High-parallel rejection sampler for post-quantum cryptography and working method thereof

Abstract

This invention discloses a highly parallel rejection sampler for post-quantum cryptography and its operating method. The 8-bit sampled data is split into symmetrical high-4 and low-4 bit parallel sampling units: the high-4 bit unit performs data compression towards the least significant bit, and the low-4 bit unit performs data compression towards the most significant bit. The two compressed outputs are combined through physical splicing to form a pre-aligned data stream with continuous data in the middle and possible invalid data bits at the beginning and end. Subsequently, the system uses the effective data count value of the high-bit unit as a control signal to drive a multiplexer network to directly select the output result according to five preset alignment paths, thereby achieving a compact arrangement of fully parallel data. This invention avoids the complex multi-level shift operations in traditional architectures, greatly optimizes critical path latency and hardware resource overhead, and is suitable for high-speed hardware accelerator design for post-quantum cryptography algorithms.

Description

Technical Field

[0001] This invention relates to a highly parallel rejection sampler for post-quantum cryptography and its working method, belonging to the technical fields of post-quantum information security algorithms, matrix operation optimization and circuit implementation. Background Technology

[0002] Ensuring information security is crucial for maintaining stability in sensitive areas, particularly in financial transactions, government networks, and military communications, where encryption algorithms are essential for data protection. With the rapid development of quantum computing technology, traditional public-key encryption algorithms such as Large Integer Prime Factorization (RSA) and Elliptic Curve Cryptography (ECC) face the threat of being effectively cracked by quantum computers. Post-quantum cryptography algorithms are considered a new generation of cryptosystems capable of effectively resisting quantum computer attacks. The ML-KEM algorithm (Modular Lattice Basis Key Encapsulation Mechanism), as a formally standardized post-quantum public-key encapsulation mechanism, is primarily used to establish secure shared keys for communicating parties in insecure networks. Based on error-learning problems on modular lattices, this algorithm achieves a good balance between security and hardware / software efficiency, and has become a core standard algorithm internationally resistant to quantum cryptographic transfers.

[0003] The hardware implementation of the ML-KEM algorithm relies on an extended hash function to generate a large number of pseudo-random numbers. These pseudo-random bitstreams must then be converted into valid polynomial coefficients that meet the algorithm's modulus requirements by a rejection sampling module. In hardware accelerator designs for high-performance applications, to meet the high throughput requirements of the overall system, the rejection sampling module must employ a highly parallel architecture to process multiple input data streams simultaneously. Because the rejection sampling operation inherently has uncertainty—that is, whether each input data point is accepted depends on its numerical value—the parallel input streams generate a variable number of valid data points with random positions after sampling.

[0004] Traditional parallel rejection sampling hardware architectures rely heavily on large-scale global decoding circuits and multi-level cascaded multiplexer networks when implementing the continuous splicing of these discrete valid data. This not only causes the logic resource consumption to increase non-linearly with the degree of parallelism, but also produces extremely long combinational logic path delays, which directly restricts the maximum operating frequency of cryptographic hardware systems.

[0005] Therefore, designing a highly parallel rejection sampler for post-quantum cryptography is of great significance in order to improve the hardware execution speed of post-quantum cryptography algorithms and optimize the utilization of logic resources. Summary of the Invention

[0006] Objective: To overcome the problems in existing technologies where, considering the hardware implementation of post-quantum cryptography algorithms, traditional parallel rejection samplers rely on global full decoding logic for 256 mask states and multi-level data shifting networks, resulting in excessive lookup table resource consumption and high logic path latency, this invention provides a highly parallel rejection sampler for post-quantum cryptography and its working method. By introducing a hierarchical divide-and-conquer symmetric compression structure, the global alignment operation of 8 parallel input data is transformed into local symmetric compression and fixed path alignment, avoiding the complex multi-level shift and accumulation operations in traditional architectures. Compared with traditional global search mapping structures, the logic unit consumption required to complete the same parallel sampling task is significantly reduced. Simultaneously, a single-level multiplexer network based on local count values ​​is added to eliminate bubbles in intermediate data streams by directly mapping preset paths, effectively reducing the depth of combinational logic and improving the hardware execution speed of the sampling module.

[0007] Technical solution: To solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0008] In the first aspect, a highly parallel rejection sampler for post-quantum cryptography specifically includes: a 4-bit high-order compression unit, a 4-bit low-order compression unit, a data recombination unit, a data selector, and an adder.

[0009] The data input terminal of the 4-bit high-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit high-order compression unit is used to receive the mask; the count value output terminal of the 4-bit high-order compression unit is connected to the selection control terminal of the data selector and the first adder input terminal of the adder, respectively; the data output terminal of the 4-bit high-order compression unit is connected to the first input terminal of the data reconstruction unit.

[0010] The data input terminal of the 4-bit low-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit low-order compression unit is used to receive the mask; the count value output terminal of the 4-bit low-order compression unit is connected to the second adder input terminal of the adder; the data output terminal of the 4-bit low-order compression unit is connected to the second input terminal of the data reconstruction unit.

[0011] The output of the data reconstruction unit is connected to the data input channel of the data selector.

[0012] The data output terminal of the data selector is used to output aligned, compact sampled data.

[0013] The sum output terminal of the adder is used to output the total effective count value.

[0014] Optionally, the 4-bit high-order compression unit is used to select and continuously arrange the valid sampled data in the high 4 bits of the sampled data towards the least significant bit direction according to the determination result of the received high-order mask, fill the invalid bits with zeros, and generate high-order pre-aligned data; at the same time, it calculates the number of valid data in the high 4 bits of the sampled data in parallel and generates a high-order valid data count value.

[0015] Optionally, the 4-bit low-order compression unit is used to select and continuously arrange the valid sampled data in the lower 4 bits of the sampled data towards the most significant bit direction according to the determination result of the received low-order mask, fill the invalid bits with zeros, and generate low-order pre-aligned data; at the same time, it calculates the number of valid data in the lower 4 bits of the sampled data in parallel and generates a low-order valid data count value.

[0016] Optionally, the data reassembly unit is used to receive high-order pre-aligned data from the first input terminal and low-order pre-aligned data from the second input terminal. The received high-order pre-aligned data and low-order pre-aligned data are bit-concatenated to form concatenated data. The concatenated data is then offset to obtain five fixed-offset data streams, which are output from the first output terminal, second output terminal, third output terminal, fourth output terminal, and fifth output terminal, respectively.

[0017] Optionally, the method for obtaining the five fixed offset data is as follows:

[0018] The first output terminal outputs Path0 data, which is the concatenated data logically shifted 0 units in width towards the higher bit direction.

[0019] The second output terminal outputs Path1 data. The content of Path1 data is the data of the concatenated data that has been logically shifted 1 unit bit width in the high-bit direction, and the 12 bits left empty at the low end after the logical shift are padded with zeros.

[0020] The third output terminal outputs Path2 data. The content of Path2 data is the data of the concatenated data that has been logically shifted 2 units in the high-order direction, and the 24 bits left empty at the low end after the logical shift are padded with zeros.

[0021] The fourth output terminal outputs Path3 data. The content of Path3 data is the data of the concatenated data that has been logically shifted 3 units in the high-order direction, and the 36 bits left empty at the low end after the logical shift are padded with zeros.

[0022] The fifth output terminal outputs Path4 data. The content of Path4 data is the data of the concatenated data that has been logically shifted 4 units in the high-order direction, and the 48 bits left empty at the low end after the logical shift are padded with zeros.

[0023] Optionally, the data selector is used to perform single-level path switching using the high-order valid data count value as a control signal. Based on the number of missing high-order valid data, it directly selects one path from the first, second, third, fourth, and fifth data input channels to perform overall shift compensation.

[0024] Optionally, the adder is used to perform real-time summation of the high-order valid data count value and the low-order valid data count value, and output the final extracted total valid count value within the current clock cycle to the back-end system.

[0025] Optionally, the 4-bit high-order compression unit includes: data input buses D0, D1, D2 and D3, multiplexer_0, multiplexer_1, multiplexer_2 and multiplexer_3, and a 4-bit parallel logic control circuit.

[0026] The first input terminal of the multiplexer_0 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit.

[0027] The first input terminal of the multiplexer_1 is connected to the data input bus D1, the second input terminal is connected to the data input bus D2, the third input terminal is connected to the data input bus D3, the fourth input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit.

[0028] The first input terminal of the multiplexer_2 is connected to the data input bus D2, the second input terminal is connected to the data input bus D3, the third input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit.

[0029] The first input terminal of the multiplexer_3 is connected to the data input bus D3, the second input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit.

[0030] The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit high-order compression unit.

[0031] The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit high-order compression unit.

[0032] The output terminals Out0 of multiplexer_0, Out1 of multiplexer_1, Out2 of multiplexer_2, and Out3 of multiplexer_3 serve as the data output terminals of the 4-bit high-order compression unit.

[0033] The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit high-order compression unit.

[0034] The 4-bit parallel logic control circuit is used to perform summation operations on M0, M1, M2, and M3 using internal addition logic, and outputs the number of high-level values ​​to the fifth output terminal Cnt. Simultaneously, it performs combination decoding on M0 to M3, outputting the index value of the first valid data to the first output terminal S0, the index value of the second valid data to the second output terminal S1, the index value of the third valid data to the third output terminal S2, and the index value of the fourth valid data to the fourth output terminal S3. If there is insufficient valid data, the corresponding output terminal outputs a control signal pointing to the ground terminal.

[0035] Optionally, the 4-bit low-order compression unit includes: data input buses D0, D1, D2 and D3, multiplexer_0, multiplexer_1, multiplexer_2 and multiplexer_3, and a 4-bit parallel logic control circuit.

[0036] The first input terminal of the multiplexer_0 is connected to the data input bus D0, the second input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit.

[0037] The first input terminal of the multiplexer_1 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit.

[0038] The first input terminal of the multiplexer_2 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit.

[0039] The first input terminal of the multiplexer_3 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit.

[0040] The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit low-order compression unit.

[0041] The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit low-order compression unit.

[0042] The output terminals Out0 of multiplexer_0, Out1 of multiplexer_1, Out2 of multiplexer_2, and Out3 of multiplexer_3 serve as the data output terminals of the 4-bit low-order compression unit.

[0043] The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit low-order compression unit.

[0044] The 4-bit parallel logic control circuit is used to perform summation operations on M0, M1, M2, and M3 using internal addition logic, and outputs the number of high-level values ​​to the fifth output terminal Cnt. Simultaneously, it performs combination decoding on M0 to M3, outputting the index value of the first valid data in the highest bit direction to the fourth output terminal S3, the index value of the second to last valid data to the third output terminal S2, the index value of the third to last valid data to the second output terminal S1, and the index value of the fourth to last valid data to the first output terminal S0. If there is insufficient valid data, the corresponding low-bit output terminal outputs a control signal pointing to the ground terminal.

[0045] Secondly, a working method for a highly parallel rejection sampler for post-quantum cryptography, utilizing the aforementioned hardware architecture, specifically includes:

[0046] Step S1, Global Signal Input and Divide-and-Conquer: During the multi-channel data rejection sampling operation, the system first receives 8 parallel input data streams D[95:0] with a total bit width of 96 bits, and generates the corresponding 8-bit validity mask M[7:0] through the modulus range determination logic. Subsequently, the system uses a divide-and-conquer strategy to divide the input signal into two independent data streams in terms of physical bit width: the high-bit data stream D[95:48] and the high-bit mask M[7:4] enter the 4-bit high-bit compression unit; the low-bit data stream D[47:0] and the low-bit mask M[3:0] enter the 4-bit low-bit compression unit.

[0047] Step S2, Local Parallel Anisotropic Compression and Effective Quantity Count: In this step, the 4-bit high-order compression unit and the 4-bit low-order compression unit simultaneously perform independent data convergence operations: The 4-bit high-order compression unit decodes the input M[7:4], generates a high-order selection signal to drive the local MUX array, and performs continuous gating of the effective sampled data (12 bits per channel) in D[95:48] towards the least significant bit (LSB), padding invalid data bits with zeros, thereby outputting the high-order pre-aligned data stream Out_H[47:0]; at the same time, the number of high-order effective data is calculated synchronously, and the high-order effective data count value cnt_H[2:0] is output. The 4-bit low-order compression unit decodes the input M[3:0], generates a low-order selection signal to drive the local MUX array, performs continuous gating of the valid sampled data in D[47:0] towards the most significant bit (MSB), and fills the invalid data bits with zeros, thereby outputting the low-order pre-aligned data stream Out_L[47:0]; at the same time, it synchronously calculates the number of low-order valid data and outputs the low-order valid data count value cnt_L[2:0].

[0048] Step S3, Physical splicing and alignment path generation: The data reconstruction unit receives Out_H[47:0] and Out_L[47:0]. Through hardwiring, the lowest pin of Out_H[47:0] and the highest pin of Out_L[47:0] are directly spliced ​​bit-by-bit to generate a 96-bit pre-aligned data stream (the effective data in the center of this data stream is seamless and continuous, but there may be zero-filled bubbles at the beginning and end). Based on this pre-aligned data stream, the data reconstruction unit directly leads out five fixed-offset shift buses through physical wiring to generate shift candidate paths Path0[95:0] to Path4[95:0].

[0049] Step S4, Single-stage global shift output and total count generation: Global shift compensation: The 5-to-1 data selector (MUX) receives Path0[95:0] to Path4[95:0] as data input and receives cnt_H[2:0] output from the high-order unit as the only selection control signal. According to the value of cnt_H[2:0], the MUX directly selects the path with the corresponding offset (i.e., shifts 4cnt_H units of bit width towards the high-order direction) in a single stage, thereby eliminating the high-order data gap in one step and finally outputting a completely compact, high-order aligned sampled data Out[95:0]. Total count: The global adder synchronously receives cnt_H[2:0] and cnt_L[2:0], performs a summation operation, and finally outputs the total number of valid sampled coefficients cnt[3:0] in this clock cycle.

[0050] Beneficial Effects: This invention provides a highly parallel rejection sampler for post-quantum cryptography and its operating method. The architecture employs a divide-and-conquer strategy, splitting the 8-bit data to be sampled into symmetrical high-4 and low-4 bit parallel sampling units: the high-4 bit units perform data compression towards the least significant bit, and the low-4 bit units perform data compression towards the most significant bit. The two compressed outputs are combined through physical splicing to form a pre-aligned data stream characterized by continuous data in the middle and possible invalid data bits at the beginning and end. Subsequently, the system uses the effective data count value of the high-bit units as a control signal to drive a multiplexer network to directly select the output result according to five preset alignment paths, thereby achieving a compact arrangement of fully parallel data. This invention avoids the complex multi-level shift operations in traditional architectures, greatly optimizing critical path latency and hardware resource overhead, and is suitable for high-speed hardware accelerator design for post-quantum cryptography algorithms. Compared with existing technologies, the advantages of this invention are:

[0051] This invention differs from existing technologies that rely on large fan-in and multi-level multiplexers for global dynamic shifting sampling alignment. This application optimizes and adjusts the decoding method of the data mask and the structure of the multiplexer network during high-parallel rejection sampling. By introducing a hierarchical divide-and-conquer compression strategy and a single-level fixed path mapping network based on local count values, it reduces the consumption of lookup tables and interconnect wiring resources, lowers the maximum latency of combinational logic paths, and thus improves the overall effect of the hardware sampling rate of post-quantum cryptography algorithms. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the overall hardware architecture of an 8-bit parallel rejection sampler for post-quantum cryptography according to the present invention.

[0053] Figure 2 This is a schematic diagram of the interconnection logic of the 4-bit high-order compression unit of the present invention.

[0054] Figure 3 This is a schematic diagram of the interconnection logic of the 4-bit low-order compression unit of the present invention. Detailed Implementation

[0055] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0056] The present invention will be further described below with reference to specific embodiments.

[0057] Example 1:

[0058] This embodiment introduces a highly parallel rejection sampler for post-quantum cryptography. Traditional 8-way parallel sampling circuits usually rely on complex global priority coding and multi-level multiplexer (MUX) cascaded networks (which need to handle 2^8=256 mask states), resulting in long critical paths for combinational logic and wiring congestion.

[0059] This invention specifically includes: such as Figure 1 As shown, it includes a 4-bit high-order compression unit, a 4-bit low-order compression unit, a data reconstruction unit, a data selector, and an adder.

[0060] The data input terminal of the 4-bit high-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit high-order compression unit is used to receive the mask; the count value output terminal of the 4-bit high-order compression unit is connected to the selection control terminal of the data selector and the first adder input terminal of the adder, respectively; the data output terminal of the 4-bit high-order compression unit is connected to the first input terminal of the data reconstruction unit.

[0061] The data input terminal of the 4-bit low-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit low-order compression unit is used to receive the mask; the count value output terminal of the 4-bit low-order compression unit is connected to the second adder input terminal of the adder; the data output terminal of the 4-bit low-order compression unit is connected to the second input terminal of the data reconstruction unit.

[0062] The first, second, third, fourth, and fifth output terminals of the data reconstruction unit are respectively connected to the first, second, third, fourth, and fifth data input channels of the data selector.

[0063] The data output terminal of the data selector is used to output aligned, compact sampled data.

[0064] The sum output terminal of the adder is used to output the total effective count value.

[0065] The 4-bit high-order compression unit is used to select and continuously arrange the valid sampled data in the high 4 bits of the sampled data towards the least significant bit (LSB) according to the determination result of the received high-order mask, fill the invalid bits with zeros, and generate high-order pre-aligned data; at the same time, it calculates the number of valid data in the high 4 bits of the sampled data in parallel and generates a high-order valid data count value.

[0066] The 4-bit low-order compression unit is used to select and continuously arrange the valid sampled data in the lower 4 bits of the sampled data towards the most significant bit (MSB) according to the determination result of the received low-order mask, fill the invalid bits with zeros, and generate low-order pre-aligned data; at the same time, it calculates the number of valid data in the lower 4 bits of the sampled data in parallel and generates a low-order valid data count value.

[0067] The data reconstruction unit is a bus-mapped circuit composed of passive hardwired connections, used to receive compressed data from the previous stage and generate multiple fixed-offset data streams. Its input data, output data, and the mapping relationships between the data are as follows:

[0068] Input data includes 48-bit high-order pre-aligned data Out_H[47:0] accessed by the first input terminal and 48-bit low-order pre-aligned data Out_L[47:0] accessed by the second input terminal.

[0069] Internal mapping logic: The input Out_L[47:0] is used as the lower 48 bits of data and Out_H[47:0] is used as the higher 48 bits of data for bit concatenation, forming a concatenated data with a total bit width of 96 bits. Due to the anisotropic compression mechanism of the previous stage, the effective data is continuous at the center position of this 96-bit concatenated data.

[0070] Output data: Includes 5 channels of fixed offset data generated based on the above 96-bit concatenated data. Given that the bit width of a single sampled data unit is 12 bits, the specific configuration of the output data at its 5 output terminals is as follows:

[0071] The first output terminal outputs Path0 data, which is the 96-bit concatenated data logically shifted 0 units (0 bits) in the higher-order direction.

[0072] The second output terminal outputs Path1 data. The content of Path1 data is the 96-bit concatenated data that has been logically shifted 1 unit width (12 bits) in the high-order direction, and the 12 bits left empty at the low end after the logical shift are padded with zeros.

[0073] The third output terminal outputs Path2 data. The content of Path2 data is the 96-bit concatenated data logically shifted 2 units (24 bits) in the high-bit direction, and the 24 bits left empty at the low end after the logical shift are padded with zeros.

[0074] The fourth output terminal outputs Path3 data. The content of Path3 data is the 96-bit concatenated data that has been logically shifted 3 units (36 bits) in the high-bit direction, and the 36 bits left empty at the low end after the logical shift are padded with zeros.

[0075] The fifth output terminal outputs Path4 data. The content of Path4 data is the 96-bit concatenated data logically shifted 4 units (48 bits) in the high-bit direction, and the 48 bits left empty at the low end after the logical shift are padded with zeros.

[0076] The data selector is used to perform single-level path switching using the high-order valid data count as a control signal. Its internal logic is to directly select one path from the first, second, third, fourth, and fifth data input channels based on the number of missing high-order valid data, performing overall shift compensation to eliminate high-order gaps in one step and achieve compact, continuous alignment of the output data towards the top of the high-order bits.

[0077] The adder is used to perform real-time summation of the high-order valid data count value and the low-order valid data count value, and outputs the final extracted total valid count value within the current clock cycle to the back-end system to ensure accurate handshaking and shifting in the subsequent data processing flow of the algorithm.

[0078] The innovative circuit structure of this invention is as follows: it adopts a hardware architecture that combines "anisotropic symmetric divide-and-conquer compression circuit" and "single-stage path alignment circuit", and decomposes the global state machine by directly splicing physical connections. It replaces the traditional deep cascaded MUX network with a single-level 5-to-1 single-stage multiplexer network, which significantly reduces hardware resource consumption and logic latency.

[0079] Both the 4-bit high-order compression unit and the 4-bit low-order compression unit internally include a "4-bit parallel logic control circuit" and a "local MUX array" consisting of four multiplexers (MUX_0 to MUX_3). To achieve anisotropic symmetrical compression, their hardware connections differ significantly in the wiring direction, as follows:

[0080] Furthermore, such as Figure 2 As shown, the 4-bit high-order compression unit includes: data input buses D0, D1, D2 and D3, MUX_0, MUX_1, MUX_2 and MUX_3, and a 4-bit parallel logic control circuit.

[0081] The first input terminal of the MUX_0 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit.

[0082] The first input terminal of the MUX_1 is connected to the data input bus D1, the second input terminal is connected to the data input bus D2, the third input terminal is connected to the data input bus D3, the fourth input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit.

[0083] The first input terminal of the MUX_2 is connected to the data input bus D2, the second input terminal is connected to the data input bus D3, the third input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit.

[0084] The first input terminal of the MUX_3 is connected to the data input bus D3, the second input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit.

[0085] The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit high-order compression unit.

[0086] The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit high-order compression unit.

[0087] The output terminals Out0 of MUX_0, Out1 of MUX_1, Out2 of MUX_2, and Out3 of MUX_3 serve as the data output terminals of the 4-bit high-order compression unit.

[0088] The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit high-order compression unit.

[0089] The 4-bit parallel logic control circuit, acting as a local state machine and decoder, converts the logic level states of M0, M1, M2, and M3 on the mask input bus into control signals and count values. Specifically, the internal addition logic sums M0, M1, M2, and M3, outputting the number of high-level (valid) values ​​to the fifth output terminal Cnt. Simultaneously, the internal decoding logic follows the circuit compression principle of "least significant bit (LSB) priority," performing combined decoding on M0 to M3. The index value of the first valid data is output to the first output terminal S0, the index value of the second valid data to the second output terminal S1, the index value of the third valid data to the third output terminal S2, and the index value of the fourth valid data to the fourth output terminal S3. If there is insufficient valid data, the corresponding output terminal outputs a control signal pointing to the ground terminal (filled with zeros for invalid data).

[0090] The MUX_0 is driven by the S0 signal received from its selection control terminal. When S0 points to the corresponding input terminal, the MUX_0 selects and transmits the corresponding valid data from the first, second, third, and fourth input terminals (i.e., data input buses D0, D1, D2, and D3) or the zero level of the fifth input terminal (ground terminal) to its data output terminal Out0.

[0091] The MUX_1 is driven by the second output terminal S1 signal received by its selection control terminal. According to the instruction of S1, it selects the corresponding data in D1, D2, D3 or the ground terminal and transmits it to its data output terminal Out1.

[0092] The MUX_2 is driven by the third output terminal S2 signal received by its selection control terminal. According to the instruction of S2, it selects the corresponding data in D2, D3 or the ground terminal and transmits it to its data output terminal Out2.

[0093] The MUX_3 is driven by the fourth output terminal S3 signal received by its selection control terminal. According to the instruction of S3, it selects the corresponding data in D3 or the ground terminal and transmits it to its data output terminal Out3.

[0094] The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit high-order compression unit.

[0095] In one embodiment, taking the input mask as M3=1, M2=0, M1=1, M0=0 (i.e., the mask is binary 1010) as an example, it means that only D3 and D1 are valid data in the input data bus, while D2 and D0 are invalid data.

[0096] The decoding process for the output control signal of the 4-bit parallel logic control circuit, based on the decoding principle of "least significant bit (LSB) priority", is as follows:

[0097] (1) First, count the number of high levels and find that the effective data amount is 2. Therefore, the fifth output terminal Cnt outputs a value of 2.

[0098] (2) Following the order of searching for valid data from low bit to high bit, the first valid data is D1. Therefore, the first output terminal S0 outputs the control signal to select D1, thereby driving the lowest layer MUX_0 to route D1 to the lowest bit Out0.

[0099] (3) Continue searching for higher bits. The second valid data is D3. Therefore, the second output terminal S1 outputs a control signal to select D3, thereby driving MUX_1 to route D3 to Out1.

[0100] (4) Since there are only 2 valid data in total, for the remaining high-end output nodes, the third output terminal S2 outputs a control signal pointing to the ground terminal, driving MUX_2 to set Out2 to zero; the fourth output terminal S3 also outputs a control signal pointing to the ground terminal, driving MUX_3 to set Out3 to zero.

[0101] Through the above decoding logic, the originally discrete valid data D3 and D1 are compressed compactly towards the lower bits, occupying the lower ends Out1 and Out0 of the output bus. The decoding logic for the remaining 15 mask states is derived in the same way.

[0102] Furthermore, such as Figure 3 As shown, the 4-bit low-order compression unit includes: data input buses D0, D1, D2 and D3, MUX_0, MUX_1, MUX_2 and MUX_3, and a 4-bit parallel logic control circuit.

[0103] The first input terminal of the MUX_0 is connected to the data input bus D0, the second input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit.

[0104] The first input terminal of the MUX_1 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit.

[0105] The first input terminal of the MUX_2 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit.

[0106] The first input terminal of the MUX_3 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit.

[0107] The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit low-order compression unit.

[0108] The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit low-order compression unit.

[0109] The output terminals Out0 of MUX_0, Out1 of MUX_1, Out2 of MUX_2, and Out3 of MUX_3 serve as the data output terminals of the 4-bit low-order compression unit.

[0110] The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit low-order compression unit.

[0111] The 4-bit parallel logic control circuit, acting as a local state machine and decoder, converts the logic level states of M0, M1, M2, and M3 on the mask input bus into control signals and count values. Specifically, the internal addition logic sums M0, M1, M2, and M3, outputting the number of high-level (valid) values ​​to the fifth output terminal Cnt. Simultaneously, the internal decoding logic follows a circuit compression principle of "most significant bit (MSB) priority," performing combined decoding on M0 to M3. It outputs the index value of the first valid data (i.e., the last one) in the MSB direction to the fourth output terminal S3, the index value of the second-to-last valid data to the third output terminal S2, the index value of the third-to-last valid data to the second output terminal S1, and the index value of the fourth-to-last valid data to the first output terminal S0. If there is insufficient valid data, the corresponding low-order output terminal outputs a control signal pointing to the ground terminal (filled with zeros for invalid data).

[0112] The MUX_0 is driven by the first output terminal S0 signal received by its selection control terminal. When S0 points to the corresponding input terminal, the MUX_0 selects the zero level of the first input terminal (i.e., the data input bus D0) or the second input terminal (the ground terminal) and transmits it to its data output terminal Out0.

[0113] The MUX_1 is driven by the second output terminal S1 signal received by its selection control terminal. According to the instruction of S1, it selects the corresponding data in D0, D1 or ground terminal and transmits it to its data output terminal Out1.

[0114] The MUX_2 is driven by the third output terminal S2 signal received by its selection control terminal. According to the instruction of S2, it selects the corresponding data in D0, D1, D2 or the ground terminal and transmits it to its data output terminal Out2.

[0115] The MUX_3 is driven by the fourth output terminal S3 signal received by its selection control terminal. According to the instruction of S3, it selects and transmits the corresponding data in D0, D1, D2, D3 or the ground terminal to its data output terminal Out3.

[0116] In one embodiment, taking the input mask as M3=1, M2=0, M1=1, M0=0 (i.e., the mask is binary 1010) as an example, it is explained that in this case, only D3 and D1 are valid data in the input data bus, while D2 and D0 are invalid data.

[0117] The 4-bit parallel logic control circuit on the low-order side, based on the decoding principle of "approaching the most significant bit (MSB) first," has the following solution process for its output control signal:

[0118] (1) First, count the number of high levels and find that the effective data amount is 2. Therefore, the fifth output terminal Cnt outputs a value of 2.

[0119] (2) Following the order of searching for valid data from the highest bit to the lowest bit (i.e., in reverse order), the first valid data appearing in the direction of the highest bit is D3. Therefore, the fourth output terminal S3 outputs a control signal to select D3, thereby driving the top-level MUX_3 to route D3 to the highest bit Out3.

[0120] (3) Continue searching for the lower bit. The second to last valid data is D1. Therefore, the third output terminal S2 outputs a control signal to select D1, thereby driving MUX_2 to route D1 to Out2.

[0121] (4) Since there are only 2 valid data in total, for the remaining low-end output nodes, the second output terminal S1 outputs a control signal pointing to the ground terminal, driving MUX_1 to set Out1 to zero; the first output terminal S0 also outputs a control signal pointing to the ground terminal, driving MUX_0 to set Out0 to zero.

[0122] Through the above decoding logic, the originally discrete valid data D3 and D1 are compressed compactly towards the higher bits, occupying the high-end Out3 and Out2 of the output bus. This forms an opposite-directional symmetry with the underlying output characteristics of the high-bit compression unit, creating the physical continuity condition for the direct splicing of the subsequent intermediate buses. The decoding and solution logic for the remaining 15 mask states is derived in the same way.

[0123] The 4-bit high-order compression unit serves as a local state machine and decoder. This circuit is responsible for directly hardware decoding the 16 local combination states corresponding to the 4-bit mask (M0-M3) into the routing selection signals (S0-S3) of the MUX array, thereby avoiding the deep and massive decoding network of 256 global states in the traditional architecture. At the same time, the addition logic inside the circuit synchronously counts the number of data that are determined to be "valid" in these 4 signals and outputs the count value Cnt for use by the entire subsequent system.

[0124] The function of the high-order local MUX array is to move data closer to the least significant bit (LSB).

[0125] The bottom-level MUX_0 has a full field of view (it can select any valid data from D0 and D3), while the top-level MUX_3 has the narrowest field of view (it can only select D3 or pad with 0). Driven by the S0S3 output of the logic control circuit, the array is forced into a "downward funnel" structure: the input valid data slots are preferentially filled downwards (i.e., towards the least significant bit Out0), while the missing invalid data bits at the top (in the Out3 direction) are selected to a fixed zero level to eliminate interference.

[0126] The 4-bit low-order compression unit serves as a local state machine and decoder. This circuit is responsible for directly hardware decoding the 16 local combination states corresponding to the 4-bit mask (M0-M3) into the routing selection signals (S0-S3) of the MUX array, thereby avoiding the deep and massive decoding network of 256 global states in the traditional architecture. At the same time, the addition logic inside the circuit synchronously counts the number of data that are determined to be "valid" in these 4 signals and outputs the count value Cnt for use by the entire subsequent system.

[0127] The function of the low-order local MUX array is to move data closer to the most significant bit (MSB).

[0128] The top-level MUX_3 has a full field of view, while the bottom-level MUX_0 has the narrowest field of view. Controlled by S0~S3, the array is configured as an "upward funnel" structure: the input valid data slots are preferentially pushed upward (i.e. towards the most significant bit Out3) and arranged tightly, while the missing invalid data bits at the bottom (in the Out0 direction) are filled with zeros.

[0129] It is precisely because of the opposite symmetrical function of the high-order MUX array "downward alignment" and the low-order MUX array "upward alignment" that the two sets of data outputs are naturally connected at the middle boundary (the bottom layer of the high-order array and the top layer of the low-order array), which eliminates internal data bubbles for subsequent single-level translation.

[0130] Example 2:

[0131] This embodiment describes a working method for a highly parallel rejection sampler for post-quantum cryptography, utilizing the aforementioned hardware architecture, specifically including:

[0132] Step S1, Global Signal Input and Divide-and-Conquer: During the multi-channel data rejection sampling operation, the system first receives 8 parallel input data streams D[95:0] with a total bit width of 96 bits, and generates the corresponding 8-bit validity mask M[7:0] through the modulus range determination logic. Subsequently, the system uses a divide-and-conquer strategy to divide the input signal into two independent data streams in terms of physical bit width: the high-bit data stream D[95:48] and the high-bit mask M[7:4] enter the 4-bit high-bit compression unit; the low-bit data stream D[47:0] and the low-bit mask M[3:0] enter the 4-bit low-bit compression unit.

[0133] Step S2, Local Parallel Anisotropic Compression and Effective Quantity Count: In this step, the 4-bit high-order compression unit and the 4-bit low-order compression unit simultaneously perform independent data convergence operations: The 4-bit high-order compression unit decodes the input M[7:4], generates a high-order selection signal to drive the local MUX array, and performs continuous gating of the effective sampled data (12 bits per channel) in D[95:48] towards the least significant bit (LSB), padding invalid data bits with zeros, thereby outputting the high-order pre-aligned data stream Out_H[47:0]; at the same time, the number of high-order effective data is calculated synchronously, and the high-order effective data count value cnt_H[2:0] is output. The 4-bit low-order compression unit decodes the input M[3:0], generates a low-order selection signal to drive the local MUX array, performs continuous gating of the valid sampled data in D[47:0] towards the most significant bit (MSB), and fills the invalid data bits with zeros, thereby outputting the low-order pre-aligned data stream Out_L[47:0]; at the same time, it synchronously calculates the number of low-order valid data and outputs the low-order valid data count value cnt_L[2:0].

[0134] Step S3, Physical splicing and alignment path generation: The data reconstruction unit receives Out_H[47:0] and Out_L[47:0]. Through hardwiring, the lowest pin of Out_H[47:0] and the highest pin of Out_L[47:0] are directly spliced ​​bit-by-bit to generate a 96-bit pre-aligned data stream (the effective data in the center of this data stream is seamless and continuous, but there may be zero-filled bubbles at the beginning and end). Based on this pre-aligned data stream, the data reconstruction unit directly leads out five fixed-offset shift buses through physical wiring to generate shift candidate paths Path0[95:0] to Path4[95:0].

[0135] Step S4, Single-stage global shift output and total count generation: Global shift compensation: The 5-to-1 data selector (MUX) receives Path0[95:0] to Path4[95:0] as data input and receives cnt_H[2:0] output from the high-order unit as the only selection control signal. According to the value of cnt_H[2:0], the MUX directly selects the path with the corresponding offset (i.e., shifts 4cnt_H units of bit width towards the high-order direction) in a single stage, thereby eliminating the high-order data gap in one step and finally outputting a completely compact, high-order aligned sampled data Out[95:0]. Total count: The global adder synchronously receives cnt_H[2:0] and cnt_L[2:0], performs a summation operation, and finally outputs the total number of valid sampled coefficients cnt[3:0] in this clock cycle.

[0136] Method Advantages Analysis: In processing high-parallel sampling tasks, this method, by introducing local anisotropic symmetric compression (step S2) and a fixed path mapping mechanism based on physical splicing (steps S3 and S4), completely reduces the traditional global large fan-in logic targeting 256 mask states (2^8) to decoding logic targeting 16 local states (2^4) and a simple single-level 5-to-1 path switching operation. Compared with the traditional full-shift algorithm, this signal processing method significantly reduces the occupation of underlying lookup table (LUT) resources and shortens the maximum propagation delay of combinational logic signals. In addition, this divide-and-conquer symmetric data stream splitting logic can easily adjust the bit width of the input data groups proportionally (e.g., expand to 16-way parallelism), exhibiting strong hardware architecture scalability.

[0137] This application provides a highly parallel rejection sampler for post-quantum cryptography. Rejection sampling is a core step in post-quantum cryptography algorithms to generate polynomial coefficients, and its hardware performance directly affects the overall computational throughput of the algorithm. This architecture addresses the logic latency problem caused by multi-stage shifting in traditional samplers by employing a divide-and-conquer strategy to split the 8-bit data stream to be sampled into symmetrical high-4-bit and low-4-bit parallel sampling units. By performing opposite data compression operations on the high- and low-bit units respectively, the effective data is aggregated into a continuous and bubble-free pre-aligned feature data stream in the intermediate logic. This architecture achieves high-speed alignment and compact arrangement of fully parallel data through direct physical-level splicing and switching of a single-stage large-width multiplexer, significantly reducing the critical path latency of combinational logic and providing rigorous and reliable logical support for high-parallel hardware acceleration in post-quantum cryptography.

[0138] Example 3:

[0139] To further demonstrate the advantages of the hierarchical divide-and-conquer compression architecture proposed in this invention over existing technologies, this embodiment provides a set of hardware simulation and structured routing experiments for comparison. This experiment verifies the optimization effects of this invention in terms of hardware resource consumption and logic processing latency by comparing various physical performance indicators of the architecture of this invention with those of the traditional direct parallel compression architecture.

[0140] 1. System-level testing background and experimental environment:

[0141] In hardware accelerators (such as SoC systems or standalone IP cores) for post-quantum cryptography algorithms, the rejection sampler acts as a bridge connecting the pseudo-random number generator and the polynomial operation core, and its data flow has strict timing requirements. The testbench and timing constraints in this comprehensive simulation experiment fully simulate the workflow of a real hardware system:

[0142] Upstream data source (SHAKE module output): The upstream of the system is the extended hash function (SHAKE) hardware acceleration module. The SHAKE module expands the short seed into a high-throughput pseudo-random bit stream and slices it according to a bit width of 12 bits per channel, continuously inputting 8 parallel data buses D[95:0] to be sampled into this rejection sampler within one clock cycle.

[0143] Midstream core processing (the rejection sampler of this invention): Faced with the continuous random data input from the SHAKE module, this rejection sampler uses the above-mentioned hierarchical divide-and-conquer and physical splicing mechanism to remove invalid data that does not meet the modulus q requirement in real time, and continuously and compactly aligns the discrete effective coefficients to the output bus Out[95:0], and synchronously outputs the total number of effective data in the current period cnt[3:0].

[0144] Downstream Data Reception (NTT Module Reception): The downstream of the system is the Number Theory Transform (NTT) operation core. To ensure the efficient operation of the NTT pipeline and avoid data bubbles caused by waiting for data, the NTT's input buffer (FIFO or SRAM) must receive seamlessly aligned continuous polynomial coefficients. The Out[95:0] output of this sampler is directly connected to the input data bus of the NTT module, while cnt[3:0] serves as the write enable boundary signal for the NTT end buffer, ensuring that valid polynomial coefficients are accurately written each time.

[0145] Based on the aforementioned system-level data flow background, this experiment uses an AMD / Xilinx Kintex-7 series FPGA chip as the hardware verification platform, specifically the XC7K70TFBV676-1. The synthesis and implementation tools utilize the Vivado 2023.2 integrated design environment. The design is simulated and verified by generating random test vector streams that mimic the output characteristics of the SHAKE module. A 100MHz virtual clock constraint is applied in the constraint file. Static timing analysis (STA) after placement and routing is used to extract various physical performance and resource indicators to verify whether it can meet the extremely stringent timing and data alignment requirements of the NTT module front end.

[0146] 2. Comparison object settings:

[0147] Comparison (Traditional 8-bit Direct Parallel Compression Architecture): This structure uses the effective masks of 8 parallel inputs (96 bits in total) as the overall control signal, constructing a global logic control circuit containing 2^8 = 256 states. At the RTL level, a large-span case statement is used to exhaustively encode and decode the 256 mask combinations, and hardwires are used to generate the global selection signal for the cascaded multiplexer (MUX).

[0148] Example (Divide-and-Conquer Compression Architecture Proposed in This Invention): The circuit structure described in Example 1 employs a high-low bit anisotropic symmetrical divide-and-conquer compression unit combined with physical interconnects. Local count values ​​drive a back-end single-stage 5-to-1 multiplexer network to achieve global alignment compensation. Both architectures handle 12-bit data widths and 8 parallel channels.

[0149] 3. Experimental results and data comparison:

[0150] Based on the above environment and test objects, the performance indicators extracted from the static timing analysis after placement and routing are shown in Table 1 below:

[0151] Table 1: Comparison of Overall Hardware Performance of the Two Sampler Architectures

[0152]

[0153] 4. Technical Effect Analysis:

[0154] Based on the experimental data above, it can be seen that the circuit architecture proposed in this invention has significant improvements over the traditional architecture, specifically reflected in:

[0155] (1) Significantly reduced logic resource overhead: Traditional architectures perform exhaustive mapping of 256 global mask states, requiring the use of numerous lookup tables to construct deep decoding networks, resulting in each output requiring multiple 6-input lookup tables for cascading. This invention employs a local divide-and-conquer strategy, enabling the selection logic of high and low bit compression units to process only 4 bits (16 states), directly mapping to a single lookup table and carry chain resources, and avoiding the massive global cascaded MUX. This significantly reduces the number of LUTs consumed from 557 to 310, saving approximately 44.3% of chip area resources.

[0156] (2) Effectively shorten critical path delay and improve timing performance: Experiments show that the divide-and-conquer strategy of this invention successfully optimized the logic level of the worst path of the signal from 4 levels to 3 levels, shortening the transmission time of the signal inside the lookup table, and reducing the logic delay from 0.212ns to 0.159ns. At the same time, the locally independent compression structure optimizes the clustering of the physical layout (physical splicing replaces long-line interconnection), reducing the line delay from 4.895ns to 4.300ns. Finally, the overall maximum propagation delay is optimized by 12.6%, meeting the stringent requirements of post-quantum cryptography algorithms for high-frequency sampling.

[0157] (3) Alleviating chip routing congestion: This invention uses five fixed mapping paths to replace the global universal shift decoder in the traditional architecture, eliminating the high fan-out problem of control signal lines and reducing the maximum fan-out number from 124 to 93. This not only reduces the occupation of interconnect resources during the physical layout and routing stage, but also improves the overall routing success rate and resource utilization.

[0158] In summary, the present invention, through a hierarchical divide-and-conquer compression strategy, reconstructs the traditional fully parallel sampling logic into local symmetric compression and single-level fixed path alignment. This effectively breaks the limitations of hardware resource overhead and the nonlinear growth of combinational logic depth with parallelism, providing a high-performance, low-area-overhead hardware implementation scheme for improving the execution throughput of the coefficient generation stage in post-quantum cryptography algorithms.

[0159] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A highly parallel rejection sampler for post-quantum cryptography, characterized in that: Specifically, it includes: The system includes a 4-bit high-order compression unit, a 4-bit low-order compression unit, a data reconstruction unit, a data selector, and an adder. The data input terminal of the 4-bit high-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit high-order compression unit is used to receive the mask; the count value output terminal of the 4-bit high-order compression unit is connected to the selection control terminal of the data selector and the first adder input terminal of the adder, respectively; the data output terminal of the 4-bit high-order compression unit is connected to the first input terminal of the data reconstruction unit. The data input terminal of the 4-bit low-order compression unit is used to receive the data to be sampled, and the mask input terminal of the 4-bit low-order compression unit is used to receive the mask; the count value output terminal of the 4-bit low-order compression unit is connected to the second addend input terminal of the adder; the data output terminal of the 4-bit low-order compression unit is connected to the second input terminal of the data reconstruction unit. The output of the data reconstruction unit is connected to the data input channel of the data selector; The data output terminal of the data selector is used to output aligned, compact sampled data; The sum output terminal of the adder is used to output the total effective count value.

2. The highly parallel rejection sampler for post-quantum cryptography according to claim 1, characterized in that: The 4-bit high-order compression unit is used to select and continuously arrange the valid sampled data in the high 4 bits of the sampled data towards the least significant bit direction according to the determination result of the received high-order mask, fill the invalid bits with zero, and generate high-order pre-aligned data; at the same time, it calculates the number of valid data in the high 4 bits of the sampled data in parallel and generates a high-order valid data count value.

3. A highly parallel rejection sampler for post-quantum cryptography according to claim 1, characterized in that: The 4-bit low-order compression unit is used to select and continuously arrange the valid sampled data in the lower 4 bits of the sampled data towards the most significant bit direction according to the determination result of the received low-order mask, fill the invalid bits with zero, and generate low-order pre-aligned data; at the same time, it calculates the number of valid data in the lower 4 bits of the sampled data in parallel and generates a low-order valid data count value.

4. A highly parallel rejection sampler for post-quantum cryptography according to claim 1, characterized in that: The data reassembly unit is used to receive high-order pre-aligned data from the first input terminal and low-order pre-aligned data from the second input terminal; to perform bit-by-bit concatenation on the received high-order pre-aligned data and low-order pre-aligned data to form concatenated data; and to offset the concatenated data to obtain five fixed-offset data, which are output from the first output terminal, the second output terminal, the third output terminal, the fourth output terminal, and the fifth output terminal, respectively.

5. A highly parallel rejection sampler for post-quantum cryptography according to claim 4, characterized in that: The method for obtaining the five fixed offset data is as follows: The first output terminal outputs Path0 data, the content of which is the concatenated data logically shifted 0 units of bit width in the high-bit direction; The second output terminal outputs Path1 data. The content of Path1 data is the data of the concatenated data that has been logically shifted 1 unit bit width in the high-bit direction, and the 12 bits left empty at the low end after the logical shift are padded with zeros. The third output terminal outputs Path2 data. The content of Path2 data is the data of the concatenated data that has been logically shifted 2 units of bit width in the high-bit direction, and the 24 bits left empty at the low end after the logical shift are padded with zeros. The fourth output terminal outputs Path3 data. The content of Path3 data is the data of the concatenated data that has been logically shifted 3 units of bit width in the high-bit direction, and the 36 bits left empty at the low end after the logical shift are padded with zeros. The fifth output terminal outputs Path4 data. The content of Path4 data is the data of the concatenated data that has been logically shifted 4 units in the high-order direction, and the 48 bits left empty at the low end after the logical shift are padded with zeros.

6. A highly parallel rejection sampler for post-quantum cryptography according to claim 1, characterized in that: The data selector is used to perform single-level path switching using the high-order valid data count value as a control signal; and to directly select one of the corresponding paths in the first, second, third, fourth, and fifth data input channels to perform overall shift compensation based on the number of high-order missing valid data.

7. A highly parallel rejection sampler for post-quantum cryptography according to claim 1, characterized in that: The adder is used to perform real-time summation of the high-order valid data count value and the low-order valid data count value, and outputs the final extracted total valid count value within the current clock cycle to the back-end system.

8. A highly parallel rejection sampler for post-quantum cryptography according to claim 2, characterized in that: The 4-bit high-order compression unit includes: data input buses D0, D1, D2 and D3, multiplexer_0, multiplexer_1, multiplexer_2 and multiplexer_3, and 4-bit parallel logic control circuit. The first input terminal of the multiplexer_0 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_1 is connected to the data input bus D1, the second input terminal is connected to the data input bus D2, the third input terminal is connected to the data input bus D3, the fourth input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_2 is connected to the data input bus D2, the second input terminal is connected to the data input bus D3, the third input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_3 is connected to the data input bus D3, the second input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit. The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit high-order compression unit. The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit high-order compression unit. The output terminals Out0 of multiplexer_0, Out1 of multiplexer_1, Out2 of multiplexer_2, and Out3 of multiplexer_3 serve as the data output terminals of the 4-bit high-order compression unit. The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit high-order compression unit. The 4-bit parallel logic control circuit is used to perform summation operations on M0, M1, M2, and M3 using internal addition logic, and outputs the number of high-level values ​​to the fifth output terminal Cnt. Simultaneously, it performs combination decoding on M0 to M3, outputting the index value of the first valid data to the first output terminal S0, the index value of the second valid data to the second output terminal S1, the index value of the third valid data to the third output terminal S2, and the index value of the fourth valid data to the fourth output terminal S3. If there is insufficient valid data, the corresponding output terminal outputs a control signal pointing to the ground terminal.

9. A highly parallel rejection sampler for post-quantum cryptography according to claim 3, characterized in that: The 4-bit low-order compression unit includes: data input buses D0, D1, D2 and D3, multiplexer_0, multiplexer_1, multiplexer_2 and multiplexer_3, and 4-bit parallel logic control circuit. The first input terminal of the multiplexer_0 is connected to the data input bus D0, the second input terminal is grounded, and the selection control terminal is connected to the first output terminal S0 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_1 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is grounded, and the selection control terminal is connected to the second output terminal S1 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_2 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is grounded, and the selection control terminal is connected to the third output terminal S2 of the 4-bit parallel logic control circuit. The first input terminal of the multiplexer_3 is connected to the data input bus D0, the second input terminal is connected to the data input bus D1, the third input terminal is connected to the data input bus D2, the fourth input terminal is connected to the data input bus D3, the fifth input terminal is grounded, and the selection control terminal is connected to the fourth output terminal S3 of the 4-bit parallel logic control circuit. The data input buses D0, D1, D2, and D3 serve as the data input terminals for the 4-bit low-order compression unit. The mask input buses M0, M1, M2, and M3 of the 4-bit parallel logic control circuit serve as the mask input terminals of the 4-bit low-order compression unit. The output terminals Out0 of multiplexer_0, Out1 of multiplexer_1, Out2 of multiplexer_2, and Out3 of multiplexer_3 serve as the data output terminals of the 4-bit low-order compression unit. The fifth output terminal Cnt of the 4-bit parallel logic control circuit serves as the output terminal of the count value of the 4-bit low-order compression unit. The 4-bit parallel logic control circuit is used to perform summation operations on M0, M1, M2, and M3 using internal addition logic, and outputs the number of high-level values ​​to the fifth output terminal Cnt. Simultaneously, it performs combination decoding on M0 to M3, outputting the index value of the first valid data in the highest bit direction to the fourth output terminal S3, the index value of the second to last valid data to the third output terminal S2, the index value of the third to last valid data to the second output terminal S1, and the index value of the fourth to last valid data to the first output terminal S0. If there is insufficient valid data, the corresponding low-bit output terminal outputs a control signal pointing to the ground terminal.

10. A method for operating a highly parallel rejection sampler for post-quantum cryptography according to any one of claims 1-9, characterized in that: Specifically, it includes: Step S1: Receive 8 parallel input data streams D[95:0] with a total bit width of 96 bits, and generate the corresponding 8-bit validity mask M[7:0] through modulus range determination logic; use a divide-and-conquer strategy to divide the input signal into two independent data streams in terms of physical bit width: the high-bit data stream D[95:48] and the high-bit mask M[7:4] enter the 4-bit high-bit compression unit; the low-bit data stream D[47:0] and the low-bit mask M[3:0] enter the 4-bit low-bit compression unit; Step S2: The 4-bit high-order compression unit decodes the input M[7:4] to generate a high-order selection signal to drive the local MUX array. It performs continuous gating of the valid sampled data in D[95:48] towards the least significant bit, padding invalid data bits with zeros, thus outputting the high-order pre-aligned data stream Out_H[47:0]. Simultaneously, it calculates the number of high-order valid data and outputs the high-order valid data count value cnt_H[2:0]. The 4-bit low-order compression unit decodes the input M[3:0] to generate a low-order selection signal to drive the local MUX array. It performs continuous gating of the valid sampled data in D[47:0] towards the most significant bit, padding invalid data bits with zeros, thus outputting the low-order pre-aligned data stream Out_L[47:0]. Simultaneously, it calculates the number of low-order valid data and outputs the low-order valid data count value cnt_L[2:0]. Step S3: The data reconstruction unit receives Out_H[47:0] and Out_L[47:0]; it directly concatenates the lowest pin of Out_H[47:0] and the highest pin of Out_L[47:0] bit by bit to generate a 96-bit pre-aligned data stream; based on the pre-aligned data stream, the data reconstruction unit outputs five fixed offset shift buses to generate shift candidate paths Path0[95:0] to Path4[95:0]; In step S4, the 5-to-1 data selector receives Path0[95:0] to Path4[95:0] as data input and receives cnt_H[2:0] output from the high-order unit as the only selection control signal; the MUX directly selects the path corresponding to the offset based on the value of cnt_H[2:0] and outputs the total number of sampled data Out[95:0]. The global adder synchronously receives cnt_H[2:0] and cnt_L[2:0], performs summation, and outputs the total number of valid sampled coefficients cnt[3:0] in the current clock cycle.

Images