critical path alignment and data synchronization are achieved, thereby avoiding additional synchronization logic.

[0045] In one implementation, the first processing channel (ML-KEM-NTT) adopts a four-stage pipeline structure, with each stage operation completed within one clock cycle, wherein: the first stage performs two parallel ML-KEM 12-bit multiplication operations; the second stage performs two parallel ML-KEM modular reduction operations; the third stage performs two parallel ML-KEM modular reduction operations; and the fourth stage performs two parallel ML-KEM modular addition and subtraction operations.

[0046] In one implementation, the second processing channel (ML-KEM-INTT) adopts a seven-stage pipeline structure, wherein: the first and second stages each perform two parallel ML-KEM modular subtraction operations; the third stage performs two parallel ML-KEM 12-bit multiplication operations; the fourth and fifth stages each perform two parallel ML-KEM modular addition operations; the sixth stage performs two parallel ML-KEM reduction, subtraction, and modular addition operations; and the seventh stage performs ML-KEM modular half operations.

[0047] In one implementation, the third processing channel (ML-DSA-NTT) adopts a three-stage multiplication pipeline structure, each stage including: a BRAM data read module for reading 24-bit operands from shared memory; a 24-bit × 24-bit multiplier for performing fixed-point multiplication to produce a 48-bit product; a 48-bit modulo reduction simplifier for reducing the product to a 24-bit effective range; and a final-stage 24-bit modulo addition and subtraction unit for performing butterfly operations.

[0048] In one embodiment, the fourth processing channel (ML-DSA-INTT) adopts a three-stage multiplication pipeline structure, wherein: the first stage includes a BRAM data reading module and a 24-bit modular subtraction unit; the second, third and fourth stages each include a 24-bit × 24-bit multiplier and a modular reduction and addition unit; the final stage includes a modular half operation unit for performing the normalization operation of the inverse transformation.

[0049] The first and second processing channels use a 12-bit data path width, while the third and fourth processing channels use a 24-bit data path width. Each channel operates independently and does not interfere with the others.

[0050] The modulo-half operation unit is used to perform the halving operation of the modulus q, that is, to calculate (x•(q+1) / 2) mod q, where q is 3329 or 8380417.

[0051] This embodiment achieves the following through independent channel design and pipeline optimization: (1) A single hardware device supports two algorithms and four transformations (NTT / INTT); (2) Separate 12-bit and 24-bit data paths to avoid bit width adaptation overhead; (3) Compared to implementing two sets of NTT hardware independently, the area is reduced by about 40%.

[0052] In one implementation, from a hardware resource optimization perspective, this embodiment proposes corresponding optimization design strategies for the costly and limited number of DSP and BRAM resources in the FPGA. Regarding arithmetic operations, given that the multiplication bit width supported by the FPGA's built-in DSP unit is much larger than the 12×12-bit basic multiplication scale required in this architecture, directly using the DSP would result in significant resource waste. Therefore, DSP resources are explicitly disabled during the synthesis stage, and a lookup table is used to implement small-bit-width multiplication operations. Although this approach extends the multiplication operation path to some extent, the overall architecture can still maintain a high operating frequency and stable timing performance due to the smaller multiplication bit width and reasonable pipeline organization. Regarding storage resources, considering that the rotation factor required by ML-KEM and ML-DSA is significantly smaller than the minimum configuration capacity of a single FPGA BRAM, this invention avoids using BRAM to store the rotation factor. Instead, it is fixed as a logical constant, and an equivalent read-only memory structure is constructed using lookup tables and registers, thereby effectively eliminating resource waste caused by idle BRAM space. This resource optimization method significantly reduces the occupation of dedicated hardware resources while ensuring functional correctness and access efficiency, improving the overall architecture's resource utilization and the economy of FPGA implementation.

[0053] The invention will be further illustrated below through specific experiments.

[0054] The performance of this experiment on the Zynq Ultrascale+ platform is shown in the table below. In addition to the data of this invention itself, the performance of several representative architectures is also provided for comparative analysis.

[0055] Table 1

[0056] As can be seen from the table above, without using DSP and BRAM, this invention uses only 1327 LUTs and 450 registers, and the area after conversion is only 48.59% of the smallest area in the previous implementation.

[0057] It should be understood that the embodiments described above are only some, not all, of the embodiments of the present invention. Furthermore, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0058] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. A method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA, characterized in that: In the modulo addition unit, a structure consisting of two adders with configurable bit widths is adopted, and modulo reduction and subtraction operations are completed in conjunction with a subtractor and a sign bit arbitration mechanism to ensure that the operation result is always within the legal modulo range. At the same time, adaptive scheduling of the ML-KEM and ML-DSA operation processes is realized through selection signals and status control signals: in ML-KEM mode, the two adders perform independent addition operations in parallel; in ML-DSA mode, the addition operation stage and the addition reduction and subtraction stage are completed in two clock cycles through time-division multiplexing, and modulo reduction and subtraction judgment is realized in conjunction with constant operands.

2. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 1, characterized in that, The module addition unit includes: The first input port group is used to receive the low-order part a1 of the first operand and the low-order part b1 of the second operand; The second input port group is used to receive the high-order part ah of the first operand and the high-order part bh of the second operand. The first constant input port is used to receive the first constant value 12'hFFF; The second constant input port is used to receive the second constant value 12'h801; The first multiplexer group consists of a first multiplexer (110) and a second multiplexer (120) arranged in parallel. The first input terminal of the first multiplexer (110) receives the a1 signal, and the first input terminal of the second multiplexer (120) receives the b1 signal. The second input terminals of the first multiplexer (110) and the second multiplexer (120) jointly receive the first constant value 12'hFFF. The first multiplexer (110) and the second multiplexer (120) select the input according to the first selection control signal sel. The first adder (130) is a 12-bit adder. Its first input is coupled to the output of the first multiplexer (110), and its second input is coupled to the output of the second multiplexer (120). It is used to perform the first addition operation. The first register (140) has its input coupled to the output of the first adder (130) and its output coupled to the second input of the first multiplexer (110) for storing intermediate results and supporting accumulation operations. The third multiplexer (150) has a first input terminal receiving a constant 0, and its second input terminal coupled to the output terminal of the first adder (130) for input selection according to the third selection control signal sel; its output terminal is coupled to the third input terminal of the second adder (180) for inputting the carry of the first adder (130) into the second adder (180) to form a 24-bit adder; The second multiplexer group consists of a fourth multiplexer (160) and a fifth multiplexer (170). The first input terminal of the fourth multiplexer (160) receives the bh signal, and its second input terminal receives the second constant value 12'h801. The first input terminal of the fifth multiplexer (170) receives the ah signal, and its second input terminal receives the second constant value 12'h801. The fourth multiplexer (160) and the fifth multiplexer (170) select inputs according to the second selection control signal sel. The first selection control signal sel and the second selection control signal sel are the same control signal. The second adder (180) is a 12-bit adder. Its first input is coupled to the output of the fourth multiplexer (160), and its second input is coupled to the output of the fifth multiplexer (170). It is used to perform a second addition operation. The second register (190) has its input coupled to the output of the second adder (180) and its output coupled to the second input of the fifth multiplexer (170) for storing intermediate results and supporting accumulation operations. The first output port is coupled to the output of the first adder (130) and is used to output the low-order operation result cl; The second output port is coupled to the output of the second adder (180) and is used to output the high-order operation result ch.

3. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 1, characterized in that: In the modular multiplication unit, a reconfigurable structure consisting of two 12×12-bit multipliers is adopted. At the same time, a unified 24-bit data representation and scheduling mechanism is combined to achieve compatibility with different modulus and bit width requirements. In ML-KEM mode, multiple butterfly multiplications are achieved in a single cycle by splitting the 24-bit operands into high and low 12-bit parallel operations. In ML-DSA mode, the 24×24-bit multiplication is decomposed into multiple 12×12 sub-multiplications and completed by cycle-by-cycle calculation, thereby balancing throughput and timing performance under limited hardware scale.

4. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 3, characterized in that: The modular multiplication unit includes: The first multiplier (Multiplier0) and the second multiplier (Multiplier1) are arranged in parallel and share the same weighted input signal W. The first input port is used to receive the first input data i and provide it to the first input terminal of the first multiplier; The second input port is used to receive the second input data i and provide it to the first input terminal of the second multiplier; The weight input port is used to receive weight data W and provide it to the second input terminals of the first multiplier and the second multiplier, respectively. A first data path is coupled to the output of the first multiplier. The first data path includes a cascaded third register (210) and a fourth register (220). The output of the third register (210) is coupled to the first input of the sixth multiplexer (250), the input of the fourth register (220), and the first input of the fourth adder (280). The output of the fourth register (220) is coupled to the first input of the third adder (240). The output of the fourth adder (280) is coupled to the third input of the third adder (240) via a second shifter (290). The second data path is coupled to the output of the second multiplier. The second data path includes a cascaded fifth register (260) and a sixth register (270). The output of the fifth register (260) is coupled to the second input of the third adder (240), the input of the sixth register (270), and the second input of the sixth multiplexer (250) via the first shifter (230). The output of the third adder (240) is coupled to the third input of the sixth multiplexer (250); The sixth multiplexer (250) selects one of the first input terminal, the second input terminal, and the third input terminal as the final output signal O according to the selection control signal.

5. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 1, characterized in that: A unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA is constructed. Through configurable operator scheduling and time-sharing multiplexing mechanisms, the overhead of registers and computing resources is significantly reduced while ensuring timing performance. The unified NTT / INTT pipeline architecture for ML-KEM and ML-DSA includes: The first processing channel, ML-KEM-NTT, performs number-theoretical transformation operations of the ML-KEM algorithm; The second processing channel, ML-KEM-INTT, performs the inverse number theory transformation operation of the ML-KEM algorithm. The third processing channel, ML-DSA-NTT, performs number-theoretical transformation operations of the ML-DSA algorithm; The fourth processing channel, ML-DSA-INTT, performs the inverse number theory transformation operation of the ML-DSA algorithm; A global clock distribution network is used to provide synchronous clock signals for the first processing channel, the second processing channel, the third processing channel, and the fourth processing channel; A shared memory interface, coupled to the BRAM data read module of the third and fourth processing channels, is used to read computational data from external block memory; A data path selector is used to select and activate the first processing channel, the second processing channel, the third processing channel, or the fourth processing channel according to the algorithm configuration signal.

6. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 5, characterized in that: For ML-KEM operations, the pipeline uses a single clock cycle as the basic scheduling unit. The first processing channel includes a first-level 12-bit multiplication unit, a first-level modular reduction simple unit, a second-level modular reduction simple unit, a third-level modular addition and subtraction unit, and a fourth-level modular addition and subtraction unit. Each level is cascaded through a pipelined register. Two 12-bit coefficients enter the modular multiplication unit in parallel to complete the modular multiplication operation, and then pass through the modular reduction and subtraction unit and the modular addition and subtraction unit in sequence to complete the butterfly operation. The second processing channel includes a first-level modular subtraction unit, a second-level modular subtraction unit, a third-level 12-bit multiplication unit, a fourth-level modular addition unit, a fifth-level modular addition unit, a sixth-level reduction and addition unit, and a seventh-level modular half-operation unit. Each level is cascaded through a pipelined register. Modular addition and modular subtraction are performed first, followed by modular multiplication and reduction, and the results are output synchronously through path alignment.

7. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in claim 5, characterized in that: For ML-DSA operations, a dual-state pipeline mechanism based on a single-bit state identifier is designed to abstract two consecutive clock cycles into one operation cycle, and to perform multiple 12-bit sub-operations in time-division on the same hardware resources, thereby realizing the splitting and recombination of large-bit-width operations. The third processing channel includes a BRAM data read module, a 24-bit × 24-bit multiplier array, a 48-bit modulo-reduction simple unit, and a 24-bit modulo-addition and modulo-subtraction unit. The multiplier array adopts a three-stage pipeline structure, with each multiplier stage coupled to a corresponding modulo-reduction simple unit. Multiplication, modulo-reduction, and modulo-addition and modulo-subtraction operations are executed sequentially across multiple operation cycles, and the number of intermediate registers is reduced by utilizing the inherent delay introduced by state switching. The fourth processing channel includes a BRAM data reading module, a 24-bit modular subtraction operation unit, a 24-bit × 24-bit multiplier array, a modular reduction and addition unit, and a modular half operation unit. The multiplier array adopts a three-stage pipeline structure. By allocating the modular addition and modular subtraction-modular multiplication paths to different operation cycles, critical path alignment and data synchronization are achieved, thereby avoiding additional synchronization logic.

8. The method for optimizing shared NTT hardware in a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA according to any one of claims 1-7, characterized in that: In terms of arithmetic operations, DSP resources are explicitly disabled during the synthesis stage, and lookup tables are used to implement small-width multiplication operations. In terms of storage resources, BRAM is avoided for storing rotation factors. Instead, they are fixed as logical constants, and lookup tables and registers are used to construct an equivalent read-only memory structure, thereby effectively eliminating the resource waste caused by idle BRAM space.

9. A shared NTT hardware optimization system for a hybrid application scenario of quantum-resistant cryptography ML-KEM and ML-DSA, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the shared NTT hardware optimization method in a quantum-resistant cryptography ML-KEM and ML-DSA hybrid application scenario as described in any one of claims 1 to 8.

10. A shared NTT hardware optimization product for a hybrid application scenario of quantum cryptography ML-KEM and ML-DSA, comprising computer program instructions, characterized in that: When the computer program instructions are executed on the computer, the computer performs the shared NTT hardware optimization method in the mixed application scenario of quantum-resistant cryptography ML-KEM and ML-DSA as described in any one of claims 1 to 8.

Images