Pure hardware implementation structure of lattice key encapsulation algorithm OSKR based on FPGA

Abstract

The application belongs to the technical field of cyberspace security, and particularly relates to a lattice key encapsulation algorithm OSKR pure hardware implementation structure based on FPGA. The application is only directed to a group of parameters with a polynomial dimension n of 512, and includes: a polynomial operation module, which can realize forward NTT operation, inverse NTT operation, point multiplication operation, compression and decompression operation and Con / Rec operation of a polynomial; a polynomial sampling module, which can realize center binomial sampling to generate a noise polynomial r i / e i , realize rejection sampling to generate a public key polynomial A ij ; a hash module, which can realize various SHA3 instances; a coding and decoding module, which can realize conversion operation of data bit width transmission between modules; and a top control module, which realizes control operation of running flow of each module through a state machine, so as to realize key encapsulation of the OSKR algorithm. The application can realize complete and efficient key encapsulation operation.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cyberspace security, and particularly relates to a lattice key encapsulation algorithm OSKR based on an FPGA platform. BACKGROUND

[0002] The design of public key cryptosystems is mostly based on three types of mathematical problems: large integer factorization problem (RSA), discrete logarithm problem (ELGamal) and discrete logarithm problem on elliptic curve (ECDSA). However, with the emergence and development of quantum computing technology, researchers have designed effective quantum algorithms represented by Shor algorithm to attack mathematical problems such as large integer factorization, discrete logarithm and discrete logarithm on elliptic curve, which will fundamentally shake the foundation of the existing public key cryptosystem and bring great challenges and threats to cyberspace security. Therefore, exploring and designing a cryptography scheme that can resist quantum algorithm attacks has become an important research direction in the field of information security. In order to resist the threat of the rapid development of quantum computing technology to traditional public key cryptosystem, post-quantum cryptography (PQC) technology has been widely studied. Among them, lattice cryptography scheme has become one of the important research directions in the field of PQC due to its good provable security characteristics. OSKR [1] is a lattice key encapsulation algorithm based on key consensus architecture [2,3] , hybrid number round transformation technology (HNTT) [4] and extended session key [5] proposed by China. The algorithm first constructs an encryption scheme that meets the chosen plaintext attack (CPA), and then obtains a key encapsulation (KEM) scheme that meets the chosen ciphertext attack (CCA) through FO conversion. Compared with the key encapsulation algorithm Kyber given by NIST, the OSKR algorithm can achieve relatively higher running efficiency and lower error rate based on the asymmetric key consensus mechanism (AKCN), and further improves the security of the algorithm by extending the bit width of the shared key from 256 bits to 512 bits through a new parameter set. OSKR is a winning algorithm of China's cryptography competition, which has important significance for China to cope with the challenges of quantum technology and maintain cyberspace security. How to efficiently implement complete PQC algorithms is one of the key research topics in the field of post-quantum cryptography, and implementing PQC cryptographic algorithms based on hardware development platforms such as FPGA is an important direction. At present, there is no complete hardware implementation of the OSKR algorithm, so it is necessary to study this problem.

[0003] REFERENCES

[0004] [1] Shen S, He F, Liang Z, et al. OSKR / OKAI: Systematic Optimization of Key Encapsulation Mechanisms from Module Lattice [J]. arXiv preprint arXiv:2109.02893, 2021.

[0005] [2] Jin Z, Zhao Y. Optimal key consensus in presence of noise [J]. arXiv preprint arXiv:1611.06150, 2016.

[0006] [3] Jin Z, Zhao Y. Optimal key consensus in presence of noise [J]. arXiv preprint arXiv:1611.06150, 2016.

[0007] [4] Liang Z, Shen S, Shi Y, et al. Number theoretic transform: generalization, optimization, concrete analysis and applications [C] / / International Conference on Information Security and Cryptology. Springer, Cham, 2020: 415-432.

[0008] [5] Wang Y, Shen S, Zhao Y L, et al. Comparative analysis and optimization of key encapsulation schemes based on module lattice [J]. Computer Research and Development, 2020, 57(10): 2086-2103. SUMMARY

[0009] The application aims to provide a pure hardware implementation structure of the lattice key encapsulation algorithm OSKR based on an FPGA platform, which can be used to implement this group of parameters with a polynomial dimension N of 512.

[0010] The pure hardware implementation structure of the lattice key encapsulation algorithm OSKR based on the FPGA platform comprises a polynomial operation module, a polynomial sampling module, a hash module, a coding and decoding module and a top control module.

[0011] The polynomial operation module can realize forward NTT operation, inverse NTT operation, point multiplication operation, compression and decompression operation, Con / Rec operation of a polynomial.

[0012] The polynomial sampling module can realize center binomial sampling to generate a noise polynomial vector r i / e i The rejection sampling is realized to generate a public key polynomial matrix A ij ;

[0013] The hash module can realize various SHA3 instances, including SHAKE256 function for sampling noise polynomial, SHAKE128 function for sampling public key polynomial, and SHA3-512 function for generating a shared secret key K.

[0014] The encoding and decoding module can realize conversion operation of data bit width between modules.

[0015] The top control module realizes control operation of running flow of each module through a state machine, and can be used for realizing the OSKR algorithm with polynomial dimension N being 512 and this group of parameters, and can also realize key generation and key unsealing operation by adjusting the top module.

[0016] The polynomial operation module has five working modes, and the control signal sel is composed of three bits: the forward NTT operation corresponds to the signal 3'b000, the inverse NTT operation corresponds to the signal 3'b001, the point multiplication operation is divided into four steps, and corresponds to the signals 3'b011, 3'b100, 3'b100 and 3'b000 respectively, the compression operation and the Con operation correspond to the signal 3'b001, and the decompression operation and the Rec operation correspond to the signal 3'b000.

[0017] The polynomial operation module is designed as a four-fold parallel structure, that is, four pairs of operands can be processed in each clock cycle. For the polynomial dimension n being 512 and the modulus q being 3329, one complete NTT operation, inverse NTT operation and point multiplication operation all need 448 clock cycles; one complete compression, decompression, Con operation and Rec operation all need 128 clock cycles.

[0018] In the polynomial module, there are two kinds of storage units: BRAM unit and FIFO unit. The BRAM unit is used to read and store intermediate values of various operations, including four BRAM storage units of RAM0, RAM1, RAM2 and RAM3; the FIFO unit is used to temporarily store coefficients of noise polynomials r i , e i and a public key polynomial A ijcoefficients of the polynomial, and stores the polynomial coefficients stored in the FIFO unit into the BRAM unit according to the control signal to perform the polynomial operation.

[0019] The polynomial sampling module includes two functions: (1) a central binomial sampling for generating a noise polynomial vector r i , e i The bit width of the hash result input by the module is 32 bits, and 8 polynomial coefficients can be generated in each clock cycle; (2) a rejection sampling for generating a public key polynomial matrix A ij The bit width of the hash result input by the module is 32 bits, and 2 polynomial coefficients can be generated in each clock cycle.

[0020] The hash module is a special hash module designed for the OSKR algorithm, and can implement multiple SHA3 instances, including SHAKE256 function, SHAKE128 function and SHA3-512 function for generating a shared key K, and the control signal thereof is composed of four bits: the fourth bit is used to determine whether the hash operation needs to be run multiple times, which is suitable for implementing the hash operation in the case of hash ciphertext and sampling polynomial matrix A; the remaining three bits of the control signal are used to determine the hash instance.

[0021] The hash module supports SHA3-512 function, SHAKE256 function and SHAKE128 function, and each is composed of five round functions and control logic.

[0022] The encoding module of the coding and decoding module is used for converting the output data of the polynomial operation module into a unified 32-bit bit width, and then sending it into the hash module for the next operation; the decoding module converts the 32-bit bit width data input from the outside into corresponding bit width data according to parameters d u and d v , and then sends it into the polynomial operation module for the next operation.

[0023] The top-level control module includes control execution as follows:

[0024] (1) running the hash module, executing SHA3-512 function and SHAKE256 function in sequence to generate a 512-bit temporary key K and a 512-bit random number r i ;

[0025] (2) running the hash module, executing SHAKE256 function to output 2048-bit data, and running the sampling module to generate a 512-dimensional noise polynomial r i ;

[0026] (3) running the polynomial operation module, and performing polynomial operation on the noise polynomial r iPerforming NTT operation;

[0027] (4) Running the hash module to perform the SHAKE128 function to output 6144-bit data, and running the sampling module to generate a 512-dimensional public key polynomial A ij ;

[0028] (5) Running the polynomial operation module to complete the polynomial point multiplication operation NTT(r i )*A ij ;

[0029] (6) Repeating state (2) to state (5) to complete the multiplication operation of the public key polynomial matrix A ij and the polynomial vector r i ;

[0030] (7) Running the polynomial operation module to perform the inverse NTT operation and compression operation on the result of state (6)

[0031] (8) Running the encoding module to convert the result of state (7) into 32-bit width and store it in the FIFO unit;

[0032] (9) Running the decoding module to convert the public key pk into a 512-dimensional polynomial vector t i ;

[0033] (10) Running the polynomial operation module to complete the multiplication operation of the public key polynomial vector t i and the polynomial vector r i ;

[0034] (11) Running the polynomial operation module to perform the inverse NTT operation and Con operation on the result of state (10) and store it in the FIFO unit;

[0035] (12) Running the hash module to perform the SHA3-512 function to perform the hash operation on the results of state (8) and state (11) to generate a 512-bit shared key K.

[0036] The beneficial effects of the present application are:

[0037] The present application realizes the key encapsulation process of OSKR based on the FPGA hardware platform, and has high running efficiency compared with the software implementation scheme. The present application divides the entire key encapsulation process into polynomial modules, hash modules, sampling modules, encoding and decoding modules, etc., and controls the running state and data transmission of each module through the state machine, thereby realizing the complete key encapsulation operation, and taking into account the hardware resource consumption and the efficiency of the algorithm. Meanwhile, the present application is aimed at realizing the key encapsulation operation of N=512 parameters, but through corresponding adjustment of the state machine, the operation of the remaining two groups of parameters can be further realized. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 is the top-level hardware architecture diagram of the present application.

[0039] Figure 2 is the structure diagram of HNTT transform.

[0040] Figure 3 is the hardware architecture diagram of the butterfly computing unit of the present application.

[0041] Figure 4 is the timing logic structure diagram of the present application. DETAILED DESCRIPTION

[0042] In order to more clearly set forth the problem solving, technical solutions and beneficial effects of the present application, the present application will be further explained and described below in conjunction with the accompanying drawings and embodiments. Meanwhile, it needs to be made clear that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

[0043] Algorithm 1: OSKR.PKE.Enc

[0044] 1,

[0045] 2,

[0046] 3,

[0047] 4,

[0048] 5,

[0049] 6,

[0050] 7, c2 := Con (σ2, m, params)

[0051] 8, c := (c1 || c2)

[0052] Algorithm 1 is the encryption process of the OSKR algorithm, and after the operation of each step, a ciphertext c of 1728 byte length is generated, and after a hash operation, a shared secret key K of 512 bit length is generated. Among them, Con and Rec are asymmetric key formula algorithms, which are used to generate a shared secret key in the key encapsulation and key decapsulation process. The specific content and proof process of the algorithm has corresponding literature, and the specification part of the present embodiment will not introduce these contents but only focus on the hardware implementation process. Meanwhile, the present embodiment only gives the introduction of the key encapsulation part, and for the key generation algorithm and the key decapsulation algorithm, the same circuit structure is used as the key encapsulation, and only the top-level timing logic needs to be adjusted, so it will not be introduced specially.

[0053] As Figure 1 shown, the top module first requests the noise polynomial vector r i coefficients from the hash module. After receiving the polynomial coefficients, they are first stored in the internal RAM0 unit. Then the data is read from the RAM0 unit, the forward NTT operation is performed, and the processed results continue to be stored in the original location. This process is repeated until the noise polynomial vector is completely transformed by the NTT operation.

[0054] Next, the polynomial operation module requests the row vector coefficients of the public key polynomial matrix A ij and temporarily stores them in the internal RAM2 unit and the RAM3 unit, because the coefficients of A ij are generated in the NTT domain by default, so there is no need to perform NTT transformation on them. Then the noise polynomial coefficients in the NTT domain and the row vector polynomial coefficients of the matrix A ij are read from the RAM0 unit, and the point multiplication operation of the corresponding coefficients is performed, and the calculation results are stored in the RAM1 unit. Finally, the inverse NTT calculation is performed on the results, and the noise polynomial e coefficients are requested, and the polynomial vector u is calculated After obtaining the polynomial vector u, it is compressed and output, and the encoding operation is performed to obtain the ciphertext c1. The same processing process is used to generate v, and the subsequent ciphertext c2 is generated. The ciphertext c=(c1||c2) is 1728 bytes, which is first stored in the FIFO unit, and then the hash module is started to perform the SHA3-512 algorithm to generate a 512-bit shared secret key K.

[0055] The standard NTT transformation requires that the polynomial dimension n and the modulus q strictly satisfy the formula q≡1(mod2n), and the embodiment of the present application requires Figure 3 As shown in the figure, the butterfly transformation circuit structure designed by the present application is more simple, and can realize CT transformation, GS transformation, point multiplication operation, compression and decompression operation, and Con / Rec operation through a 3-bit chip selection signal, maximizing the utilization rate of hardware resources. Among them, the polynomial coefficients, the chip selection signal, and the rotation factor are input, and the working mode of the control module is controlled according to the chip selection signal. Among them, the polynomial coefficients are temporarily stored in the on-chip RAM, and the rotation factor is pre-calculated and pre-stored in the on-chip ROM in the form of fixed parameters. The circuit structure is composed of adders, multipliers, registers, and multiplexers, which support modulus multiplication, modulus addition, and modulus subtraction operations, and are controlled by the chip selection signal and the multiplexer. When the chip selection signal is 3’b000, the circuit structure enables the CT butterfly transformation structure, and at this time the output signal A=a+b·w(mod q), B=a-b·w(mod q); when the chip selection signal is 3’b001, the circuit structure enables the GS butterfly transformation structure, and at this time the output signal A=(a+b) / 2(mod q), B=(a-b)·w / 2(mod q).

[0056] The butterfly computation unit circuit module designed in the embodiment of the present application can realize four times parallel number theory transformation operation, that is, four pairs (total eight) of polynomial coefficient operations can be completed in each clock cycle, thus 64*7=448 clock cycles are consumed for fast number theory transformation of 512-dimensional polynomial. When the chip selection signal is 3'b011, 3'b100, 3'b100 and 3'b000, the circuit structure enables the corresponding point multiplication operation to be completed in four stages, and 4*64=256 clock cycles are consumed for point multiplication operation of two 512-dimensional polynomials. The compression and decompression operation each needs one multiplication operation and one division operation, and thus can also be realized in the butterfly transformation module.

[0057] In the example of the present application, the compress operation of the key encapsulation process corresponds to the chip selection signal 3'b011, and the output result is obtained by bit truncation of the output result quo[11:0], corresponding to the ciphertext information c1; the con operation is used when the ciphertext c2 is generated, and from the hardware implementation aspect, the message m can be added at the same time of the compression operation, also corresponding to the chip selection signal 3'b011. Since the butterfly unit designed in the present application is composed of four multipliers, that is, four operands can be processed in each clock cycle, thus 128 clock cycles are consumed for each compression and decompression operation.

[0058] The operand multiplication 1 / 2 operation in the algorithm, that is, x / 2mod q, does not need to use the multiplier, and can be realized by reasonable shift operation. When the modulus q is a prime number, 1 / 2=(q+1) / 2mod q, and there are two cases: when x is even, x / 2mod q can be realized by right shift one bit (x>>1); when x is odd, wherein, x is right shifted one bit (x>>1); (q+1) / 2 is a constant. Thus, the multiplication operation in x / 2mod q can be converted into shift and addition, that is, x>>1 or x>>1+(q+1) / 2. At the same time, since the modulus reduction operation is needed after the multiplication operation in one way of the butterfly transformation module, this process function will consume 6 clock cycles, thus a shift register needs to be designed for the other way to delay the operation data and chip selection signal for 6 clock cycles, so as to make up for the data difference delay caused by the pipeline design.

[0059] When the point multiplication operation is performed, the hardware implementation method of improved Karatsuba algorithm is designed in the embodiment of the present application, and since two first-order polynomials (a0+a1x) and (b0+b1x) need 5 times of subtraction and 4 times of multiplication, the operation sequence of the above operation is reasonably arranged and combined with the four times parallel butterfly transformation module of the embodiment of the present application, so that two point multiplication operations can be completed in each cycle on average. The specific process includes four steps:

[0060] (1) Calculate (a0+a1)(b0+b1), (a2+a3)(b2+b3), (a4+a5)(b4+b5), (a6+a7)(b6+b7) and store the results in the RAM3 module, and the corresponding control signal is 3'b011;

[0061] (2) Calculate a0*b0, a2*b2, a4*b4, a6*b6 and store the results in the RAM2 module. At the same time, calculate (a0+a1)(b0+b1)-a0*b0, (a2+a3)(b2+b3)-a2*b2, (a4+a5)(b4+b5)-a4*b4, (a6+a7)(b6+b7)-a6*b6 and store the results in the RAM3 module, and the corresponding control signal is 3'b100;

[0062] (3) Calculate a1*b1, a3*b3, a5*b5, a7*b7 and store the results in the RAM2 module. At the same time, calculate (a0+a1)(b0+b1)-a0*b0-a1*b1, (a2+a3)(b2+b3)-a2*b2-a3*b3, (a4+a5)(b4+b5)-a4*b4-a5*b5, (a6+a7)(b6+b7)-a6*b6-a7*b7 and store the results in the RAM3 module, and the corresponding control signal is 3'b100;

[0063] (4) Calculate a0*b0+a1*b1*phi0, a2*b2+a3*b3*phi1, a4*b4+a5*b5*phi2, a6*b6+a7*b7*phi3 and store the results in the RAM1 module, and the corresponding control signal is 3'b000.

[0064] Through the above four steps, the point multiplication operation on two 512-dimensional polynomials can be realized within 256 clock cycles, and the efficiency of the polynomial point multiplication operation is further improved.

[0065] The operands and intermediate values used in the butterfly transformation module need to be saved to the BRAM storage unit. In order to improve the utilization rate of BRAM hardware resources, the storage positions of the operation operands need to be properly arranged. First, the butterfly transformation module designed by the present application is four times parallel, so four pairs of operands need to be input and output every clock cycle, and the total length is 96 bits. The RAM0 unit is divided into four banks, and the width is 24 bits and the depth is 128. The RAM0 unit is responsible for storing the operands during forward NTT operation, including NTT(r ij ) and NTT(u ij ) and the like. Taking the key encapsulation part as an example, since NTT(r ij), the depth of RAM0 needs to be enough to store two complete 512-bit polynomials. Secondly, RAM1 and RAM2 are responsible for storing the output results of the point multiplication operation. During the point multiplication operation, 8 polynomial coefficients are used per clock cycle, four of which come from RAM0 and the other four come from the output results of the sampling module. As described above, steps two and three of the point multiplication operation can obtain odd item results, but the intermediate values need to be stored, so the bank depth of RAM2 and RAM3 units is 64, and the total width is 96 and 48 respectively, which can store 1.5 512-dimensional polynomials in total. The RAM1 unit is responsible for storing the results of the inverse NTT operation, and the total depth of the four banks is 64, and the total width is 96. In addition, it should be noted that in the case of n=512, two point multiplication operations need to be completed in succession and the results are added to the RAM1 unit, and then the inverse NTT operation is performed, and the RAM2 unit and the RAM3 unit can store a maximum of 1.5 512-dimensional polynomials. Therefore, the top-level timing needs to be reasonably arranged, and the results of steps three and four of the first point multiplication operation are stored in the RAM1 unit at the same time, and then the second point multiplication operation can arbitrarily overwrite the data in the RAM2 unit and the RAM3 unit without causing conflicts. The hardware design in this paper uses a read-write-in-place structure, and uses a dual-port BRAM to ensure the throughput requirements of the butterfly operation number. Through appropriate delay processing of the input and output coefficients, the effect of in-place storage is realized while meeting the data bandwidth requirements.

[0066] When generating the public key polynomial matrix A ij and the noise polynomial vector r i , it is necessary to first complete the hash operation to generate a pseudo-random sequence. In the OSKR algorithm, 4 SHA3 instances are used: SHA128 is used to generate the public key polynomial matrix A, and each 24-round Keccak function can output 1344-bit data. In the case of rejecting sampling, at least 6 hash operations are required to generate 6144-bit data; SHA256 is used to generate the noise polynomial vector r i , e i , e, and each 24-round Keccak function can output 1088-bit data. In the case of central binomial sampling, a maximum of 1536-bit data is required, and two complete hash operations can be completed. SHA512 and SHA256 are used to generate the digest of the public key and the ciphertext. Since multiple types of hash operations are designed in the entire key encapsulation process, the application designs a special hash module. The working mode of the hash module is controlled by three signals: absorb corresponds to the absorption process, sequence corresponds to the output process, and mode signal is responsible for determining the padding content after the input data of the round function and determining the SHA3 instance, and judging whether iteration operation is required. The input and output data bit width of the hash module is set to 32 bits, and 24 clock cycles are consumed for 24 iterations. In order to generate the matrix Aij For example, the random bit of the input seed with a length of 512 bits consumes 16 clock cycles, the output of 1344 bits for six times consumes 252 clock cycles, the round function process consumes 144 clock cycles, and the total clock cycles are 442 clock cycles including the delay time of the signal.

[0067] Figure 4 The timing logic of the top module is used to determine the running order and data transmission process of each module. As described above, the number of random bits required by noise sampling is 512*4=2048, and two SHAKE256 operations are required, which consumes 142 clock cycles; the number of bits required by the polynomial in the public key matrix A ij is 512*12=6144 bits, and at least 6 SHAKE128 algorithms are required to meet the demand in the case of rejection sampling, and the entire hash process requires 442 clock cycles. The rejection sampling process and hash operation of the example design of the application are synchronously run, so that about 20 cycles are required after the last hash operation is completed to generate a complete polynomial. The number theory transformation process requires 64*8=448 clock cycles, the point multiplication operation process requires 64*4=256 clock cycles, and the compression process requires 512 / 4=128 clock cycles. According to the above pre-computation, the time consumed by the NTT module is much more than that of the sampling module, and the waiting time between each operation process in the NTT module can be reduced by reasonably adjusting the timing logic of the top module. The top control module is composed of the following states:

[0068] (1) running the hash module, executing SHA3-512 function and SHAKE256 function in sequence to generate a 512-bit temporary secret key K and a 512-bit random number r i ;

[0069] (2) running the hash module, executing SHAKE256 function to output 2048-bit data, and running the sampling module to generate a 512-dimensional noise polynomial r i ;

[0070] (3) running the polynomial operation module, performing NTT operation on the noise polynomial r i ;

[0071] (4) running the hash module to execute SHAKE128 function to output 6144-bit data, and running the sampling module to generate a 512-dimensional public key polynomial A ij ;

[0072] (5) running the polynomial operation module, completing the polynomial point multiplication operation NTT(r i )*A ij ;

[0073] (6) repeat state (2) to state (5), complete the multiplication of the public key polynomial matrix A ij and the polynomial vector r i

[0074] (7) run the polynomial operation module, inverse NTT operation and compression operation are carried out on the result of state (6)

[0075] (8) run the encoding module, the result of state (7) is converted into 32 bit width, and is stored in the FIFO unit;

[0076] (9) run the decoding module, the public key pk is converted into 512-dimensional polynomial vector t i ;

[0077] (10) run the polynomial operation module, complete the multiplication of the public key polynomial vector t i and the polynomial vector r i ;

[0078] (11) run the polynomial operation module, inverse NTT operation and Con operation are carried out on the result of state (10), and are stored in the FIFO unit;

[0079] (12) run the hash module, SHA3-512 function is executed, the results of state (8) and state (11) are hashed, and 512-bit shared key K is generated.

[0080] The above is only the preferred embodiment of the present application, and does not limit the patent range of the present application, and any equivalent result or equivalent process transformation using the content of the present application specification and drawings, and direct or indirect application in other related technical fields, are also included in the patent protection range of the present application.​

Claims

1. A pure hardware implementation structure of lattice key encapsulation algorithm OSKR based on FPGA platform, for the set of parameters of polynomial dimension n being 512, characterized in that, Comprise: A polynomial operation module, a polynomial sampling module, a hash module, a coding and decoding module, and a top-level control module; wherein: The polynomial operation module is configured to implement forward NTT operation, inverse NTT operation, point multiplication operation, compression and decompression operation, Con / Rec operation of a polynomial; The polynomial sampling module is configured to generate a noise polynomial vector by implementing central binomial sampling r i / e i Implementing rejection sampling to generate a public key polynomial matrix A ij ; The hash module is configured to implement multiple SHA3 instances, including a SHAKE256 function for sampling a noise polynomial, a SHAKE128 function for sampling a public key polynomial, and a SHA3-512 function for generating a shared key K; The coding and decoding module is configured to implement conversion operation of data bit width between modules; The top-level control module is configured to control operation flow of each module through a state machine, implement a set of parameters of the OSKR algorithm with a polynomial dimension N of 512, and implement key generation and key unsealing operation; The top-level control module comprises the following states: (1) running a hash module to successively execute a SHA3-512 function and a SHAKE256 function to generate a 512-bit temporary secret key and a 512-bit random number r ; (2) Run the hash module to execute the SHAKE256 function to output 2048-bit data, and run the sampling module to generate a 512-dimensional noise polynomial r i ; (3) running a polynomial operation module on the noise polynomial r i to perform an NTT operation; (4) Run the hash module to execute the SHAKE128 function to output 6144-bit data, and run the sampling module to generate a 512-dimensional public key polynomial A ij ; (5) running a polynomial operation module to complete a polynomial point multiplication operation NTT (NTT (x, y) = x y) r i * A ij ; (6) Repeat states (2) to (5) to complete the multiplication of the public key polynomial matrix A ij and the polynomial vector r i ​ (7) Run the polynomial operation module to perform inverse NTT operation and compression operation on the result of state (6) (8) Run the coding module to convert the result of state (7) into 32-bit width and store it in a FIFO unit; (9) running a decoding module to convert the public key pk into a 512-dimensional polynomial vector t i ; (10) running a polynomial operation module to complete multiplication operation of the public key polynomial vector t i and the polynomial vector r i ​ (11) Run the polynomial operation module to perform inverse NTT operation and Con operations on the result of state (10) and store in the FIFO unit; (12) Run the hash module to perform SHA3-512 function, and perform hash operation on the results of state (8) and state (11) to generate a 512-bit shared key K.

2. The pure hardware implementation structure of the basis key encapsulation algorithm OSKR according to claim 1, characterized in that, The polynomial operation module has five working modes, and the control signal sel consists of three bits: the forward NTT operation corresponds to the signal 3’b000, the inverse NTT operation corresponds to the signal 3’b001, the point multiplication operation is divided into four steps, which correspond to the signals 3’b011, 3’b100, 3’b100, and 3’b000 respectively, the compression operation and the Con operation correspond to the signal 3’b001, and the decompression operation and the Rec operation correspond to the signal 3’b000; The polynomial operation module is designed as a four-fold parallel structure, that is, four pairs of operands are processed in each clock cycle; for the polynomial dimension n of 512 and the modulus q of 3329, one complete NTT operation, inverse NTT operation, and point multiplication operation all require 448 clock cycles; one complete compression, decompression, Con operation, and Rec operation all require 128 clock cycles; The polynomial operation module, wherein the storage units are of two types: BRAM units and FIFO units; the BRAM units are used to read and store intermediate values of various operations, including four BRAM storage units of RAM0, RAM1, RAM2 and RAM3; the FIFO units are used to temporarily store noise polynomials transmitted from the sampling module into the polynomial module r i , e i coefficients of the public key polynomial A ij coefficients, and stores the polynomial coefficients stored in the FIFO units into the BRAM units according to a control signal to perform polynomial operations.

3. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 2, characterized in that, The polynomial sampling module comprises two functions: (1) Central binomial sampling, used to generate noise polynomial vectors r i , e i The bit width of the hash result of the module input is 32 bits, and 8 polynomial coefficients are generated for each clock cycle. (2) Reject sampling, used to generate public key polynomial matrix A ij The bit width of the hash result of the module input is 32 bits, and at most 2 polynomial coefficients are generated per clock cycle.

4. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 3, characterized in that, The hash module has four bits in the control signal: the fourth bit is used to determine whether the hash operation needs to be run multiple times, and is used to implement hash operation in two cases of hash ciphertext and sampling polynomial matrix A; the remaining three bits of the control signal are used to determine the hash instance; The hash module supports SHA3-512 function, SHAKE256 function, and SHAKE128 function, and each of them consists of five round functions and control logic.

5. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 4, characterized in that, In the codec module, the encoding process of the encoding module is used to convert the output data of the polynomial operation module into a unified 32-bit width, and then send it to the hash module for the next operation; the decoding module converts the 32-bit width data input from the outside according to the parameters d u and d v into the corresponding bit width data, and then send it to the polynomial operation module for the next operation.

6. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 5, characterized in that, For the polynomial operation of the set of parameters (512, 3329), the HNTT is used to implement the polynomial number theory transform, the 512-dimensional polynomial is decomposed by one top layer, two 256-dimensional polynomials are formed, and one layer of the number of transform is deleted for each of them, the results are combined, and the 512-dimensional polynomial number transform result is obtained. The inverse NTT transform uses the same method.

7. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 6, characterized in that, For the butterfly transform circuit structure, CT transform, GS transform, point multiplication operation, compression and decompression operation and Con / Rec operation are realized through 3-bit chip selection signal, which maximizes the utilization rate of hardware resources; wherein, polynomial coefficient, chip selection signal, rotation factor are input, and the working mode of the module is controlled according to the chip selection signal; wherein, the polynomial coefficient is temporarily stored in the on-chip RAM, and the rotation factor is pre-stored in the on-chip ROM in the form of fixed parameters after pre-calculation; the circuit structure is composed of adder, multiplier, register and multiplexer hardware resources, supports modular multiplication, modular addition and modular subtraction operation, and is controlled through chip selection signal and multiplexer; when the chip selection signal is 3’b000, the circuit structure enables CT butterfly transform structure, at this time the output signal , ; when the chip selection signal is 3’b001, the circuit structure enables GS butterfly transform structure, at this time the output signal , .

8. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 7, characterized in that, The butterfly transform module circuit can implement four times parallel HNTT operation, so the fast number theory transform of the 512-dimensional polynomial needs to consume 64*7=448 clock cycles; when the chip selection signal is 3'b011, 3'b100, 3'b100 and 3'b000, the circuit structure enables the corresponding point multiplication operation to be completed in four stages, and for the point multiplication operation of two 512-dimensional polynomials, 4*64=256 clock cycles are needed; the compression and decompression operations need one multiplication operation and one division operation, respectively, and the multiplier and the reduction operation of the module can be implemented in the butterfly transform module.

9. The pure hardware implementation structure of the galois key encapsulation algorithm OSKR according to claim 8, characterized in that, When performing dot product operations, an improved hardware implementation structure for the Karatsuba algorithm is designed, due to the two first-order polynomials ( a 0+ a 1 x) and ( b 0 + b 1 x) Multiplication requires 5 subtractions and 4 multiplications. By arranging the execution order of the above operations reasonably and combining it with a butterfly transformation module that operates four times in parallel, an average of two dot product operations can be completed per cycle. The specific process consists of four steps: (1) Calculate a 0 + a 1 ) (b 0 + b 1 ),( a 2 + a 3 )( b 2 + b 3 ),( a 4 + a 5 )( b 4 + b 5 ), ( a 6 + a 7 )( b 6 + b 7 ) Results stored in RAM 3 module, the corresponding control signal is 3 'b011; (2) Compute a 0 b 0 a 2 b 2 a 4 b 4 a 6 b 6 and store the result in the RAM2 module; simultaneously compute a 0 a 1 b 0 b 1 a 0 b 0 a 2 a 3 b 2 b 3 a 2 b 2 a 4 a 5 b 4 b 5 a 4 b 4 a 6 a 7 b 6 b 7 a 6 b 6 and store the result in the RAM3 module, with corresponding control signal 3'b100;​​​​​​​​​​​​​​​​​​​​​​​​​​​​​ (3) Calculate a 1 b 1 , a 3 b 3 , a 5 b 5 , a 7 b 7 , the results are stored in the RAM2 module; while calculating a 0 a 1 b 0 b 1 a 0 b 0 a 1 b 1 a 2 a 3 b 2 b 3 a 2 b 2 a 3 b 3 a 4 a 5 b 4 b 5 a 4 b 4 a 5 b 5 a 6 a 7 b 6 b 7 ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​) - a 6 * b 6 – a 7 * b 7 , the result is stored in the RAM 3 module, the corresponding control signal 3' b100; (4) Compute a 0 * b 0 + a 1 * b 1 * phi0, a 2 * b 2 + a 3 * b 3 * phi1, a 4 * b 4 + a 5 * b 5 * phi2, a 6 * b 6 + a 7 * b 7 * phi3, result stored in RAM1 module, corresponding control signal 3'b000; Through the above four steps, the point multiplication operation of two 512-dimensional polynomials is implemented in 256 clock cycles, and the efficiency of the polynomial point multiplication operation is further improved.

Images