A RISC-V-based processor for post-quantum cryptographic algorithms

Abstract

The present invention discloses a RISC-V-based special processor for post-quantum cryptographic algorithms, which adopts a superscalar pipeline design with separation of reading, writing and computing, and has two pipelines, reading and writing and computing, which can be executed in parallel, including an instruction fetch part, a decoding part, an execution part, a write-back part and the like. The parallel computing unit module contained in the execution part is implemented by adopting component reorganization technology and operator fusion technology, and the same components are used to implement core operations of post-quantum cryptographic algorithms of different computing types and bit widths, thereby reducing the hardware resource overhead of the processor and accelerating the computing speed. The parallel computing unit module and the parallel register module contained in the processor constitute a parallel storage system and data flow with mixed bit widths, which balances the loads of the two pipelines of computing and reading and writing and reduces the bandwidth.

Description

Technical Field

[0001] The present invention belongs to the technical field of hardware acceleration of post-quantum cryptographic algorithms and RISC-V (Reduced Instruction Set Computer-V, a fifth-generation reduced instruction set processor) instruction set extension processor, and specifically relates to a RISC-V-based special processor for post-quantum cryptographic algorithms. Background Art

[0002] Post-quantum cryptographic algorithms are a new generation of public key cryptographic algorithms that can cope with quantum computer attacks. The construction of the traditional public key cryptographic algorithms currently used (RSA, Diffie-Hellman, elliptic curves, etc.) is based on difficult mathematical problems such as large integer factorization and discrete logarithms (and elliptic curve versions). However, with the continuous development of quantum computer technology and the emergence of efficient quantum algorithms (such as Shor's algorithm in 1994), sufficiently large and stable quantum computers can crack these difficult problems within polynomial time complexity, and traditional public key cryptographic algorithms will soon no longer be secure. In order to ensure information security, the cryptography community has developed new post-quantum cryptographic algorithm standards after years of extensive research and discussion, in order to gradually promote and replace traditional cryptographic algorithms that will no longer be secure.

[0003] However, it is difficult to deploy post-quantum cryptographic algorithms on existing hardware devices, especially low-cost terminal devices. Compared with traditional public key cryptographic algorithms, post-quantum cryptographic algorithms have the characteristics of larger computational complexity and more complex computational forms. Their larger key length and computational scale also make it very difficult to plan data flow and storage space during the calculation process, making it difficult to implement applications with high real-time requirements. In order to improve the running speed of post-quantum cryptographic algorithms, the academic community has conducted extensive research and optimized and accelerated them at the software and hardware levels. However, these designs are mainly aimed at high-performance, high-overhead server-side devices, and have the disadvantages of high power consumption, low circuit reuse, and high resource overhead. For low-performance, low-cost terminal devices that dominate applications such as the Internet of Things, there is still a gap in the field of hardware acceleration solutions for post-quantum cryptographic algorithms.

[0004] The RISC-V instruction set is an open source instruction set architecture based on the reduced instruction set (RISC) principle. It is suitable for small, fast, and low-power designs. It has strong scalability and is widely used in the design of low-cost terminal devices. It is one of the basic technologies adopted in this design. Summary of the invention

[0005] In order to solve the problems in the prior art and fill the technical gap in this field, the present invention proposes a post-quantum cryptographic algorithm dedicated processor based on the RISC-V instruction set for expansion. The present invention aims to utilize the easy-to-expand feature of the RISC-V instruction set, combine the parallelism, high reusability, low power consumption and other characteristics of technologies such as computing component reorganization technology, operator fusion technology, and instruction multi-issue technology, accelerate the calculation speed of the post-quantum cryptographic algorithm with lower power consumption and resource overhead, and design a low-power and high-speed post-quantum cryptographic algorithm dedicated processor.

[0006] The technical solution of the present invention is as follows:

[0007] The present invention first provides a RISC-V-based post-quantum cryptographic algorithm dedicated processor, which adopts a superscalar pipeline design with separated reading, writing and computing, and has two pipelines that can be executed in parallel, one for reading and writing and the other for computing. Each pipeline has four parts of fetching, decoding, executing and writing back that are executed in sequence. The processor specifically includes:

[0008] Instruction fetching part: the read-write and computing pipelines reuse the same instruction fetching part, which is used to obtain instructions from the instruction cache outside the processor and distribute the instructions to the decoding part of the two pipelines of the processor after pre-analysis, including an instruction interface module that serves as an interface to exchange data with the instruction cache outside the processor, a pre-fetching module for pre-reading multiple instructions and caching them, and an instruction distribution module, wherein the instruction distribution module adopts a sequential multi-issue scheme; this part transmits non-read-write instructions to the computing pipeline and transmits read-write instructions to the read-write pipeline;

[0009] The decoding part mainly includes four register modules and two decoder-type modules, which are used to process the instructions sent by the instruction fetching part, translate these instructions into specific control signals, read the data in the register modules, and then send these control signals and data to the execution parts of the two pipelines; the register module is shared by the two pipelines; the decoder-type modules include a first decoder module belonging to the calculation pipeline and a second decoder module belonging to the read-write pipeline. These two decoder modules respectively translate the instructions received by the corresponding pipelines, and each reads the required data from the required register modules, and then each sends the control signals and data of the corresponding pipelines to the execution parts of their respective pipelines;

[0010] The execution part is used to perform specific calculations or memory access operations according to the control signals and data sent from the decoding part, and then send the calculation results and control signals to the write-back parts of the two pipelines. The execution part of the calculation pipeline includes a parallel calculation unit module, which adopts a mixed bit width design and supports parallel calculation of data with multiple bit widths up to 256 bits; the execution part of the read-write pipeline includes the first stage of the read-write control unit module, which is used to access the data cache outside the processor according to the control signals and data sent from the decoding part, and the other parts of the module work in the write-back part of the read-write pipeline;

[0011] The write-back part is used to write the calculation results sent from the calculation pipeline and the read-write pipeline execution part back to the corresponding register module contained in the decoding part according to the control signal, wherein the write-back part of the read-write pipeline includes the second stage of the read-write control unit module, which is used to return the results obtained by accessing the external data cache in the first stage to the processor and store them in the register module.

[0012] Compared with the prior art, the present invention has the following beneficial effects:

[0013] (1) The present invention adopts a superscalar pipeline technology that separates reading, writing and computing. The computing and reading and writing resources of the processor are respectively configured in two pipelines. The two pipelines can work in parallel, computing and reading and writing data at the same time, thereby improving the running speed of the post-quantum cryptographic algorithm. In addition, its instruction fetch part combines the characteristics of the post-quantum cryptographic algorithm and adopts a sequential multi-transmission design. Compared with the commonly used out-of-order multi-transmission, it can save a lot of resources and power consumption.

[0014] (2) The present invention adopts component reorganization technology and operator fusion technology, using the same basic resources to provide support for post-quantum cryptographic algorithms of different types and different bit widths through reorganization, greatly reducing the overhead of hardware resources, and reducing the number of cycles required for the algorithm through operator fusion, thereby improving the running speed of the post-quantum cryptographic algorithm.

[0015] (3) The present invention adopts a storage structure and data flow design with different read-write and computing bit widths, combined with the characteristics of the core operations of the post-quantum cryptographic algorithm, to achieve a balance in the workload of the two pipelines of computing and reading and writing, while reducing bandwidth requirements and hardware resource overhead without affecting the algorithm's running speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a pipeline architecture diagram of a dedicated processor for a post-quantum cryptographic algorithm of the present invention;

[0017] Figure 2 It is an architecture diagram of the parallel computing unit module in the present invention;

[0018] Figure 3 A schematic diagram of the storage structure and data flow in the present invention;

[0019] Figure 4 It is a schematic diagram of the combination of processing modules in the parallel computing unit module corresponding to the XORVNA instruction in the embodiment;

[0020] Figure 5 The instruction issuing sequence corresponding to one butterfly operation when performing NTT (fast number theoretic transform) operation in an embodiment of the present invention;

[0021] Figure 6 This is the assembly instruction stream corresponding to one butterfly operation when performing NTT (fast number theoretic transform) operation in the embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0023] like Figure 1 As shown, an embodiment of the present invention provides a RISC-V-based post-quantum cryptographic algorithm dedicated processor, which adopts a superscalar pipeline design with separation of reading, writing and computing, and has two pipelines of reading and writing and computing that can be executed in parallel, and each pipeline has four parts of instruction fetch, decoding, execution, and write back that are executed in sequence.

[0024] In a specific embodiment of the present invention, the processor specifically includes:

[0025] Instruction fetching part: the read-write and computing pipelines reuse the same instruction fetching part, which is used to obtain instructions from the instruction cache outside the processor and distribute the instructions to the decoding part of the two pipelines of the processor after pre-analysis, including an instruction interface module that serves as an interface to exchange data with the instruction cache outside the processor, a pre-fetching module for pre-reading multiple instructions and caching them, and an instruction distribution module, wherein the instruction distribution module adopts a sequential multi-issue scheme; this part transmits non-read-write instructions to the computing pipeline and transmits read-write instructions to the read-write pipeline;

[0026] The decoding part mainly includes four register modules and two decoder-type modules, which are used to process the instructions sent by the instruction fetch part, translate these instructions into specific control signals, read the data in the register modules, and then send these control signals and data to the execution parts of the two pipelines; the register modules include a general register module for storing 32-bit data, a first parallel register module and a second parallel register module for storing 128-bit data, and a parameter register module for storing 32-bit parameters, and these modules are shared by the two pipelines; the decoder-type modules include a first decoder module belonging to the calculation pipeline and a second decoder module belonging to the read-write pipeline, and these two decoder modules respectively translate the instructions received by the corresponding pipelines, and each reads the required data from the required register modules, and then each sends the control signals and data of the corresponding pipelines to the execution parts of their respective pipelines;

[0027] The execution part is used to perform specific calculations or memory access operations according to the control signals and data sent from the decoding part, and then send the calculation results and control signals to the write-back parts of the two pipelines. The execution part of the calculation pipeline includes a parallel calculation unit module, which adopts a mixed bit width design and supports parallel calculation of data with multiple bit widths up to 256 bits; the execution part of the read-write pipeline includes the first stage of the read-write control unit module, which is used to access the data cache outside the processor according to the control signals and data sent from the decoding part, and the other parts of the module work in the write-back part of the read-write pipeline;

[0028] The write-back part is used to write the calculation results sent from the calculation pipeline and the read-write pipeline execution part back to the corresponding register module contained in the decoding part according to the control signal, wherein the write-back part of the read-write pipeline includes the second stage of the read-write control unit module, which is used to return the results obtained by accessing the external data cache in the first stage to the processor and store them in the register module.

[0029] Further, such as Figure 1As shown, the RISC-V-based post-quantum cryptographic algorithm dedicated processor also includes six register groups, wherein the first instruction fetch to decode register group is used to temporarily store the signal and data to be sent by the instruction fetch part to the decoding part of the computing pipeline, the second instruction fetch to decode register group is used to temporarily store the signal and data to be sent by the value fetch part to the decoding part of the read-write pipeline, the first decode-to-execute register group is used to temporarily store the signal and data to be sent by the decoding part of the computing pipeline to the execution part of the computing pipeline, the second decode-to-execute register group is used to temporarily store the signal and data to be sent by the decoding part of the read-write pipeline to the execution part of the computing pipeline, the first execute-to-write back register group is used to temporarily store the signal and data to be sent by the execution part of the computing pipeline to the write-back part, and the second execute-to-write back register group is used to temporarily store the signal and data to be sent by the execution part of the read-write pipeline to the write-back part.

[0030] like Figure 2 As shown, the parallel computing unit module of the execution part of the post-quantum cryptographic algorithm processor in the embodiment of the present invention adopts the component reorganization technology and operator fusion technology to realize the post-quantum cryptographic algorithm core operations of different calculation types and bit widths using the same components. The module includes:

[0031] Preprocessing module, used for data transformation before calculation of NTT (fast number theoretic transformation) and Keccak algorithm;

[0032] Post-processing module, used for data transformation after calculation of NTT and Keccak algorithms;

[0033] The processing module includes main computing resources, which are composed of a 64-bit shifter module for implementing shift operations and 8 completely identical sub-unit modules for implementing other computing operations; each sub-unit module contains a 32-bit multiplier module for implementing multiplication-related operations, a 32-bit carry-preserving adder module for implementing modular operations and logical operations, and two 32-bit adder modules for implementing addition and subtraction; there are selectable connection modes between these modules, and several modules in the processing module have multiple connection modes, which are respectively used to support computing operations in different operations of different bit widths required in post-quantum cryptographic algorithms. According to the different instructions obtained by the instruction fetching part, the decoding part translates the translated specific computing operations and the corresponding control signals. In the execution part, the processing module will select the corresponding connection mode according to the control signal, and adopt different connection modes, so as to execute different computing operations of different bit widths to obtain computing results.

[0034] like Figure 3As shown, the parallel computing unit module and the first parallel register module and the second parallel register module in the embodiment of the present invention form a mixed bit width parallel storage system and data flow, wherein the first parallel register module and the second parallel register module logically each contain 16 128-bit registers, wherein each 128-bit register is physically composed of 2 64-bit registers. When the computing pipeline performs parallel computing operations, the parallel computing unit module can perform up to 8 groups of operations simultaneously, each group is an operation between two 32-bit numbers, so the total input is two 256-bit operands of input A and input B, each operand is composed of a 128-bit number provided by parallel register 1 and a 128-bit number provided by parallel register 2. When the read / write pipeline performs read / write operations, the read / write control unit module reads 128-bit data from external storage and stores it in parallel register module 1 or parallel register module 2 during read operations, or reads 32-bit data from external storage and stores it in parameter registers; when the read / write pipeline performs write operations, the read / write control unit module writes the value of a 128-bit register in parallel register module 1 or parallel register module 2 to external storage during write operations. Different storage and calculation bit widths improve the load balance of the two pipelines of calculation and reading and writing in NTT and other operations, which can save bandwidth and improve resource utilization.

[0035] like Figure 4 As shown, in the embodiment of the present invention, a post-quantum cryptographic algorithm-specific instruction supported by the present invention is introduced, and its instruction name is xorvna, and its function is to perform a logical operation on three 64-bit input data A, B, and C, and the output 64-bit result is the value of A^(~B&C). The calculation operation corresponding to the instruction is a step in the keccak operation, a core operation commonly used in the post-quantum cryptographic algorithm. Figure 4 The figure shows the connection and combination mode adopted by the processing modules of the parallel computing unit module when executing the operation corresponding to the instruction, that is, Figure 2 The 32-bit carry-save adders in the sub-unit module shown are spliced ​​to form two 64-bit carry-save adders, and then Figure 4 Connect as shown. Figure 4 The module named negation shown connected to B is not in Figure 2 There are many other similar circuits not marked in the figure that play auxiliary roles, and they are all common technologies in the field.

[0036] like Figure 5 and Figure 6 As shown, the embodiment of the present invention introduces how the superscalar pipeline architecture with separated reading, writing and calculation proposed by the present invention accelerates the execution of NTT (fast number theoretic transform) operation, which is a core operation commonly used in post-quantum cryptographic algorithms. Figure 5The figure shows the instruction issuance order of the butterfly unit calculation that needs to be executed repeatedly during the NTT operation, where IF, ID, EX, and WB correspond to Figure 1 The four parts shown are instruction fetch, decode, execute, and write back. Each butterfly unit calculation requires multiplying the two input data A and B, and then summing and subtracting them to obtain two outputs C and D, where C = A + (B * w), D = A - (B * w), where w is a known constant called a rotation factor. Figure 5 The two instructions corresponding to the two adjacent and aligned rows in the table are a calculation instruction and a read-write instruction executed in parallel, such as the calculation instruction mulvh in the first row and the read-write instruction S1b in the second row. Figure 1 The instruction fetch IF stage shown will be sent to the computing pipeline and the read-write pipeline by the instruction dispatch module respectively, and run in parallel at the same time, so that the processor can execute both computing and reading and writing instructions at the same time. Figure 5 It can be seen that each butterfly unit calculation includes 7 calculation instructions and 8 read and write instructions, which need to be performed in turn in the traditional single-pipeline processor, and take 15 cycles to complete. In the present invention, both are performed simultaneously and only need 8 cycles to complete, which increases the running speed by nearly one-fold. In addition, the 7 calculation instructions adopted are: mulvh, mulv, mulvm, mulvhf, subv, addmv, submv. These seven instructions are all parallel calculation instructions with a bit width of 256 bits. Compared with ordinary 32-bit processors that can only calculate 32-bit data each time, the present invention can calculate 8 groups of 32-bit data each time, so each instruction can provide eight times parallel acceleration. Figure 6 The figure shows a specific assembly instruction flow corresponding to a butterfly unit calculation in an NTT calculation performed in an embodiment of the present invention.

[0037] The above-described embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present invention. The present invention can support a variety of post-quantum cryptographic algorithms and a variety of core operations contained therein, and correspondingly have dozens of dedicated extension instructions that have not yet been listed and corresponding parallel computing unit modules in the combination of various components in the processing module. For those of ordinary skill in the art, without departing from the concept of the present invention, several variations and improvements can also be made, which all belong to the scope of protection of the present invention.

Claims

1. A RISC-V-based post-quantum cryptographic algorithm dedicated processor, characterized in that A superscalar pipeline design with separated reading, writing and calculation is adopted, with two pipelines that can be executed in parallel, one for reading and writing and the other for calculation. Each pipeline has four parts of fetching, decoding, executing and writing back that are executed in sequence. The processor specifically includes: Instruction fetching part: the read-write and computing pipelines reuse the same instruction fetching part, which is used to obtain instructions from the instruction cache outside the processor and distribute the instructions to the decoding part of the two pipelines of the processor after pre-analysis, including an instruction interface module that serves as an interface to exchange data with the instruction cache outside the processor, a pre-fetching module for pre-reading multiple instructions and caching them, and an instruction distribution module, wherein the instruction distribution module adopts a sequential multi-issue scheme; this part transmits non-read-write instructions to the computing pipeline and transmits read-write instructions to the read-write pipeline; The decoding part mainly includes four register modules and two decoder-type modules, which are used to process the instructions sent by the instruction fetching part, translate these instructions into specific control signals, read the data in the register modules, and then send these control signals and data to the execution parts of the two pipelines; the register module is shared by the two pipelines; the decoder-type modules include a first decoder module belonging to the calculation pipeline and a second decoder module belonging to the read-write pipeline. These two decoder modules respectively translate the instructions received by the corresponding pipelines, and each reads the required data from the required register modules, and then each sends the control signals and data of the corresponding pipelines to the execution parts of their respective pipelines; The execution part is used to perform specific calculations or memory access operations according to the control signals and data sent from the decoding part, and then send the calculation results and control signals to the write-back parts of the two pipelines. The execution part of the calculation pipeline includes a parallel calculation unit module, which adopts a mixed bit width design and supports parallel calculation of data with multiple bit widths up to 256 bits; the execution part of the read-write pipeline includes the first stage of the read-write control unit module, which is used to access the data cache outside the processor according to the control signals and data sent from the decoding part, and the other parts of the module work in the write-back part of the read-write pipeline; The write-back part is used to write the calculation results sent from the calculation pipeline and the read-write pipeline execution part back to the corresponding register module contained in the decoding part according to the control signal, wherein the write-back part of the read-write pipeline includes the second stage of the read-write control unit module, which is used to return the results obtained by accessing the external data cache in the first stage to the processor and store them in the register module.

2. The post-quantum cryptographic algorithm dedicated processor according to claim 1, characterized in that: The register module of the decoding part includes a general register module for storing 32-bit data, a first parallel register module and a second parallel register module for storing 128-bit data, and a parameter register module for storing 32-bit parameters, and these modules are shared by two pipelines.

3. The post-quantum cryptographic algorithm dedicated processor according to claim 1, characterized in that: The parallel computing unit module is implemented by using component reorganization technology and operator fusion technology, and uses the same components to implement the core operations of post-quantum cryptographic algorithms of different computing types and bit widths. The module includes: Preprocessing module, used for data transformation before calculation of NTT (fast number theoretic transformation) and Keccak algorithm; Post-processing module, used for data transformation after calculation of NTT and Keccak algorithms; The processing module includes main computing resources, which are composed of a 64-bit shifter module for implementing shift operations and 8 completely identical sub-unit modules for implementing other computing operations; each sub-unit module contains a 32-bit multiplier module for implementing multiplication-related operations, a 32-bit carry-preserving adder module for implementing modular operations and logical operations, and two 32-bit adder modules for implementing addition and subtraction; each module in the processing module has a variety of connection modes, which are respectively used to support the computing operations in different operations of different bit widths required in the post-quantum cryptographic algorithm. According to the different instructions obtained by the instruction fetching part, the decoding part translates the specific computing operations and the corresponding control signals, and the processing module in the execution part will select the corresponding connection mode according to the control signal, so as to execute different computing operations of different bit widths to obtain the computing results.

4. The post-quantum cryptographic algorithm dedicated processor according to claim 1, characterized in that: The parallel computing unit module and the first parallel register module and the second parallel register module form a mixed bit width parallel storage system and data flow, wherein the first parallel register module and the second parallel register module logically each contain 16 128-bit registers, wherein each 128-bit register physically consists of 2 64-bit registers; when the computing pipeline performs parallel computing operations, the parallel computing unit module can execute up to 8 groups of operations simultaneously, each group is an operation between two 32-bit numbers, so the total input is two 256-bit operands, input A and input B, and each operation The operation number is formed by splicing a 128-bit number provided by the first parallel register module and a 128-bit number provided by the second parallel register module; when the read-write pipeline performs read and write operations, the read-write control unit module reads 128-bit data from the external storage and stores it in the first parallel register module or the second parallel register module during the read operation, or reads 32-bit data from the external storage and stores it in the parameter register module; when the read-write pipeline performs a write operation, the read-write control unit module writes the value of a 128-bit register in the first parallel register module or the second parallel register module into the external storage during the write operation.

Images