Operation device and operation method for flexibly performing number theory transformation

Abstract

An operation method for flexibly performing number theory transformation, includes: initializing internal parameters of a calculation circuit in a memory and preloading a plurality of weight coefficients corresponding to each level in a number theoretic transformation stage circuit with a flexible resolution; storing metadata in one of two memory blocks; generating a control signal through a control logic circuit so that the number theoretic transformation stage circuit with a flexible resolution sequentially performs number theoretic transformation stage operations on each flexible resolution butterfly operation circuit until all the flexible resolution butterfly operation circuits have completed the number theoretic transformation stage operations, wherein the number theoretic transformation stage operations include number theoretic transformation stage calculations and inverse number theoretic transformation stage calculations; repeatedly performing the number theoretic transformation stage operations corresponding to the number of points required for the number theoretic transformation stage operations through the number theoretic transformation stage circuit; and then outputting the number theoretic transformation result from the memory block that receives the data last of the two memory blocks.

Description

[Technical Field]

[0001] This invention relates to a computing technique, and more particularly to a computing device and method for flexibly performing number-theoretic transformations. [Previous Technology]

[0002] In lattice-based post-quantum cryptosystems, number-theoretic transforms (NTTs) based on butterfly operations to implement polynomial multiplication are currently one of the mainstream methods for encryption and decryption algorithms in post-quantum cryptography (PQC), such as CRYSTALS-Kyber and CRYSTALS-Dilithium. However, these algorithms use many different combinations of modulus Q and resolution (bit-width), as shown in Table 1 below.

[0003] Type Cryptosystem N q # bits of q Signature Falcon 512 12289 14 1024 12289 14 Dilithium 256 8380417 twenty three Key Encapsulation Mechanism(KEM) Kyber 256 3329 12 Saber 256 2 13 , 2 10 13 NTRU 509 2048 11 701 8192 13 NTRU Prime 653 4621 13 1277 7897 13 FrodoKEM 640 2 15 15 1344 2 16 16

[0004] Taking CRYSTALS-Kyber and CRYSTALS-Dilithium, both N=256-point NTTs, as examples, CRYSTALS-Kyber uses 12-bit input and Q=3329, while CRYSTALS-Dilithium uses 23-bit input and Q=8380417. In most existing NTT systems, a fixed resolution length is used to implement the NTT and addition, subtraction and multiplication operations are performed according to the modulus Q value. However, different modulus Q will affect the results of all addition, subtraction and multiplication operations in the NTT, which means that a fixed resolution NTT cannot be used in both CRYSTALS-Kyber and CRYSTALS-Dilithium systems at the same time. An NTT module with a fixed 12-bit input and a modulus Q=3329 cannot be used on a system that requires a 23-bit NTT module with a modulus Q=8380317, because the results of all modulo addition, modulo subtraction, and multiplication operations calculated using modulus Q=3329 are different from the results using modulus Q=8380417.

[0005] In the US patent (application number US 18 / 819,499) filed by the same inventor in this case, a simplified butterfly arithmetic architecture is used to realize number theory transformation and inverse number theory transformation operations through ping-pong sorting operation, reducing the number of butterfly arithmetic circuits. Based on the improved memory access mechanism, the results of butterfly arithmetic operations are accessed, achieving higher access efficiency and data accuracy.

[0006] Based on the computing device of the aforementioned US patent (application number US 18 / 819,499), the inventors of this case have proposed improvements to the number theory transform stage circuit. To enhance the flexibility of the number theory transform (NTT) module in practical applications, the variable resolution number theory transform stage (NTT Stage) module can define the input and output resolution and the associated Q value (modulus) according to different encryption and decryption algorithms. The flexible resolution universal NTT / INTT of this case can improve the limitations of existing NTT / INTT modules that can only fix the resolution in the application of algorithms at different resolutions. [Summary of the Invention]

[0007] This invention provides a computing device for flexibly performing number-theory transformations, comprising two memory blocks, a flexible resolution number-theory transformation stage (NTT Stage) circuit, a sorting circuit, and a control logic circuit. One of the two memory blocks is used to store metadata. The flexible resolution number-theory transformation stage circuit has multiple weight coefficients corresponding to each stage and includes multiple flexible resolution butterfly circuits and a division-by-two circuit, wherein each flexible resolution butterfly circuit includes an in-memory computing macro circuit, a Barrett reduction circuit, and a modulo adder and modulo subtractor circuit, wherein the in-memory computing macro circuit has internal parameters and is used to preload multiple weight coefficients corresponding to each stage in the flexible resolution number-theory transformation stage circuit. The sorting circuit is coupled to the two memory blocks and the flexible resolution number-theory transformation stage circuit. A control logic circuit is coupled to an elastic resolution number-theoretical transform stage circuit to generate control signals that cause the elastic resolution number-theoretical transform stage circuit to sequentially perform number-theoretical transform stage operations on each elastic resolution butterfly arithmetic circuit until all elastic resolution butterfly arithmetic circuits have completed the number-theoretical transform stage operations. The number-theoretical transform stage operations include number-theoretical transform stage calculations and inverse number-theoretical transform stage calculations, and the elastic resolution number-theoretical transform stage circuit performs both calculations. The elastic resolution number-theoretical transform stage circuit reads metadata and input data from one of two memory blocks, where one of the two memory blocks is the last memory block to receive data. When the number-theoretical transform stage operation is a calculation, the elastic resolution number-theoretical transform stage circuit performs the calculation on the metadata and input data to obtain the calculation result. A sorting circuit sorts the calculation result to obtain a sorted result, and the sorted result is stored in the other of the two memory blocks. When the number-theoretical transformation level operation is an inverse number-theoretical transformation level calculation, the sorting circuit sorts the input data to obtain the sorted inverse number-theoretical transformation input data. The flexible resolution number-theoretical transformation level circuit performs the inverse number-theoretical transformation level calculation on the inverse number-theoretical transformation input data and the metadata to obtain the calculation result, and stores the calculation result in one of the two memory blocks. The flexible resolution number-theoretical transformation level circuit repeatedly performs the level operation corresponding to the number of points required for the number-theoretical transformation level operation. After the flexible resolution number-theoretical transformation level circuit completes the level operation corresponding to the number-theoretical transformation level operation, it outputs the number-theoretical transformation result from the memory block that received the last data in the two memory blocks.

[0008] In one embodiment of the present invention, when the number-theoretical transformation level operation is a number-theoretical transformation level calculation, the flexible resolution number-theoretical transformation level circuit is further used to read the first data and the weight coefficient of the corresponding level from the input data through the memory operation circuit, and perform multiplication operation to obtain the first multiplication result corresponding to the level. The modular operation circuit performs modular operation based on the first multiplication result and the metadata to obtain the first modulo result. The modular addition and subtraction circuit calculates the first modulo addition result and the first modulo subtraction result based on the metadata, the second data and the first modulo result, and outputs the first modulo addition result and the first modulo subtraction result to the sorting circuit.

[0009] In one embodiment of the present invention, when the number theory transformation level operation is an inverse number theory transformation level calculation, the flexible resolution number theory transformation level circuit is further used to calculate the second modular addition result and the second modular subtraction result of the corresponding level based on the first data and the second data in the primitive data and the inverse number theory transformation input data through the modular addition and subtraction circuit. The second modular subtraction result and the weight coefficient corresponding to the level are read through the memory operation circuit and multiplication operation is performed accordingly to obtain the second multiplication result. The modular operation circuit performs modular operation based on the second multiplication result and the primitive data to obtain the second modulo result. The division by two circuit calculates the two division by two result based on the second modulo result, the second modular addition result and the primitive data, and outputs the two division by two result to one of the two memory blocks.

[0010] In one embodiment of the present invention, the analog-to-digital arithmetic circuit is further configured to receive a selection value to select different analog-to-digital arithmetic modules.

[0011] In one embodiment of the present invention, the modulus arithmetic module uses the CRYSTAL-Kyber algorithm or the CRYSTAL-Dilithium algorithm.

[0012] The present invention also provides a computational method for flexibly performing number theory transformations, applicable to a computing device. The computing device includes two memory blocks, a number theory transformation stage (NTT Stage) circuit, a sorting circuit, and a control logic circuit. The flexible resolution number theory transformation stage circuit includes multiple flexible resolution butterfly circuits and a division-by-two circuit. Each flexible resolution butterfly circuit includes an in-memory computing macro circuit and a barrett circuit. The reduction circuit and the modular addition and subtraction circuit are used for the flexible execution of number-theoretical transformation operations. The method includes: initializing the internal parameters of the arithmetic circuit in the memory and preloading multiple weight coefficients corresponding to each stage in the flexible resolution number-theoretical transformation stage circuit; storing the metadata in one of the two memory blocks; generating control signals through the control logic circuit so that the flexible resolution number-theoretical transformation stage circuit sequentially performs number-theoretical transformation stage operations on each flexible resolution butterfly arithmetic circuit until the number-theoretical transformation stage operations are completed on all flexible resolution butterfly arithmetic circuits. The number-theoretical transformation stage operations include number-theoretical transformation stage calculations and inverse number-theoretical transformation stage calculations, and the number-theoretical transformation stage calculations and inverse number-theoretical transformation stage calculations can be performed through the flexible resolution number-theoretical transformation stage circuit. The steps of the number-theoretical transformation stage operation include: reading the metadata and input data from one of the two memory blocks, where one of the two memory blocks is the memory block that received the data last among the two memory blocks; when the number-theoretical transformation stage operation is performed... When the transformation-level operation is a number-theoretical transformation-level calculation, the number-theoretical transformation-level circuit with flexible resolution performs the calculation on the raw data and input data to obtain the calculation result. The calculation result is sorted by a sorting circuit to obtain a sorted result, and the sorted result is stored in one of the two memory blocks. When the number-theoretical transformation-level operation is an inverse number-theoretical transformation-level calculation, the raw data is sorted by a sorting circuit to obtain sorted inverse number-theoretical transformation input data. The inverse number-theoretical transformation-level circuit with flexible resolution performs the calculation on the inverse number-theoretical transformation input data and raw data to obtain the calculation result, and the calculation result is stored in one of the two memory blocks. The number-theoretical transformation-level circuit with flexible resolution repeatedly performs the number-theoretical transformation-level operation corresponding to the number of points required. After the number-theoretical transformation-level circuit with flexible resolution completes the number-theoretical transformation-level operation corresponding to the number of points required, the number-theoretical transformation result is output from the memory block that received the last data in the two memory blocks.

[0013] Based on the above, the computing device and computing method for flexibly performing number-theoretical transformations provided by the present invention can use flexible resolution n-bit modulo adder and modulo subtractor circuits, modulo reduction circuits and division-by-two circuits, as well as a number-theoretical transformation stage circuit composed of an in-memory computing macro circuit for performing multiplication operations, combined with a dual memory buffer for data exchange and sorting circuits, thereby achieving flexible resolution number-theoretical transformation stage operations.

Implementation Method

[0014] Some exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. Component symbols used in the following description are considered to be the same or similar components when they appear in different drawings. These exemplary embodiments are only a part of the present invention and do not disclose all possible implementations disclosed herein. More precisely, these exemplary embodiments are merely examples of the methods, apparatus, and systems within the scope of the present invention's patent application.

[0015] FIG1 is a block diagram illustrating an arithmetic device 1 for flexibly performing number theory transformations according to an embodiment of the present invention. The arithmetic device 1 includes a memory block 10, a memory block 20, a flexible analytical number theory transformation stage (NTT Stage) circuit 30, a sorting circuit 40, and a control logic circuit 50.

[0016] The control logic circuit 50 is coupled to the memory block 10 and memory block 20 storing metadata, the flexible resolution number-theoretic transform stage circuit 30, and the sorting circuit 40. In practice, the control logic circuit 50 may be a central processing unit (CPU), a microprocessor, or an embedded controller. The memory blocks 10 and 20 may be, for example, static random-access memory (SRAM), dynamic random-access memory (DRAM), or other memory blocks, and this disclosure is not limiting.

[0017] Figure 2 is a block diagram of an elastic resolution number-theoretic transform stage circuit 30 according to an embodiment of the present invention. As shown in Figure 2, the function of the elastic resolution number-theoretic transform stage circuit 30 is to perform analog-to-digital operations to obtain number-theoretic transform results / inverse number-theoretic transform results, that is, the results of each stage in the number-theoretic transform (NTT) / inverse number-theoretic transform (INTT) operations. The analog-to-digital operations include CRYSTAL-Kyber and CRYSTAL-Dilithium.

[0018] The flexible analytic number theory transform stage circuit 30 includes multiple flexible resolution butterfly circuits 310 and an n-bit div2 circuit 320. Each flexible resolution butterfly circuit 310 includes an in-memory computing macro circuit 311, a Barrett reduction circuit 312, and a modulo adder and modulo subtractor circuit 313.

[0019] Figure 3 is a circuit diagram of an in-memory arithmetic circuit 311 according to an embodiment of the present invention. The in-memory arithmetic circuit 311 of the flexible resolution can store 256 weight coefficients omega[0]~omega

[127] required for 8 stages, and its function is to perform multiplication operations. The in-memory arithmetic circuit 311 has internal parameters and is used to preload multiple weight coefficients omega[0]~omega

[127] corresponding to each stage in the flexible resolution number theory transformation stage circuit. When the in-memory arithmetic circuit 311 is used for multiplication operations, multiple points of first data In_Y[0]~In_Y

[127] can be simultaneously input into the in-memory arithmetic circuit 311, multiply with the weight coefficients omega[0]~omega

[127] , and output the first multiplication result D[0]~D

[127] .

[0020] Figure 4 is a circuit diagram of an analog-to-digital arithmetic circuit 312 according to an embodiment of the present invention. The flexible resolution analog-to-digital arithmetic circuit 312 consists of a modulo 3329 (24-bit input) module and a modulo 8380417 (46-bit input) module. It is used to perform analog-to-digital arithmetic operations after multiplication through the memory-in-memory arithmetic circuit 311. It can support 24-bit * 24-bit multiplication followed by either modulo 3329 or modulo 8380417 analog-to-digital arithmetic modules. The modulo 3329 and modulo 8380417 modules respectively use CRYSTALS-Kyber and CRYSTALS-Dilithium algorithms. In one embodiment, to save hardware area and cost, the analog-to-digital arithmetic circuit 312 can use left and right shift circuits to replace multiplication and division operations. In one embodiment of the present invention, the control logic circuit 50 is further used to input a selection value (sel) to the analog-to-digital arithmetic circuit 312 to select different analog-to-digital operations (a modulo 3329 (24-bit input) module and a modulo 8380417 (46-bit input) module), which can support 24-bit * 24-bit multiplication operations. The memory-in-memory arithmetic circuit 311, in conjunction with the analog-to-digital arithmetic circuit 312, can be configured to support a maximum of 24-bit data multiplication. In a 256-point NTT / INTT operation, eight stage 24-bit weighting coefficients can be pre-stored.

[0021] The number of stages in NTT / INTT is determined by the number of points. Generally, in NTT operations that are multiples of 2, the number of stages is equal to (N is the number of points). However, the CRYSTALS-Kyber algorithm is a special case and has one less stage. For example, the traditional 256-point NTT / INTT requires 8 stages to complete the operation, but Kyber's NTT / INTT has 7 stages. This NTT Stage module and its sub-modules are all flexible in resolution. By changing the resolution and Q value, it can be applied to different encryption and decryption algorithms, such as: CRYSTALS-Kyber (12-bit input, Q=3329) and CRYSTALS-Dilithium (23-bit input, Q=8380417).

[0022] Figure 5 is a circuit diagram of a modulo addition / subtraction circuit 313 according to an embodiment of the present invention. The modulo addition / subtraction circuit 313 with flexible resolution includes an n-bit modulo adder 313a and an n-bit modulo subtractor 313s. The number of input bits can be changed to achieve modulo addition and modulo subtraction using n-bit modulo addition / subtraction, and the addition / subtraction resolution must be greater than or equal to the number of bits of the Q value.

[0023] Figure 6 is a circuit diagram of a division-by-two circuit 320 according to an embodiment of the present invention. When the number-theory transform level operation is an inverse number-theory transform level (INTT) calculation, the flexible resolution division-by-two circuit 320 is used to perform the division-by-two operation. The result of the operation is the input value (X) divided by 2 and then modulo Q (X / 2 mod Q). The least significant bit of the input value is used to determine whether it is odd or even. If it is even, the input value is directly shifted to the right by 1 bit and output. If it is odd, the input value is directly shifted to the right by 1 bit and then the value of Q / 2 is added before output. In one embodiment, the sorting circuit 40 is coupled to two memory blocks 10 and 20 and the flexible resolution number-theory transform level circuit 30. This invention uses a flexible resolution number-theoretic transform stage (NTT Stage) circuit 30, and a flexible resolution modulo adder and modulo subtractor circuit 313 to process n-bit modulo addition and subtraction operations. It is combined with an in-memory computing macro circuit 311 to perform n-bit multiplication operations. After the multiplication operation, a flexible resolution Barrett reduction circuit 312 is used to perform modulo Q operations for different Q values. Finally, for the division by two operation required by INTT, a flexible resolution n-bit div2 circuit 320 is used. In addition to avoiding the use of a divider to save hardware area, it can also perform modulo Q operations at the same time. The design incorporates a general-purpose sorting circuit 40, combined with a flexible resolution NTT stage unit, and uses the dual-memory block architecture used in the same US patent (application number US 18 / 819,499) filed by the same inventors in this case to perform ping-pong sorting operations. This allows for the use of N / 2 butterfly operation circuits 310 to complete the operation for an N-point NTT in as little as one clock cycle.

[0024] In one embodiment, the control logic circuit 50 is coupled to the elastic resolution number theory transform stage circuit 30 to generate a control signal so that the elastic resolution number theory transform stage circuit 30 sequentially performs number theory transform stage operations on each elastic resolution butterfly operation circuit 310 until all elastic resolution butterfly operation circuits 310 have completed the number theory transform stage operations.

[0025] FIG7 is a flowchart illustrating an operational method 3 for flexibly performing number-theoretical transformations according to an embodiment of the present invention. The operational method 3 of FIG7 can be executed by the control logic circuit 50 of the operational device 1 of FIG1, and the operational method 3 includes steps S31 to S36. Please refer to FIG1 to FIG7 simultaneously.

[0026] In step S31, the internal parameters of the memory operation circuit 311 are initialized, and multiple weight coefficients omega[0]~omega

[127] corresponding to each level in the elastic resolution number theory transformation stage circuit 30 are preloaded.

[0027] In step S32, the metadata Q is stored in one of the two memory blocks 10 and 20 (e.g., memory block 10).

[0028] In step S33, a control signal is generated by the control logic circuit 50 so that the flexible resolution number theory transformation level circuit 30 sequentially performs number theory transformation level operations on each flexible resolution butterfly operation circuit 310 until the number theory transformation level operations are completed on all flexible resolution butterfly operation circuits 310.

[0029] In detail, number-theoretical transformation level operations include number-theoretical transformation level (NTT) calculations and inverse number-theoretical transformation level (INTT) calculations, and the flexible resolution number-theoretical transformation level circuit 30 can perform both number-theoretical transformation level calculations and inverse number-theoretical transformation level calculations. Specifically, the flexible resolution number-theoretical transformation level circuit 30 can complete n-bit NTT / INTT level operations. By issuing control signals through the control logic circuit 50, and then reordering the memory blocks 10 and 20 using a ping-pong memory mechanism, all N-point NTT / INTT level operations can be completed.

[0030] Therefore, when performing number theory transformation level operation in step S33, the number theory transformation level circuit 30 first reads the metadata Q and input data from one of the two memory blocks 10 and 20 (e.g., memory block 10), i.e. step S331.

[0031] Next, when the flexible resolution number-theoretical transform stage circuit 30 processes the number-theoretical transform stage (NTT) calculation, in step S332, the flexible resolution number-theoretical transform stage circuit 30 performs the number-theoretical transform stage (NTT) calculation on the primitive data Q and the input data to obtain the calculation result. Details will be described later. In step S333, the calculation results are sorted by the sorting circuit 40 to obtain a sorted result. Next, in step S34, the sorted result is stored in the other of the two memory blocks 10 and 20 (e.g., memory block 20).

[0032] Alternatively, when the flexible resolution number-theoretical transform stage circuit 30 processes the inverse number-theoretical transform stage (INTT) calculation, in step S334, the input data is sorted by the sorting circuit 40 to obtain the sorted inverse number-theoretical transform input data; in step S335, the flexible resolution number-theoretical transform stage circuit 30 performs the inverse number-theoretical transform stage (INTT) calculation on the inverse number-theoretical transform input data and the metadata Q to obtain the calculation result. Details will be described later. Next, in step S34, the calculation result is stored in the other of the two memory blocks 10 and 20 (e.g., memory block 20).

[0033] In step S35, the number of points required for the number-theory transformation stage operation is repeatedly executed through the flexible resolution number-theory transformation stage circuit 30, i.e., returning to step S32 and executing steps S32 to S35. Specifically, in step S34, using the calculation result stored in the other of the two memory blocks 10 and 20 (e.g., memory block 20), when performing the next number-theory transformation stage operation, the flexible resolution number-theory transformation stage circuit 30 reads the metadata Q and input data from one of the two memory blocks 10 and 20 (e.g., memory block 20). Similarly, by reordering the two memory blocks 10 and 20 using a ping-pong memory mechanism, all N-point NTT / INTT level operations can be completed.

[0034] In step S36, after the number of points required for the number theory transformation operation is completed by the flexible resolution number theory transformation stage circuit 30, the number theory transformation result is output from the memory block that last received the data in the two memory blocks 10 and 20 (which may be memory block 10 or memory block 20).

[0035] Next, the step of performing number-theoretical transform level (NTT) calculations through the flexible resolution number-theoretical transform level circuit 30 in step S332 of the operation method 3 shown in FIG7 to obtain the calculation result will be described. FIG8 is a flowchart illustrating the execution of number-theoretical transform level (NTT) calculations in step S332 of an operation method 3 for flexibly performing number-theoretical transforms according to an embodiment of the present invention; FIG9 is a schematic diagram illustrating the execution of number-theoretical transform level (NTT) calculations in step S332 of an operation method 3 for flexibly performing number-theoretical transforms according to an embodiment of the present invention. The NTT calculations in FIG8 and 9 can be executed by the control logic circuit 50 of the operation device 1 in FIG1, and the NTT calculations include steps S3321 to S3324. Please refer to FIG1 and FIG8 and 9 simultaneously.

[0036] In step S3321, the first data and the weight coefficients corresponding to the level are read from the input data through the memory-in-memory arithmetic circuit 311, and a multiplication operation is performed accordingly to obtain the first multiplication result corresponding to the level. In detail, the internal memory block (not shown in the figure) in the memory-in-memory arithmetic circuit 311 can pre-store the first data required for the level and the weight coefficients corresponding to the level. The memory-in-memory arithmetic circuit 311 reads the first data required for the level and the weight coefficients corresponding to each level from the internal memory block, and multiplies them accordingly to calculate the first multiplication result corresponding to the level.

[0037] In step S3322, metadata is read from the first memory block 10, and the first modulo result is obtained by performing a modulo operation based on the first multiplication result and the metadata through the analog-to-digital arithmetic circuit 312.

[0038] In step S3323, the first modulo addition result and the first modulo subtraction result are calculated by the modulo addition and subtraction circuit 313 based on the original data Q, the second data and the result after taking the first modulo.

[0039] In step S3324, the control logic circuit 50 outputs the first modulo addition result and the first modulo subtraction result to the sorting circuit 40.

[0040] After the control logic circuit 50 outputs the first modulo addition result and the first modulo subtraction result to the sorting circuit 40, it returns to step S333 in Figure 3 and sorts the calculation results through the sorting circuit 40 to obtain the sorting result of the calculation results.

[0041] Figure 10 is an architecture diagram of the flexible resolution 256-point number theory transform stage circuit NTT according to an embodiment of the present invention. As shown in Figure 10, the flexible resolution number theory transform stage circuit 30 reads metadata Q[0]~Q

[127] and input data from one of the two memory blocks 10 and 20, and divides the 256-point input data into first data even-numbered terms In_X[0]~In_X

[127] and first data odd-numbered terms In_Y[0]~In_Y

[127] . Through the memory in-process circuit 311, multiplication operations are performed based on the first data odd-numbered terms In_Y[0]~In_Y

[127] and the weight coefficients omega[0]~omega

[127] preloaded into the memory in-process circuit 311 to obtain the first multiplication result of the corresponding stage. Next, the modular arithmetic circuit 312 performs modular arithmetic based on the first multiplication result D[0]~D

[127] and the metadata Q[0]~Q

[127] to obtain the first modulo result In_Y_multi[0]~In_Y_multi

[127] . Next, the modular addition and subtraction circuit 313 performs modular addition and subtraction operations on the original data Q[0]~Q

[127] , the first even-numbered data items In_X[0]~In_X

[127] , and the first modulo result In_Y_multi[0]~In_Y_multi

[127] to calculate the first modular addition result NTT_OUT0, NTT_OUT2, ..., NTT_OUT254 and the first modular subtraction result NTT_OUT1, NTT_OUT3, ..., NTT_OUT255. The first modular addition result NTT_OUT0, NTT_OUT2, ..., NTT_OUT254 and the first modular subtraction result NTT_OUT1, NTT_OUT3, ..., NTT_OUT255 are output to the sorting circuit 40. After output, the sorting circuit 40 stores the results in the other of the two memory blocks 10 and 20. The elastic resolution number-theoretic transform stage circuit 30 iterates through multiple stages until all stages are completed (kyber=7, Dilithium=8).

[0042] Next, the step of performing inverse number theory transform level (INTT) calculation through the flexible resolution number theory transform level circuit 30 in step S332 of the operation method 3 shown in FIG7 to obtain the calculation result will be described. FIG11 is a flowchart illustrating the execution of inverse number theory transform level (INTT) calculation in step S335 of an operation method 3 for flexibly performing number theory transform according to an embodiment of the present invention. FIG12 is a schematic diagram illustrating the execution of inverse number theory transform level (INTT) calculation in step S335 of an operation method 3 for flexibly performing number theory transform according to an embodiment of the present invention. The INTT calculation in FIG11 and FIG12 can be executed by the control logic circuit 50 of the operation device 1 in FIG1. ​​The INTT calculation includes steps S3351 to S3355. Please refer to FIG1 and FIG11 and FIG12 simultaneously.

[0043] In step S3351, the first data and the second data in the sorted inverse number theory transformation input data are obtained by the modular addition and subtraction circuit 313 based on the original data and the sorting circuit 40 in step S334 to obtain the second modular addition result and the second modular subtraction result of the corresponding level.

[0044] In step S3352, the second modular subtraction result and the corresponding weight coefficients of the level are read through the memory-in-memory arithmetic circuit 311, and a multiplication operation is performed accordingly to obtain the second multiplication result. In detail, the internal memory block can store the weight coefficients corresponding to the level, and the second modular subtraction result and multiple weight coefficients are read through the memory-in-memory arithmetic circuit 311 to calculate the second multiplication result.

[0045] In step S3353, the data is read through the analog-to-digital arithmetic circuit 312, and the second modulo result is calculated based on the second multiplication result and the data.

[0046] In step S3354, the two-division-by-two result is calculated by the division-by-two circuit 320 based on the second modulus result, the second modulus addition result, and the metadata.

[0047] In step S3355, the result of dividing two by two is stored in one of the two memory blocks 10 and 20.

[0048] Figure 13 is a schematic diagram of the flexible resolution 256-point inverse number theory transform stage circuit INNT according to an embodiment of the present invention. As shown in Figure 13, the input data stored in one of the two memory blocks 10 and 20 is reordered by the sorting circuit 40 to obtain the sorted inverse number theory transform input data. The inverse number theory transform input data is input to the flexible resolution number theory transform stage circuit 30, and the sorted 256-point inverse number theory transform input data is divided into the first data even-numbered items In_X[0]~In_X

[127] and the first data odd-numbered items In_Y[0]~In_Y

[127] .

[0049] On the one hand, the modular addition and subtraction circuit 313 calculates the modular addition operation based on the original data Q[0]~Q

[127] , the first data even-numbered terms In_X[0]~In_X

[127] and the first data odd-numbered terms In_Y[0]~In_Y

[127] to output the second modular addition result MOD_ADD_OUT[0]~MOD_ADD_OUT

[127] , and the second modular addition result MOD_ADD_OUT[0]~MOD_ADD_OUT

[127] calculates the even-numbered terms INTT_OUT0, INTT_OUT2, ..., INTT_OUT254 of the result after division by two through the division circuit 320.

[0050] On the other hand, the modular addition and subtraction circuit 313 calculates the modular subtraction operation based on the original data Q[0]~Q

[127] , the first data even-numbered terms In_X[0]~In_X

[127] and the first data odd-numbered terms In_Y[0]~In_Y

[127] to output the second modular subtraction result MOD_SUB_OUT[0]~MOD_SUB_OUT

[127] . Then, the memory operation circuit 311, the modular operation circuit 312 and the division-by-two circuit 320 calculate the odd-numbered terms INTT_OUT1, INTT_OUT3, ..., INTT_OUT255 of the result after division by two. The flexible resolution butterfly arithmetic circuit 310 outputs the even-numbered terms INTT_OUT0, INTT_OUT2, ..., INTT_OUT254 and the odd-numbered terms INTT_OUT1, INTT_OUT3, ..., INTT_OUT255 after division by two, and stores them in one of the two memory blocks 10 and 20. The flexible resolution number-theory transform stage circuit 30 repeats multiple stages until the operations of all stages are completed (kyber=7, Dilithium=8).

[0051] In the technology of the computing device 1 and computing method 3 for flexibly performing number-theoretic transformation disclosed in this invention, the data stream can be processed by the flexible resolution number-theoretic transformation stage circuit 30 according to the needs of number-theoretic transformation (NTT) or inverse number-theoretic transformation (INTT) and then sorted by the sorting circuit 40 before being written to the memory block, or read from the memory block and sorted by the sorting circuit 40 before being transmitted to the flexible resolution number-theoretic transformation stage circuit 30 for processing. The memory blocks written for processing are used alternately. After completing the number of levels corresponding to the number of points required for NTT / INTT, the final result is output by the last memory block that has been written.

[0052] This invention proposes a computational technique that enables the implementation of a general-purpose NTT / INTT hardware circuit with flexible resolution. It flexibly flexibly performs modulo-digital operations from a mathematical algorithmic perspective, and uses an n-bit modulo addition / subtraction circuit 313 to handle modulo addition and subtraction, and an n-bit division-by-two circuit 320 to handle modulo division, thereby achieving the goal of flexible resolution. This allows the flexible resolution number-theoretical transform stage circuit 30 of this invention to be applied to encryption and decryption algorithms with different resolutions and modulus Q values ​​by changing its internal parameters.

[0053] In summary, the computing device and computing method for flexibly performing number-theoretical transformations provided by the present invention can use flexible resolution n-bit modulo adder and modulo subtractor circuits, modulo (Barrett reduction) circuits and division-by-two circuits, as well as number-theoretical transformation stage circuits composed of in-memory computing macro circuits for performing multiplication operations, combined with dual memory buffer data exchange and sorting circuits, thereby achieving flexible resolution number-theoretical transformation stage operations. [Simplified Explanation of the Diagram]

[0054] Figure 1 is a block diagram of an arithmetic device for flexibly performing number-theoretical transformations according to an embodiment of the present invention. Figure 2 is a block diagram of a flexible resolution number-theoretical transformation stage circuit according to an embodiment of the present invention. Figure 3 is a circuit diagram of an arithmetic circuit within a memory according to an embodiment of the present invention. Figure 4 is a circuit diagram of an analog-to-digital arithmetic circuit according to an embodiment of the present invention. Figure 5 is a circuit diagram of a modular addition / subtraction circuit according to an embodiment of the present invention. Figure 6 is a circuit diagram of a division-by-two circuit according to an embodiment of the present invention. Figure 7 is a flowchart of an arithmetic method 3 for flexibly performing number-theoretical transformations according to an embodiment of the present invention. Figure 8 is a flowchart illustrating the execution of number-theoretical transformation stage (NTT) calculation in step 332 of an arithmetic method for flexibly performing number-theoretical transformations according to an embodiment of the present invention. Figure 9 is a schematic diagram illustrating the execution of number-theoretical transformation stage (NTT) calculation in step S332 of an arithmetic method for flexibly performing number-theoretical transformations according to an embodiment of the present invention. Figure 10 is a schematic diagram of the flexible resolution 256-point number-theoretical transform stage circuit NTT according to an embodiment of the present invention. Figure 11 is a flowchart illustrating the calculation of the inverse number-theoretical transform stage (INTT) in step S335 of a method for flexibly performing number-theoretical transforms according to an embodiment of the present invention. Figure 12 is a schematic diagram illustrating the calculation of the inverse number-theoretical transform stage (INTT) in step S335 of a method for flexibly performing number-theoretical transforms according to an embodiment of the present invention. Figure 13 is a schematic diagram of the flexible resolution 256-point inverse number-theoretical transform stage circuit INNT according to an embodiment of the present invention.

Claims

1. A computational device for flexibly performing number-theoretical transformations, comprising: Two memory blocks, one of which stores metadata; an NTT Stage circuit with multiple weighting coefficients corresponding to each stage and including multiple NTT Stage circuits; a sorting circuit coupled to the two memory blocks and the NTT Stage circuit; and a control logic circuit coupled to the NTT Stage circuit to generate control signals so that the NTT Stage circuit sequentially performs NTT Stage operations on all the NTT Stage circuits, wherein the NTT Stage operations include NTT calculations and inverse NTT calculations, wherein each NTT Stage circuit includes a Barrett Reduction circuit for receiving selection values ​​to select different Barrett Reduction modules; wherein the NTT Stage circuit reads the metadata and input data from one of the two memory blocks. When the number-theoretical transformation level operation is a number-theoretical transformation level calculation, the flexible resolution number-theoretical transformation level circuit performs the number-theoretical transformation level calculation on the metadata and the input data to obtain the calculation result. The sorting circuit sorts the calculation result to obtain a sorted result, and the other memory block stores the sorted result. When the number-theoretical transformation level operation is an inverse number-theoretical transformation level calculation, the sorting circuit sorts the input data to obtain sorted inverse number-theoretical transformation input data. The flexible resolution number-theoretical transformation level circuit performs the inverse number-theoretical transformation level calculation on the inverse number-theoretical transformation input data and the metadata to obtain the calculation result, and the other memory block stores the calculation result. The flexible resolution number-theoretical transformation level circuit repeatedly performs the level operation corresponding to the number of points required for the number-theoretical transformation level operation. The flexible resolution number-theoretical transformation level circuit outputs the number-theoretical transformation result from the memory block that last receives data from the two memory blocks.

2. The computing device as claimed in claim 1, wherein each of the flexible resolution butterfly computing circuits further includes an in-memory computing macro circuit and a modulo adder and modulo subtractor circuit, wherein the in-memory computing macro circuit has internal parameters and is used to preload the weight coefficients corresponding to each stage in the flexible resolution number-theoretical transform stage circuit, wherein when the number-theoretical transform stage operation is the number-theoretical transform stage calculation, the flexible resolution number-theoretical transform stage circuit is further used to: read the first data and the weight coefficient corresponding to the stage from the input data through the in-memory computing macro circuit, and perform a multiplication operation to obtain a first multiplication result corresponding to the stage; perform a modulo operation based on the first multiplication result and the metadata through the modulo computing macro circuit to obtain a first modulo result; and calculate a first modulo addition result and a first modulo subtraction result based on the metadata, the second data and the first modulo result through the modulo adder and subtractor circuit, and output the first modulo addition result and the first modulo subtraction result to the sorting circuit.

3. The computing device as claimed in claim 1, wherein each of the flexible resolution butterfly computing circuits further includes an in-memory computing circuit and a modular addition / subtraction circuit, wherein the in-memory computing circuit has internal parameters and is used to preload the weight coefficients corresponding to each stage in the flexible resolution number-theoretical transform stage circuit, wherein the flexible resolution number-theoretical transform stage circuit further includes a division-by-two circuit, wherein when the number-theoretical transform stage operation is the inverse number-theoretical transform stage calculation, the flexible resolution number-theoretical transform stage circuit is further used to: calculate, through the modular addition / subtraction circuit, based on the metadata, the first data in the inverse number-theoretical transform input data, and the second data, to obtain a second modular addition result and a second modular subtraction result corresponding to the stage; read the second modular subtraction result and the weight coefficients corresponding to the stage through the in-memory computing circuit and perform a multiplication operation accordingly to obtain a second multiplication result; and perform a modular operation based on the second multiplication result and the metadata through the modular arithmetic circuit to obtain a second modulo-digit result. The division-by-two circuit calculates the result of the second modulo operation, the second modulo addition result, and the metadata, and outputs the result of the second division-by-two to one of the two memory blocks.

4. The computing device as claimed in claim 1, wherein the modular arithmetic module uses the CRYSTAL-Kyber algorithm or the CRYSTAL-Dilithium algorithm.

5. A computational method for flexibly performing number-theoretical transformations, applicable to a computing device, the computing device including two memory blocks, a number-theoretical transformation stage (NTT Stage) circuit, a sorting circuit, and a control logic circuit, wherein the flexible resolution number-theoretical transformation stage circuit includes multiple flexible resolution butterfly circuits, and the computational method for flexibly performing number-theoretical transformations includes: The metadata is stored in one of the two memory blocks; the control logic circuit generates a control signal to cause the flexible resolution number-theoretic transformation stage circuit to sequentially perform number-theoretic transformation stage operations on all the flexible resolution butterfly operation circuits, wherein each of the flexible resolution butterfly operation circuits includes a Barrett reduction circuit, wherein the number-theoretic transformation stage operation includes number-theoretic transformation stage calculation and inverse number-theoretic transformation stage calculation, wherein the steps of the number-theoretic transformation stage operation include: reading the metadata and inputting data from one of the two memory blocks; When the number-theoretical transformation level operation is a number-theoretical transformation level calculation, the flexible resolution number-theoretical transformation level circuit performs the number-theoretical transformation level calculation on the metadata and the input data to obtain the calculation result. The sorting circuit sorts the calculation result to obtain the sorted result, and the sorted result is stored in one of the two memory blocks. When the number-theoretical transformation level operation is an inverse number-theoretical transformation level calculation, the sorting circuit sorts the input data to obtain the sorted inverse number-theoretical transformation input data. The flexible resolution number-theoretical transformation level circuit performs the inverse number-theoretical transformation level calculation on the inverse number-theoretical transformation input data and the metadata to obtain the calculation result, and the calculation result is stored in the other of the two memory blocks. The flexible resolution number-theoretical transformation level circuit repeatedly performs the level operation corresponding to the number of points required for the number-theoretical transformation level operation. The number-theoretical transformation result is output from the memory block that last received data from the two memory blocks. The calculation method further includes: inputting a selection value to the analog-to-digital arithmetic circuit to select different analog-to-digital arithmetic modules.

6. The computation method as described in claim 5, wherein each of the flexible resolution butterfly computation circuits further includes an in-memory computing macro circuit and a modulo adder and modulo subtractor circuit, wherein when the number-theory transform level operation is the number-theory transform level calculation, the step of performing the number-theory transform level calculation on the metadata and the input data through the flexible resolution number-theory transform level circuit to obtain the calculation result includes: The internal parameters of the operational circuit within the memory are initialized, and multiple weight coefficients corresponding to each stage in the flexible resolution number-theoretical transform stage circuit are preloaded. The first data in the input data and the weight coefficient corresponding to the stage are read through the operational circuit within the memory, and a multiplication operation is performed accordingly to obtain the first multiplication result corresponding to the stage. The modular arithmetic circuit performs a modular arithmetic based on the first multiplication result and the metadata to obtain the first modulo result. The modular addition and subtraction circuit calculates the first modulo addition result and the first modulo subtraction result based on the metadata, the second data, and the first modulo result, and outputs the first modulo addition result and the first modulo subtraction result to the sorting circuit.

7. The computational method as described in claim 5, wherein each of the flexible resolution butterfly computation circuits further includes an in-memory computation circuit and a modulo addition / subtraction circuit, wherein the flexible resolution number theory transform stage circuit further includes a division-by-two circuit, wherein when the number theory transform stage operation is the inverse number theory transform stage calculation, the step of performing the number theory transform stage operation on the metadata and the input data to obtain the computation result includes: The internal parameters of the operational circuit within the memory are initialized, and multiple weighting coefficients corresponding to each stage in the flexible resolution number-theoretical transform stage circuit are preloaded. The modular addition and subtraction circuit calculates the second modular addition and second modular subtraction results corresponding to the corresponding stage based on the metadata, the first data in the inverse number-theoretical transform input data, and the second data. The operational circuit within the memory reads the second modular subtraction result and the weighting coefficients corresponding to the stage and performs multiplication accordingly to obtain a second multiplication result. The modular arithmetic circuit reads the metadata and performs modular arithmetic based on the second multiplication result and the metadata to obtain a second modulo result. The division-by-two circuit calculates the two-by-two result based on the second modulo result, the second modular addition result, and the metadata, and outputs the two-by-two result to one of the two memory blocks.

8. The computation method as described in claim 5, wherein the modulus arithmetic module uses the CRYSTAL-Kyber algorithm or the CRYSTAL-Dilithium algorithm.

Images