A memory suitable for a post-quantum cryptography algorithm kyber instruction set architecture
By designing an instruction set architecture suitable for the post-quantum cryptography algorithm Kyber, and combining memory selection and operation function selection, the problem of not being able to balance high-performance hardware design and highly flexible programmable systems in existing technologies is solved, realizing efficient Kyber algorithm execution and diverse information security applications.
Patent Information
- Application Number
- CN202310223149.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Priority Date
- 2023-03-02
- Filing Date
- 2023-03-08
- Publication Date
- 2025-10-24
- Estimated Expiration
- 2043-03-08
AI Technical Summary
The existing Kyber instruction set architecture for post-quantum cryptography algorithms cannot simultaneously satisfy the requirements of high-performance hardware design and highly flexible programmable systems.
An instruction set architecture suitable for the post-quantum cryptography algorithm Kyber was designed, including memory selection, data block selection, and operation function selection instructions. It adopts a segmented decoding method, supports polynomial operations and hash evaluation, and achieves a 32-bit instruction length.
It achieves a balance between efficient hardware design and programmable systems, enabling the completion of the full PKE and KEM processes for the three security levels of the Kyber quantum cryptography algorithm, and is suitable for diverse information security scenarios in the future quantum computing era.
Smart Images
Figure CN116318670B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of post-quantum information security algorithm and digital signal processing implementation, and particularly relates to a memory suitable for a post-quantum cryptographic algorithm Kyber instruction set architecture. BACKGROUND
[0002] In recent years, quantum computers have developed rapidly. For example, in 2019, Google published a paper on quantum superiority in Nature, claiming that it took 3 minutes and 20 seconds for a quantum computer to complete a calculation that the world's most powerful supercomputer Summit would take 10,000 years to complete. In 2020, China's 76-photon quantum computing prototype machine "Jiuzhang" was introduced, which claimed that its computing speed was 100 billion times that of Google's "sycamore", and the necessity of researching and deploying public key cryptography systems that can resist quantum computer attacks was raised to an unprecedented height. The CRYSTALS-KYBER (also known as Kyber) public key encryption algorithm has become a hot spot for post-quantum cryptography research due to its advantages of resisting quantum attacks, high efficiency, small key length, and easy implementation.
[0003] Various post-quantum cryptographic algorithm Kyber implementation schemes on various platforms have been proposed. Software (SW) implementation provides programming capabilities, flexibility, and shorter design cycles, while hardware (HW) implementation can accelerate specialized computing and significantly increase the throughput of the system. In recent years, great progress has been made in the research of using hardware-software (HW / SW) co-design to implement cryptographic systems. Compared with pure hardware schemes, this method makes the design more portable, more controllable / programmable, shorter in design cycle, and more flexible, but at the cost of requiring an additional general-purpose processor. In addition, this design scheme often cannot achieve good performance. On the other hand, using optimization strategies (including register balancing, parallelization, and resource sharing) can significantly accelerate pure hardware implementation, thereby improving the overall throughput of the hardware architecture. The main difficulty of this strategy is that its manual optimization design requires a long time and loses system flexibility. To this end, the application provides an instruction set architecture suitable for a post-quantum cryptographic algorithm Kyber, which can simultaneously satisfy high-performance hardware design and high-flexibility programmable systems. SUMMARY
[0004] The technical problem to be solved by the application is that the existing instruction set architecture suitable for the post-quantum cryptographic algorithm Kyber cannot simultaneously satisfy high-performance hardware design and high-flexibility programmable systems, and a new memory suitable for the post-quantum cryptographic algorithm Kyber instruction set architecture is provided.
[0005] In order to solve the above technical problems, the embodiment of the present application provides a memory suitable for a Kyber instruction set architecture of a post-quantum cryptography algorithm, the Kyber instruction set architecture is applied to the memory, and the Kyber instruction set architecture comprises, in sequence, a memory selection instruction, a first source data block selection instruction, a second source data block selection instruction, a destination data block selection instruction, an operation function selection instruction, a blank instruction, a polynomial operation instruction and a hash evaluation instruction.
[0006] The memory selection instruction is used for selecting a memory in which the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are located.
[0007] The first source data block selection instruction is used for selecting a first address in a first source data block.
[0008] The second source data block selection instruction is used for selecting a first address in a second source data block.
[0009] The destination data block selection instruction is used for selecting a first address in a destination data block.
[0010] The operation function selection instruction is used for selecting one of the polynomial operation instruction and the hash evaluation instruction.
[0011] The polynomial operation instruction is an instruction code of polynomial operation, and is used for performing polynomial operation.
[0012] The hash evaluation instruction is an instruction code of hash evaluation, and is used for performing hash operation.
[0013] The instruction set architecture is 32-bit instruction length, and adopts a segmented decoding mode.
[0014] Preferably, the polynomial operation instruction is 5-bit instruction length, and includes 10 different polynomial operations, which are polynomial NTT operation, polynomial INTT operation, polynomial point multiplication operation, polynomial modular addition operation, polynomial encryption modular addition, polynomial decryption modular subtraction, polynomial compression with data bit width of 4, 5, 10 and 11, polynomial decompression with data bit width of 4, 5, 10 and 11, polynomial comparison with data bit width of 4, 5, 10 and 11 and a blank instruction.
[0015] Preferably, the polynomial operation instruction has 32 different instruction codes; the polynomial NTT operation, polynomial INTT operation, polynomial point multiplication operation, polynomial modulo addition operation, polynomial encryption modulo addition, polynomial decryption modulo subtraction and empty instruction each has one instruction code; the polynomial compression with data bit width of 4, 5, 10 and 11, polynomial decompression with data bit width of 4, 5, 10 and 11, and polynomial comparison with data bit width of 4, 5, 10 and 11 each has four instruction codes.
[0016] Preferably, the hash evaluation instruction is 6-bit instruction length, including seven different hash operations, which are SHA512 hash with input length of 256 and 512 bits, sampling error vector, uniform distribution sampling, SHA256 hash with input length of 256 bits, three security level public key hash evaluation, three security level cipher text hash evaluation and empty instruction.
[0017] Preferably, the hash evaluation instruction has 64 different instruction codes; the sampling error vector has 12 instruction codes, and the uniform distribution sampling has 16 instruction codes.
[0018] Preferably, the memory selection instruction is 3-bit instruction length, including three instructions, each of which is 1-bit instruction length; the three instructions of the memory selection instruction select the memory where the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are located by 0 / 1.
[0019] Preferably, the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction each have 4-bit instruction length, and the first address of the data block is determined by the 4-bit instruction, and then the specific address of the required data block is determined.
[0020] Preferably, the operation function selection instruction is 1-bit instruction length, and 0 / 1 is used to select the polynomial operation instruction or the hash evaluation instruction; when the polynomial operation instruction is selected, the hash evaluation instruction will run empty instruction; when the hash evaluation instruction is selected, the polynomial operation instruction will run empty instruction.
[0021] The embodiment of the present application has the following beneficial effects:
[0022] (1) The embodiment of the present application selects data on different memories through a memory selection instruction; determines the specific address of the data through a first source data block selection instruction, a second source data block selection instruction and a destination data block selection instruction; selects different operation functions through an operation function selection instruction; and finally realizes two core operations in Kyber: polynomial operation and hash evaluation through a polynomial operation instruction and a hash evaluation instruction. The embodiment of the present application can balance the efficiency of hardware design and the flexibility of programmable design, and can efficiently and conveniently complete the complete PKE and KEM processes of three security levels of the post-quantum cryptographic algorithm Kyber; and can be used for diversified information security occasions in various industries in the future quantum computer era by customizing programming any single operation in the process. BRIEF DESCRIPTION OF DRAWINGS
[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.
[0024] Figure 1 is a structural schematic diagram of the first embodiment provided by the present application. DETAILED DESCRIPTION
[0025] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0026] Please refer to Figure 1 The embodiment of the present application provides an instruction set architecture suitable for the post-quantum cryptographic algorithm Kyber. The instruction set architecture comprises, in sequence, a memory selection instruction 101 (RAM_CTR), a first source data block selection instruction 102 (Rs1_Addr), a second source data block selection instruction 103 (Rs2_Addr), a destination data block selection instruction 104 (Dst_Addr), an operation function selection instruction 105 (Sel), a blank instruction 106 (Reserved), a polynomial operation instruction 107 (PolyFunc) and a hash evaluation instruction 108 (HashFunc). The instruction set architecture is 32-bit instruction length, and adopts segmented decoding mode.
[0027] The memory selection instruction 101 is used to select the memory 201 (RAM) where the first source data block selection instruction 102, the second source data block selection instruction 103 and the destination data block selection instruction 104 are located. The memory 201 includes RAM1 and RAM2. The memory selection instruction 101 is a 3-bit instruction length, including three instruction segments (A2, A1, A0), each of which is a 1-bit instruction length. The instructions A2, A1 and A0 select the memory 201 by 0 / 1, where 0 is RAM1 and 1 is RAM2.
[0028] The first source data block selection instruction 102 is used to select the first address in the first source data block, the second source data block selection instruction 103 is used to select the first address in the second source data block, and the destination data block selection instruction 104 is used to select the first address in the destination data block, so as to determine the specific address of each item of data. The first source data block selection instruction 102, the second source data block selection instruction 103 and the destination data block selection instruction 104 are each a 4-bit instruction length. Since one polynomial requires 48*64 storage units, for a 48*1024 RAM, 4-bit data (1024 / 64 = 16 = 2 4 ) are required to select the first address of the data block in the memory 201. The specific address can be determined by the first address.
[0029] The operation function selection instruction 105 is used to select one of the polynomial operation instruction 107 and the hash evaluation instruction 108 to be applied. The operation function selection instruction 105 is a 1-bit instruction length, selected by 0 / 1, where 0 is the hash evaluation instruction 108 and 1 is the polynomial operation instruction 107. The blank instruction 106 is a blank instruction and has no actual meaning.
[0030] The polynomial operation instruction 107 represents the instruction code of polynomial operation and is used to perform polynomial operation. Referring to Table 1, the polynomial operation instruction 107 is a 5-bit instruction length, including 32 different instruction codes and 10 different polynomial operations. The polynomial NTT operation, the polynomial INTT operation, the polynomial point multiplication operation, the polynomial modulo addition operation, the polynomial encryption modulo addition, the polynomial decryption modulo subtraction and the blank instruction each occupy one instruction code. The polynomial compression with data bit width of 4, 5, 10 and 11, the polynomial decompression with data bit width of 4, 5, 10 and 11, and the polynomial comparison with data bit width of 4, 5, 10 and 11 each occupy four instruction codes.
[0031] Table 1 PolyFunc 107 definition
[0032] Operation name Func code Remark NTT 00000 Polynomial NTT operation INTT 00001 Polynomial INTT operation PWM 00010 Polynomial point multiplication operation PolyAdd 00011 Polynomial modular addition operation EncodeAdd 00100 Polynomial encryption modular addition DecodeSub 00101 Polynomial decryption modular subtraction Compress 01000～01011 Polynomial compression with data bit width 4, 5, 10, 11 Decompress 01100～01111 Polynomial decompression with data bit width 4, 5, 10, 11 Compare 10000～10011 Polynomial comparison with data bit width 4, 5, 10, 11 VoidInst 11111 Void instruction
[0033] The hash evaluation instruction 108 represents the instruction code of hash evaluation, which is used to perform hash operation. Referring to Table 2, the hash evaluation instruction 108 is a 6-bit instruction length, including 64 different instruction codes, and 7 different hash operations. Among them, the SHA512 hash with input length of 256 and 512 bits occupies 2 instruction codes, the sampling error vectors s and e occupy 12 instruction codes, the uniformly distributed sampling A occupies 16 instruction codes, the SHA256 hash with input length of 256 bits and the null instruction each occupy 1 instruction code, and the three security level public key pk hash evaluation and the three security level ciphertext ct hash evaluation each occupy 3 instruction codes.
[0034] Table 2 HashFunc 108 definition
[0035]
[0036]
[0037] When the instruction set architecture works, the specific memory and specific location of the required data are determined through the memory selection instruction 101, the first source data block selection instruction 102, the second source data block selection instruction 103, and the destination data block selection instruction 104, and the specific operation mode in Kyber is selected through the operation function selection instruction 105. The specific operation is provided through the polynomial operation instruction 107 and the hash evaluation instruction 108, and finally the operation of the post-quantum cryptography algorithm Kyber is realized.
[0038] Taking the instruction set 100_1001_1000_0010_1_00000_00011_111111 as an example, the memory selection instruction 101 = 100, the first source data block selection instruction 102 = 1001, the second source data block selection instruction 103 = 1000, and the destination data block selection instruction 104 = 0010. It can be seen that the 9th block of RAM2 and the 8th block of RAM1 are selected as the source data block, and the 2nd block of RAM1 is selected as the target address. The operation function selection instruction 105 = 1 selects the polynomial operation instruction 107 to perform polynomial operation; the polynomial operation instruction 107 = 00011 performs polynomial addition operation. Therefore, the operation of this instruction is to store the polynomial stored in the 9th block of RAM2 and the 8th block of RAM1 into the 2nd block of RAM1 after addition.
[0039] The above disclosed is only a preferred embodiment of the present application, of course, cannot be limited by this to limit the scope of the present application, the person skilled in the art can understand that the implementation of all or part of the above-mentioned processes, and according to the equivalent changes of the claims of the present application, still belong to the scope covered by the present application.
Claims
1. A memory suitable for a post-quantum cryptography algorithm Kyber instruction set architecture, characterized in that, The Kyber instruction set architecture is applied to the memory, and the Kyber instruction set architecture sequentially comprises a memory selection instruction, a first source data block selection instruction, a second source data block selection instruction, a destination data block selection instruction, an operation function selection instruction, a blank instruction, a polynomial operation instruction and a hash evaluation instruction. The memory selection instruction is used to select the memory in which the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are located. The first source data block selection instruction is used to select the first address in the first source data block. The second source data block selection instruction is used to select the first address in the second source data block. The destination data block selection instruction is used to select the first address in the destination data block. The operation function selection instruction is used to select one of the polynomial operation instruction and the hash evaluation instruction. The polynomial operation instruction is an instruction code of polynomial operation, and is used to perform polynomial operation. The hash evaluation instruction is an instruction code of hash evaluation, and is used to perform hash operation. The instruction set architecture is 32-bit instruction length, and adopts segmented decoding mode.
2. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 1, wherein, The polynomial operation instruction is 5-bit instruction length, and comprises 10 different polynomial operations, which are polynomial NTT operation, polynomial INTT operation, polynomial point multiplication operation, polynomial modular addition operation, polynomial encryption modular addition, polynomial decryption modular subtraction, polynomial compression with data bit width of 4, 5, 10 and 11, polynomial decompression with data bit width of 4, 5, 10 and 11, polynomial comparison with data bit width of 4, 5, 10 and 11 and a blank instruction.
3. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 2, wherein, The polynomial operation instruction has 32 different instruction codes; the polynomial NTT operation, the polynomial INTT operation, the polynomial point multiplication operation, the polynomial modular addition operation, the polynomial encryption modular addition, the polynomial decryption modular subtraction and the blank instruction each occupy one instruction code; the polynomial compression with data bit width of 4, 5, 10 and 11, the polynomial decompression with data bit width of 4, 5, 10 and 11 and the polynomial comparison with data bit width of 4, 5, 10 and 11 each occupy four instruction codes.
4. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 1, wherein, The hash evaluation instruction is 6-bit instruction length, and comprises 7 different hash operations, which are SHA512 hash with input length of 256 and 512 bits, sampling error vector, uniform distribution sampling, SHA256 hash with input length of 256 bits, three security level public key hash evaluations, three security level cipher text hash evaluations and a blank instruction.
5. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 4, wherein, The hash evaluation instruction has 64 different instruction codes; the sampling error vector occupies 12 instruction codes, and the uniform distribution sampling occupies 16 instruction codes.
6. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 1, wherein, The memory selection instruction is 3-bit instruction length, and comprises three instructions, each of which is 1-bit instruction length; the three instructions of the memory selection instruction sequentially select the memory in which the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are located through 0 / 1.
7. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 1, wherein, The first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are 4-bit instruction lengths, and the first source data block selection instruction, the second source data block selection instruction and the destination data block selection instruction are used to determine the first address of a data block and further determine the specific address of the data block.
8. The memory suitable for post-quantum cryptography Kyber instruction set architecture as claimed in claim 1, wherein, The operation function selection instruction is a 1-bit instruction length, and 0 / 1 is used to select the polynomial operation instruction or the hash value evaluation instruction; when the polynomial operation instruction is selected, the hash value evaluation instruction will run an empty instruction; when the hash value evaluation instruction is selected, the polynomial operation instruction will run an empty instruction.