A polynomial multiplication hardware implementation system suitable for lattice cryptographic algorithms

Abstract

The present invention belongs to the field of information security hardware circuit design, and discloses a polynomial multiplication hardware implementation system suitable for a lattice cryptographic algorithm, including an operation control unit, a storage control unit, a memory unit, a number theory transformation unit, and a parameter operation unit; the operation control unit is used to control the calculation process of the polynomial multiplication hardware implementation system; the storage control unit is used to control the read and write addresses of data in the memory unit; the storage control unit parses the control signal sent by the operation control unit to control the address of the data that the number theory transformation unit and the parameter operation unit need to read from the memory unit before calculation or write to the memory unit after calculation; the memory unit is composed of a plurality of SRAMs, and is used to store polynomial data, various parameters, calculation intermediate data, and calculation results. The system reuses hardware units, effectively reduces the use of hardware resources, and improves hardware utilization.

Description

Technical Field

[0001] The invention belongs to the field of information security hardware circuit design, and in particular relates to a fast polynomial multiplication calculation unit hardware implementation system suitable for a lattice cryptographic algorithm. Background Art

[0002] The development of quantum computing has brought great challenges to the security of existing public key cryptography systems. The Shor algorithm in quantum computing research has achieved the solution of large integer decomposition problems in polynomial time, which means that a number of public key cryptography algorithms based on large integer decomposition problems, including the RSA algorithm, are no longer safe. As a new generation of quantum-resistant cryptography systems, the lattice cryptography system has received widespread attention from cryptography researchers. The National Institute of Standards and Technology (NIST) has been soliciting cryptographic algorithm standards that are resistant to quantum computing attacks since 2016. Among the seven algorithms selected in the third round of the post-quantum cryptography standards competition announced by NIST in 2020, five belong to the category of lattice cryptography. Similarly, at the three major international cryptography annual conferences in 2020, the lattice cryptography system, as the most important type of post-quantum cryptography, is also a hot topic of research. In addition to its ability to resist quantum computing attacks, lattice cryptography can also construct some new cryptographic algorithms and applications. For example, the first fully homomorphic encryption algorithm proposed by gentry in 2009 was based on an ideal lattice construction. Later, Brakerski and Vaikuntanathan proposed a new fully homomorphic encryption system based on a hypothetical error learning (Learning with Error, LWE) of lattice cryptography.

[0003] Many existing lattice cryptographic algorithms are constructed based on Ring Learning with Error (R-LWE). A large number of operations in such algorithms are performed on polynomial rings. Polynomial multiplication is the most core underlying operation and generates a lot of time overhead. Therefore, the study of fast polynomial multiplication can greatly improve the computational efficiency of lattice cryptographic algorithms. Using fast number theoretic transform (NTT) to calculate polynomial multiplication is an effective optimization method. Polynomial multiplication based on NTT reduces the time complexity from O(n2) to linear complexity O(nlogn). Number theoretic transform is a generalization of fast Fourier transform FFT on finite fields. NTT inherits the idea of ​​FFT and uses the original unit root on the finite field to replace the unit root on the complex plane in FFT to realize the fast calculation of polynomial multiplication on the polynomial ring. In addition, the NTT algorithm has a high degree of computational parallelism, and the hardware circuit can use its parallelism to improve the computational speed. Therefore, it is very meaningful to realize the fast calculation of polynomial multiplication through hardware circuits to improve the computational efficiency of lattice cryptographic algorithms. Summary of the invention

[0004] In view of the characteristics of polynomial multiplication, the present invention proposes a polynomial multiplication hardware implementation system suitable for lattice cryptographic algorithm based on NTT algorithm, which realizes the fast calculation of polynomial multiplication by utilizing the higher parallelism in NTT algorithm. The specific technical scheme is as follows:

[0005] A polynomial multiplication hardware implementation system suitable for a lattice cryptographic algorithm comprises an operation control unit, a storage control unit, a memory unit, a number theory transformation unit, and a parameter operation unit; the characteristics are:

[0006] The operation control unit is used to control the calculation process of the polynomial multiplication hardware implementation system;

[0007] The storage control unit is used to control the read and write addresses of data in the memory unit; the storage control unit analyzes the control signal sent by the operation control unit to control the address of the data that the number theory transformation unit and the parameter operation unit need to read from the memory unit before calculation or write to the memory unit after calculation;

[0008] The memory unit is composed of a plurality of SRAMs and is used to store polynomial data, various parameters, intermediate calculation data and calculation results in the calculation process.

[0009] Furthermore, the number theoretic transformation unit is used to perform number theoretic transformation operations and inverse number theoretic transformation operations.

[0010] Furthermore, the parameter operation unit is used to complete parameter generation, parameter operation and polynomial multiplication operation.

[0011] Furthermore, the number theory transformation unit is composed of a plurality of butterfly calculation units, and the butterfly calculation unit is used for butterfly calculation in number theory transformation and inverse number theory transformation.

[0012] Furthermore, the butterfly computing unit includes a modular multiplication unit, a modular addition unit, a modular subtraction unit and a plurality of registers.

[0013] Furthermore, the modular multiplication unit is a Montgomery modular multiplication unit, which is composed of a multiplier and a Montgomery modular reduction combination.

[0014] The polynomial multiplication hardware implementation system applicable to the lattice cryptographic algorithm of the present invention has the following advantages:

[0015] 1. The hardware architecture of this hardware implementation system has a high degree of parallelism, which can fully utilize the parallelizable parts of the polynomial multiplication process and greatly improve the computational efficiency of polynomial multiplication.

[0016] 2. This system is implemented using hardware. For the same calculations in number theory transformation and inverse number theory transformation, this system reuses hardware units, effectively reducing the use of hardware resources, improving hardware utilization, and ensuring high budget performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of polynomial multiplication based on NTT;

[0018] Figure 2 It is a hardware architecture diagram of the polynomial multiplication hardware implementation system of the present invention;

[0019] Figure 3 is a hardware architecture diagram of a butterfly computing unit in an embodiment;

[0020] Figure 4 is a hardware architecture diagram of a simple Montgomery module in an embodiment;

[0021] Figure 5a and Figure 5b They are hardware architecture diagrams of the analog addition unit and the analog subtraction unit in the embodiment; DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with specific embodiments and drawings.

[0023] like Figure 1 As shown, the NTT-based polynomial multiplication operation process followed by the polynomial multiplication hardware implementation system of the present invention includes the following steps:

[0024] Step 1: For the two n-dimensional polynomials involved in the polynomial multiplication calculation and Perform preprocessing, where ψ is Z q The 2nth original unity root of

[0025] Step 2: Preprocess the polynomials and Performing number-theoretic transformations and multiplying, we get and

[0026] Step 3: After the number theory transformation and The corresponding coefficients of are multiplied and transformed by inverse number theory, and we get

[0027] Step 4: For the obtained polynomial Post-processing to get the final polynomial multiplication result

[0028] The embodiment of the present invention demonstrates a polynomial multiplication hardware implementation system suitable for lattice cryptographic algorithms. The embodiment of the present invention implements hardware according to the aforementioned NTT-based polynomial fast multiplication algorithm, and can support less than 2 in parameter configuration. 16 And it is applicable to the modulus of the lattice cryptographic algorithm. The default parameters used by this system are modulus q = 12298 and order n = 1024. All data in the calculation process of this system are in the finite field Z with q as the modulus. q In the calculation, all polynomials involved are in the polynomial ring R q =Z q [X] / (X n +1), ω is Z q is the nth-order primitive root of unity, and ψ is the 2nth-order primitive root of unity.

[0029] like Figure 2 As shown, the polynomial multiplication hardware system suitable for the lattice cryptographic algorithm of the present invention includes an operation control unit, a storage control unit, a memory unit, a number theory transformation unit, and a parameter operation unit. The calculation process of the system is as follows: external data and signals are configured by the operation control unit, and the data is stored in the memory unit through the storage control unit. When the system configuration is completed, the state machine of the operation control unit starts to execute. The parameter operation unit first pre-processes the polynomial data, and the number theory transformation unit starts the calculation after the pre-processing is completed; when all the polynomial coefficients are calculated, the parameter operation unit multiplies the corresponding terms of the two transformed polynomials, and the result is then inversely transformed by the number theory transformation unit; finally, after post-processing by the parameter operation unit, the entire polynomial multiplication operation is completed.

[0030] The operation control unit is Figure 1 The polynomial multiplication operation process controls each hardware unit in the system. For example, when controlling the number theory transformation unit to calculate the number theory transformation or the inverse number theory transformation, the operation control unit needs to control the parameter operation unit to calculate the corresponding parameters and input them into the number theory transformation unit for calculation; at the same time, the operation control unit sends the address signal of data reading and writing to the storage control unit according to the current operation state.

[0031] The storage control unit is used to control the data read and write addresses in the RAM.

[0032] The storage unit is composed of multiple RAMs, and each piece of data is stored in two RAMs at the same time as a backup, so that the parallel butterfly computing units in the number theory transformation unit can read and write data at the same time.

[0033] The number theory transformation unit is the core unit of the system, which is used to perform number theory transformation and inverse transformation operations. The number theory transformation unit has multiple parallel butterfly calculation paths (the number of paths can be set according to the required parallelism), and a pipeline is composed of multiple butterfly calculation units on each butterfly calculation path. The number theory transformation unit implemented in the embodiment of the present invention follows the Cooley-Tukey number theory transformation algorithm, which is not specifically described here.

[0034] The parameter operation unit is mainly composed of a Montgomery modular multiplication unit, which is used to calculate the number theory transformation parameters (such as the power of the original unit root ω and the pre-calculated rotation factor ψ, and the product of the corresponding terms of the polynomial after the number theory transformation. For the above parameters in the number theory transformation, this embodiment adopts pre-storing initial values ​​ω and ψ, and then calculates the required power in real time; compared with pre-storing all parameters in the memory, although a certain delay will be generated, it can save a lot of storage resources.

[0035] The butterfly computing unit is used to perform butterfly computing in number theory transformation operations. Figure 3 As shown, the butterfly computing unit is mainly composed of a Montgomery modular multiplication unit, a modular addition unit, a modular subtraction unit and multiple registers. A multiplexer is used to select the parameters involved in the calculation to achieve the switching of number theory transformation or inverse transformation. Figure 3 In the butterfly computing unit, there are two data paths, and a Montgomery modular multiplication unit is on the lower data path. In order to make the two input data of the modular addition unit / modular subtraction unit arrive at the same time, a set of registers is inserted on the higher data path to balance the delay of the modular multiplication unit, so that the entire butterfly computing unit forms a pipeline structure.

[0036] For the modular multiplication operation used in the butterfly computing unit, the embodiments of the present invention implement it using the Montgomery modular multiplication algorithm. Montgomery modular reduction is a commonly used fast modular algorithm. The Montgomery modular reduction unit in the embodiments of the present invention follows the following algorithm to implement:

[0037] Step 1: Divide the input 32-bit product into the high 16-bit A h and the low 16-bit A l , multiply the low 16-bit A l by the inverse q -1 of the modulus to obtain B;

[0038] Step 2: Take the modulus of the product result B with 2 16 to obtain the low 16-bit B l , and then multiply it by the modulus q to obtain C;

[0039] Step 3: Shift the product result C to the right by 16 bits to obtain the high 16-bit C h , subtract C h from A h to obtain r;

[0040] Step 4: Compare r and q. If r > q, the final result is r - q; otherwise, the final result is r.

[0041] Based on this, the embodiments of the present invention provide a hardware architecture of a Montgomery modular reduction unit, as Figure 4 shown. The multiplier and the Montgomery modular reduction are combined to form a Montgomery modular multiplication unit. In order to improve the working frequency of the hardware unit, registers are inserted after each multiplier in the Montgomery modular reduction, and at the same time, the entire hardware unit also forms a pipeline structure to achieve a higher data throughput.

[0042] Furthermore, the embodiment provides a hardware architecture of an adder unit, as Figure 5a shown. The adder unit requires one clock cycle to perform an addition operation. The adder unit adds the two's complement of the modulus q to the result C of (A + B), and determines whether C is greater than q through the carry of the adder. If the carry is 1, it means C > q, and the output C - q is used as the addition result. This hardware architecture eliminates a comparator.

[0043] The embodiment also provides a hardware architecture of a subtractor unit, as Figure 5b shown. The circuit of the subtractor unit is similar to that of the adder unit, and the subtraction result can also be obtained in one clock cycle. Add the two's complement of B to A. If the carry is 1, it means A < B. At this time, add the result of A - B to q as the output result; if the carry is 0, it means A > B. At the same time, because both A and B are numbers less than q, A - B is a positive integer less than q and can be used as the result output.

[0044] The embodiment of the present invention is implemented by Verilog HDL. Support q<2 16 , n<1024 polynomial calculation. The polynomial multiplication hardware accelerator for the lattice cryptographic algorithm implemented according to the polynomial multiplication hardware implementation system architecture provided by the present invention has been tested to show that the operating results achieved are normal. The frequency reaches 350MHz under the SMIC55nm process. The simulation results of the polynomial multiplication operation show that the performance is greatly improved compared with the software implementation of the ARM cortex-M4 platform.

[0045] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A polynomial multiplication hardware implementation system suitable for a lattice cryptographic algorithm, comprising an operation control unit, a storage control unit, a memory unit, a number theory transformation unit, and a parameter operation unit; characterized in that: The operation control unit is used to control the calculation process of the polynomial multiplication hardware implementation system; The storage control unit is used to control the read and write addresses of data in the memory unit; the storage control unit analyzes the control signal sent by the operation control unit to control the address of the data that the number theory transformation unit and the parameter operation unit need to read from the memory unit before calculation or write to the memory unit after calculation; The memory unit is composed of a plurality of SRAMs and is used to store polynomial data, various parameters, intermediate calculation data and calculation results during the calculation process; The parameter operation unit is used to complete parameter generation, parameter operation and polynomial multiplication operation; The number theory transformation unit is composed of a plurality of butterfly calculation units, and the butterfly calculation units are used for butterfly calculation in number theory transformation and inverse number theory transformation; The butterfly computing unit includes a modular multiplication unit, a modular addition unit, a modular subtraction unit and a plurality of registers; the modular multiplication unit is a Montgomery modular multiplication unit, which is composed of a multiplier and a Montgomery modular reduction combination; The Montgomery modular reduction is implemented using the following algorithm: Step 1: Convert the input 32-bit product into the high 16 bits A h and the lower 16 bits A l , use the lower 16 bits of A l The inverse of the modulus q -1 Multiply them to get B; Step 2: Multiply the result B by 2 16 Modulo, get the lower 16 bits B l , and then multiply it by the modulus q to get C; Step 3: Shift the product C right again by 16 bits to get the high 16 bits C h , use A h Minus C h get r; Step 4: Compare r and q. If r>q, the final result is rq, otherwise the final result is r.

2. The polynomial multiplication hardware implementation system suitable for lattice cryptographic algorithm as claimed in claim 1, characterized in that: The number-theoretic transformation unit is used to perform number-theoretic transformation operations and inverse number-theoretic transformation operations.

Images