Polynomial hardware multiplier based on Saber key encapsulation and its use method

Abstract

The present invention provides a polynomial hardware multiplier based on Saber key encapsulation and a method for using the same, wherein the polynomial hardware multiplier includes an addressing circuit, a public polynomial data loading module, a coefficient multiplication accumulation circuit and a control module; the control module controls the overall state trend and provides the addressing circuit with address indexes of two multipliers. The first storage unit outputs 64-bit data, and a continuous 2-way coefficient stream can be stably obtained through the public polynomial data loading module. At the same time, the 2-way coefficient stream of the secret polynomial can be directly read out from the second storage unit according to the address, and the lower 3-bit absolute value of the 2-way secret polynomial and 13-bit 0 form a 19-bit Com_s signal. The above three-way signals enter the coefficient multiplication accumulation circuit for operation. The present invention avoids the cycle of frequently reading and writing the accumulation result, and does not need to suspend the polynomial multiplier, thereby shortening the operation time while keeping the hardware resource consumption basically unchanged and the same low power consumption.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security encryption, and in particular relates to a polynomial hardware multiplier based on Saber key encapsulation and a use method thereof. Background Art

[0002] After the emergence of Shor's quantum algorithm, traditional public key encryption schemes such as RSA (asymmetric encryption) and ECC (elliptic curve encryption) have been greatly threatened, and there is a possibility that they can be cracked by quantum computers in polynomial time. There are three key encapsulation schemes based on lattices, and the Saber key encapsulation scheme is one of them. The security of Saber is based on module learning with rounding (Module-Learning with Rounding, M-LWR), which is obtained by transforming the public key encryption primitive through FO. In Saber, since the modulus is a power of 2, the rounding method can be used to transform the modulus domain to introduce random errors, thereby reducing the size of the ciphertext and public key, which will bring advantages to lightweight hardware implementation.

[0003] In specific implementation, without optimization, whether it is a software platform or a hardware platform, polynomial multiplication occupies the most resources and computing time in Saber. However, because the modulus is not a prime number, the current fast number theoretic transform (The Number of Transform, NTT) cannot be used for Saber's hardware implementation. Researchers have turned to the Toom-Cook k-way and Karatsuba algorithms to speed up the operation of polynomial multiplication. The core idea of ​​this algorithm is to reduce the number of multiplications. For example, in 2020, Yihong Zhu et al. proposed using an 8-level iterative Karatsuba polynomial multiplication structure to reduce the 65536 coefficient multiplications by 90%, greatly reducing the overall computing time. Similar "divide and conquer" algorithms use addition and subtraction in hardware implementation to replace multiplication, which can reduce the number of cycles, but will require more pre-processing and post-processing steps, and therefore consume more hardware resources. Even the requirements of a single multiplier exceed the available resources of the hardware platform, which is not suitable for lightweight implementation on resource-constrained platforms.

[0004] The focus of lightweight hardware implementation is to use as few resources as possible and achieve a reasonably fast implementation speed. How to efficiently implement lightweight multipliers has become of great significance. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a polynomial hardware multiplier based on Saber key encapsulation, comprising an addressing circuit, a public polynomial data loading module, a coefficient multiplication and accumulation circuit and a control module;

[0006] The addressing circuit includes a first storage unit and a second storage unit; the first output end of the control module is electrically connected to the first input end of the first storage unit through a first address line, the second output end is electrically connected to the second input end of the first storage unit through a second address line, and the third output end is electrically connected to the input end of the second storage unit through a third address line;

[0007] The public polynomial data loading module includes a buffer control unit, a first register, a second register, a third register, a three-selection selector, a first delay register and a second delay register; the input end of the buffer control unit is electrically connected to the output end of the second storage unit, the first output end is electrically connected to the input end of the first register, the second output end is electrically connected to the input end of the second register, the third output end is electrically connected to the input end of the third register, and the fourth output end is electrically connected to the control end of the three-selection selector; the output end of the first register is electrically connected to the first input end of the three-selection selector; the output end of the second register is electrically connected to the second input end of the three-selection selector; the output end of the third register is electrically connected to the third input end of the three-selection selector; the output end of the three-selection selector is electrically connected to the input end of the first delay register; the output end of the first delay register is electrically connected to the input end of the second delay register;

[0008] The coefficient multiplication and accumulation circuit includes a first DSP and a second DSP; the first input end of the first DSP is electrically connected to the output end of the second delay register, and the output end is electrically connected to the input end of the first inverter, the first input end of the first two-selector, the input end of the second inverter, and the first input end of the second two-selector; the output end of the first inverter is electrically connected to the second input end of the first two-selector; the output end of the second inverter is electrically connected to the second input end of the second two-selector; the output end of the first two-selector is electrically connected to the input end of the first accumulation register; the output end of the second two-selector is electrically connected to the input end of the second accumulation register; the second input end of the first DSP is electrically connected to the first output end and the second output end of the first storage unit;

[0009] The first input end of the second DSP is electrically connected to the output end of the three-selector, the second input end is electrically connected to the first output end and the second output end of the first storage unit, and the output end is electrically connected to the input end of the third inverter, the first input end of the third two-selector, the input end of the fourth inverter and the first input end of the fourth two-selector; the output end of the third inverter is electrically connected to the second input end of the third two-selector; the output end of the fourth inverter is electrically connected to the second input end of the fourth two-selector; the output end of the third two-selector is electrically connected to the input end of the third accumulator register; the output end of the fourth two-selector is electrically connected to the input end of the fourth accumulator register;

[0010] The fourth output terminal, the fifth output terminal, the sixth output terminal and the seventh output terminal of the control module are respectively electrically connected to the control terminal of the first two-to-one selector, the control terminal of the second two-to-one selector, the control terminal of the third two-to-one selector and the control terminal of the fourth two-to-one selector.

[0011] In a second aspect, the present invention provides a method for using a polynomial hardware multiplier based on Saber key encapsulation, the method being applied to the polynomial hardware multiplier described in the first aspect, comprising:

[0012] When performing matrix-vector multiplication, the public polynomial data loading module is in the ring domain In the first cycle of the polynomial hardware multiplier, the lower 52 bits of the 64-bit first register are loaded with [51:0] of the address 0 data in the second storage unit, that is, the polynomial coefficients a3, a2, a1, a0, and the polynomial coefficient a0 is read by the three-to-one selector. The second register [11:0] is loaded with [63:52] of the address 0 data in the second storage unit, that is, the lower 12 bits of the polynomial coefficient a4. The complete polynomial coefficients will be synthesized when the data of the next address arrives;

[0013] In the next three cycles, the 64-bit first register outputs the polynomial coefficients a1, a2 and a3 in sequence; in the next cycle, the highest bit of the third register loads the last bit of the address 1 data to form the polynomial coefficient a4 and outputs it, and the third register [10:0] loads [63:53] of the address 1 data, that is, the lower 11 bits of the polynomial coefficient a9; the first register reads [52:1] of the address 1 data one cycle later, that is, the polynomial coefficients a8, a7, a6 and a5, and outputs the coefficients; the three-selection selector controls the first register, the second register and the third register to output the coefficients in sequence and continuously; the first delay register and the second delay register are used to delay the coefficient stream for two cycles, and the coefficient streams a[j] and a[(j+2)mod 256] enter the coefficient multiplication and accumulation circuit at the same time; the alternating read data state is updated every 13 addresses, and is updated 4 times in a single polynomial multiplication, that is, 52 addresses;

[0014] When performing vector inner product multiplication, the public polynomial data loading module is in the ring domain In the coefficient multiplication and accumulation circuit, only the 64-bit first register, the first delay register and the second delay register are enabled; in the coefficient multiplication and accumulation circuit, after the addressing circuit coefficient stream is ready, the first DSP and the second DSP respectively perform 19-bit × 13-bit multiplication, which is equivalent to two coefficient multiplications; the multiplication result of the first DSP and the second DSP will be generated in the next cycle, and the lower 16 bits and the upper 16 bits are taken after the modular reduction operation, and under the control signal of the control module, the first two-selection selector, the second two-selection selector, the third two-selection selector and the fourth two-selection selector are selected to be connected with the first accumulation register, the second accumulation register, ... first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the The third accumulator register and the fourth accumulator register perform modular addition or modular subtraction; after 256 cycles, 4 consecutive coefficients of the product polynomial are obtained and written into the first storage unit and the second storage unit. After a total of 16384 cycles, the 256-order polynomial multiplication is completed; wherein the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register read the coefficients of the corresponding previous polynomial multiplication results in the first storage unit and the second storage unit every 256 cycles, which is equivalent to initializing the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register.

[0015] The present invention provides a polynomial hardware multiplier based on Saber key encapsulation and a method for using the same, wherein the polynomial hardware multiplier includes an addressing circuit, a public polynomial data loading module, a coefficient multiplication accumulation circuit and a control module; the control module controls the overall state trend, and provides the addressing circuit with two multiplier address indexes according to the double-layer loop control logic of the schoolbook polynomial multiplication algorithm for Saber. The first storage unit outputs 64-bit data, and a continuous 2-way 13-bit coefficient stream can be stably obtained through the public polynomial data loading module. At the same time, the 2-way 4-bit coefficient stream of the secret polynomial can be directly read out from the second storage unit according to the address, and the lower 3-bit absolute value of the 2-way secret polynomial and 13-bit 0 form a 19-bit Com_s signal, and the above three-way signal enters the coefficient multiplication accumulation circuit for operation. The present invention adopts the above device to avoid the cycle of frequently reading and writing the accumulation result, and does not need to suspend the polynomial multiplier, and shortens the operation time while keeping the hardware resource consumption basically unchanged and the same low power consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A circuit structure diagram of a polynomial hardware multiplier based on Saber key encapsulation provided in an embodiment of the present invention;

[0018] Figure 2 The public polynomial a(x) provided in the embodiment of the present invention is in the ring domain A schematic diagram of a device stored in a storage unit during operation;

[0019] Figure 3 A schematic diagram of the parallel schoolbook algorithm optimized for Saber provided in an embodiment of the present invention;

[0020] Figure 4 A circuit structure diagram of a common polynomial data loading module provided in an embodiment of the present invention;

[0021] Figure 5 This is the schematic diagram of the traditional schoolbook algorithm;

[0022] Figure 6 A schematic diagram of the ring polynomial operation rules of the schoolbook provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The embodiment of the present invention is directed to a lightweight schoolbook polynomial hardware multiplier for a Saber key encapsulation scheme, such as Figure 1 The figure shows the overall architecture of the lightweight parallel schoolbook polynomial multiplication circuit design.

[0025] When a single polynomial multiplication starts, the control module will first determine whether the current polynomial multiplier is performing matrix-vector multiplication or vector inner product multiplication. Different modes will use different measurements. The control module follows Figure 3 The algorithm line3-line6 in generates the address index and provides it to the addressing circuit, which is connected to the two RAMs for data reading.

[0026] The embodiment of the present invention partially provides a polynomial hardware multiplier based on Saber key encapsulation, including an addressing circuit, a public polynomial data loading module, a coefficient multiplication and accumulation circuit and a control module; wherein the control module is composed of a state machine.

[0027] The addressing circuit includes a first storage unit RAM_S and a second storage unit RAM_A; the first output end of the control module is electrically connected to the first input end of the first storage unit RAM_S through the first address line 8-bit s0_addr, the second output end is electrically connected to the second input end of the first storage unit RAM_S through the second address line 8-bit s1_addr, and the third output end is electrically connected to the input end of the second storage unit through the third address line 7-bit a(x)_addr. The address line is used to obtain data of the corresponding address.

[0028] The public polynomial data loading module includes a buffer control unit, a 64-bit first register buffer0, a 13-bit second register buffer1, a 13-bit third register buffer2, a three-selection selector, a 13-bit first delay register and a 13-bit second delay register, wherein the buffer control unit is composed of a state machine. The input end of the buffer control unit is electrically connected to the output end of the second storage unit RAM_A, the first output end is electrically connected to the input end of the first register buffer0, the second output end is electrically connected to the input end of the second register buffer1, the third output end is electrically connected to the input end of the third register buffer2, and the fourth output end is electrically connected to the control end of the three-selection selector; the output end of the first register buffer0 is electrically connected to the first input end of the three-selection selector; the output end of the second register buffer1 is electrically connected to the second input end of the three-selection selector; the output end of the third register buffer2 is electrically connected to the third input end of the three-selection selector; the output end of the three-selection selector is electrically connected to the input end of the first delay register; the output end of the first delay register is electrically connected to the input end of the second delay register.

[0029] The coefficient multiplication and accumulation circuit includes a first DSP and a second DSP, wherein the first DSP and the second DSP are both DSP48E1; the first input end of the first DSP is electrically connected to the output end of the second delay register, and the output end is electrically connected to the input end of the first inverter M1, the first input end of the first two-to-one selector G1, the input end of the second inverter M2 and the first input end of the second two-to-one selector G2; the output end of the first inverter M1 is electrically connected to the second input end of the first two-to-one selector G1; the output end of the second inverter M2 is electrically connected to the second input end of the second two-to-one selector G2; the output end of the first two-to-one selector G1 is electrically connected to the input end of the first accumulation register acc1; the output end of the second two-to-one selector G2 is electrically connected to the input end of the second accumulation register acc2; the second input end of the first DSP is electrically connected to the first output end and the second output end of the first storage unit RAM_S.

[0030] The first input terminal of the second DSP is electrically connected to the output terminal of the three-to-one selector, the second input terminal is electrically connected to the first output terminal and the second output terminal of the first storage unit RAM_S, and the output terminal is electrically connected to the input terminal of the third inverter M3, the first input terminal of the third two-to-one selector G3, the input terminal of the fourth inverter M4 and the first input terminal of the fourth two-to-one selector G4; the output terminal of the third inverter M3 is electrically connected to the second input terminal of the third two-to-one selector G3; the output terminal of the fourth inverter M4 is electrically connected to the second input terminal of the fourth two-to-one selector G4; the output terminal of the third two-to-one selector G3 is electrically connected to the input terminal of the third accumulator register acc3; the output terminal of the fourth two-to-one selector G4 is electrically connected to the input terminal of the fourth accumulator register acc4.

[0031] The fourth output terminal, the fifth output terminal, the sixth output terminal and the seventh output terminal of the control module are electrically connected to the control terminal of the first two-to-one selector, the control terminal of the second two-to-one selector, the control terminal of the third two-to-one selector and the control terminal of the fourth two-to-one selector through output lines Sign1⊕b0[3], Sign2⊕b1[3], Sign3⊕b0[3] and Sign4⊕b1[3] respectively.

[0032] The embodiment of the present invention also provides a method for using a polynomial hardware multiplier based on Saber key encapsulation, including: when performing matrix-vector multiplication, a public polynomial data loading module is in a ring domain In the first cycle of the polynomial hardware multiplier, the lower 52 bits of the 64-bit first register are loaded with [51:0] of the data at address 0 in the second storage unit, that is, the polynomial coefficients a3, a2, a1, a0. The polynomial coefficient a0 is read by the three-to-one selector, and the second register [11:0] is loaded with [63:52] of the data at address 0 in the second storage unit, that is, the lower 12 bits of the polynomial coefficient a4. The complete polynomial coefficients will be synthesized when the data of the next address arrives.

[0033] In the next three cycles, the 64-bit first register outputs the polynomial coefficients a1, a2 and a3 in sequence; in the next cycle, the highest bit of the third register loads the last bit of the address 1 data to form the polynomial coefficient a4 and outputs it, and the third register [10:0] loads [63:53] of the address 1 data, that is, the lower 11 bits of the polynomial coefficient a9; the first register reads [52:1] of the address 1 data one cycle later, that is, the polynomial coefficients a8, a7, a6 and a5, and outputs the coefficients; the three-to-one selector controls the first register, the second register and the third register to output the coefficients in sequence and continuously; the first delay register and the second delay register are used to delay the coefficient stream for two cycles, and the coefficient streams a[j] and a[(j+2)mod 256] enter the coefficient multiplication and accumulation circuit at the same time; the alternating read data state is updated every 13 addresses, and is updated 4 times in a single polynomial multiplication, that is, 52 addresses.

[0034] When performing vector inner product multiplication, the public polynomial data loading module is in the ring domain In the coefficient multiplication and accumulation circuit, only the 64-bit first register, the first delay register and the second delay register are enabled; in the coefficient multiplication and accumulation circuit, after the addressing circuit coefficient stream is ready, the first DSP and the second DSP respectively perform 19-bit × 13-bit multiplication, which is equivalent to two coefficient multiplications; the multiplication result of the first DSP and the second DSP will be generated in the next cycle, and the lower 16 bits and the upper 16 bits are taken after the modular reduction operation, and under the control signal of the control module, the first two-selection selector, the second two-selection selector, the third two-selection selector and the fourth two-selection selector are selected to be connected with the first accumulation register, the second accumulation register, ... first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the The third accumulator register and the fourth accumulator register perform modular addition or modular subtraction; after 256 cycles, 4 consecutive coefficients of the product polynomial are obtained and written into the first storage unit and the second storage unit. After a total of 16384 cycles, the 256-order polynomial multiplication is completed; wherein the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register read the coefficients of the corresponding previous polynomial multiplication results in the first storage unit and the second storage unit every 256 cycles, which is equivalent to initializing the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register.

[0035] In Saber, when performing matrix-vector multiplication, the control module generates an address index and provides it to the addressing circuit. The coefficient of the common polynomial is 13 bits, and the output expansion function SHAKE-128 of the common polynomial is generated. Each round of "squeezing" output process will write a 1344-bit byte string into the RAM in the form of a 64-bit bit stream. The reason for using a 64-bit bit width for output is that it can reduce the consumption of data alignment. However, the 13-bit coefficient in the storage unit RAM with a bit width of 64 bits will have the phenomenon of cross-address storage. For example Figure 2 As shown in the figure, a specific coefficient will be divided by the address in such a storage method. For example, the upper 12 bits of address 0 belong to the lower 12 bits of coefficient a4, and the remaining highest 1 bit of a4 is the lowest 1 bit of address 1; the upper 11 bits of address 1 belong to the lower 11 bits of coefficient a9, and the remaining 2 bits of a9 are the lowest 2 bits of address 2; the upper 2 bits of address 10 belong to the lower 2 bits of a54, and the remaining 10 bits of a54 are the lower 10 bits of address 11, and so on. This situation will be repeated every 13 addresses, and the 52 addresses occupied by a polynomial will be repeated 4 times. Therefore, when it is necessary to read the coefficients of a public polynomial in a 64-bit RAM sequentially and continuously, it becomes a challenge to carefully design a reading strategy to avoid the situation where the coefficients are divided. The traditional solution that can be directly thought of is to directly use a 13×64=832-bit buffer to read the data of the first storage unit RAM_A, but it consumes a large number of registers and has a large cycle overhead waiting for the 832-bit buffer to be fully read.

[0036] This design is designed based on the storage method of public polynomials in RAM. Figure 4 The data loading module shown, in which the lower 52 bits of the 64-bit first register buffer0 are used to load the complete continuous 4 coefficients in each address, and output them sequentially. The second register buffer1 and the third register buffer2 alternately load part of the high bits and part of the low bits in the address data. For example, the second register buffer1 will give priority to reading the upper 12 bits of address 0, and wait for the remaining 1 bit to form a4 and then output it one cycle after a3. The third register buffer2 will give priority to reading the upper 11 bits of address 1, and wait for the remaining 2 bits to form a9 and then output it after a8. The above alternating reading control logic is composed of the counter and state machine in the buffer control unit. When a complete coefficient is synthesized, the three-selection selector will select one of the first register buffer0, the second register buffer1 and the third register buffer2 for reading. The remaining two registers are used to delay the coefficient stream a[j] by two cycles to generate a[(j+2)mod n]. After these two data are ready, they will enter the coefficient multiplication and accumulation circuit at the same time. a[j] is Figure 3 The coefficient stream required by the third line of the algorithm is updated once every cycle, and is controlled by the inner loop index j to determine whether a certain common polynomial coefficient participates in the multiplication in each cycle.

[0037] Another case of Saber, when performing vector inner product polynomial multiplication, The coefficients of the public polynomial are 16 bits, and the highest 6 bits are supplemented with 0 to facilitate subsequent data alignment. In this way, the coefficients are stored in RAM without crossing addresses. Therefore, it can be simply read into the first register buffer0, and only the first delay register and the second delay register after the three-select selector are called for continuous output. The public polynomial and the secret polynomial in the multiplication are further constrained to In this case, the coefficients of the polynomial are all 10 bits. If they are directly stored in a 64-bit wide RAM, they will also be truncated. Therefore, 0s can be added to the high bits to make it 16 bits, so that it will not be truncated by the RAM. This operation is not implemented in the multiplier and consumes almost no computing resources.

[0038] In the above two cases, the coefficients of the secret polynomial s(x) are all 4 bits, and the data of the first storage unit RAM_S can be directly read according to the address index in the algorithm. When the coefficient streams Coeff_a0, Coeff_a1 and Com_s are ready, the first DSP and the second DSP called start to perform 4 coefficient multiplications. Take the upper 16 bits and lower 16 bits of the first DSP and the second DSP as temporary results for modular operation to obtain temp1-temp4, and perform modular addition or modular subtraction operations with the first accumulator register acc1, the second accumulator register acc2, the third accumulator register acc3 and the fourth accumulator register acc4 under the control of Sign⊕b[3], as shown in Figure 1 As shown. Both the public polynomial and the secret polynomial are generated by a function called SHAKE-128 that can generate infinite random coefficients. However, when these two polynomials are generated, the input of the function, also called the seed, is different. The secret polynomial needs to be kept confidential, so it is called a secret polynomial.

[0039] The present invention compares the efficient parallel schoolbook algorithm schematic diagram for Saber and the traditional schoolbook algorithm schematic diagram, such as Figure 3 and Figure 5 As shown. The traditional schoolbook polynomial multiplication is to perform convolution operation on two polynomial multipliers. First, initialize the accumulator register acc. When the inner variable j is incremented by one, multiply a multiplier coefficient a[j] and each multiplicand polynomial b[i] traverse and multiply. At the same time, because in the ring domain R q In the calculation, the polynomial b(x) needs to be multiplied by x in the outer loop to transform the order. Every time the outer loop ends, we get Figure 6 The result in the bold box is shown in the figure. However, in a lightweight implementation, the size of the accumulator register is limited by the resource size, so the accumulated value needs to be frequently written / read to / from the storage unit when performing multiplication. Figure 5 The algorithm in is different. The optimized schoolbook algorithm for Saber changes the order of reading a(x) and s(x). The reading strategy of a[j], a[(j+2)mod n] and s[(ij)mod n], s[(i-j+1)mod n] can fix the continuous accumulation registers and avoid frequent reading and writing of accumulation values ​​like traditional schoolbook polynomial multiplication, which can save unnecessary cycles. After the outer loop is completed, 4 consecutive result coefficients can be obtained, such as Figure 6 As shown in the thin box in the middle, this is equivalent to performing a small convolution operation. After 16384 cycles, a complete polynomial multiplication operation is completed.

[0040] It should be emphasized that this example optimizes the polynomial multiplier separately, and the RAM resources can be attributed to the overall resource requirements for reuse. This embodiment uses Vivado 2018.3 to build the above hardware structure on Artix-7 FPGA, and selects q=2 13 , n=256. The final overall frequency reaches 130Mhz, requiring 16384 clock cycles. It consumes 561 LUT area resources, 302 FFs and 2 DSP48E1. Compared with the existing lightweight polynomial multiplier technology for Saber, this embodiment can provide faster operation speed with almost equivalent hardware resources, save 3087 cycles, and increase the frequency.

[0041] In this specification, the same or similar parts between the various embodiments can be referred to each other. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0042] The present invention has been described in detail above in conjunction with specific implementations and exemplary examples, but these descriptions cannot be understood as limiting the present invention. Those skilled in the art understand that, without departing from the spirit and scope of the present invention, a variety of equivalent substitutions, modifications or improvements may be made to the technical solution of the present invention and its implementation methods, all of which fall within the scope of the present invention. The scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A polynomial hardware multiplier based on Saber key encapsulation, characterized in that: It includes an addressing circuit, a common polynomial data loading module, a coefficient multiplication and accumulation circuit and a control module; The addressing circuit includes a first storage unit and a second storage unit; the first output end of the control module is electrically connected to the first input end of the first storage unit through a first address line, the second output end is electrically connected to the second input end of the first storage unit through a second address line, and the third output end is electrically connected to the input end of the second storage unit through a third address line; The public polynomial data loading module includes a buffer control unit, a first register, a second register, a third register, a three-selection selector, a first delay register and a second delay register; the input end of the buffer control unit is electrically connected to the output end of the second storage unit, the first output end is electrically connected to the input end of the first register, the second output end is electrically connected to the input end of the second register, the third output end is electrically connected to the input end of the third register, and the fourth output end is electrically connected to the control end of the three-selection selector; the output end of the first register is electrically connected to the first input end of the three-selection selector; the output end of the second register is electrically connected to the second input end of the three-selection selector; the output end of the third register is electrically connected to the third input end of the three-selection selector; the output end of the three-selection selector is electrically connected to the input end of the first delay register; the output end of the first delay register is electrically connected to the input end of the second delay register; The coefficient multiplication and accumulation circuit includes a first DSP and a second DSP; the first input end of the first DSP is electrically connected to the output end of the second delay register, and the output end is electrically connected to the input end of the first inverter, the first input end of the first two-selector, the input end of the second inverter, and the first input end of the second two-selector; the output end of the first inverter is electrically connected to the second input end of the first two-selector; the output end of the second inverter is electrically connected to the second input end of the second two-selector; the output end of the first two-selector is electrically connected to the input end of the first accumulation register; the output end of the second two-selector is electrically connected to the input end of the second accumulation register; the second input end of the first DSP is electrically connected to the first output end and the second output end of the first storage unit; The first input end of the second DSP is electrically connected to the output end of the three-selector, the second input end is electrically connected to the first output end and the second output end of the first storage unit, and the output end is electrically connected to the input end of the third inverter, the first input end of the third two-selector, the input end of the fourth inverter and the first input end of the fourth two-selector; the output end of the third inverter is electrically connected to the second input end of the third two-selector; the output end of the fourth inverter is electrically connected to the second input end of the fourth two-selector; the output end of the third two-selector is electrically connected to the input end of the third accumulator register; the output end of the fourth two-selector is electrically connected to the input end of the fourth accumulator register; The fourth output terminal, the fifth output terminal, the sixth output terminal and the seventh output terminal of the control module are respectively electrically connected to the control terminal of the first two-to-one selector, the control terminal of the second two-to-one selector, the control terminal of the third two-to-one selector and the control terminal of the fourth two-to-one selector.

2. A method for using a polynomial hardware multiplier based on Saber key encapsulation, characterized in that: The method of use is applied to the polynomial hardware multiplier according to claim 1, comprising: When performing matrix-vector multiplication, the public polynomial data loading module is in the ring domain In the first cycle of the polynomial hardware multiplier, the lower 52 bits of the 64-bit first register are loaded with [51:0] of the address 0 data in the second storage unit, that is, the polynomial coefficients a3, a2, a1, a0, and the polynomial coefficient a0 is read by the three-to-one selector. The second register [11:0] is loaded with [63:52] of the address 0 data in the second storage unit, that is, the lower 12 bits of the polynomial coefficient a4. The complete polynomial coefficients will be synthesized when the data of the next address arrives; In the next three cycles, the 64-bit first register outputs the polynomial coefficients a1, a2 and a3 in sequence; in the next cycle, the highest bit of the third register loads the last bit of the address 1 data to form the polynomial coefficient a4 and outputs it, and the third register [10:0] loads [63:53] of the address 1 data, that is, the lower 11 bits of the polynomial coefficient a9; the first register reads [52:1] of the address 1 data one cycle later, that is, the polynomial coefficients a8, a7, a6 and a5, and outputs the coefficients; the three-selection selector controls the first register, the second register and the third register to output the coefficients in sequence and continuously; the first delay register and the second delay register are used to delay the coefficient stream for two cycles, and the coefficient streams a[j] and a[(j+2)mod 256] enter the coefficient multiplication and accumulation circuit at the same time; the alternating read data state is updated every 13 addresses, and is updated 4 times in a single polynomial multiplication, that is, 52 addresses; When performing vector inner product multiplication, the public polynomial data loading module is in the ring domain In the coefficient multiplication and accumulation circuit, only the 64-bit first register, the first delay register and the second delay register are enabled; in the coefficient multiplication and accumulation circuit, after the addressing circuit coefficient stream is ready, the first DSP and the second DSP respectively perform 19-bit × 13-bit multiplication, which is equivalent to two coefficient multiplications; the multiplication result of the first DSP and the second DSP will be generated in the next cycle, and the lower 16 bits and the upper 16 bits are taken after the modular reduction operation, and under the control signal of the control module, the first two-selection selector, the second two-selection selector, the third two-selection selector and the fourth two-selection selector are selected to be connected with the first accumulation register, the second accumulation register, ... first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the second accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the first accumulation register, the The third accumulator register and the fourth accumulator register perform modular addition or modular subtraction; after 256 cycles, 4 consecutive coefficients of the product polynomial are obtained and written into the first storage unit and the second storage unit. After a total of 16384 cycles, the 256-order polynomial multiplication is completed; wherein the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register read the coefficients of the corresponding previous polynomial multiplication results in the first storage unit and the second storage unit every 256 cycles, which is equivalent to initializing the first accumulator register, the second accumulator register, the third accumulator register and the fourth accumulator register.

Images