Adaptive large integer modular multiplication method and device based on homomorphic encryption

Abstract

The present invention discloses an adaptive large-integer modular multiplication method and device based on homomorphic encryption, belonging to the field of lattice cryptography. A pre-calculation is first performed based on the modulus and bit width parameters to obtain a cyclic indicator; the modulus is then used to obtain a decomposition basis, and the multiplicand is decomposed according to the decomposition basis; substitution reduction is performed based on the cyclic indicator and the bit width parameter, and the square of the basis is replaced by the difference between the square of the decomposition basis and the modulus in a congruence environment for reduction; the obtained result is then shifted and reduced and compared with the modulus to obtain the final modular multiplication result. The present invention solves the problem of requiring a high bit width and high multiplication complexity in large-integer modular multiplication calculations, can reduce the multiplication complexity, reduce the bit width required for large-integer modular multiplication calculations, and ensure operation speed.

Description

Technical Field

[0001] The present invention relates to the field of lattice cryptographic algorithms in cryptography, and in particular to an adaptive large integer modular multiplication method based on homomorphic encryption. Background Art

[0002] Since the advent of quantum computers, quantum algorithms have also achieved significant breakthroughs. Under the quantum computing model, polynomial-time quantum algorithms exist for classic public-key cryptography systems like RSA and elliptic curve cryptography. To address the threat posed by quantum computers, "post-quantum cryptography" has emerged, and lattice cryptography is a highly sought-after type of post-quantum cryptography.

[0003] Based on lattice cryptography, fully homomorphic encryption schemes have been proposed, enabling keyless computation on ciphertext. Fully homomorphic encryption schemes can improve information security and ensure data privacy, and have important application prospects in fields such as cloud computing. However, achieving good encryption and computational performance requires modular multiplication operations on large integer moduli.

[0004] Existing algorithms such as Barrett modular multiplication still have the following problems: when calculating modular multiplication, it is necessary to directly calculate the product of the multiplicand, which has high requirements on the data bit width; it involves multiple multiplications of high-bit-width integers, and the multiplication complexity is high. Summary of the Invention

[0005] Purpose of the invention: To overcome the problem that the large integer modular multiplication calculation process in the existing algorithm requires a high bit width and the multiplication calculation complexity is high, a large integer modular multiplication operation method based on homomorphic encryption is proposed, which can reduce the multiplication calculation complexity, reduce the bit width required for large integer modular multiplication calculation, and ensure the operation speed.

[0006] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is as follows:

[0007] An adaptive large integer modular multiplication method based on homomorphic encryption includes the following steps:

[0008] Step 1: Initialize the environment, receive two multiplicands, a modulus, a first parameter, and a second parameter as input, and calculate a loop indicator according to the modulus and the bit width parameter;

[0009] Step 2: Determine whether the loop indicator is zero and whether the first parameter is equal to the second parameter; use the modulus to obtain a decomposition basis, and then decompose the multiplicand according to the decomposition basis based on the determination result; replace the square of the basis with the difference between the square of the decomposition basis and the modulus to perform reduction under the congruence environment; and perform shift reduction on the obtained result;

[0010] Step 3: Determine whether the result is less than the modulus. If so, output the result; otherwise, subtract the modulus from the result and output it.

[0011] According to one aspect of the present application, step 2 is further:

[0012] If the loop indicator is not equal to 0,

[0013] Calculating a first decomposition basis, decomposing the multiplicand according to the first decomposition basis and multiplying the multiplicand;

[0014] Substituting the square of the first decomposition basis with the difference of the square and the modulus of the first decomposition basis to obtain a first result;

[0015] Calculate a second decomposition basis, decompose the first result according to the second decomposition basis, and perform substitution and reduction using the difference between the square and modulus of the first decomposition basis to obtain a second result;

[0016] Calculate whether the second result is non-negative. If so, right-shift and subtract the second result to obtain the third result.

[0017] Determine whether the third result is less than twice the modulus. If so, continue to determine whether the third result is less than the modulus. If so, output the third result.

[0018] According to one aspect of the present application, step 2 is further:

[0019] If the loop indicator is equal to 0 and the first parameter is equal to the second parameter;

[0020] Calculate the decomposition basis and decompose the multiplicand according to the decomposition basis;

[0021] Use the decomposed result to perform substitution and shift reduction at the same time, and determine whether the result is less than the modulus. If it is less than the modulus, output the result.

[0022] According to one aspect of the present application, step 2 is further:

[0023] If the loop indicator is equal to 0 and the first parameter is not equal to the second parameter;

[0024] Calculate the decomposition basis, decompose the multiplicand according to the decomposition basis and multiply;

[0025] Substitute the square of the basis for the difference between the square of the decomposed basis and the modulus to reduce it, and shift the result right to reduce it;

[0026] Determine whether the result is less than the modulus. If so, output the result.

[0027] In a further embodiment, a method for adaptive large integer modular multiplication based on homomorphic encryption is provided, and the steps are as follows:

[0028] Step 1: Receive input multiplicand a, multiplicand b, and modulus Q; decompose multiplicand a and multiplicand b according to decomposition basis B to obtain low-order integer a1 and high-order integer a2 of multiplicand a, and low-order integer b1 and high-order integer b2 of multiplicand b, respectively;

[0029] Where modulus Q = 2 2v -k*2 v1 +1, v1, v and k are parameters, v1 and v are positive integers, and v1≤v, basis B=2 v The multiplicand a and the multiplicand b are any integers less than the modulus Q; the low-order integer a1 and the high-order integer a2 of the multiplicand a, and the low-order integer b1 and the high-order integer b2 of the multiplicand b satisfy a=a1+a2*B, b=b1+b2*B;

[0030] Step 2: Based on the parameters k, v1, and v, as well as the low-order integer a1 and the high-order integer a2 of the multiplicand a, and the low-order integer b1 and the high-order integer b2 of the multiplicand b, loop n times under a congruence environment with a modulus of Q to calculate a first intermediate result r1;

[0031] Step 3: For the first intermediate result r1, perform a shift reduction operation by shifting right by 2v bits to obtain a second intermediate result r2, where r2 = r1 - (r1>>2v)*Q, where >> represents a right shift operation.

[0032] Step 4: judge the second intermediate result r2. When the second intermediate result r2 is less than the modulus Q, output the final result r=r2; otherwise, output the final result r=r2-Q.

[0033] According to one aspect of the present application, step 2 further includes calculating a cycle indicator number and determining the cycle indicator number. When the cycle indicator number is not 0, the following operations are performed:

[0034] S1, decompose the multiplicand a and the multiplicand b according to the decomposition basis B, and obtain the low-order integer and the high-order integer of the multiplicand a and the multiplicand b respectively;

[0035] S2, multiply the multiplicand a and the multiplicand b by the result of the decomposition basis B, and use the difference between the square of the decomposition basis and the modulus B 2 -Q instead of B 2 Perform a reduction to obtain the first operation result;

[0036] S3, according to the result of the first operation, find the bisection term B of the decomposition basis 2 Repeat the subtraction according to step S2 and add an integer multiple of the modulus Q to keep the result non-negative, and finally obtain a second calculation result that meets the preset range;

[0037] S4, right-shifting and reducing the second calculation result, subtracting the result of right-shifting itself by len(Q) bits from the second calculation result to obtain a third calculation result;

[0038] S5, judging the third calculation result, when the third calculation result is greater than or equal to the modulus, outputting the quotient of the third calculation result and the modulus; when the third calculation result is less than the modulus, outputting the third calculation result.

[0039] According to one aspect of the present application, S3 specifically includes the following steps:

[0040] S31, assigning the first calculation result to the intermediate calculation result;

[0041] S32, the B in the intermediate calculation result 2 Use B 2 -Q result substitution;

[0042] S33, when the intermediate calculation result is negative, adding an integer multiple of the modulus Q to make the intermediate calculation result non-negative; when the intermediate calculation result is non-negative, no change is made;

[0043] S34, determine whether it meets the preset range, that is, use the intermediate calculation result as the second calculation result to perform step S4 to obtain the third calculation result. When the third calculation result is less than 2Q, it means that the intermediate calculation result meets the preset range and is assigned to the second calculation result; when the intermediate calculation result does not meet the preset range, return to step S32.

[0044] According to one aspect of the present application, the calculation of the intermediate result r1 in step 2 is affected by the parameters k, v, and v1. Before the calculation, the loop indicator number N in step 2 needs to be pre-calculated based on the parameters k, v, and v1. The calculation method of N is as follows:

[0045] For any 1 and 2 v Positive integers x1, x2 between -1 and any 1 and 2 v -k positive integers y1,y2, let When t-(t>>2v)*Q is less than 2Q, N=0; otherwise N=1.

[0046] According to one aspect of the present application, the calculation process of the intermediate result r1 in step 2 is as follows:

[0047] When the loop indicator is 0 and parameter 1 and parameter 2 are not equal, the specific steps are as follows:

[0048] Step 21, expand the multiplicand a about the decomposition basis B, and obtain the high-order integer a1 of a by performing a right shift by v bits. Then, obtain the low-order integer a2 of a by performing an AND operation on a and B-1.

[0049] Step 22, expand b with respect to the decomposition basis B, and obtain the high-order integer b2 of b by right shifting by v bits, and obtain the low-order integer b1 of b by performing an AND operation on b and B-1;

[0050] Step 23, set the first calculation result, Assign a value to the first calculation result;

[0051] Step 24, right-shift and subtract the first calculation result, and subtract the result of right-shifting itself by len(Q) bits from the first calculation result to obtain a second calculation result;

[0052] Step 5: judge the second calculation result. When the second calculation result is greater than or equal to the modulus, the output result is the difference between the second calculation result and the modulus; when the second calculation result is less than the modulus, the output result is the second calculation result.

[0053] When the loop indicator is 0 and parameter 1 is equal to parameter 2, the specific steps are as follows:

[0054] Expand the multiplicand a about the decomposition basis B, and obtain the high-order integer a2 of a by shifting it right by v bits. Then obtain the low-order integer a1 of a by performing an AND operation on a and B-1.

[0055] Expand the multiplicand b about the decomposition basis B, and obtain the high-order integer b2 of b by right shifting by v bits. Then obtain the low-order integer b1 of b by performing an AND operation on b and B-1.

[0056] Set the first calculation result and assign a1*b1-a2*b2 to the first calculation result;

[0057] Set the second calculation result and assign a1*b2+a2*b1+k*a2*b2 to the second calculation result;

[0058] Set up a third calculation result, shift the second calculation result left by v bits, add it to the first calculation result, subtract the second calculation result right-shifted by v bits, and multiply it by the modulus Q. The final calculation result is the third calculation result;

[0059] The third calculation result is judged. When the third calculation result is greater than or equal to the modulus, the output result is the difference between the third calculation result and the modulus; when the third calculation result is less than the modulus, the output result is the third calculation result.

[0060] Finally, a device is also provided, comprising:

[0061] at least one processor; and

[0062] a memory communicatively connected to at least one of the processors; wherein,

[0063] The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the adaptive large integer modular multiplication method based on homomorphic encryption as described in any one of the above embodiments.

[0064] Compared with the prior art, the present invention has the following technical effects:

[0065] The multiplicand is decomposed by setting a decomposition basis, and reduction is performed by replacing high-bit-width integers with low-bit-width integers in a congruence environment, thereby avoiding the occurrence of high-bit-width multiplication. The present invention combines shift reduction to simplify the modular multiplication algorithm of special moduli, reduce the calculation complexity, and thus ensure calculation speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a simplified flow chart of the present invention.

[0067] Figure 2 It is a schematic diagram of the process of the present invention.

[0068] Figure 3 This is a schematic diagram of Example 1.

[0069] Figure 4 This is a schematic diagram of Example 2.

[0070] Figure 5 It is a schematic diagram of the physical structure of the present invention. DETAILED DESCRIPTION

[0071] To make the objectives, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0072] The present invention provides an adaptive large integer modular multiplication method based on homomorphic encryption, comprising the following steps:

[0073] Define a single modular multiplication as a·b(modQ), where a and b are the multiplicands and can be any integer less than Q, and Q is the modulus. v1 and v are exponents, which must be positive integers and v1≤v. Define the decomposition basis B=2 v ;

[0074] Step 1. Input the multiplicand a and the multiplicand b and the modulus Q, decompose the multiplicand a and the multiplicand b according to the decomposition basis B, and obtain the low-order integers a1 and b1 and the high-order integers a2 and b2 of the multiplicand a and the multiplicand b, respectively, where a1, a2, b1, and b2 satisfy a=a1+a2*B and b=b1+b2*B;

[0075] Step 2: Calculate the first intermediate result r1 in the congruence environment with modulus Q according to the parameters k, v1, v, a1, a2, b1, b2.

[0076] Step 3: For the first intermediate result r1 in Step 3, perform a right shift reduction of 2v bits to obtain the second intermediate result r2, where r2 = r1 - (r1 >> 2v) * Q, and >> represents the right shift operation.

[0077] Step 4: Judge the second intermediate result r2 in Step 4. When r2 < Q, output the final result r = r2; otherwise, output the final result r = r2 - Q.

[0078] The calculation of the first intermediate result r1 in Step 2 is affected by the parameters k, v, v1. Before the operation, the loop index N of Step 2 needs to be pre-calculated according to the parameters k, v, v1. The process is as follows:

[0079] The calculation of the loop index N is as follows:

[0080] For any positive integers x1, x2 between 1 and 2 v -1 and any positive integers y1, y2 between 1 and 2 v -k, let When t - (t >> 2v) * Q is less than 2Q, N = 0; otherwise N = 1.

[0081] When v1 = v and the loop index N is 0, Step 2 is to calculate r1 = a1b1 + (a1b2 + a2b1 + k * a2b2) * 2 v - a2b2; at this time, Step 2 and Step 3 can be combined to calculate r1 = a1 * b2 + a2 * b1 + k * a2 * b2, and calculate r2 = a1b1 - a2b2 + (r1 >> v) - (r1 >> v) * Q.

[0082] When v1 ≠ v and the loop index N is 0, Step 2 is to calculate

[0083] When the loop index N is not 0, the process of Step 2 is as follows:

[0084] S1: Calculate a·b (mod Q) in the residue system with modulus Q, express the result of a·b as a polynomial about the decomposition basis B, and use Replace B 2 Perform a reduction to obtain the result t1.

[0085] S2: For the large integer in t1, further reduce it according to the new decomposition basis Decompose and get the low-order formal c1 and high-order integer c2 of s1, satisfying calculate Where n is the smallest integer that ensures t2 is a non-negative integer;

[0086] S3. When t2-(t2>>2v)*Q is less than 2Q, r1=t2; otherwise, set t1=t2 and repeat step S2;

[0087] like Figure 1 As shown, the present invention provides an adaptive large integer modular multiplication method based on homomorphic encryption, comprising the following steps:

[0088] Get the multiplicand a, multiplicand b and modulus Q. Modulus Q is represented by parameters 1, 2 and 3. Set parameter 1 to v, parameter 2 to v1, and parameter 3 to k. Set len(Q) to represent the bit width of the modulus Q. In the operation, len(Q) = 2v, and the decomposition basis B is obtained according to len(Q). The decomposition basis B is assigned a value of 2. v ; Multiplicand a and multiplicand b are any non-negative numbers less than Q;

[0089] Before proceeding to the next step, precalculate the loop indicator number N: for any 1 and 2 v Positive integers x1, x2 between -1 and any 1 and 2 v -k positive integers y1,y2, let When t-(t>>2v)*Q is less than 2Q, N=0; otherwise N=1.

[0090] The cycle indicator number is judged. When the cycle indicator number is not 0, the following operations are performed:

[0091] S1, decompose the multiplicand a and the multiplicand b according to the decomposition basis B, and obtain the low-order integer and the high-order integer of the multiplicand a and the multiplicand b respectively;

[0092] S2, multiply the multiplicand a and the multiplicand b in step S1 by the result of the decomposition basis B, and use the difference between the square of the decomposition basis and the modulus B 2 -Q instead of B 2 Perform a reduction to obtain the first operation result;

[0093] S3, according to the first operation result in step S2, find the bisection term B of the decomposition basis 2 Repeat the subtraction according to step S2 and add an integer multiple of the modulus Q to keep the result non-negative, and finally obtain a second calculation result that meets the preset range;

[0094] S4, right-shifting and reducing the second calculation result, subtracting the result of right-shifting itself by len(Q) bits from the second calculation result to obtain a third calculation result;

[0095] S5, judging the third calculation result, when the third calculation result is greater than or equal to the modulus, outputting the quotient of the third calculation result and the modulus; when the third calculation result is less than the modulus, outputting the third calculation result;

[0096] The specific operations of step S1 include: right-shifting the multiplicand a and the multiplicand b by v bits respectively to obtain the high-order results a2 and b2; performing an AND operation on the multiplicand a, b and B-1 to obtain the low-order results a1 and b1;

[0097] The specific operation of step S2 includes: multiplying a1+a2B and b1+b2B to obtain a1b1+(a2b1+a1b2)B+a2b2B 2 , then B 2 -Q's result replaces B 2 , get the first calculation result;

[0098] S3 specifically includes the following steps:

[0099] S31, assigning the first calculation result to the intermediate calculation result;

[0100] S32, the B in the intermediate calculation result 2 Use B 2 -Q result substitution;

[0101] S33, when the intermediate calculation result is negative, adding an integer multiple of the modulus Q to make the intermediate calculation result non-negative; when the intermediate calculation result is non-negative, no change is made;

[0102] S34, determine whether it meets the preset range, that is, use the intermediate calculation result as the second calculation result to perform step S4 to obtain the third calculation result. When the third calculation result is less than 2Q, it means that the intermediate calculation result meets the preset range and is assigned to the second calculation result; when the intermediate calculation result does not meet the preset range, return to step S32.

[0103] When the loop indicator is 0 and parameter 1 and parameter 2 are not equal, the specific steps are as follows:

[0104] Step 1: Expand the multiplicand a with respect to the decomposition basis B, and obtain the high-order integer a1 of the multiplicand a by performing a right shift by v bits. Then, obtain the low-order integer a2 of the multiplicand a by performing an AND operation on the multiplicand a and B-1.

[0105] Step 2: Expand the multiplicand b with respect to the decomposition basis B, and obtain the high-order integer b2 of the multiplicand b by right shifting it by v bits. Then, obtain the low-order integer b1 of the multiplicand b by performing an AND operation on the multiplicand b and B-1.

[0106] Step 3, set the first calculation result, Assign a value to the first calculation result;

[0107] Step 4, right-shift and subtract the first calculation result, and subtract the result of right-shifting itself by len(Q) bits from the first calculation result to obtain the second calculation result;

[0108] Step 5, judge the second calculation result. When the second calculation result is greater than or equal to the modulus, the output result is the difference between the second calculation result and the modulus; when the second calculation result is less than the modulus, the output result is the second calculation result.

[0109] When the loop indicator is 0 and parameter 1 is equal to parameter 2, the specific steps are as follows:

[0110] 1. Expand the multiplicand a about the decomposition basis B, and obtain the high-order integer a2 of the multiplicand a by shifting it right by v bits. Then obtain the low-order integer a1 of the multiplicand a by performing an AND operation on a and B-1.

[0111] 2. Expand the multiplicand b about the decomposition basis B and right-shift it by v bits to obtain the high-order integer b2 of the multiplicand b. And perform an AND operation on the multiplicand b and B-1 to obtain the low-order integer b1 of the multiplicand b.

[0112] 3. Set the first calculation result and assign a1*b1-a2*b2 to the first calculation result;

[0113] 4. Set the second calculation result and assign a1*b2+a2*b1+k*a2*b2 to the second calculation result;

[0114] 5. Set up a third calculation result. Shift the second calculation result left by v bits, add it to the first calculation result, subtract the second calculation result right-shifted by v bits, and multiply it by the modulus Q. The final calculation result is the third calculation result.

[0115] 6. Judge the third calculation result. When the third calculation result is greater than or equal to the modulus, the output result is the difference between the third calculation result and the modulus; when the third calculation result is less than the modulus, the output result is the third calculation result.

[0116] As can be seen from the above scheme, when a, b, and Q are large integers, calculating a*b involves multiplication of 2v-bit integers with 2v-bit integers. This scheme, however, avoids direct a*b calculations, concentrating all multiplications on multiplication of v-bit integers with v-bit integers. This scheme achieves computational speed comparable to the Barrett algorithm. Using C++ to perform partial modulus calculations, the time required for one million loop calculations is within 0.001 seconds of the Barrett algorithm. Furthermore, the maximum number of bits required for the calculation is 3v+1, which is one-quarter less than the number of bits required by the Barrett algorithm, effectively reducing computational complexity.

[0117] Example 1

[0118] like Figure 2 As shown, when the loop indicator number is 0 and v1≠v, the present invention provides a simplified large integer modular multiplication method, including:

[0119] Step 1: Expand the multiplicand a with respect to the decomposition basis B, and obtain the high-order integer a1 of the multiplicand a by performing a right shift by v bits. Then, obtain the low-order integer a2 of the multiplicand a by performing an AND operation on the multiplicand a and B-1.

[0120] Step 2: Expand the multiplicand b with respect to the decomposition basis B, and obtain the high-order integer b2 of the multiplicand b by right shifting it by v bits. Then, obtain the low-order integer b1 of the multiplicand b by performing an AND operation on the multiplicand b and B-1.

[0121] Step 3, calculate

[0122] Step 4, calculate r2 = a1b1 - a2b2;

[0123] Step 5, calculate r3 = r2 + (r1 < < v1) - (r1 > > (2v - v1)) * Q;

[0124] Step 6, judge r3. When r3 is greater than or equal to the modulus, the output result is the difference between r3 and the modulus; when r3 is less than the modulus, the output result is r3.

[0125] Table 1 shows the speed comparison between the modular multiplication method of the present invention and the currently commonly used Barrett modular multiplication method, where the modulus Q is 2 2v -2 v-1 +1, a=b=Q-1; the time required for running is the time it takes to execute the C++ program one million times. As can be seen from Table 1, the operation speed of the embodiment of the present invention is comparable to that of the Barrett modular multiplication method.

[0126] Table 1 Comparison of running time under different parameters v

[0127]

[0128]

[0129] In this embodiment, the software C++ is used for implementation. It is found that the maximum number of bits required for data calculation is 3v+1, while the maximum number of bits required for data calculation in the Barrett modular multiplication algorithm is 4v+1. The above embodiment can reduce the calculation bit width by 1 / 4. Table 2 shows the comparison of the maximum number of bits of data in the modular multiplication method of the present invention and the currently commonly used Barrett modular multiplication method, where the modulus Q is 2 2v -2 v-1 +1, a=b=2 2v -kk*2 v-1 ,kk is the bit width parameter set for the multiplicand.

[0130] Table 2 Comparison of the maximum number of bits required for calculation under different parameters v,kk

[0131] Parameter v Parameter kk Maximum number of bits required by the embodiment of the present invention Maximum number of bits required for the Barrett modular multiplication algorithm 12 1 37 49 12 64 35 49 12 4096 33 48 14 1 43 57 14 32 41 57 14 1024 41 57

[0132] Example 2

[0133] like Figure 2 As shown, when the loop indicator number is 0 and v1=v, the present invention provides a large integer modular multiplication method, including:

[0134] Step 1: Expand a with respect to the decomposition basis B, and obtain the high-order integer a2 of a by shifting it right by v bits. Then, obtain the low-order integer a1 of a by performing an AND operation on a and B-1.

[0135] Step 2: Expand b with respect to the decomposition basis B, and obtain the high-order integer b2 of b by right shifting by v bits. Then, obtain the low-order integer b1 of b by performing an AND operation on b and B-1.

[0136] Step 3, calculate r1 = a1*b1 - a2*b2;

[0137] Step 4, calculate r2 = a1*b2 + a2*b1 + k*a2*b2;

[0138] Step 5, calculate r3=r1+(r2<<v)-(r2> >v)*Q;

[0139] Step 6, judge r3. When r3 is greater than or equal to the modulus, the output result is the difference between r3 and the modulus; when r3 is less than the modulus, the output result is r3.

[0140] Table 3 shows the speed comparison between the modular multiplication method of this embodiment and the Barrett modular multiplication method, where the modulus Q is 2. 2v -2v +1, a=b=Q-1; the time required for running is the time it takes to execute the C++ program one million times. As can be seen from Table 3, the operation speed of the embodiment of the present invention is comparable to that of the Barrett modular multiplication method.

[0141] Table 3 Comparison of running time under different parameters v

[0142] Parameter v Modulus Q Time required for the embodiment of the present invention (seconds) Time required for Barrett modular multiplication algorithm (seconds) 11 4192257 0.006 0.005 12 16773121 0.005 0.005 13 67100673 0.005 0.005 14 268419073 0.005 0.004 15 1073709057 0.005 0.005

[0143] In this embodiment, the software C++ is used for implementation, and it is found that the maximum number of bits required for data calculation is 3v+1, while the maximum number of bits required for data calculation of the Barrett modular multiplication algorithm is 4v+1. The above embodiment can reduce the calculation bit width by 1 / 4.

[0144] Finally, the present application also provides a device, specifically comprising:

[0145] at least one processor; and

[0146] a memory communicatively connected to at least one of the processors; wherein,

[0147] The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the adaptive large integer modular multiplication method based on homomorphic encryption as described in any one of the above embodiments.

[0148] According to one aspect of this application, Figure 5 As shown, the processor includes a pre-calculation unit, a substitution reduction unit, a shift reduction unit, and a comparison reduction unit.

[0149] The present invention has been described in detail above with reference to specific exemplary embodiments. However, it should be understood that various modifications and variations may be made without departing from the scope of the present invention as defined by the appended claims. The detailed description and accompanying drawings should be considered merely illustrative and not restrictive, and any such modifications and variations, if any, are intended to fall within the scope of the present invention as described herein. In addition, the background art is intended to illustrate the current status and significance of the present technology and is not intended to limit the present invention or the application and fields of application of the present invention.

Claims

1. An adaptive large integer modular multiplication method based on homomorphic encryption, characterized in that: Step 1: Receive input multiplicand a, multiplicand b, and modulus Q; decompose multiplicand a and multiplicand b according to decomposition basis B to obtain low-order integer a1 and high-order integer a2 of multiplicand a, and low-order integer b1 and high-order integer b2 of multiplicand b, respectively; The modulus Q=2 2v -k*2 v1 +1, v1, v and k are parameters, v1 and v are positive integers, and v1≤v, basis B=2 v ; Multiplicand a and multiplicand b are any integers less than the modulus Q; the low-order integer a1 and the high-order integer a2 of multiplicand a, and the low-order integer b1 and the high-order integer b2 of multiplicand b satisfy a=a1+a2*B, b= b1+b2*B; Step 2, based on the parameters k, v1 and v, as well as the low-order integer a1 and the high-order integer a2 of the multiplicand a, and the low-order integer b1 and the high-order integer b2 of the multiplicand b; Looping in a congruence environment modulo Q Calculate the first intermediate result r1; Step 3: For the first intermediate result r1, perform a shift reduction operation by shifting it right by 2v bits to obtain the second intermediate result r2, where r2 = r1-(r1≫2v)*Q, where ≫ represents a right shift operation. Step 4, judge the second intermediate result r2, when the second intermediate result r2 < modulus Q, output the final result r = r2, otherwise, output the final result r = 2-Q; Step 2 also includes calculating the cycle indicator number and judging the cycle indicator number. When the cycle indicator number is not 0, the following operations are performed: S1, decompose the multiplicand a and the multiplicand b according to the decomposition basis B, and obtain the low-order integer and the high-order integer of the multiplicand a and the multiplicand b respectively; S2, multiply the multiplicand a and the multiplicand b by the result of the decomposition basis B, and use the difference between the square of the decomposition basis and the modulus B 2 -Q instead of B 2 Perform a reduction to obtain the first operation result; S3, according to the result of the first operation, find the bisection term B of the decomposition basis 2 Repeat the subtraction according to step S2 and add an integer multiple of the modulus Q to keep the result non-negative, and finally obtain a second calculation result that meets the preset range; S4, right shift and reduce the second calculation result, and subtract the right shift from the second calculation result The result of the bit is used to obtain the third calculation result; S5, judging the third calculation result, when the third calculation result is greater than or equal to the modulus, outputting the quotient of the third calculation result and the modulus; when the third calculation result is less than the modulus, outputting the third calculation result; The intermediate result of step 2 The calculation process is as follows: When the loop indicator is 0 and parameter 1 and parameter 2 are not equal, the specific steps are as follows: Step 21, expand the multiplicand a about the decomposition basis B, and obtain the high-order integer of a by right shifting v bits. , by combining a and Perform AND operation to get the low integer of a ; Step 22: Expand b about the decomposition basis B and obtain the high-order integer of b by right shifting v bits. , by combining b and Perform AND operation to get the low-order integer of b ; Step 23, set the first calculation result, Assign a value to the first calculation result; Step 24: right-shift and reduce the first calculation result, and subtract the first calculation result from the right-shifted result. The result of the bit is used to obtain the second calculation result; Step 25, judging the second calculation result, when the second calculation result is greater than or equal to the modulus, outputting the difference between the second calculation result and the modulus; When the second calculation result is less than the modulus, the output result is the second calculation result; Parameter 1 is , parameter 2 is ; When the loop indicator is 0 and parameter 1 is equal to parameter 2, the specific steps are as follows: Expand the multiplicand a about the decomposition basis B and obtain the high-order integer of a by shifting it right by v bits. , by combining a and Perform AND operation to get the low integer of a ; Expand the multiplicand b about the decomposition basis B and obtain the high-order integer of b by right shifting v bits. , by combining b and Perform AND operation to get the low-order integer of b ; Set the first calculation result, Assign a value to the first calculation result; Set the second calculation result, Assign the value to the second calculation result; Set up the third calculation result and shift the second calculation result to the left Add the first calculation result and subtract the second calculation result and shift right Multiply by the modulus after the bit , the final calculation result is the third calculation result; The third calculation result is judged, and when the third calculation result is greater than or equal to the modulus, the output result is the difference between the third calculation result and the modulus; When the third calculation result is less than the modulus, the output result is the third calculation result.

2. The adaptive large integer modular multiplication method based on homomorphic encryption according to claim 1 is characterized in that: The S3 specifically includes the following steps: S31, assigning the first calculation result to the intermediate calculation result; S32, the B in the intermediate calculation result 2 Use B 2 -Q result substitution; S33, when the intermediate calculation result is negative, adding an integer multiple of the modulus Q to make the intermediate calculation result non-negative; when the intermediate calculation result is non-negative, no change is made; S34, determining whether it meets the preset range, that is, taking the intermediate calculation result as the second calculation result and performing step S4 to obtain a third calculation result. If the third calculation result is less than 2Q, it means that the intermediate calculation result meets the preset range, and the value is assigned to the second calculation result; When the intermediate calculation result does not meet the preset range, the process returns to step S32.

3. The adaptive large integer modular multiplication method based on homomorphic encryption according to claim 1, characterized in that: The intermediate result of step 2 The calculation is affected by the parameters The influence of the parameters Precompute the number of loop indicators for step 2 , is calculated as follows: For any and Positive integers between and any and Positive integers between ,make ;when Less than hour, ;otherwise .

4. A device, characterized in that: include: at least one processor; as well as a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the adaptive large integer modular multiplication method based on homomorphic encryption as described in any one of claims 1 to 3.

Images