Polynomial multiplication processing method and system applied to lattice cryptographic algorithm

Abstract

The embodiment of the present invention provides a polynomial multiplication processing method and system applied to a lattice cryptographic algorithm, belonging to the field of lattice cryptographic encryption technology. The method comprises: S10) collecting data encoded based on a lattice cryptographic algorithm, and obtaining a corresponding input key based on the encoded data, and identifying an input polynomial of the input key, and obtaining a corresponding accumulator polynomial based on the input polynomial; S20) splitting the accumulator polynomial into m sub-polynomials of the accumulator polynomial; S30) performing cyclic calculations based on the sub-polynomials of the accumulator polynomial; S40) completing all cyclic calculations, obtaining the calculation results of the accumulator polynomial, decoding the encoded data based on the calculation results, and obtaining corresponding decoded data. The scheme of the present invention shortens the processing time of polynomial multiplication and greatly reduces the consumption of hardware resources.

Description

Technical Field

[0001] The present invention relates to the technical field of lattice cipher encryption, and in particular to a polynomial multiplication processing method applied to a lattice cipher algorithm and a polynomial multiplication processing system applied to a lattice cipher algorithm. Background Art

[0002] The security of traditional cryptographic algorithms, including block ciphers and public key cryptography, is based on some specific mathematical problems that cannot be cracked by computers or human power in polynomial time. However, since the emergence of decomposition algorithms for these mathematical problems, the rapid development of quantum computers that can use this algorithm has caused people to have greater concerns about information security. In the future of quantum computer development, encryption and decryption such as Shor's algorithm will become very simple. Although it will bring certain benefits, these quantum computer algorithms will become very dangerous for the data that users want to encrypt. In order to protect user data, it is necessary to propose an encryption algorithm that cannot be deciphered by quantum computers, and lattice cryptography is one of them. Lattice cryptography is a type of public key cryptographic system that has received much attention and is resistant to quantum computing attacks. It uses the concept of lattices in mathematical structures for encoding and decoding. Simply put, it encodes data to a secure lattice point, and only by holding the private key to solve it can this point be found. Because it needs to be solved based on the vector product in the lattice point, in the lattice cryptographic algorithm, for the corresponding public polynomials and private polynomials, the process of implementing the algorithm inevitably involves a large number of polynomial multiplications. However, as the order of polynomial multiplication increases, the calculation process will become very large, and in order to cope with the huge amount of calculation, most of the computing time and resource costs are required.

[0003] In the current Saber key encapsulation scheme, the mainstream polynomial multiplication algorithms include the fast number theory algorithm (Number Theoretic Transform, NTT) with the lowest time complexity, the Karatsuba algorithm, the Toom-Cook algorithm, and the textbook multiplication that does not reduce any complexity, that is, does not reduce the number of point-to-point coefficient multiplications. These algorithms do not fundamentally solve the problem of excessive operation time and resource cost. In view of the problems of excessive operation time and excessive resource cost when performing polynomial multiplication operations in lattice cryptographic algorithms, it is necessary to create a new polynomial multiplication processing method applied to lattice cryptographic algorithms. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a polynomial multiplication processing method and system applied to a lattice cryptographic algorithm, so as to at least solve the problems of long operation time and excessive resource cost when performing polynomial multiplication operations in the current lattice cryptographic algorithm.

[0005] In order to achieve the above-mentioned purpose, the first aspect of the present invention provides a polynomial multiplication processing method applied to a lattice cryptographic algorithm, the method comprising: S10) collecting data encoded based on the lattice cryptographic algorithm, and obtaining a corresponding input key based on the encoded data, and identifying an input polynomial of the input key, and obtaining a corresponding accumulator polynomial based on the input polynomial; S20) splitting the accumulator polynomial into m sub-polynomials of the accumulator polynomial; S30) performing a loop calculation based on the sub-polynomials of the accumulator polynomial; the loop calculation is to assign values ​​to the coefficients of the input polynomial one by one, and perform calculations of the sub-polynomials of the accumulator polynomial based on the assigned input polynomial; S40) completing all loop calculations, obtaining a calculation result of the accumulator polynomial, decoding the encoded data based on the calculation result, and obtaining corresponding decoded data.

[0006] Optionally, obtaining the accumulator polynomial based on the input polynomial includes: constructing a textbook multiplication algorithm based on the input polynomial to obtain a corresponding accumulator polynomial; the textbook multiplication algorithm is a multiplication algorithm determined based on the polynomial multiplication rule.

[0007] Optionally, the input polynomial includes: a public polynomial and a secret polynomial in a lattice cryptographic algorithm; wherein, the public polynomial and the secret polynomial have the same order; the input key includes: an input public key and an input private key; the input polynomial of the input public key is a public polynomial; the input polynomial of the input private key is a secret polynomial.

[0008] Optionally, each coefficient of the public polynomial is no more than 2 10 A positive integer.

[0009] Optionally, the cumulative polynomial is expressed as:

[0010]

[0011] Where n is the order of the input polynomial; i is the independent variable of the public polynomial; j is the independent variable of the private polynomial; a i is the ith coefficient of the public polynomial; b j is the j-th coefficient of the private polynomial.

[0012] Optionally, splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial includes: splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial based on a Toeplitz matrix.

[0013] Optionally, the method of splitting the accumulator polynomial into m sub-polynomials of the accumulator polynomial based on the Toeplitz matrix includes: expressing the accumulator polynomial as an n-order matrix and a corresponding n-order vector to obtain an initial matrix; based on the symmetric property of the Toeplitz matrix, splitting the initial matrix into m corresponding sub-polynomials of the accumulator polynomial; the method further includes: based on the obtained m sub-polynomials of the accumulator polynomial, performing public polynomial splitting and private polynomial splitting respectively, and correspondingly obtaining m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial; wherein the sub-polynomials of the accumulator polynomial are represented by addition and subtraction linear expressions of the corresponding m sub-polynomials of the public polynomial and the m sub-polynomials of the private polynomial based on sign characteristics.

[0014] Optionally, splitting the public polynomial includes: dividing the coefficients of the public polynomial into m equal parts, and the coefficients of each part of the public polynomial form a sub-polynomial of the public polynomial; splitting the private polynomial includes: dividing the coefficients of the private polynomial into m equal parts, and the coefficients of each part of the private polynomial form a sub-polynomial of the private polynomial.

[0015] Optionally, before performing loop calculation based on the sub-polynomials of the accumulator polynomial, the method further includes: determining a loop rule based on the sub-polynomials of the multiple accumulator polynomials obtained by splitting; performing loop calculation based on the sub-polynomials of the accumulator polynomial includes: performing loop calculation based on the sub-polynomials of the accumulator polynomial and the loop rule.

[0016] Optionally, the loop rule is determined based on the sub-polynomials of the multiple accumulator polynomials obtained by splitting, including: determining that the order of the input polynomial is n, and the number of sub-polynomials of the accumulator polynomial is m, and then determining the loop rule to be a loop rule including n / m outer loops and n / m inner loops; wherein the outer loop is a loop based on updating the public polynomial independent variable; and the inner loop is a loop based on updating the private polynomial independent variable.

[0017] Optionally, the loop rule of the outer loop is: determine the outer loop index to be 0 to n / m-1; where n is the order of the input polynomial; m is the number of sub-polynomials of the accumulator polynomial; starting from 0, each time the outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; assign values ​​to the public polynomial independent variables based on the corresponding outer loop index to obtain the sub-polynomials of the m public polynomials after the assignment.

[0018] Optionally, the loop rule of the inner loop is: introduce the sub-polynomials of the m public polynomials obtained in each outer loop into the inner loop, and assign the private polynomial independent variable based on the inner loop index; wherein, the inner loop index is determined to be n / m-1 to 0; starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is reduced by 1 based on the inner loop index of the previous inner loop; perform point-to-point coefficient multiplication based on the introduced sub-polynomial of the public polynomial and the assigned sub-polynomial of the private polynomial to obtain m 2 coefficient multiplication results; perform linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; each time an operation result is obtained, a shift operation is performed to the left on the private polynomial based on the shift and addition principle.

[0019] Optionally, all loop calculations are completed based on the loop rule to obtain the calculation result of the cumulative polynomial, including: until the outer loop index is n / m-1 and the inner loop index is 0, after completing this loop calculation, the cumulative polynomial of the calculation result of the previous loop is updated based on the calculation result after this loop calculation, and the loop calculation is stopped, and the final updated cumulative polynomial calculation result is output as the calculation result of the cumulative polynomial.

[0020] The second aspect of the present invention provides a polynomial multiplication processing system applied to a lattice cryptographic algorithm, the system comprising: a collection unit, used to collect data encoded based on a lattice cryptographic algorithm, and obtain a corresponding input key based on the encoded data; a processing unit, used to: identify an input polynomial of the input key, and obtain a corresponding accumulator polynomial based on the input polynomial; split the accumulator polynomial into m sub-polynomials of the accumulator polynomial; perform a cyclic calculation based on the sub-polynomials of the accumulator polynomial; the cyclic calculation is to assign values ​​to the coefficients of the input polynomial one by one, and perform calculations of the sub-polynomials of the accumulator polynomial based on the assigned input polynomial; a solving unit, used to complete all cyclic calculations, obtain a calculation result of the accumulator polynomial, and decode the encoded data based on the calculation result to obtain corresponding decoded data.

[0021] Optionally, the input polynomial includes: a public polynomial and a secret polynomial in a lattice cryptographic algorithm; wherein the public polynomial and the secret polynomial have the same order; the input key includes: an input public key and an input private key; the input polynomial of the input public key is a public polynomial; the input polynomial of the input private key is a secret polynomial; before performing a loop calculation based on a sub-polynomial of the accumulator polynomial, the processing unit is further used to: determine that the order of the input polynomial is n, and the number of sub-polynomials of the accumulator polynomial is m, then determine that the loop rule is a loop rule including n / m outer loops and n / m inner loops; wherein the outer loop is a loop based on updating the public polynomial independent variable; and the inner loop is a loop based on updating the secret polynomial independent variable.

[0022] Optionally, the loop rule of the outer loop is: determine the outer loop index to be 0~n / m-1; where n is the order of the input polynomial; m is the number of sub-polynomials of the accumulated polynomial; starting from 0, each time the outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; assign values ​​to the public polynomial independent variables based on the corresponding outer loop index to obtain m sub-polynomials of the assigned public polynomial; the loop rule of the inner loop is: introduce the sub-polynomials of the m public polynomials obtained in each outer loop into the inner loop, and assign values ​​to the private polynomial independent variables based on the inner loop index; where the inner loop index is determined to be n / m-1~0; starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is reduced by 1 based on the inner loop index of the previous inner loop; perform point-to-point coefficient multiplication based on the introduced sub-polynomial of the public polynomial and the sub-polynomial of the assigned private polynomial to obtain m 2 coefficient multiplication results; perform linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; each time an operation result is obtained, a shift operation is performed to the left on the private polynomial based on the shift and addition principle.

[0023] Optionally, the processing unit includes: m MAC units, used to execute inner loop operations of the introduced m public polynomials; a circular shift buffer unit, used to update the outer loop index and the inner loop index; multiple RAM memories, used to sequentially store the coefficients of the public polynomials and realize the coefficient reading of the public polynomials; and a coefficient centralized distribution circuit, used to multiply the coefficients of the read secret polynomials by multiples through a shift-addition table lookup mode.

[0024] Optionally, the multiple RAM memories share a clock.

[0025] Optionally, each MAC unit is composed of m selectors and m adders.

[0026] On the other hand, the present invention provides a computer-readable storage medium having instructions stored thereon, which, when executed on a computer, enables the computer to execute the above-mentioned polynomial multiplication processing method applied to a lattice cryptographic algorithm.

[0027] Through the above technical solution, the textbook multiplication is similar to the convolution operation, and the entire polynomial multiplication is completed in the form of multiplication accumulation. Although the algorithm complexity of the above algorithm is much lower than that of the textbook multiplication algorithm, it is difficult to achieve a very high degree of parallelism due to the dependence of the internal data of the multiplication. On the contrary, the textbook multiplication is very suitable for high-performance and high-throughput hardware implementation because of its simplicity and accuracy. The scheme of the present invention makes full use of the advantages of textbook multiplication, expands the entire inner loop in parallel to improve the overall throughput, and uses the special symmetry of its matrix to simplify the linear relationship of the cumulative expression, so as to achieve the effect of omitting the negative convolution step in a large proportion of textbook multiplication, and the algorithm of the present invention can provide a higher degree of parallelism of point-to-point coefficient multiplication. The processing time of polynomial multiplication is shortened, and the consumption of hardware resources is greatly reduced.

[0028] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0030] Figure 1 It is a flowchart of the steps of a polynomial multiplication processing method applied to a lattice cryptographic algorithm provided by one embodiment of the present invention;

[0031] Figure 2 It is a system structure diagram of a polynomial multiplication processing system applied to a lattice cryptographic algorithm provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0032] The specific implementation of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present invention, and is not used to limit the present invention.

[0033] The security of traditional cryptographic algorithms, including block ciphers and public key cryptography, is based on certain mathematical problems that cannot be cracked by computers or human power in polynomial time. However, since the emergence of decomposition algorithms for these mathematical problems, the rapid development of quantum computers that can use such algorithms has caused people to have greater concerns about information security. For example, in quantum computers, there is a Shor algorithm, which is a quantum algorithm (an algorithm that runs on a quantum computer) for the problem of integer decomposition. It solves the following problem: given an integer N, find its prime factors. Shor's algorithm is very important because it means that if we use quantum computers, we can use it to crack the widely used public key encryption method, namely the RSA encryption algorithm. The basis of the RSA algorithm is the assumption that we cannot efficiently decompose a known integer. As far as we know, this assumption is true for traditional (that is, non-quantum) computers; there is no known traditional algorithm that can solve this problem in polynomial time. However, Shor's algorithm shows that the problem of factorization can be solved efficiently on a quantum computer, so a large enough quantum computer can crack RSA. This is a great motivation for building quantum computers and researching new quantum computer algorithms.

[0034] It can be seen that in the future of quantum computer development, encryption and decryption such as Shor's algorithm will become very simple. Although it will bring certain benefits, these quantum computer algorithms will become very dangerous for the data that users want to encrypt. In order to protect user data, it is necessary to propose an encryption algorithm that cannot be decrypted by quantum computers, and lattice cryptography is one of them. Lattice cryptography is a type of public key cryptographic system that has received much attention and is resistant to quantum computing attacks. It uses the concept of lattice in mathematical structures for encoding and decoding. Simply put, it encodes data to a secure lattice point, and only the private key for solving can find this point. Because it needs to be solved based on the vector product in the lattice point, in the lattice cryptographic algorithm, for the corresponding public polynomials and private polynomials, the process of implementing the algorithm inevitably involves a large number of polynomial multiplications. However, as the order of polynomial multiplication increases, its calculation process will become very large, and in order to cope with this huge amount of calculation, it will take up most of the computing time and resource costs. In the current Saber key encapsulation scheme, the mainstream polynomial multiplication algorithms include the fast number theory algorithm (Number Theoretic Transform, NTT) with the lowest time complexity, Karatsuba algorithm, Toom-Cook algorithm, and textbook multiplication that does not reduce any complexity, that is, does not reduce the number of point-to-point coefficient multiplications. These algorithms do not fundamentally solve the problem of excessive computing time and resource costs.

[0035] In response to this problem, the scheme of the present invention proposes a polynomial multiplication calculation method for polynomial multiplication calculation in a lattice cryptographic algorithm. The textbook multiplication is similar to a convolution operation, and the entire polynomial multiplication is completed in the form of multiplication accumulation. Although the algorithm complexity of the above algorithm is much lower than that of the textbook multiplication algorithm, it is difficult to achieve a very high degree of parallelism due to the dependence of the internal data of the multiplication. On the contrary, the textbook multiplication is very suitable for hardware high-performance and high-throughput implementation because of its simplicity and accuracy. The scheme of the present invention makes full use of the advantages of textbook multiplication, expands the entire inner loop in parallel to improve the overall throughput, and reduces a large amount of hardware resource consumption by using the centralized distribution of multiple coefficients. The special symmetry of the matrix is ​​used to simplify the linear relationship of the cumulative expression, so as to achieve the effect of omitting the negative convolution step in the 3 / 4 ratio textbook multiplication, and the algorithm of the present invention can provide a higher degree of parallelism of point-to-point coefficient multiplication.

[0036] Figure 1 1 is a method flow chart of a polynomial multiplication processing method applied to a lattice cryptographic algorithm provided by one embodiment of the present invention. Figure 1 As shown, an embodiment of the present invention provides a polynomial multiplication processing method applied to a lattice cryptographic algorithm, the method comprising:

[0037] Step S10: Collect data encoded based on the lattice cipher algorithm, obtain a corresponding input key based on the encoded data, identify an input polynomial of the input key, and obtain a corresponding accumulator polynomial based on the input polynomial.

[0038] Specifically, the input polynomial includes: a public polynomial and a secret polynomial in a lattice cryptographic algorithm; wherein the public polynomial and the secret polynomial have the same order.

[0039] In the embodiment of the present invention, in simple terms, the lattice cipher is based on multiplying a public polynomial with a self-held private key to obtain a result, and then sending the public polynomial and the result to the other party, who decodes and verifies based on the common private key. Among them, the private key is the corresponding secret polynomial, which is often expressed as: The public polynomial is a public polynomial, often expressed as: The coefficients in the secret polynomial are all in the set range of {-4,-3,-2,-1,0,1,2,3,4}. Because encoding and decoding are based on the private key to solve and verify the product, that is, to find the prime factors of the corresponding number, in order to control the difficulty of decoding, the value needs to be limited to a certain ring field. The prime factors of positive integers are the most controllable, so it is necessary to limit each coefficient of the public polynomial to no more than 2. 10 A positive integer.

[0040] The textbook multiplication algorithm is a multiplication algorithm determined based on the rule of polynomial multiplication of polynomials, that is, each term of a polynomial is multiplied by each term of another polynomial, and then the products are added. The scheme of the present invention constructs a textbook multiplication algorithm based on the input polynomial to obtain a corresponding cumulative polynomial, which is expressed as:

[0041]

[0042] Where n is the order of the input polynomial; i is the independent variable of the public polynomial; j is the independent variable of the private polynomial; a i is the ith coefficient of the public polynomial; b j is the j-th coefficient of the private polynomial.

[0043] Step S20: split the accumulative polynomial into m sub-polynomials of the accumulative polynomial.

[0044] Specifically, the accumulative polynomial is represented as an n-order matrix and a corresponding n-order vector to obtain an initial matrix; based on the symmetric property of the Toeplitz matrix, the initial matrix is ​​split into m corresponding sub-polynomials of the accumulative polynomial; the method further comprises: based on the obtained m sub-polynomials of the accumulative polynomial, public polynomial splitting and private polynomial splitting are respectively performed to obtain m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial; wherein the sub-polynomials of the accumulative polynomial are represented by addition and subtraction linear expressions of the corresponding m sub-polynomials of the public polynomial and the m sub-polynomials of the private polynomial based on the sign characteristics.

[0045] Specifically, the public polynomial is split, including: dividing the coefficients of the public polynomial into m parts, and the coefficients of each part of the public polynomial form a sub-polynomial of the public polynomial; the private polynomial is split, including: dividing the coefficients of the private polynomial into m parts, and the coefficients of each part of the private polynomial form a sub-polynomial of the private polynomial.

[0046] Toeplitz matrix is ​​also called Toeplitz matrix, or T-type matrix for short. The elements on the main diagonal of the Toeplitz matrix are equal, and the elements on the lines parallel to the main diagonal are also equal; the elements in the matrix are symmetric about the secondary diagonal, that is, the T-type matrix is ​​a secondary symmetric matrix. Simple T-shaped matrices include forward displacement matrices and backward displacement matrices. In the mathematical software Matlab, the function to generate a Toeplitz matrix is: toeplitz(x,y). It generates a Toeplitz matrix with x as the first column and y as the first row. Here, x and y are both vectors, and they do not have to be of equal length. Because in the lattice code, it involves the multiplication of two polynomials. After being expressed by the product of the matrix and the vector, it has the symmetric structure of the Toeplitz matrix, that is, matrix processing can be performed based on the characteristics of the Toeplitz matrix itself.

[0047] In a possible implementation, for example, if the order of the input polynomial is 256, the above accumulative polynomial is represented as a 256-order matrix multiplied by a 256-order vector, and then based on the symmetric property of the Toeplitz matrix, the 16 sub-matrices of the 256-order matrix are further simplified to 4 sub-matrices, and the final accumulative polynomial C is obtained. 0 -C 3 , specifically:

[0048]

[0049] C 0 -C 3 All are 64-order vectors. Finally, the present invention obtains a high-performance polynomial multiplication algorithm using the Toeplitz matrix to accelerate the textbook algorithm. The present invention splits the complex polynomial into several parallel sub-polynomials to facilitate subsequent parallel processing, and finally summarizes and updates based on the parallel processing results, thereby improving throughput, reducing hardware resource consumption, and improving computing efficiency.

[0050] Step S30: performing a loop calculation based on the sub-polynomials of the accumulator polynomial.

[0051] Specifically, the loop rule is determined based on the sub-polynomials of the multiple accumulator polynomials obtained by splitting, including: determining that the order of the input polynomial is n, and the number of sub-polynomials of the accumulator polynomial is m; then determining a loop rule including n / m outer loops and n / m inner loops; wherein the outer loop is a loop based on updating the public polynomial independent variable; and the inner loop is a loop based on updating the private polynomial independent variable.

[0052] The loop rule of the outer loop is: determine the index of the outer loop to be 0~n / m-1; where n is the order of the input polynomial; m is the number of sub-polynomials of the accumulated polynomial; starting from 0, each time the outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; based on the corresponding outer loop index, the public polynomial independent variable is assigned to obtain the assigned m sub-polynomials of the public polynomial. The loop rule of the inner loop is: introduce the sub-polynomials of the m public polynomials obtained in each outer loop into the inner loop, and assign the private polynomial independent variable based on the inner loop index; where the inner loop index is n / m-1~0; starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is reduced by 1 based on the inner loop index of the previous inner loop; perform point-to-point coefficient multiplication based on the introduced sub-polynomial of the public polynomial and the assigned sub-polynomial of the private polynomial to obtain m 2 coefficient multiplication results; performing linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; and updating the accumulator polynomial once based on the operation result each time an operation result is obtained.

[0053] For example, the input polynomial has an order of 256. The entire polynomial multiplication is divided into two loops, each with 64 steps. The index of the outer loop starts from 0 to 63, and the index of the inner loop starts from 63 to 0. The step size is 1. A single loop includes 16 point-to-point coefficient multiplications. The public polynomial is also divided into 4 parts, each with 64 coefficients. According to the index of each outer loop of the coefficient, the coefficients of 4 public polynomials separated by 64 orders will enter the inner loop operation. In the entire inner loop, the coefficients of the secret polynomial are divided into 4 parts, each with 64 coefficients, and are assigned to B according to the index of the inner loop. 0 , B 1 , B 2 , B 3 After the point-to-point coefficient multiplication and linear operations of addition and subtraction of four 64-dimensional vectors are completed, they are added to the accumulator polynomial to update the polynomial.

[0054] Step S40: complete all loop calculations, obtain the calculation result of the cumulative polynomial, decode the encoded data based on the calculation result, and obtain corresponding decoded data.

[0055] Specifically, the method completes all loop calculations based on the loop rule to obtain the calculation result of the cumulative polynomial, including: until the outer loop index is n / m-1 and the inner loop index is 0, after completing this loop calculation, the cumulative polynomial of the calculation result of the previous loop is updated based on the calculation result after this loop calculation, and the loop calculation is stopped, and the final updated cumulative polynomial calculation result is output as the calculation result of the cumulative polynomial.

[0056] In a possible implementation, taking two polynomials with n=8 as an example, the two polynomials are as follows:

[0057] a(x)=0+x+2x 2 +3x 3 +4x 4 +5x 5 +6x 6 +7x 7

[0058] v(x)=1+x+x 2 +x 3 +x 4 +x 5 +x 6 +x 7

[0059] First, the polynomial a(x) will be considered as a public polynomial and b(x) as a secret polynomial. The order of both is n=8, so only two outer loops are needed to complete the polynomial multiplication, that is, i=0 / 1. When i=0, a[0]=0, a[1]=2, a[2]=4, a[3]=6, and specific point-to-point coefficient multiplication is performed according to the index of the inner loop j. After the inner loop is completed, the secret polynomial b(x) will undergo a cyclic shift operation, as shown in Table 1:

[0060]

[0061] Table 1 Cyclic shift operation timing table

[0062] When i=1, a[0]=1, a[1]=3, a[2]=5, a[3]=7, and the above operations are performed to complete a polynomial multiplication.

[0063] Figure 2 1 is a system structure diagram of a polynomial multiplication processing system applied to a lattice cryptographic algorithm provided by one embodiment of the present invention. Figure 2 As shown, an embodiment of the present invention provides a polynomial multiplication processing system applied to a lattice cryptographic algorithm, the system comprising: a collection unit, used to collect an input polynomial of the lattice cryptographic algorithm; a processing unit, used to: construct a textbook multiplication algorithm based on the input polynomial to obtain a corresponding accumulator polynomial; the textbook multiplication algorithm is a multiplication algorithm determined based on the polynomial multiplication rule; based on the Toeplitz matrix, the accumulator polynomial is split into multiple sub-polynomials of the accumulator polynomial; based on the sub-polynomials of the multiple accumulator polynomials obtained by splitting, a loop rule is determined, and a loop calculation is performed based on the sub-polynomials and the loop rule; a solving unit, used to complete all loop calculations based on the loop rule to obtain the calculation result of the accumulator polynomial.

[0064] Preferably, the input polynomial includes: a public polynomial and a secret polynomial in a lattice cryptographic algorithm; wherein the public polynomial and the secret polynomial have the same order; the determining of the loop rule based on the order of the input polynomial includes: determining that the order of the input polynomial is n, and the number of sub-polynomials of the accumulator polynomial is m; then determining a loop rule including n / m outer loops and n / m inner loops; wherein the outer loop is a loop based on updating the public polynomial independent variable; and the inner loop is a loop based on updating the secret polynomial independent variable.

[0065] Preferably, the loop rule of the outer loop is: determine the index of the outer loop to be 0 to n / m-1; wherein n is the order of the input polynomial; m is the number of sub-polynomials of the accumulator polynomial; starting from 0, each time the outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; assign values ​​to the public polynomial independent variables based on the corresponding outer loop index to obtain the assigned m sub-polynomials of the public polynomial; the loop rule of the inner loop is: introduce the sub-polynomials of the m public polynomials obtained in each outer loop into the inner loop, and assign values ​​to the private polynomial independent variables based on the inner loop index; wherein the inner loop index is n / m-1 to 0; starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is decreased by 1 based on the inner loop index of the previous inner loop; perform point-to-point coefficient multiplication based on the introduced sub-polynomials of the public polynomials and the assigned sub-polynomials of the private polynomials to obtain m 2 coefficient multiplication results; performing linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; and updating the accumulator polynomial once based on the operation result each time an operation result is obtained.

[0066] Preferably, the processing unit includes: m MAC units, used to execute inner loop operations on the introduced m public polynomials; a circular shift buffer unit, used to update the outer loop index and the inner loop index; multiple RAM memories, used to sequentially store the coefficients of the public polynomials and realize the coefficient reading of the public polynomials; a coefficient centralized distribution circuit, used to multiply the coefficients of the read secret polynomials by multiples through a shift-addition table lookup mode.

[0067] Specifically, taking the input polynomial of order 256 as an example, two dual-port RAMs share a clock and can access the memory at the same time through two ports. The 256 coefficients of the public polynomial are stored in the RAM according to the address sequence, and the bit width is 13 bits. At the beginning of multiplication, the dual address of a single dual-port RAM in each cycle will be incremented from 0 to directly read the coefficients of the four public polynomials. In order to meet the requirement of reading the coefficients of the four public polynomials at the same time in one cycle, at the same time, because the coefficients of the public polynomials have a large bit width, it is not suitable to read all of them into the cache unit of the multiplier in advance, which will occupy a large amount of resources.

[0068] Preferably, taking the input polynomial as an example of order 256, the coefficient centralized distribution circuit multiplies the coefficients of the four public polynomials read out by multiples of 0-4. Because the absolute value of the coefficient of the secret polynomial in the lattice cipher is within {0,1,2,3,4}, the multiple is small, so the shift addition method is used to replace the traditional multiplier. Shift addition means that in hardware, when the coefficient is multiplied by 2 and 4, it can be arithmetic shifted to the left by 1 or 2 bits, and the obtained 2 times coefficient and 4 times coefficient can be added to the original coefficient to obtain 3 times or 5 times coefficient. The multiples of these five coefficients can obtain the correct multiplication result through the lookup table (also called selector). The multiples of these coefficients will all enter the MAC unit.

[0069] Preferably, taking the input polynomial as an example of order 256, the secret polynomial cyclic shift buffer unit is composed of a shift register, which loads all secret polynomial coefficients before multiplication begins, and arithmetic cyclic shifts a coefficient with opposite sign in each cycle after multiplication begins. The buffer unit enters the 256 coefficients into the 256 MAC units according to the index, and uses them as the control signal of the selector in the MAC unit to select the multiple of the corresponding public polynomial coefficient.

[0070] Preferably, taking the input polynomial as an example of order 256, the MAC unit is the lowest-level basic operation unit, which consists of 4 selectors and 4 adders. A single inner loop corresponds to 4 MAC units. The coefficient multiples of the public polynomial are selected according to the 4 secret polynomial coefficients entering the MAC unit, and then the linear operations are performed separately. Therefore, there are 64 groups of 256 MAC units, corresponding to 64 times of the inner loop. The secret polynomial shift buffer unit first loads 256 secret polynomial coefficients. When multiplication starts, each cycle will read the public polynomial coefficients separated by 64 orders from two dual-port RAMs, and the order will increase by one order each cycle.

[0071] Preferably, taking the input polynomial as an example of order 256, the 4 public polynomial coefficients read out will obtain their own 4 multiple values ​​through the coefficient centralized distribution circuit and enter the 256 MAC units. A single MAC unit receives 4 secret polynomial coefficients at the same time, and performs addition and subtraction linear operations to update the accumulator register. At the beginning of the next cycle, the secret polynomial shift buffer unit will perform a circular shift to the left, which is the negative convolution operation in the polynomial multiplication. After 64 cycles, the entire multiplication operation is completed.

[0072] An embodiment of the present invention further provides a computer-readable storage medium, on which instructions are stored, which, when executed on a computer, enable the computer to execute the above-mentioned polynomial multiplication processing method applied to the lattice cryptographic algorithm.

[0073] Those skilled in the art will understand that all or part of the steps in the method for implementing the above-mentioned embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a single-chip microcomputer, a chip or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0074] The optional embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the technical concept of the embodiments of the present invention, the technical scheme of the embodiments of the present invention can be subjected to a variety of simple modifications, and these simple modifications all belong to the protection scope of the embodiments of the present invention. It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the embodiments of the present invention will not further describe various possible combinations.

[0075] In addition, various embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the embodiments of the present invention, they should also be regarded as the contents disclosed in the embodiments of the present invention.

Claims

1. A polynomial multiplication processing method applied to a lattice cryptographic algorithm, characterized in that: The method comprises: S10) collecting data encoded based on a lattice cryptographic algorithm, obtaining a corresponding input key based on the encoded data, identifying an input polynomial of the input key, and obtaining a corresponding accumulator polynomial based on the input polynomial; wherein, The obtaining of the accumulator polynomial based on the input polynomial comprises: Constructing a textbook multiplication algorithm based on the input polynomial to obtain a corresponding accumulator polynomial; the textbook multiplication algorithm is a multiplication algorithm determined based on the polynomial multiplication rule; The input polynomial includes: a public polynomial and a private polynomial in a lattice cryptographic algorithm; wherein the public polynomial and the private polynomial have the same order; The input key includes: an input public key and an input private key; the input polynomial of the input public key is a public polynomial; the input polynomial of the input private key is a secret polynomial; S20) splitting the cumulative polynomial into m cumulative polynomial sub-polynomials; comprising: Splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial based on a Toeplitz matrix; The step of splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial based on the Toeplitz matrix includes: Representing the cumulative polynomial as an n-order matrix and a corresponding n-order vector to obtain an initial matrix; Based on the symmetric property of the Toeplitz matrix, the initial matrix is ​​split into m corresponding sub-polynomials of the cumulative polynomial; The method further comprises: Based on the obtained m sub-polynomials of the cumulative polynomial, the public polynomial splitting and the private polynomial splitting are performed respectively, and m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial are obtained accordingly; wherein, The sub-polynomials of the accumulator polynomial are represented by linear addition and subtraction operations based on the sign characteristics of the corresponding m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial; S30) performing a loop calculation based on the sub-polynomials of the accumulator polynomial; the loop calculation is to assign values ​​to the coefficients of the input polynomial one by one, and perform calculations on the sub-polynomials of the accumulator polynomial based on the assigned input polynomials; S40) Complete all cyclic calculations to obtain the calculation result of the cumulative polynomial, and decode the encoded data based on the calculation result to obtain corresponding decoded data.

2. The method according to claim 1, characterized in that Each coefficient of the public polynomial is no more than 2 10 A positive integer.

3. The method according to claim 1, characterized in that The cumulative polynomial is expressed as: Where n is the order of the input polynomial; i is the independent variable of the public polynomial; j is the independent variable of the private polynomial; a i is the i-th coefficient of the public polynomial; b j is the jth coefficient of the private polynomial.

4. The method according to claim 1, wherein Perform public polynomial splitting, including: Divide the coefficients of the public polynomial into m equal parts, and each coefficient of the public polynomial forms a sub-polynomial of the public polynomial; Perform private polynomial splitting, including: Divide the coefficients of the private polynomial into m equal parts, and the coefficients of each part of the private polynomial form a sub-polynomial of the private polynomial.

5. The method according to claim 1, characterized in that Before performing the loop calculation based on the sub-polynomials of the accumulator polynomial, the method further includes: determining a loop rule based on sub-polynomials of the plurality of cumulative polynomials obtained by splitting; The performing of cyclic encryption / decryption calculation based on the sub-polynomial of the accumulator polynomial comprises: A cyclic encryption / decryption calculation is performed based on the sub-polynomials of the accumulator polynomial and the cyclic rule.

6. The method according to claim 5, characterized in that The determining of the loop rule based on the sub-polynomials of the multiple cumulative polynomials obtained by splitting includes: Determine that the order of the input polynomial is n, the number of sub-polynomials of the accumulator polynomial is m, and then determine that the loop rule is a loop rule including n / m outer loops and n / m inner loops; wherein, The outer loop is a loop based on updating the public polynomial argument; The inner loop is a loop based on updating the private polynomial argument.

7. The method according to claim 6, characterized in that The loop rules of the outer loop are: Determine the outer loop index from 0 to n / m-1; where n is the order of the input polynomial; and m is the number of subpolynomials in the accumulator polynomial. Starting from 0, each time an outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; The public polynomial variables are assigned values ​​based on the corresponding outer loop indexes to obtain m sub-polynomials of the public polynomial after the assignments.

8. The method according to claim 6, characterized in that The loop rules of the inner loop are: The m sub-polynomials of the public polynomial obtained in each outer loop are introduced into the inner loop, and the private polynomial independent variables are assigned based on the inner loop index; wherein, Determine the inner loop index to be n / m-1~0; Starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is reduced by 1 based on the inner loop index of the previous inner loop; Based on the introduced sub-polynomials of the public polynomial and the assigned sub-polynomials of the private polynomial, point-to-point coefficient multiplication is performed to obtain m 2 The result of multiplying coefficients; Perform linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; Each time an operation result is obtained, a shift operation is performed on the private polynomial to the left based on the shift-and-add principle.

9. The method according to claim 8, characterized in that The step of completing all cyclic calculations to obtain the calculation result of the cumulative polynomial includes: Until the outer loop index is n / m-1 and the inner loop index is 0, after completing the current loop calculation, the cumulative polynomial of the calculation result of the previous loop is updated based on the calculation result after the current loop calculation, and the loop calculation is stopped, and the final updated cumulative polynomial calculation result is output as the calculation result of the cumulative polynomial.

10. A polynomial multiplication processing system applied to a lattice cryptographic algorithm, characterized in that: The system comprises: an acquisition unit, configured to collect data encoded based on a lattice cryptographic algorithm and obtain a corresponding input key based on the encoded data; A processing unit for: and identifying an input polynomial of the input key, and obtaining a corresponding accumulator polynomial based on the input polynomial; wherein, The obtaining of the accumulator polynomial based on the input polynomial comprises: Constructing a textbook multiplication algorithm based on the input polynomial to obtain a corresponding accumulator polynomial; the textbook multiplication algorithm is a multiplication algorithm determined based on the polynomial multiplication rule; The input polynomial includes: a public polynomial and a private polynomial in a lattice cryptographic algorithm; wherein the public polynomial and the private polynomial have the same order; The input key includes: an input public key and an input private key; the input polynomial of the input public key is a public polynomial; the input polynomial of the input private key is a secret polynomial; Splitting the cumulative polynomial into m cumulative polynomial sub-polynomials; comprising: Splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial based on a Toeplitz matrix; The step of splitting the cumulative polynomial into m sub-polynomials of the cumulative polynomial based on the Toeplitz matrix includes: Representing the cumulative polynomial as an n-order matrix and a corresponding n-order vector to obtain an initial matrix; Based on the symmetric property of the Toeplitz matrix, the initial matrix is ​​split into m corresponding sub-polynomials of the cumulative polynomial; Also includes: Based on the obtained m sub-polynomials of the cumulative polynomial, the public polynomial splitting and the private polynomial splitting are performed respectively, and m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial are obtained accordingly; wherein, The sub-polynomials of the accumulator polynomial are represented by linear addition and subtraction operations based on the sign characteristics of the corresponding m sub-polynomials of the public polynomial and m sub-polynomials of the private polynomial; Executing a cyclic calculation based on the sub-polynomials of the accumulator polynomial; the cyclic calculation is to assign values ​​to the coefficients of the input polynomial one by one, and executing the calculation of the sub-polynomials of the accumulator polynomial based on the assigned input polynomials; The solving unit is used to complete all cyclic calculations, obtain the calculation results of the cumulative polynomial, and decode the encoded data based on the calculation results to obtain corresponding decoded data.

11. The system according to claim 10, wherein: Before performing the loop calculation based on the sub-polynomials of the accumulator polynomial, the processing unit is further configured to: Determining a loop rule based on the order of the input polynomial includes: Determine that the order of the input polynomial is n, the number of sub-polynomials of the accumulator polynomial is m, and then determine that the loop rule is a loop rule including n / m outer loops and n / m inner loops; wherein, The outer loop is a loop based on updating the public polynomial argument; The inner loop is a loop based on updating the private polynomial argument.

12. The system according to claim 11, wherein: The loop rules of the outer loop are: Determine the outer loop index from 0 to n / m-1; where n is the order of the input polynomial; and m is the number of subpolynomials in the accumulator polynomial. Starting from 0, each time an outer loop is executed, the corresponding outer loop index is increased by 1 based on the outer loop index of the previous outer loop; Assign values ​​to the public polynomial independent variables based on the corresponding outer loop indexes to obtain m sub-polynomials of the public polynomial after the assignments; The loop rules of the inner loop are: The m sub-polynomials of the public polynomial obtained in each outer loop are introduced into the inner loop, and the private polynomial independent variables are assigned based on the inner loop index; wherein, Determine the inner loop index to be n / m-1~0; Starting from n / m-1, each time the inner loop is executed, the corresponding inner loop index is reduced by 1 based on the inner loop index of the previous inner loop; Based on the introduced sub-polynomials of the public polynomial and the assigned sub-polynomials of the private polynomial, point-to-point coefficient multiplication is performed to obtain m 2 The result of multiplying coefficients; Perform linear addition and subtraction operations on all coefficient multiplication results according to their sign characteristics to obtain corresponding operation results; Each time an operation result is obtained, a shift operation is performed on the private polynomial to the left based on the shift-and-add principle.

13. The system according to claim 12, wherein: The processing unit includes: m MAC units, used to execute inner loop operations of the introduced m public polynomials; Circular shift buffer unit, used for updating outer loop index and inner loop index; A plurality of RAM memories, for sequentially storing coefficients of a public polynomial and realizing reading the coefficients of the public polynomial; The coefficient centralized distribution circuit is used for multiplying the coefficients of the read secret polynomial by multiples through a shift-add table lookup mode.

14. The system according to claim 13, wherein: The plurality of RAM memories share a common clock.

15. The system according to claim 13, wherein: Each MAC unit consists of m selectors and m adders.

16. A computer-readable storage medium having instructions stored thereon, which, when executed on a computer, enables the computer to execute the polynomial multiplication processing method applied to a lattice cryptographic algorithm as claimed in any one of claims 1 to 9.

Images