Efficient lightweight ntt multiplier circuit based on lattice cryptography

Abstract

The application discloses an efficient lightweight NTT multiplier circuit based on a lattice cryptosystem, comprising an NTT control unit, a dual-port RAM and two parallel NTT butterfly calculation units; wherein the NTT butterfly calculation unit mode is switchable, the NTT control unit is connected with the dual-port RAM, and the dual-port RAM is connected with the two parallel NTT butterfly calculation units respectively; data is input into the NTT butterfly calculation unit through the dual-port RAM, different NTT butterfly calculation unit modes are selected through a mode control signal of the NTT control unit, the NTT butterfly calculation unit processes data, the calculation result is reduced through a Barrett reduction unit, and the result is written back into the dual-port RAM in accordance with a specific sequence of the NTT algorithm. The application reduces the calculation complexity and hardware resource consumption, and improves the operation speed of the modular multiplication unit.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a high-efficiency, lightweight NTT multiplier circuit based on lattice cryptography. Background Technology

[0002] Information security primarily refers to the integrity, availability, confidentiality, and reliability of information, serving as a safeguard for the construction and development of other fields in the information age. From ubiquitous IoT terminal devices to massive cloud computing platforms, the transmission, exchange, and storage of various application information are all conducted under the protection of cryptographic systems that we consider sufficiently secure.

[0003] The public-key cryptosystems widely used in the field of information security today are mainly constructed based on intractable mathematical problems. For example, RSA (Rivest-Shamir-Adleman) is based on the problem of factoring large integers, Diffie-Hellman and ElGamal are based on the discrete logarithm problem, and Elliptic Curve Cryptography (ECC) is based on the elliptic curve discrete logarithm problem. Under classic computer architectures, the underlying mathematical problems upon which encryption technologies such as RSA, ECC, and Diffie-Hellman rely are difficult enough to be solved in a short time. However, with the continuous improvement of computer performance, it is necessary to increase the key length and parameter size to resist security attacks from high-performance computers.

[0004] However, in the face of quantum computers, traditional public-key cryptosystems, which rely on increasing key length and parameter size to defend against security attacks, will no longer be effective, exposing greater security vulnerabilities. As early as 1994, Peter Shor proposed the first quantum algorithm capable of solving the large integer factorization problem in polynomial time. Subsequently, Shor's quantum factorization algorithm, after certain improvements, was also proven to be effective in solving the elliptic curve discrete logarithm problem. In 2018, tech giants such as IBM and Google announced the launch of quantum computers with tens of qubits. Although currently far from being able to break existing public-key cryptosystems (estimated to require thousands of qubits), quantum computers will have more qubits and higher bit quality over time. Researchers predict that commercial quantum computers will be available within the next 10 years. In the face of quantum computers, the mathematical problems upon which traditional public-key cryptosystems are based will be utterly insecure. Consequently, information security systems and applications built upon cryptosystems will face severe security problems, and may even be completely cracked. Therefore, research into cryptosystems and their chip implementation technologies to resist quantum attacks is urgently needed.

[0005] To deploy quantum-resistant cryptographic algorithms as early as possible, the National Institute of Standards and Technology (NIST) announced in 2012 that existing public-key encryption technologies needed to gradually transition to quantum-safe, or post-quantum alternatives, and officially launched research into post-quantum cryptography (PQC). In February 2016, NIST's PQC Project announced a call for post-quantum cryptography standards, focusing on two main categories of algorithms: public-key encryption algorithms (including key encapsulation mechanisms) and digital signatures. NIST required each team to submit detailed documentation, engineering implementations, and test vector data for their quantum-resistant algorithms. This competition for post-quantum cryptography standards was open globally, with cryptographers from 25 countries and regions across six continents participating. The first round of draft PQC standard submissions closed on November 30, 2017, and NIST received 82 draft post-quantum cryptography algorithms. After initial review, NIST released 69 "complete and suitable" drafts to advance to the first round of selection. These 64 candidate drafts primarily included post-quantum cryptography algorithms constructed using four mathematical methods: 26 lattice-based algorithms, 19 code-based algorithms, 9 multivariate-based algorithms, and 3 hash-based algorithms. Subsequently, 26 post-quantum cryptography schemes advanced to the second round of selection, including well-known algorithms such as NewHope (key exchange) and Rainbow (digital signature). In July 2020, the NIST PQC Project announced that only 7 post-quantum cryptography schemes had made it to the third final round, including five lattice-based post-quantum cryptography schemes: CRYSTALS-KYBER, CRYSTALS-DILITHIUM (digital signature), FALCON (digital signature), NTRU, and SABER. In July 2022, NIST announced the final post-quantum cryptography standard, in which KYBER was successfully selected for lattice cryptography. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a high-efficiency and lightweight NTT multiplier circuit based on lattice cryptography, which addresses the shortcomings of the prior art.

[0007] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows:

[0008] A high-efficiency, lightweight NTT multiplier circuit based on lattice cryptography, including an NTT control unit, a dual-port RAM, and two parallel NTT butterfly computing units;

[0009] The NTT butterfly computing unit mode is switchable, the NTT control unit is connected to the dual-port RAM, and the dual-port RAM is connected to two parallel NTT butterfly computing units respectively.

[0010] Data is input into the NTT butterfly computing unit via dual-port RAM. Different NTT butterfly computing unit modes are selected by the mode control signal of the NTT control unit. The NTT butterfly computing unit processes the data and reduces the calculated multiplication result by the Barrett reduction unit, and then writes it back to the dual-port RAM in the order specific to the NTT algorithm.

[0011] To optimize the above technical solution, the specific measures also include:

[0012] The circuit described above also includes a BRAM, which is used to temporarily store the output results of the NTT butterfly computing unit.

[0013] The aforementioned NTT butterfly computing unit has two modes: CT butterfly mode or GS butterfly mode.

[0014] The aforementioned NTT butterfly computing unit includes four data selectors, three modular addition / subtraction modules, and one Barrett modular multiplication module;

[0015] The two data points and one zero data point to be processed first pass through two data selectors, and the mode control signal selects the data to be output to the next stage. The data is then connected to the modular addition / subtraction module to complete the addition / subtraction operation. After the operation, the data is multiplied by the Barrett modular multiplication unit. The result is then added or subtracted by the two original input data points through the two data selectors and the two modular addition / subtraction modules, and the output data is selected.

[0016] The four data selectors change the order in which data passes through the modulus addition / subtraction module and the Barrett modulus multiplication module in the NTT butterfly computing unit, thus allowing the NTT butterfly computing unit to switch back and forth between the CT and GS butterfly computing units with only one mode selection signal.

[0017] In the aforementioned NTT butterfly computing unit, when the multiplier ω of the Barrett modular multiplication module is replaced with a certain coefficient, the NTT butterfly computing unit can also perform coefficient-by-coefficient multiplication by switching modes.

[0018] The aforementioned Barrett modular multiplication module includes an absolute value module, a multiplication unit, a Barrett reduction and subtraction unit, a bit-value determination module, and a sign bit restoration module;

[0019] The absolute value module is responsible for taking the absolute value of the input data, then connecting it to the multiplication unit to perform multiplication calculations. The calculation result is connected to the Barrett reduction unit and the bit determination module to standardize the number of bits, and finally connected to the sign bit restoration module to restore the final calculated data.

[0020] The data to be calculated is first input into the absolute value module, which converts the negative number represented by n-bit two's complement into a positive number represented by n-bit original code.

[0021] Then, through an n-bit multiplication unit composed of two DSPs, a 2n-bit multiplication result is obtained;

[0022] Then, the multiplication result is reduced to the required n-bit range by a Barrett reduction unit composed of addition, subtraction and shift circuits. After comparison by the bit determination module, the sign bit restoration module restores the sign bit of the result by XOR gate based on the sign bits of the two multipliers.

[0023] The present invention has the following beneficial effects:

[0024] This invention uses the Fast Number Theory Transform (NTT) algorithm as the polynomial multiplication algorithm, uses the GS mode butterfly computation unit to calculate the forward NTT process, and uses the GS mode NTT butterfly computation unit to calculate the reverse NTT process. This efficiently realizes the ring polynomial multiplication of lattice cryptography. The selected NTT algorithm reduces the computational complexity and improves the overall design frequency and computational speed.

[0025] In the NTT multiplier circuit of the present invention, a dual-port RAM is used to store two coefficients simultaneously, so that the multiplier can process two coefficients at the same time in one calculation process; two NTT butterfly computing units are used in parallel, which can process two different data in different calculation methods at the same time, greatly improving the calculation speed.

[0026] The switchable mode NTT butterfly computing unit used in this invention integrates three different circuit functions into one computing unit. Different modes are controlled by the mode control signal m and the input address selection signal. The two different NTT butterfly computing units, CT and GS, are integrated into the same module, which greatly reduces the consumption of hardware resources.

[0027] This invention proposes a signed number Barrett reduction unit, using the Barrett reduction algorithm as the reduction algorithm in the modular multiplication module. It uses signed two's complement instead of unsigned numbers for calculation, reducing the effective computation bit length to 25 bits. Compared to other designs, this significantly reduces resource consumption. Specifically, based on the data obtained from two preprocessing steps, division operations, which are difficult to implement in hardware, are converted into multiplication and addition / subtraction operations. Multiplication operations can be converted into easily implemented bit shift operations. This allows for the rapid reduction of large number multiplication results to the required data range, reducing computational complexity and hardware resource consumption, and improving the speed of the modular multiplication unit. Furthermore, an absolute value module is added before calculation, and a sign bit restoration module is added after calculation, enabling the Barrett calculation module to perform signed two's complement calculations without losing data accuracy. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of a high-efficiency, lightweight NTT multiplier circuit based on lattice cryptography.

[0029] Figure 2 This is a schematic diagram of the NTT butterfly computing unit with switchable modes;

[0030] Figure 3 This is a schematic diagram of the Barrett modular multiplication module for signed numbers. Detailed Implementation

[0031] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0032] like Figure 1 As shown, the present invention provides a high-efficiency, lightweight NTT multiplier circuit based on lattice cryptography, comprising an NTT control unit, a dual-port RAM, and two parallel NTT butterfly computing units.

[0033] The NTT butterfly computing unit mode is switchable, the NTT control unit is connected to the dual-port RAM, and the dual-port RAM is connected to two parallel NTT butterfly computing units respectively.

[0034] Data is input into the NTT butterfly computing unit via dual-port RAM. Different NTT butterfly computing unit modes are selected by the mode control signal of the NTT control unit. The NTT butterfly computing unit processes the data and reduces the calculated multiplication result by the Barrett reduction unit, and then writes it back to the dual-port RAM in the order specific to the NTT algorithm.

[0035] In a specific embodiment, a BRAM is also included for temporarily storing the output results of the NTT butterfly computing unit.

[0036] The control module includes read / write enable signals and read / write address selection signals for RAM. The mode control signals for the NTT butterfly computing unit are also provided by the NTT control module.

[0037] When 256 50-bit data entries are input into RAM (where the high 25 bits form one set of coefficients and the low 25 bits form another set of coefficients, which can be controlled by two data selectors after RAM), the entire NTT multiplication calculation process is as follows:

[0038] 1) Forward NTT phase:

[0039] The NTT control module sets the control signal m to 1, and the two parallel NTT butterfly calculation units operate in a CT butterfly mode. After data passes through the two NTT butterfly calculation units, it is temporarily stored in BRAM. After all data calculations are completed, it is written back to RAM in a specific order to prepare for the next NTT calculation. After 8 rounds of calculations, the result of the forward NTT is stored in RAM.

[0040] 2) Coefficient-by-coefficient multiplication stage:

[0041] The NTT control module provides a control signal m of 1, and the two parallel NTT butterfly calculation units operate in CT butterfly mode. One coefficient replaces the ω input of the Barrett modular multiplication module, and the calculation unit performs coefficient-by-coefficient multiplication of the two data points. The result is stored in BRAM, and after all calculations are completed, it is written back to RAM in the original order.

[0042] 3) Reverse NTT stage:

[0043] The NTT control module sets the control signal m to 0, and the two parallel NTT butterfly calculation units operate in GS butterfly mode. The result of coefficient-wise multiplication is read from RAM, and the INTT calculation is performed by the NTT butterfly calculation units. INTT also requires eight rounds of calculation. The result of each round is temporarily stored in BRAM, and then written back to RAM in a specific order after all calculations are completed. The final INTT result is directly output from BRAM.

[0044] For the NTT butterfly computing unit, the specific implementation scheme is as follows: Figure 2 As shown. The modes are divided into CT butterfly mode or GS butterfly mode. The bit width of each data is 25 bits. The difference between CT and GS butterfly modes is the order of data addition, subtraction, and multiplication.

[0045] The NTT butterfly computing unit includes four data selectors, three modular addition / subtraction modules, and one Barrett modular multiplication module. For example... Figure 2As shown, the two data points and one zero data point to be processed first pass through two data selectors, and the mode control signal selects the data to be output to the next stage. The data is then connected to the modular addition / subtraction module to complete the addition / subtraction operation. After the operation, the data is multiplied by the Barrett modular multiplication unit. The result is then added or subtracted by the two original input data points through the two data selectors and the two modular addition / subtraction modules, and the output data is selected.

[0046] This invention changes the order in which data passes through the modular addition / subtraction module and the Barrett modular multiplication module in the computing unit by using four data selectors. Thus, only one mode selection signal m is needed to control the computing unit to switch back and forth between the CT / GSNTT butterfly computing units.

[0047] First, calculate all the necessary operation results, and then select the data needed in the butterfly operation through the data selector and the corresponding mode control signal to achieve an effect that approximates the control of the data passage order.

[0048] Furthermore, by replacing the multiplier in the Barrett modular multiplication module with a specific calculation coefficient, this computing unit can also perform coefficient-by-coefficient multiplication. The switchable-mode NTT butterfly computing unit employed in this invention integrates three different circuit functions into a single computing unit. Different modes are controlled via a mode control signal m and an input address selection signal, significantly reducing hardware resource consumption.

[0049] The Barrett modular multiplication module of the present invention includes an absolute value taking module, a multiplication unit, a Barrett reduction unit, a bit-number determination module, and a sign bit restoration module;

[0050] The absolute value module is responsible for taking the absolute value of the input data, then connecting it to the multiplication unit to perform multiplication calculations. The calculation result is connected to the Barrett reduction unit and the bit determination module to standardize the number of bits, and finally connected to the sign bit restoration module to restore the final calculated data.

[0051] Specifically, a Barrett reduction unit for signed numbers is proposed, which can quickly reduce the result of multiplication of 25*25 bit signed numbers to the range of a 25-bit modulus, such as... Figure 3 As shown.

[0052] After data input, two DSPs are used to perform 25*25 bit signed multiplication. Then, the absolute value of the resulting 50-bit result is taken. The result is then processed by two shift circuits designed based on pre-calculated coefficients to obtain a 50-bit approximate remainder, where the high 25 bits are all 0. The result is then passed through a comparison circuit to perform a difference-addition operation. Finally, based on the highest sign bit of the first multiplication result, the sign bit of the difference-addition result is restored. The Barrett reduction calculation unit used in this invention reduces computational complexity and hardware resource consumption, and improves the speed of the modular multiplication unit operation.

[0053] In the above process, it's important to note that since the reduction unit uses a shift operation instead of division, effectively discarding the decimal places generated after division, a comparison with the modulus q is added after the reduction unit to avoid data errors. Finally, the high n bits of the result are discarded, and the sign bit is restored using an XOR gate based on the sign bits of the two multipliers. The entire calculation process uses the two's complement of signed numbers.

[0054] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A high-efficiency, lightweight NTT multiplier circuit based on lattice cipher, characterized in that, It includes an NTT control unit, a dual-port RAM, and two parallel NTT butterfly computing units; The NTT butterfly computing unit has two modes: CT butterfly mode and GS butterfly mode. The NTT butterfly computing unit mode can be switched. The NTT control unit is connected to the dual-port RAM. The dual-port RAM is connected to two parallel NTT butterfly computing units respectively. Data is input into the NTT butterfly computing unit through the dual-port RAM. Different NTT butterfly computing unit modes are selected by the mode control signal of the NTT control unit. The NTT butterfly computing unit processes the data and reduces the calculated multiplication result through the Barrett reduction unit. The result is then written back to the dual-port RAM in the order specific to the NTT algorithm. The NTT butterfly computing unit includes four data selectors, three modular addition / subtraction modules, and one Barrett modular multiplication module; The two data points and one zero data point to be processed first pass through two data selectors, and the mode control signal selects the data to be output to the next stage. The data is then connected to the modular addition / subtraction module to complete the addition / subtraction operation. After the operation, the data is multiplied by the Barrett modular multiplication unit. The result is then added or subtracted by the two original input data points through the two data selectors and the two modular addition / subtraction modules, and the output data is selected. The four data selectors change the order in which data passes through the modulus addition / subtraction module and the Barrett modulus multiplication module in the NTT butterfly computing unit, thus allowing the NTT butterfly computing unit to switch back and forth between the CT and GS butterfly computing units with only one mode selection signal. The Barrett modular multiplication module includes an absolute value module, a multiplication unit, a Barrett reduction and subtraction unit, a bit-value determination module, and a sign bit restoration module; The absolute value module is responsible for taking the absolute value of the input data, then connecting it to the multiplication unit to perform multiplication calculations. The calculation result is connected to the Barrett reduction unit and the bit determination module to standardize the number of bits, and finally connected to the sign bit restoration module to restore the final calculated data. The data to be calculated is first input into the absolute value module, which converts the negative number represented by n-bit two's complement into a positive number represented by n-bit original code. Then, through an n-bit multiplication unit composed of two DSPs, a 2n-bit multiplication result is obtained; Then, the multiplication result is reduced to the required n-bit range by a Barrett reduction unit composed of addition, subtraction and shift circuits. After comparison by the bit determination module, the sign bit restoration module restores the sign bit of the result by XOR gate based on the sign bits of the two multipliers.

2. The high-efficiency, lightweight NTT multiplier circuit based on lattice cipher according to claim 1, characterized in that, It also includes BRAM, which is used to temporarily store the output results of the NTT butterfly computing unit.

3. The high-efficiency, lightweight NTT multiplier circuit based on lattice cipher according to claim 1, characterized in that, In the NTT butterfly computing unit, when the multiplier ω of the Barrett modular multiplication module is replaced with a certain coefficient, the NTT butterfly computing unit can also perform coefficient-by-coefficient multiplication by switching modes.

Images