Dilithium processing method and system based on sparse computation

Abstract

The application discloses a Dilithium processing method and system based on sparse calculation. The method comprises the following steps: representing the power set of the non-zero terms in the sparse polynomial related to Dilithium as an index set, and representing the coefficient set of the non-zero terms in the sparse polynomial as a symbol set; storing the index set into an index block random memory, and storing the symbol set corresponding to the index set into a register after compression, so as to complete the compressed storage of the sparse polynomial; representing the dense polynomial related to Dilithium as a private key vector, and storing the private key vector into a vector block random memory; the sparse polynomial multiplier addresses the private key vector according to the index set, and determines the operation type according to the symbol set, so as to convert the modular multiplication operation of the dense polynomial and the sparse polynomial related to Dilithium into a target operation. The application also discloses a Dilithium processing device based on sparse calculation, a timing scheduling method and system of a Dilithium signature generation algorithm, an electronic device and a storage medium.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of quantum encryption technology, in particular to a Dilithium processing method and system based on sparse calculation, a Dilithium processing device based on sparse calculation, a timing scheduling method and system of Dilithium signature generation algorithm, an electronic device and a storage device. BACKGROUND

[0002] The security of traditional public key cryptography is based on integer factorization, discrete logarithm or elliptic curve discrete logarithm problem, which can be solved by a quantum computer in super-polynomial time. In order to cope with the threat of quantum computers to classical cryptographic algorithms, the skilled person in the art has proposed a variety of post-quantum digital signature algorithms. Among them, CRYSTALS-Dilithium is standardized as the main post-quantum digital signature algorithm due to its strong security and high performance. Polynomial multiplication is the main bottleneck of high-performance Dilithium. In the signature generation process, 29%~43% of the multiplications are sparse polynomial multiplications. In particular, one polynomial of the sparse polynomial multiplication has sparsity and ternary, and its coefficients are {0, 1, -1}; the coefficients of the other polynomial have low bit width characteristics. The existing technical solutions ignore the sparsity of the algorithm, and calculate all polynomial multiplications, including sparse multiplications, through the NTT (Number Theoretic Transform, Fast Number Theory Transform) processing mode, resulting in high computational complexity and storage requirements, causing high resource consumption and low efficiency. However, using sparsity also brings new challenges to the overall device design of Dilithium. The operation engine used to calculate the intensive and sparse polynomial multiplication needs to be scheduled to process different stages of the algorithm, resulting in low utilization of the operation engine. SUMMARY

[0003] In view of the above problems, the present application provides a Dilithium processing method and system based on sparse calculation, a Dilithium processing device based on sparse calculation, a timing scheduling method and system of Dilithium signature generation algorithm, an electronic device and a storage device, in order to at least solve one of the above problems.

[0004] According to a first aspect of the present application, a Dilithium processing method based on sparse calculation is provided, characterized by comprising:

[0005] The power set of the non-zero terms in the sparse polynomial involved in Dilithium is expressed as an index set, and the coefficient set of the non-zero terms in the sparse polynomial is expressed as a symbol set;

[0006] The index set is stored into an index block random memory, and a symbol set corresponding to the index set is compressed and stored into a register, and the compressed storage of the sparse polynomial is completed;

[0007] The dense polynomial involved in Dilithium is expressed as a private key vector, and the private key vector is stored into a vector block random memory;

[0008] The sparse polynomial multiplier addresses the private key vector according to the index set, and determines the operation type according to the symbol set, and then converts the modular multiplication operation of the dense polynomial and the sparse polynomial involved in Dilithium into a target operation.

[0009] According to the embodiment of the present application, the sparse polynomial multiplier addresses the private key vector according to the index set, and determines the operation type according to the symbol set, and then converts the modular multiplication operation of the dense polynomial and the sparse polynomial involved in Dilithium into a target operation, which includes:

[0010] According to the index set stored in the index block random memory, the addressing unit of the sparse polynomial multiplier performs parallel addressing on the private key vector stored in the vector block random memory, to obtain a plurality of private key vectors participating in the modular multiplication operation in Dilithium;

[0011] According to the symbol set stored in the register, the selection unit of the sparse polynomial multiplier determines the operation type, wherein the operation type includes addition operation and / or subtraction operation;

[0012] The sparse polynomial multiplier performs an inversion operation on the plurality of private key vectors participating in the modular multiplication operation in Dilithium, to obtain a plurality of inverted private key vectors;

[0013] According to the operation type, the sparse polynomial multiplier converts the modular multiplication operation of the plurality of inverted private key vectors and the symbol set into an accumulation operation.

[0014] According to the second aspect of the present application, a Dilithium processing device based on sparse calculation is provided, which is applied to the Dilithium processing method based on sparse calculation, and characterized in that it comprises:

[0015] A fast number theory transformation data path is used to perform the key generation operation of Dilithium, the signature generation operation of Dilithium and the signature verification operation of Dilithium;

[0016] A sparse data path is used to perform the signature generation operation of Dilithium and the signature verification operation of Dilithium;

[0017] a memory array for exchanging data between a fast number theoretic transform data path and a sparse data path;

[0018] wherein the fast number theoretic transform data path performs multiplication operations between dense polynomials in Dilithium through a one-time fast number theoretic transform, a multiply-accumulate operation and an inverse fast number theoretic transform;

[0019] wherein the sparse data path converts multiplication operations between dense polynomials and sparse polynomials in Dilithium into accumulation operations based on the intrinsic sparsity of Dilithium;

[0020] wherein the memory array comprises a block random memory array applied to a programmable gate array and a static random access memory array applied to an application-specific integrated circuit.

[0021] According to an embodiment of the present application, the fast number theoretic transform data path comprises a one-way hash function module, a sampling module, a fast number theoretic transform module and a post-fast number theoretic transform processing module.

[0022] According to an embodiment of the present application, the one-way hash function module is instantiated as a permutation core for time-sharing realization of SHAKE-128 and SHAKE-256, and a permutation is performed once every 24 cycles.

[0023] According to an embodiment of the present application, the sampling module comprises a SampleInBall module and a rejection sampling module.

[0024] wherein the SampleInBall module is used to obtain a sign set and an index set of non-zero term coefficients of sparse polynomials in Dilithium.

[0025] wherein the rejection sampling module is used to sample vectors and matrices.

[0026] According to an embodiment of the present application, the fast number theoretic transform module comprises a plurality of butterfly units for pipelined fast number theoretic transform, multiply-accumulate operation and pipelined inverse fast number theoretic transform.

[0027] According to an embodiment of the present application, the post-fast number theoretic transform processing module is used to realize pipelined processing of data streams.

[0028] According to an embodiment of the present application, the sparse data path comprises a sparse polynomial multiplier and a post-sparse processing module.

[0029] According to an embodiment of the present application, the sparse polynomial multiplier is used to process multiplication of a plurality of sparse polynomials in parallel and convert multiplication operations of sparse polynomials into addition operations based on the intrinsic sparsity of Dilithium.

[0030] According to an embodiment of the present application, the post-sparse processing module is configured to implement pipelining processing of the data stream.

[0031] According to an embodiment of the present application, the block random memory array comprises a data storage area and a data exchange area.

[0032] According to an embodiment of the present application, the data storage area is configured to store a matrix and a private key vector.

[0033] According to an embodiment of the present application, the data exchange area is configured to transfer associated data of a fast number theory transform data path and a sparse data path.

[0034] According to a third aspect of the present application, a timing scheduling method of a Dilithium signature generation algorithm is provided, applied to the Dilithium processing device based on sparse computation, and characterized in that the timing scheduling method comprises:

[0035] According to the SampleInBall operation in the Dilithium signature generation algorithm, a rejection loop in the Dilithium signature generation algorithm is divided into a dense polynomial multiplication stage and a sparse polynomial multiplication stage.

[0036] In a pre-computation stage of the Dilithium signature generation algorithm, a pseudo-random number generation operation, a pseudo-random number sampling and screening operation are performed through an NTT data path to obtain a sampling matrix according to a private key given by a user, wherein elements in the sampling matrix are dense polynomials in the Dilithium.

[0037] In the dense polynomial multiplication stage, a sampling vector is obtained through a fast number theory transform data path, and the sampling vector and the sampling matrix are processed to complete multiplication of the dense polynomials, and the multiplication result of the dense polynomials is stored in the block random memory, wherein the sampling vector is a dense polynomial with a first preset bit width.

[0038] In the sparse polynomial multiplication stage, a sparse polynomial in the Dilithium and a private key vector are processed through a sparse data path to complete multiplication of the sparse polynomials, and the multiplication result of the sparse polynomials is stored in the block random memory, wherein the private key vector is a dense polynomial with a second preset bit width.

[0039] By introducing a ping-pong mechanism and using multiple groups of block random memories as data exchange areas for writing operations, the associated data reading and writing operations in the dense polynomial multiplication stage and the sparse polynomial multiplication stage are alternately and continuously performed.

[0040] According to an embodiment of the present application, the timing scheduling method of the Dilithium signature generation algorithm further comprises:

[0041] After the rejection condition check on the sparse polynomial multiplication stage, a check result is obtained;

[0042] In the case that the check result is a rejection condition violation, after the fast number theory transform data path operation ends in parallel with the sparse data path operation, the sparse data path is restarted;

[0043] In the case that the check result is no rejection condition violation, the fast number theory transform data path is suspended, and the generated digital signature is output.

[0044] According to a fourth aspect of the present application, a Dilithium processing system based on sparse computation is provided, characterized in that it comprises:

[0045] An information representation module is configured to represent the power set of the non-zero terms in the sparse polynomial involved in Dilithium as an index set, and represent the coefficient set of the non-zero terms in the sparse polynomial as a symbol set;

[0046] A compressed storage module is configured to store the index set into an index block random memory, and store the symbol set corresponding to the index set into a register after compression, thereby completing the compressed storage of the sparse polynomial;

[0047] A storage module is configured to represent the dense polynomial involved in Dilithium as a private key vector, and store the private key vector into a vector block random memory;

[0048] An operation conversion module is configured to address the private key vector according to the index set by the sparse polynomial multiplier, and determine the operation type according to the symbol set, thereby converting the modular multiplication operation of the dense polynomial and the sparse polynomial involved in Dilithium into a target operation.

[0049] According to a fifth aspect of the present application, a timing scheduling system of a Dilithium signature generation algorithm is provided, which is applied to the above-mentioned Dilithium processing device based on sparse computation, and characterized in that it comprises:

[0050] A division module is configured to divide the rejection loop in the Dilithium signature generation algorithm into a dense polynomial multiplication stage and a sparse polynomial multiplication stage according to the SampleInBall operation in the Dilithium signature generation algorithm;

[0051] A pre-computation module is configured to perform a pseudo-random number generation operation, a pseudo-random number sampling and screening operation through an NTT data path to obtain a sampling matrix in the pre-computation stage of the Dilithium signature generation algorithm according to a private key given by a user, wherein the elements in the sampling matrix are dense polynomials in Dilithium;

[0052] The dense multiplication module is configured to obtain a sampling vector through a fast number theory transform data path in a dense polynomial multiplication stage, and perform processing on the sampling vector and a sampling matrix to complete multiplication of the dense polynomial, and store a result of the multiplication of the dense polynomial in the block random memory, wherein the sampling vector is a dense polynomial with a first preset bit width;

[0053] The sparse multiplication module is configured to perform processing on a sparse polynomial and a private key vector in the Dilithium through a sparse data path in a sparse polynomial multiplication stage to complete multiplication of the sparse polynomial, and store a result of the multiplication of the sparse polynomial in the block random memory, wherein the private key vector is a dense polynomial with a second preset bit width;

[0054] The control module is configured to control the associated data read and write operations in the dense polynomial multiplication stage and the sparse polynomial multiplication stage to be alternately and continuously performed by introducing a ping-pong mechanism and taking multiple sets of block random memories as exchange areas for data write operations.

[0055] According to a sixth aspect of the present application, an electronic device is provided, characterized by comprising:

[0056] one or more processors;

[0057] a storage device configured to store one or more programs,

[0058] wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-mentioned sparse-computation-based Dilithium processing method and the timing scheduling method of the Dilithium signature generation algorithm.

[0059] According to a seventh aspect of the present application, a computer-readable storage medium is provided, characterized by storing executable instructions thereon, which, when executed by a processor, cause the processor to perform the above-mentioned sparse-computation-based Dilithium processing method and the timing scheduling method of the Dilithium signature generation algorithm.

[0060] The above-mentioned sparse-computation-based Dilithium processing method provided by the present application takes advantage of the endogenous sparsity of Dilithium, and customizes a sparse polynomial multiplier for Dilithium, thereby converting complex modular multiplication between dense polynomials and sparse polynomials into target operations, greatly reducing the calculation complexity of sparse multiplication and the storage requirement of private keys; meanwhile, the above-mentioned sparse-computation-based Dilithium processing device provided by the present application realizes interleaved mixed processing of dense and sparse polynomial multiplication, and designs a switching scheduling strategy between different operation engines, thereby achieving higher throughput and better area-time performance. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 is a schematic diagram of the calculation principle of sparse multiplication according to an embodiment of the present application;

[0062] Figure 2 is a flowchart of a Dilithium processing method based on sparse calculation according to an embodiment of the present application;

[0063] Figure 3 is a schematic diagram of compressed entries of a sparse polynomial according to an embodiment of the present application;

[0064] Figure 4 is a flowchart of converting a modular multiplication operation of a polynomial into a target operation according to an embodiment of the present application;

[0065] Figure 5 is a comparison diagram of NTT and sparse processing methods according to an embodiment of the present application;

[0066] Figure 6 is a structural schematic diagram of a sparse polynomial multiplier according to an embodiment of the present application;

[0067] Figure 7 is a schematic diagram of a Dilithium processing device based on sparse calculation according to an embodiment of the present application;

[0068] Figure 8 is a flowchart of a timing scheduling method of a Dilithium signature generation algorithm according to an embodiment of the present application;

[0069] Figure 9 is a timing scheduling diagram of a Dilithium signature generation algorithm according to an embodiment of the present application;

[0070] Figure 10 is a structural schematic diagram of a Dilithium processing system 1000 based on sparse calculation according to an embodiment of the present application;

[0071] Figure 11 is a structural schematic diagram of a timing scheduling system of a Dilithium signature generation algorithm according to an embodiment of the present application;

[0072] Figure 12 A block diagram of an electronic device suitable for implementing the above-mentioned Dilithium processing method based on sparse calculation and the timing scheduling method of a Dilithium signature generation algorithm according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0073] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application with reference to specific embodiments and the accompanying drawings.

[0074] With the standardization of post-quantum cryptography, existing cryptographic algorithms are migrating from classical cryptographic algorithms to post-quantum cryptographic algorithms. In order to achieve high-throughput encryption and decryption operations and meet the compatibility in the process of cryptographic algorithm migration, a high-performance cryptographic coprocessor is needed by those skilled in the art. The lattice-based post-quantum cryptographic algorithm has sparse polynomial multiplication, so a special sparse multiplication processing operator can be designed to achieve higher throughput and performance at a smaller resource cost.

[0075] Dilithium is a lattice-based post-quantum digital signature algorithm, and its security is based on the module error learning problem. There are usually two solutions for polynomial multiplication in lattice-based cryptography. One is to calculate all polynomial multiplications, including dense and sparse polynomial multiplications, through an NTT module. The existing Dilithium hardware implementation technology adopts this scheme, and the hardware design of the NTT module is continuously optimized to speed up the multiplication operation, but the algorithm characteristics are not well utilized, resulting in high resource consumption and low efficiency. The second is to design different operation engines for dense and sparse polynomial multiplications. At present, there is no sparse polynomial multiplier customized for Dilithium and no switching scheduling strategy between different operation engines.

[0076] In view of the above technical problems, the present application provides a Dilithium processing method based on sparse calculation, which fully utilizes the endogenous sparsity of the Dilithium algorithm and designs an overlapping dense and sparse polynomial multiplication hybrid processing device to realize more compact and higher performance Dilithium hardware implementation. Meanwhile, the above-mentioned Dilithium processing device based on sparse calculation provided by the present application greatly reduces the calculation complexity of sparse multiplication and the storage requirement degree of the private key by utilizing the overlapping hybrid processing device. At the same time, the present application customizes a sparse polynomial multiplier for Dilithium and designs a switching scheduling strategy between different operation engines, thereby realizing higher throughput and better area-time performance.

[0077] In the technical scheme of the present application, denotes an integer module ring, denotes a polynomial module ring, denotes an integer polynomial module with coefficients ring. In Dilithium, and are 256 and 8380417, respectively. The conventional lowercase letter represents an element in or , for example ; the bold lowercase letter represents a column vector whose elements are or , for example ; bold capital letters represent matrices, e.g. .

[0078] The signature generation algorithm of Dilithium is shown as Algorithm 1.

[0079]

[0080]

[0081]

[0082]

[0083]

[0084]

[0085]

[0086]

[0087]

[0088]

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098] The signature verification algorithm of Dilithium is shown as Algorithm 2.

[0099]

[0100]

[0101]

[0102]

[0103]

[0104]

[0105] Figure 1 is the schematic diagram of the calculation principle of sparse multiplication according to the embodiment of the present application.

[0106] The following will be described in detail Figure 1 The principle of sparse multiplication (polynomial-vector) in Dilithium.

[0107] The most time-consuming operation in Dilithium is the multiplication of polynomials in the polynomial ring . The multiplication operands are matrices or vectors, and the elements are polynomials in the ring . All polynomial multiplications can be divided into two categories: dense matrix-vector multiplication (i.e. and ) and sparse polynomial-vector multiplication (i.e. , and ). The calculation principle of sparse multiplication (polynomial-vector multiplication) is shown in Figure 1 . All vectors are multiplied by the same polynomial, which is called consistency; the polynomial is sparse and ternary, and of the 256 coefficients are 1 or -1 (under the security level {2,3,5} condition, {39,49,60} respectively), and the remaining are 0. The vector is l-dimensional, and the vectors and are k-dimensional (l is 4, 5 or 7; k is 4, 6 or 8); the coefficients of the polynomial elements in the vector are low bit width (3 or 4 bits, and , and 13 bits ).

[0108] The existing scheme calculates sparse polynomial multiplication by NTT processing, including the reference software implementation submitted to NIST, and the specific calculation process can be represented as formula (1). The NTT processing needs to go through NTT, point multiplication and INTT operations, which require , and times of modular multiplication. Since NTT is a modular operation, 3 or 4 bits and , and 13 bits are converted to 23-bit frequency domain representation.

[0109] (1),

[0110] wherein, , and denotes a dot product.

[0111] Figure 2 is a flowchart of a Dilithium processing method based on sparse calculation according to an embodiment of the present application.

[0112] As shown in Figure 2 , the above-mentioned Dilithium processing method based on sparse calculation comprises operations S210-S240.

[0113] In operation S210, the power set of non-zero terms in the sparse polynomial involved in Dilithium is expressed as an index set, and the coefficient set of non-zero terms in the sparse polynomial is expressed as a symbol set.

[0114] In operation S220, the index set is stored in an index block random memory, and the symbol set corresponding to the index set is compressed and stored in a register, completing the compressed storage of the sparse polynomial.

[0115] Since the symbol set occupies a smaller bit width after compression, for example, 2 bits, the symbol set can be directly stored in the register, thereby improving the execution efficiency of the entire algorithm.

[0116] In operation S230, the dense polynomial involved in Dilithium is expressed as a private key vector, and the private key vector is stored in a vector block random memory.

[0117] In operation S240, the sparse polynomial multiplier addresses the private key vector according to the index set, and determines the operation type according to the symbol set, and then converts the modular multiplication operation of the dense polynomial and the sparse polynomial involved in Dilithium into a target operation.

[0118] The above-mentioned fast number theory transform processing operation includes NTT (Number Theoretic Transforms) of dense polynomials and sparse polynomials, dot product, and INTT (Inverse Number Theoretic Transforms) operation, and the core operation is modular multiplication; the above-mentioned target operation includes addition operation and / or subtraction operation.

[0119] The present application adopts a sparse processing method to calculate sparse polynomial multiplication, and converts complex modular multiplication into simple addition.

[0120] Figure 3 is a compressed entry schematic diagram of a sparse polynomial according to an embodiment of the present application.

[0121] The following is combined with Figure 3 The compression and information representation process of the coefficient polynomial involved in this invention will be described in further detail.

[0122] like Figure 3 As shown, sparse polynomials Compression, represented as a set of indices and symbols corresponding to the coefficients of non-zero terms, is a set. and Representing a polynomial ,in, It is 1 or -1. Therefore, dense polynomials and sparse polynomials The product can be calculated by simple addition. The The coefficients can be expressed as formula (2).

[0123] (2),

[0124] in, .

[0125] The Dilithium processing method based on sparse computation provided by this invention uses a sparse processing approach to calculate sparse polynomial multiplication, transforming complex modular multiplication into simple addition.

[0126] Figure 4 This is a schematic diagram illustrating the process of converting modular multiplication of a polynomial into a target operation according to an embodiment of the present invention.

[0127] like Figure 4 As shown, the sparse polynomial multiplier addresses the private key vector according to the index set and determines the operation type according to the symbol set, thereby converting the modular multiplication operations of dense and sparse polynomials involved in Dilithium into target operations including operations S410 to S450.

[0128] In operation S410, based on the index set stored in the index block random access memory, the addressing unit of the sparse polynomial multiplier performs parallel addressing of the private key vectors stored in the vector block random access memory, thereby obtaining multiple private key vectors in Dilithium that participate in modular multiplication operations.

[0129] The sparse polynomial multiplier mentioned above supports parallel computation, meaning that a sparse polynomial can be modularly multiplied with multiple dense polynomials simultaneously.

[0130] In operation S420, the selection unit of the sparse polynomial multiplier determines the operation type based on the symbol set stored in the register, wherein the operation type includes addition and / or subtraction.

[0131] In operation S430, the sparse polynomial multiplier performs an inversion operation on the plurality of private key vectors participating in the modular multiplication operation in Dilithium, to obtain the plurality of inverted private key vectors.

[0132] In the case of a negative private key vector, an inversion operation is performed thereon; in the case of a positive private key vector, no inversion operation is performed on the private key vector.

[0133] In operation S440, according to the operation type, the sparse polynomial multiplier converts the modular multiplication operation of the plurality of inverted private key vectors and the symbol set into an accumulation operation.

[0134] The modular multiplication operation includes a number theoretic transform (NTT), a point multiplication, and an inverse number theoretic transform (INTT), and the sparse polynomial multiplier converts the three into an accumulation operation, thereby completing the modular multiplication operation between the dense polynomial and the sparse polynomial.

[0135] The sparse polynomial multiplier converts the number theoretic transform, the point multiplication, and the inverse number theoretic transform of the plurality of inverted private key vectors and the symbol set into an addition and / or subtraction operation according to the operation type, to obtain a partial sum operation result.

[0136] The above sparse polynomial multiplier supports parallel operation, that is, supports modular multiplication operation of a plurality of dense polynomials with one sparse polynomial at the same time.

[0137] Figure 5 is a comparison diagram of the NTT and sparse processing mode according to an embodiment of the present application.

[0138] The following will be described in combination with Figure 5 The above sparse computing-based Dilithium processing method provided by the present application is further distinguished from the NTT in the prior art.

[0139] The difference between the NTT and the sparse processing mode is as shown in Figure 5 Taking the signature generation process of Level 5 as an example, if the sparse polynomial multiplication is calculated using the NTT processing mode, , and the NTT operation of the above can be pre-calculated. The remaining NTT, point multiplication, and INTT operations still need , , and times of modular multiplication, respectively. Therefore, the NTT processing mode needs a total of times of 23-bit modular multiplication, which is equivalent to times of 23-bit modular addition. The pre-calculated data converted into the frequency domain needs bits of storage space.

[0140] According to the method provided by the present application, the modular multiplication between the dense polynomial and the sparse polynomial is processed, and the 23-bit modular multiplication is converted into 3 or 13-bit simple addition. The accumulation operation needs 3-bit addition, and 13-bit addition. , and a total of bit storage space. Therefore, the calculation complexity is reduced by 85.8%, and the storage requirement is reduced by 71.8%. In the conditions of security levels 2 and 3, the calculation complexity is reduced by 89.9% and 87.3% respectively, and the storage requirement is reduced by 72.5% and 68.8% respectively.

[0141] Figure 6 is a structural schematic diagram of a sparse polynomial multiplier according to an embodiment of the present application.

[0142] Considering the consistency of polynomial-vector multiplication, that is, all vectors are multiplied by the same polynomial, the present application proposes a sparse polynomial multiplier supporting parallel calculation of multiple polynomial multiplications, as shown in Figure 6 . The sparse polynomial is represented using an index and a symbol set, the index is used for addressing, and the vector stored in the BRAM is taken out , and ); the symbol is used to select the operation type (addition or subtraction) and determine whether to take the inverse of the vector. All sparse polynomial multiplications can be calculated simultaneously in the manner shown in Figure 4 . Wherein, l is the dimension of the vector , k is the dimension of the vector and , α is the bit width of the element coefficient in the vector and , and β is the bit width of the element coefficient in the vector .

[0143] Figure 7 is a schematic diagram of a Dilithium processing device based on sparse calculation according to an embodiment of the present application.

[0144] As shown in Figure 7 , the above-mentioned Dilithium processing device based on sparse calculation is applied to the above-mentioned Dilithium processing method based on sparse calculation, and is characterized by comprising a fast number theory transformation data path, a sparse data path and a memory array.

[0145] The application takes NTT processing unit and sparse polynomial multiplier as the core, constructs two data paths for high-speed parallel execution of dense and sparse polynomial multiplication. The NTT data path is used for calculating dense polynomial multiplication, and the sparse data path is used for calculating sparse polynomial multiplication. The related data between the two data paths is transmitted through the exchange area of the BRAM array. The signature generation and signature verification algorithm is executed through the two data paths, and the key generation algorithm is executed only through the NTT data path. Due to the specially designed sparse data path, in the NTT data path, the data flow of all algorithms only needs to pass through NTT once, multiplication and accumulation and INTT operation, so that the multiplication operation between dense polynomials can be completed, without complex turning, reducing a large number of access to memory, and simplifying the control logic.

[0146] The above fast number theory transformation data path is used for executing the key generation operation of Dilithium, the signature generation operation of Dilithium and the signature verification operation of Dilithium.

[0147] The above fast number theory transformation data path completes the multiplication operation between dense polynomials in Dilithium through one fast number theory transformation, product accumulation operation and inverse fast number theory transformation.

[0148] According to the embodiment of the application, the above fast number theory transformation data path comprises a one-way hash function module, a sampling module, a fast number theory transformation module and a post-fast number theory transformation processing module.

[0149] The above one-way hash function module can be Keccak.

[0150] According to the embodiment of the application, the above one-way hash function module is instantiated as a permutation core for realizing SHAKE-128 and SHAKE-256 in time sharing mode, and the permutation is executed once every 24 cycles.

[0151] That is, one cycle executes one round of permutation.

[0152] According to the embodiment of the application, the above sampling module comprises a SampleInBall module and a rejection sampling module; wherein the SampleInBall module is used for obtaining the symbol set and the index set of the non-zero term coefficient of the sparse polynomial in Dilithium; wherein the rejection sampling module is used for sampling vectors and matrices.

[0153] According to the embodiment of the application, the above fast number theory transformation module comprises a plurality of butterfly units, which are used for pipelining fast number theory transformation, multiplication accumulation operation and pipelining inverse fast number theory transformation.

[0154] The number of the above butterfly units is preferably 8.

[0155] According to an embodiment of the present application, the post-FFT processing module is configured to implement pipelining of data flow.

[0156] The sparse data path is configured to perform a signature generation operation of Dilithium and a signature verification operation of Dilithium.

[0157] The sparse data path is configured to convert multiplication operations between dense polynomials and sparse polynomials in Dilithium into accumulation operations based on intrinsic sparsity of Dilithium.

[0158] According to an embodiment of the present application, the sparse data path includes a sparse polynomial multiplier and a post-sparse processing module.

[0159] The sparse polynomial multiplier is configured to process multiplication of multiple sparse polynomials in parallel and convert multiplication operations of sparse polynomials into addition operations based on intrinsic sparsity of Dilithium.

[0160] According to an embodiment of the present application, the post-sparse processing module is configured to implement pipelining of data flow.

[0161] The sparse data path includes a sparse polynomial multiplier and a post-sparse processing module. The sparse polynomial multiplier takes advantage of algorithmic properties of Dilithium and processes multiplication of multiple polynomials in parallel. After the sparse multiplier completes the operations, the post-sparse processing module is configured to implement pipelining of data flow, similar to the post-FFT module.

[0162] The memory array is configured to exchange data between the FFT data path and the sparse data path.

[0163] The memory array includes a block random access memory (BRAM) array applied to a field programmable gate array (FPGA) and a static random access memory (SRAM) array applied to an application specific integrated circuit (ASIC).

[0164] According to an embodiment of the present application, the BRAM array includes a data storage area and a data exchange area.

[0165] According to an embodiment of the present application, the data storage area is configured to store a matrix and a private key vector.

[0166] According to an embodiment of the present application, the data exchange area is configured to transfer associated data of the FFT data path and the sparse data path.

[0167] The BRAM (Block RAM) array includes a data storage area and a data exchange area. The data storage area is configured to store a matrix and a private key vector (e.g., , and ). The exchange area is used to transfer the relevant data between the NTT and sparse data paths.

[0168] Figure 8 is a flow chart of a timing scheduling method of a Dilithium signature generation algorithm according to an embodiment of the present application.

[0169] As shown in Figure 8 , the timing scheduling method of the Dilithium signature generation algorithm is applied to the Dilithium processing device based on sparse calculation, and characterized in that it comprises operations S810-S850.

[0170] In operation S810, the rejection loop in the Dilithium signature generation algorithm is divided into a dense polynomial multiplication stage and a sparse polynomial multiplication stage according to the SampleInBall operation in the Dilithium signature generation algorithm.

[0171] In operation S820, in the pre-computation stage of the Dilithium signature generation algorithm, the pseudo-random number generation operation and the pseudo-random number sampling and screening operation are performed through the NTT data path according to the private key given by the user to obtain a sampling matrix, wherein the elements in the sampling matrix are dense polynomials in Dilithium.

[0172] The elements in the sampling matrix are polynomials on the ring .

[0173] According to the private key given by the user, the Keccak module in the NTT data path generates a pseudo-random number, the sampling module in the NTT data path samples the pseudo-random number to obtain a sampling result, and the NTT data path screens the dense polynomials in Dilithium according to the sampling result to obtain a sampling matrix.

[0174] In operation S830, in the dense polynomial multiplication stage, a sampling vector is obtained through the fast number theory transformation data path, and the sampling vector and the sampling matrix are processed to complete the multiplication operation of the dense polynomials, and the multiplication result of the dense polynomials is stored in the block random memory, wherein the sampling vector is a dense polynomial with a first preset bit width.

[0175] The first preset bit width of the sampling vector is preferably 20-24 bits.

[0176] In operation S840, in the sparse polynomial multiplication stage, the sparse polynomial and the private key vector in Dilithium are processed by the sparse data path to complete the multiplication operation of the sparse polynomial, and the multiplication result of the sparse polynomial is stored in the block random memory, wherein the private key vector has a second preset bit width of the dense polynomial.

[0177] The second preset bit width is preferably 3-13 bits.

[0178] The multiplication operation is the multiplication of the private key vector and (i.e. the symbol set and index set involved in the present application), and the private key vector is also stored in the data storage area; the operation result or sample value of the dense polynomial is added or subtracted with the sparse multiplication result, so some values of the dense polynomial need to be stored and then transmitted to the sparse data path.

[0179] In operation S850, the associated data read and write operations of the dense polynomial multiplication stage and the sparse polynomial multiplication stage are alternately and continuously performed by introducing a ping-pong mechanism and using multiple sets of block random memories as data write operation exchange areas.

[0180] According to the embodiments of the present application, the timing scheduling method of the Dilithium signature generation algorithm further comprises:

[0181] After the rejection condition check on the sparse polynomial multiplication stage, a check result is obtained.

[0182] In the case where the check result is a rejection condition violation, the fast number theory transform data path operation parallel to the sparse data path is ended, and the sparse data path is restarted.

[0183] In the case where the check result is that the rejection condition is not violated, the fast number theory transform data path is paused, and the generated digital signature is output.

[0184] Figure 9 is a timing scheduling diagram of the Dilithium signature generation algorithm according to the embodiments of the present application.

[0185] The following will be described in combination with Figure 9 The timing scheduling method is further described in detail.

[0186] The signature generation is the most complex and resource-intensive algorithm operation in Dilithium, and the scheduling strategy of the operation engine provided by the present application will be introduced by taking Figure 9 as an example. The rejection loop in the signature generation algorithm is divided into two stages, one of which is the calculation of the dense polynomial multiplication (i.e. ) using the NTT data path; the second part is the sparse polynomial multiplication (i.e. , and The two-stage boundary is the SampleInBall operation, so this division can divide the dense and sparse polynomial multiplication, maintain the data flow within the two stages, and avoid resource hazards of the Keccak module in the two stages.

[0187] The entire signature generation process is divided into three stages. The pre-computation stage samples the matrix and stores it in the BRAM; the NTT stage calculates the dense polynomial multiplication , generates and stores and ; the sparse stage calculates the sparse polynomial multiplication , and , and reads and for operation. In order to avoid data overwriting, a ping-pong mechanism is introduced, and two groups of BRAMs are designed to act as write exchange areas, alternating reading and writing to achieve continuous data transmission.

[0188] In the sparse stage, the rejection condition is checked. If the condition is violated, the parallel NTT data path operation is restarted after the sparse data path operation is completed; otherwise, the NTT data path is paused, and the generated digital signature is output.

[0189] Figure 10 is a structural schematic diagram of a Dilithium processing system based on sparse computation according to an embodiment of the present application.

[0190] As shown in Figure 10 , the above-mentioned Dilithium processing system based on sparse computation 1000 includes an information representation module 1010, a compressed storage module 1020, a storage module 1030, and an operation conversion module 1040.

[0191] The information representation module 1010 is used to represent the power set of the non-zero terms in the sparse polynomial involved in Dilithium as an index set, and represent the coefficient set of the non-zero terms in the sparse polynomial as a symbol set.

[0192] The compressed storage module 1020 is used to store the index set into the index block random memory, and store the symbol set corresponding to the index set after compression into the register, to complete the compressed storage of the sparse polynomial.

[0193] The storage module 1030 is used to represent the dense polynomial involved in Dilithium as a private key vector, and store the private key vector into the vector block random memory.

[0194] The operation conversion module 1040 is used by the sparse polynomial multiplier to address the private key vector according to the index set and determine the operation type according to the symbol set, thereby converting the modular multiplication operations of dense and sparse polynomials involved in Dilithium into the target operation.

[0195] Figure 11 This is a schematic diagram of the timing scheduling system of the Dilithium signature generation algorithm according to an embodiment of the present invention.

[0196] like Figure 11 As shown, the timing scheduling system 1100 of the Dilithium signature generation algorithm includes a partitioning module 1110, a pre-computation module 1120, a dense multiplication module 1130, a sparse multiplication module 1140, and a control module 1150.

[0197] The partitioning module 1110 is used to divide the rejection loop in the Dilithium signature generation algorithm into a dense polynomial multiplication stage and a sparse polynomial multiplication stage based on the SampleInBall operation in the Dilithium signature generation algorithm.

[0198] The pre-computation module 1120 is used in the pre-computation stage of the Dilithium signature generation algorithm to perform pseudo-random number generation, pseudo-random number sampling and filtering operations through the NTT data channel based on the private key given by the user, to obtain a sampling matrix, wherein the elements in the sampling matrix are dense polynomials in Dilithium.

[0199] The dense multiplication module 1130 is used to obtain a sampling vector through a fast number theory transformation data path during the dense polynomial multiplication stage, process the sampling vector and the sampling matrix to complete the dense polynomial multiplication operation, and store the result of the dense polynomial multiplication operation in a block random access memory, wherein the sampling vector is a dense polynomial with a first preset bit width.

[0200] The sparse multiplication module 1140 is used to process the sparse polynomial and the private key vector in Dilithium through a sparse data path to complete the sparse polynomial multiplication operation during the sparse polynomial multiplication stage, and to store the result of the sparse polynomial multiplication operation in a block random access memory, wherein the private key vector has a dense polynomial with a second preset bit width.

[0201] The control module 1150 is used to control the alternating and continuous execution of associated data read and write operations in the dense polynomial multiplication stage and the sparse polynomial multiplication stage by introducing a ping-pong mechanism and using a multi-block random access memory as the exchange area for data write operations.

[0202] The Dilithium processing method based on sparse calculation provided by the application utilizes the endogenous sparsity of Dilithium, customizes a sparse polynomial multiplier for Dilithium, and converts the complex modular multiplication between dense polynomials and sparse polynomials into target operations, so that the calculation complexity of sparse multiplication and the storage requirement of private keys are greatly reduced; meanwhile, the Dilithium processing device based on sparse calculation provided by the application realizes the mixed processing of dense and sparse polynomial multiplication, and designs a switching scheduling strategy between different operation engines, so that higher throughput and better area-time performance are realized.

[0203] Figure 12 A block diagram of an electronic device suitable for implementing the timing scheduling method of the Dilithium processing method based on sparse calculation and the Dilithium signature generation algorithm is schematically shown.

[0204] As shown in Figure 12 The electronic device 1200 according to the embodiment of the application includes a processor 1201 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1202 or loaded from a storage portion 1208 into a random access memory (RAM) 1203. The processor 1201 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), and the like. The processor 1201 can also include an on-board memory for cache use. The processor 1201 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to the embodiment of the application.

[0205] In the RAM 1203, various programs and data required for the operation of the electronic device 1200 are stored. The processor 1201, the ROM 1202, and the RAM 1203 are connected to each other through a bus 1204. The processor 1201 performs various operations of the method processes according to the embodiment of the application by executing the programs in the ROM 1202 and / or the RAM 1203. It should be noted that the programs can also be stored in one or more memories other than the ROM 1202 and the RAM 1203. The processor 1201 can also perform various operations of the method processes according to the embodiment of the application by executing the programs stored in the one or more memories.

[0206] According to an embodiment of the present application, the electronic device 1200 can further include an input / output (I / O) interface 1205 that is also connected to the bus 1204. The electronic device 1200 can further include one or more of the following components connected to the I / O interface 1205: an input part 1206 including, for example, a keyboard and a mouse; an output part 1207 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage part 1208 including, for example, a hard disk; and a communication part 1209 including, for example, a LAN card, a modem, and the like. The communication part 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the I / O interface 1205 as necessary. A removable medium 1211 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 1210 as necessary, so that a computer program read out therefrom is installed in the storage part 1208 as necessary.

[0207] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present application.

[0208] According to an embodiment of the present application, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, the computer readable storage medium can include one or more memories such as the ROM 1202 and / or the RAM 1203 described above and / or one or more memory other than the ROM 1202 and the RAM 1203.

[0209] The computer program product of the present application can be a computer program product that comprises a computer-readable medium having stored thereon instructions that can be executed by a processor of a computer. The computer program product can have stored thereon the instructions for carrying out any or all of the steps, operations, functions, etc. associated with the processes, algorithms, methods, etc. according to any of the various embodiments of the present application. These instructions can also be stored, for example, in the memory 204 of a general purpose computer, a computer attached to a network, and / or any of the other types of computers or devices discussed herein. These instructions can be executed by the processor of the computer to carry out any or all of the steps, operations, functions, etc. associated with the processes, algorithms, methods, etc. according to any of the various embodiments of the present application.

[0210] The above detailed description has shown, described, and pointed out the various embodiments of the application. It will be understood that various modifications can be made without departing from the scope of the application, which is not to be limited to the particular embodiments discussed above. It will be apparent to those skilled in the art that various alternatives to the embodiments described herein can be employed in practicing the present application. From the disclosure provided herein, equivalents to the disclosed embodiments will be readily apparent to those of ordinary skill in the art.

Claims

1. A Dilithium processing method based on sparse computation, characterized in that, The method comprises the following steps: expressing the power set of the non-zero term of the sparse polynomial involved in the Dilithium as an index set, and expressing the coefficient set of the non-zero term of the sparse polynomial as a symbol set; storing the index set into an index block random memory, and storing the symbol set corresponding to the index set into a register after compression, to complete the compressed storage of the sparse polynomial; expressing the dense polynomial involved in the Dilithium as a private key vector, and storing the private key vector into a vector block random memory; addressing the private key vector stored in the vector block random memory in parallel by the addressing unit of the sparse polynomial multiplier according to the index set stored in the index block random memory, to obtain a plurality of private key vectors participating in the modular multiplication operation in the Dilithium; determining the operation type by the selection unit of the sparse polynomial multiplier according to the symbol set stored in the register, wherein the operation type includes addition operation and / or subtraction operation; performing the NOT operation on the plurality of private key vectors participating in the modular multiplication operation in the Dilithium by the sparse polynomial multiplier, to obtain a plurality of private key vectors after the NOT operation; converting the modular multiplication operation of the plurality of private key vectors after the NOT operation and the symbol set into the accumulation operation according to the operation type.

2. A Dilithium processing device based on sparse computation, applied to the method of claim 1, characterized in that, The method comprises the following steps: a fast number theory transform data path is used to perform the key generation operation of the Dilithium, the signature generation operation of the Dilithium and the signature verification operation of the Dilithium; a sparse data path is used to perform the signature generation operation of the Dilithium and the signature verification operation of the Dilithium; a memory array is used to exchange data between the fast number theory transform data path and the sparse data path; wherein the fast number theory transform data path completes the multiplication operation between the dense polynomials in the Dilithium through one-time fast number theory transform, product accumulation operation and inverse fast number theory transform; wherein the sparse data path converts the multiplication operation between the dense polynomials and the sparse polynomials in the Dilithium into the accumulation operation based on the endogenous sparsity of the Dilithium; wherein the memory array comprises a block random memory array applied to a programmable gate array and a static random access memory array applied to a dedicated integrated circuit.

3. The processing device of claim 2, wherein, The fast number theory transform data path comprises a one-way hash function module, a sampling module, a fast number theory transform module and a post-fast number theory transform processing module.

4. The processing device of claim 3, wherein, The one-way hash function module is instantiated as a permutation core for realizing SHAKE-128 and SHAKE-256 in time sharing mode, and the permutation is performed once every 24 cycles.

5. The processing device of claim 3, wherein, The sampling module comprises a SampleInBall module and a rejection sampling module; wherein the SampleInBall module is used to obtain the symbol set and the index set of the non-zero term coefficient of the sparse polynomial in the Dilithium; The rejection sampling module is configured to sample a vector and a matrix.

6. The processing device of claim 3, wherein, The fast number theory transform module includes a plurality of butterfly units, which are configured to perform pipelined fast number theory transform, multiplication accumulation operation and pipelined inverse fast number theory transform.

7. The processing device of claim 3, wherein, The post-fast number theory transform processing module is configured to perform pipelined processing of data streams.

8. The processing device of claim 2, wherein, The sparse data path includes a sparse polynomial multiplier and a post-sparse processing module.

9. The processing device of claim 8, wherein, The sparse polynomial multiplier is configured to perform parallel processing of multiplication of a plurality of sparse polynomials and convert multiplication of the sparse polynomials into addition operation based on endogenous sparsity of the Dilithium.

10. The processing device of claim 8, wherein, The post-sparse processing module is configured to perform pipelined processing of data streams.

11. The processing device of claim 2, wherein, The block random memory array includes a data storage area and a data exchange area.

12. The processing device of claim 11, wherein, The data storage area is configured to store a matrix and a private key vector.

13. The processing device of claim 11, wherein, The data exchange area is configured to transfer associated data of the fast number theory transform data path and the sparse data path.

14. A timing schedule method of a Dilithium signature generation algorithm, applied to the processing device of any one of claims 2-13, characterized in that, The method comprises the following steps: According to the SampleInBall operation in the Dilithium signature generation algorithm, the rejection loop in the Dilithium signature generation algorithm is divided into a dense polynomial multiplication stage and a sparse polynomial multiplication stage; In the pre-computation stage of the Dilithium signature generation algorithm, a pseudo-random number generation operation, a pseudo-random number sampling and screening operation are performed through an NTT data path based on a private key given by a user to obtain a sampling matrix, wherein elements in the sampling matrix are dense polynomials in the Dilithium; In the dense polynomial multiplication stage, a sampling vector is obtained through a fast number theory transform data path, and the sampling vector and the sampling matrix are processed to complete multiplication of dense polynomials, and the multiplication result of the dense polynomials is stored in the block random memory, wherein the sampling vector is a dense polynomial with a first preset bit width; In the sparse polynomial multiplication stage, the sparse polynomials in the Dilithium and the private key vector are processed through the sparse data path to complete multiplication of sparse polynomials, and the multiplication result of the sparse polynomials is stored in the block random memory, wherein the private key vector is a dense polynomial with a second preset bit width; By introducing a ping-pong mechanism and using a plurality of block random memories as data exchange areas for write operation, the associated data read and write operations of the dense polynomial multiplication stage and the sparse polynomial multiplication stage are alternately and continuously performed.

15. The timing scheduling method of claim 14, further comprising: After performing rejection condition checking on the sparse polynomial multiplication stage, a checking result is obtained; In the case that the checking result is a rejection condition violation, after the fast number theory transform data path operating in parallel with the sparse data path ends, the sparse data path is restarted; In the case that the checking result is no rejection condition violation, the fast number theory transform data path is paused, and a generated digital signature is output.

16. A Dilithium processing system based on sparse computation, characterized by, The method comprises the following steps: The information representation module is configured to represent a power set of non-zero terms in a sparse polynomial related to the Dilithium as an index set and represent a coefficient set of the non-zero terms in the sparse polynomial as a symbol set; The compression storage module is configured to store the index set into an index block random access memory and store the symbol set corresponding to the index set into a register after compression, thereby completing compression storage of the sparse polynomial; The storage module is configured to represent a dense polynomial related to the Dilithium as a private key vector and store the private key vector into a vector block random access memory; The operation conversion module is configured to address the private key vector according to the index set and determine an operation type according to the symbol set by a sparse polynomial multiplier, thereby converting a modular multiplication operation of the dense polynomial and the sparse polynomial related to the Dilithium into a target operation; The operation conversion module is configured to address the private key vector according to the index set and determine an operation type according to the symbol set by a sparse polynomial multiplier, thereby converting a modular multiplication operation of the dense polynomial and the sparse polynomial related to the Dilithium into a target operation, and the operation conversion includes: According to the index set stored in the index block random access memory, an addressing unit of the sparse polynomial multiplier performs parallel addressing on the private key vector stored in the vector block random access memory, thereby obtaining a plurality of private key vectors participating in the modular multiplication operation in the Dilithium; According to the symbol set stored in the register, a selection unit of the sparse polynomial multiplier determines an operation type, wherein the operation type includes an addition operation and / or a subtraction operation; The sparse polynomial multiplier performs an inversion operation on the plurality of private key vectors participating in the modular multiplication operation in the Dilithium, thereby obtaining a plurality of inverted private key vectors; According to the operation type, the sparse polynomial multiplier converts the modular multiplication operation of the plurality of inverted private key vectors and the symbol set into an accumulation operation.

17. A timing schedule system of a Dilithium signature generation algorithm, applied to the processing device of any one of claims 2-13, characterized in that, The division module is configured to divide a rejection loop in the Dilithium signature generation algorithm into a dense polynomial multiplication stage and a sparse polynomial multiplication stage according to a SampleInBall operation in the Dilithium signature generation algorithm; The pre-computation module is configured to perform a pseudo-random number generation operation, a pseudo-random number sampling operation and a pseudo-random number screening operation through an NTT data path to obtain a sampling matrix according to a private key given by a user in a pre-computation stage of the Dilithium signature generation algorithm, wherein an element in the sampling matrix is a dense polynomial in the Dilithium; The dense multiplication module is configured to obtain a sampling vector through a fast number theory transform data path in the dense polynomial multiplication stage, process the sampling vector and the sampling matrix to complete a multiplication operation of a dense polynomial, and store a multiplication operation result of the dense polynomial in the block random access memory, wherein the sampling vector is a dense polynomial with a first preset bit width. ​ a sparse multiplication module, configured to, in the sparse polynomial multiplication phase, process the sparse polynomial and a private key vector in the Dilithium through a sparse data path to complete multiplication of the sparse polynomial, and store a multiplication result of the sparse polynomial in the block random memory, wherein the private key vector has a dense polynomial with a second preset bit width; a control module, configured to control the alternative continuous performance of the associated data read-write operations of the dense polynomial multiplication phase and the sparse polynomial multiplication phase by introducing a ping-pong mechanism and taking multiple sets of block random memories as exchange areas of data write operations.

18. An electronic device, comprising: comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, enable the one or more processors to carry out the method according to any one of claims 1, 14 and 15.

19. A computer-readable storage medium, characterized in that, having stored thereon executable instructions that, when executed by a processor, cause the processor to carry out the method according to any one of claims 1, 14 and 15.

Images