An NTT hardware implementation system based on an FPGA platform

Abstract

The present application belongs to the technical field of post-quantum cryptography engineering, and specifically relates to an NTT hardware implementation system based on an FPGA platform. The system is used for accelerating the polynomial multiplication operation on a ring with the highest complexity and the longest time consumption in a lattice-based cryptography scheme; the hardware circuit supporting multiple parameters is designed for standard NTT, pruned NTT and hybrid NTT, and specifically includes: a compact butterfly operation unit, a reconfigurable modulo reduction unit and a cross-storage type memory access mode, the polynomial multiplication operation is completed through a multi-parallel acceleration structure and a multiplexed butterfly calculation unit; forward NTT, corresponding point coefficient multiplication and inverse NTT operations can be realized. The butterfly operation unit is internally in a pipeline mode, thereby reducing the time delay of the critical path; the modulo reduction hardware unit uses addition and shift to replace the multiplication operation therein, thereby reducing the consumption of DSP resources; the cross-storage type memory access mode can simultaneously support three NTT calculations, and the memory utilization rate reaches 100%.

Description

Technical Field

[0001] The present invention belongs to the field of post-quantum cryptography engineering technology, and specifically relates to an NTT hardware implementation system that supports multiple parameters, which is used to accelerate polynomial multiplication operations on rings in lattice cryptographic algorithms. Background Art

[0002] The development of quantum computers will have a substantial impact on existing public-key cryptography systems. Researching and designing quantum-resistant public-key cryptographic algorithms and protocols has become a top priority. Among the many post-quantum cryptography schemes, Lattice-based cryptography has garnered widespread attention due to its security and efficiency. In July 2022, the National Institute of Standards and Technology (NIST) announced four algorithms as future post-quantum cryptography standards, three of which are Lattice-based schemes. Lattice-based algorithms have also been the majority of winning algorithms in post-quantum cryptography competitions held in my country.

[0003] Ring polynomial multiplication is the most computationally complex and time-consuming operation in lattice-based cryptography. Currently, most schemes use NTT (Number-Theoretic Transform) to reduce computational complexity and accelerate polynomial multiplication. The NTT techniques used in mainstream lattice-based cryptography algorithms are categorized into standard NTT (SNTT), truncated NTT (TNTT), and hybrid NTT (HNTT), depending on their parameters.

[0004] This method proposes a compact, constant-time, multi-parameter hardware circuit, implemented purely in hardware on an FPGA platform using the Verilog HDL language. This method performs a complete polynomial multiplication, including forward NTT, multiplication of corresponding point coefficients, and inverse NTT. The hardware module design includes a compact, low-latency butterfly computation unit, a reduction unit suitable for multimodular values, and a unique "interleaved storage" mode. Summary of the Invention

[0005] The purpose of the present invention is to provide a concise, constant-executable, multi-parameter-supporting NTT hardware implementation system based on an FPGA platform.

[0006] The NTT hardware implementation system based on the FPGA platform provided by the present invention is intended to accelerate the ring polynomial multiplication operation, which is the most complex and time-consuming operation in the lattice cryptography scheme. For standard NTT, deleted NTT, and hybrid NTT, a concise hardware circuit is designed that can be executed in constant time and supports multiple parameters. Specifically, it includes: a compact butterfly operation unit, a reconfigurable modular reduction unit, and a cross-storage memory access mode. The polynomial multiplication operation is completed through multiple parallel acceleration structures and multiplexing of butterfly calculation units.

[0007] Define a polynomial ring, let n and q be some positive integers, the symbol represents the set of integers; definition The present invention uses polynomial rings Where n is a power of 2 and q is a prime number. Each element in is an n-dimensional polynomial with coefficients in middle.

[0008] In the standard NTT, the polynomial ring parameter needs to satisfy q≡1(mod 2n), where n is a power of 2 and q is a prime number.

[0009] The truncated NTT, given some non-negative integer β, the parameters n and q of the polynomial ring need to satisfy Among them, the complexity is the lowest when β=1.

[0010] In the hybrid NTT, given certain non-negative integers α and β, the parameters of the polynomial ring need to satisfy Among them, the complexity is lowest when α=β=1.

[0011] The compact butterfly operation unit module supports both Cooley-Tukey (CT) and Gentleman-Sande (GS) structures and corresponding point multiplication operations, and realizes function switching through a (1-bit) chip select signal; the forward NTT adopts the CT structure, with natural order input and bit-flipped order output; the reverse NTT adopts the GS structure, with bit-flipped order input and natural order output.

[0012] The reconfigurable modular reduction unit module is a modular reduction unit suitable for multiple modular values ​​and can be executed in constant time, specifically a modified Barrett reduction algorithm. [1] The designed hardware circuit replaces the multiplication calculation in the algorithm with addition and shift operations, reducing the occupancy of the multiplier (Digital-Signal-Processor, DSP) resources.

[0013] The cross-storage memory access mode, described here, is a memory access mode—a cross-storage structure—that supports three NTT calculations simultaneously, achieving 100% memory utilization. This cross-storage structure utilizes dual-port RAM, each divided into Bank 0 and Bank 1. The read and write addresses of the two RAMs are consistent, and each unit within a bank stores a single coefficient. During each forward / reverse NTT layer, two data points read from the RAM are directly fed into the butterfly unit. The calculated result is first delayed, and the adjacent data points are cross-swapped before being written to the RAM.

[0014] Further.

[0015] The compact butterfly operation unit module includes two modular adders, two modular subtracters, a multiplier, and a reduction unit. To shorten the data critical path, two levels of registers are inserted. Together with the DSP (multiplier) and reduction unit modules, the butterfly operation unit consumes a total of seven clock cycles. When the chip select signal sel is 0, a forward NTT calculation is performed. The polynomial coefficient pair stored in the BRAM is input through ports a and b, and the primitive unit root ω stored in the ROM is input through port w. In this case, A = a + b·ω mod q and B = ab·ω mod q. When the chip select signal sel is 1, a reverse NTT calculation is performed, where A = (a + b) / 2 mod q and B = (a + b)·ω / 2 mod q. Modular addition / subtraction calculations are performed by the modular adder / subtracter, multiplication calculations are performed by the multiplier, and modular operations are performed by the reduction unit. The 1 / 2 mod q calculation in the formula can be implemented in hardware design using only shift and modular addition operations. When the prime number q is fixed, 1 / 2 mod q is equivalent to (q+1) / 2. When the number x is even, x / 2 mod q is converted to x>>1; when x is odd, x / 2 becomes middle, Convert to x>>1, (q+1) / 2 is a constant that can be preset. The optimized butterfly unit hardware structure is as follows Figure 1 shown.

[0016] The reconfigurable modular reduction unit module has a critical path from input to output port that includes 4 adders, 2 subtractors, and 2 multiplexers. In order to increase the maximum clock frequency of the module, 4 levels of registers are inserted into it, and the modular reduction operation takes a total of 4 clock cycles. When performing NTT calculation, the intermediate result obtained by the multiplier is input into the module through port w, and the data is obtained through modular addition / subtraction, shifting, multiplexing and other operations to obtain the reduced modular value, and the result is output to the outside through port x. The optimized hardware structure of the reconfigurable modular reduction unit module is as follows: Figure 2 shown.

[0017] The cross-storage type memory access mode, the dual-port RAM adopts the "simple A port and B port dual-port mode", its A port supports read and write operations, and the B port only supports read operations, and the BRAM can be read and written simultaneously in the same clock cycle. The cross-storage structure polynomial coefficients are stored according to the butterfly calculation pair, and the initial storage method is Bank0 to store 0-127, and Bank1 to store 128-255 (taking 256-dimensional polynomials as an example). During each layer of forward / reverse NTT, the two-point data read in the RAM are directly input into the butterfly unit, and the result after calculation is first delayed and beat, and the two adjacent points are cross-swapped and written to the RAM. This cross-storage method simplifies the module reading logic and ensures that the two-point coefficients read in the next layer are each other's butterfly operation coefficient pairs. The read address of the RAM is generated by real-time calculation, and the write address is the delay of the read address. Its reading and writing methods are as follows: Figure 3 shown.

[0018] Polynomial multiplication is accomplished through a multi-parallel acceleration structure and multiplexed butterfly units. Here, a dual-parallel structure employs two butterfly units, each used within a layer, with dual-parallel acceleration performed at each layer. One butterfly unit, designated BFU0, processes the first 64 pairs of data, while the other, designated BFU1, processes the second 64 pairs. Both units share the same read and write logic. To ensure dual-parallel data throughput with four inputs and four outputs in the same clock cycle, RAM0 is split into RAM0 and RAM2. Polynomial coefficients are stored according to butterfly pairs. Initially, RAM0 Bank0 stores 0-63, RAM2 Bank0 stores 64-127, RAM0 Bank1 stores 128-191, and RAM2 Bank1 stores 192-255 (using a 256-dimensional polynomial as an example). The coefficients in RAM are computed in parallel, with the results of each layer stored back in the original bank.

[0019] The quad-parallel architecture reuses four butterfly units, and the data flow optimization process is the same as the dual-parallel architecture. The difference is that the quad-parallel RAM storage structure is divided into 8 banks, each storing 32 coefficients.

[0020] The beneficial effects of the present invention are:

[0021] This invention utilizes a hardware implementation system for multi-parameter number theoretic transformations based on an FPGA hardware platform. It supports three NTT techniques used in mainstream lattice cryptography schemes, including a butterfly computation unit, a modular reduction unit, and a "cross-store" memory access module. The module utilizes an internal pipeline approach to reduce critical path latency. This system is suitable for modular reduction hardware units with multiple modulos, replacing multiplication operations with additions and shifts to reduce DSP resource consumption. The cross-store memory access module simultaneously supports all three NTT computations, achieving 100% memory utilization. Brief Description of the Drawings

[0022] Figure 1 is the structural diagram of the compact butterfly operation unit in the present invention.

[0023] Figure 2 is the structural diagram of the reconfigurable modular reduction unit of the present invention.

[0024] Figure 3 is the structural diagram of the cross-storage memory access module. Detailed Embodiments

[0025] In order to more clearly elaborate on the problems solved, technical solutions, and beneficial effects of the present invention, the present invention will be further explained and illustrated below in conjunction with the drawings and embodiments. At the same time, it should be clear that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

[0026] Algorithm 1. Calculate using SNTT polynomial multiplication above.

[0027] Input:

[0028] Input:

[0029] Output:

[0030] 1

[0031] 2

[0032] 3

[0033] 4

[0034] The number-theoretic transform (NTT) is a special case of the discrete Fourier transform (DFT) over a finite field. The standard n-point NTT based on negative folded convolution requires parameters to satisfy q ≡ 1 (mod 2n), where n is a power of 2 and q is a prime number. The forward transform is Expressed as:

[0035]

[0036] where ζ is a 2n-th primitive root of unity in 2n ≡ 1 (mod q), and ζ i ≠ 1 (mod q), 0 < i < 2n, and take ω ≡ ζ 2(mod q). The inverse transformation is Expressed as:

[0037]

[0038] at this time, Polynomial multiplication It can be calculated by the following formula:

[0039]

[0040] Its detailed calculation process is shown in Algorithm 1.

[0041] Algorithm 2. SNTT iterative forward transform.

[0042] Input: natural order polynomial f=(f0,f1,…,f n；1 ).

[0043] Input: Precomputed primitive root of unity

[0044] Output: Bit-flipping order polynomial

[0045]

[0046] Algorithm 3. SNTT corresponding point multiplication.

[0047] Input: NTT field polynomial

[0048] Input: NTT field polynomial

[0049] Output: NTT field polynomial

[0050] 1 FOR k←0;k <n;k←k+1 DO。

[0051] 2

[0052] 3 END FOR.

[0053] Algorithm 4. SNTT iterative inverse transform.

[0054] Input: Bit-flipping sequence polynomial

[0055] Input: Precomputed primitive root of unity

[0056] Output: natural order polynomial f=(f0,f1,…,f n；1 ).

[0057]

[0058]

[0059] The iterative pseudocodes for the FFT-trick to calculate the forward transform, corresponding coefficient dot product, and inverse transform of SNTT are shown in Algorithm 2, Algorithm 3, and Algorithm 4, respectively.

[0060] The calculation process of the Truncated-NTT (TNTT) FFT-trick does not have to continue until the linear polynomial. Its FFT-trick tree can delete the last β layer so that its calculation process only continues until Right now:

[0061]

[0062] Among them, ζ is middle The second primitive root of unity, β is less than A non-negative integer, Forward transformation yields The number of times is 2 β -1 polynomial. The dot product contains the corresponding 2 β -1 degree polynomial multiplication. In this case, the parameters n and q of the polynomial ring only need to satisfy This "bottom-pruning" NTT variant is called pruning NTT, and its complexity is minimized when β=1.

[0063] Hybrid-NTT (HNTT) calculation Polynomial multiplication The specific process is:

[0064] Given some non-negative integers α and β.

[0065] The first step is top decomposition. Divide the original polynomial f, g into 2 α subpolynomials.

[0066]

[0067] in:

[0068]

[0069] The second step is NTT calculation. For i=0,…,2 α -1, in Calculation:

[0070]

[0071] in, The above process uses the Remove the β layer from the bottom Point TNTT, and TNTT(y) can be pre-calculated and stored. Combined with Karatsuba technique [1] , first calculate Then for any i≠j, calculate:

[0072]

[0073] The Karatsuba technique is as follows: Let a, b, c, and d be four constants or polynomials. To calculate s1 = a·c, s2 = a·d + b·c, and s3 = b·d, the Karatsuba technique first calculates s1 and s3, then calculates s2 = (a+b)·(c+d)-s1-s3. As can be seen, directly calculating s1, s2, and s3 requires a total of one addition and four multiplications. Using the Karatsuba technique, a total of four additions and three multiplications are required, eliminating one multiplication.

[0074] At the same time, the β layer is deleted The Karatsuba technique is used in the calculation of the corresponding dot multiplication of the TNTT. For example, When , first calculate Then for any i≠j, calculate:

[0075]

[0076] The third step is to reorganize the polynomials. Calculation:

[0077]

[0078] The conditions of HNTT on parameters n and q can be weakened to When α=β=1, the complexity of HNTT is the smallest.

[0079] Algorithm 5. Improved Barrett reduction algorithm.

[0080] Input: Modulus value q = 8380417, bit width is

[0081] Input: the number to be reduced ω, the maximum bit width is

[0082] Output: Reduced value x≡ωmodq

[0083] 1

[0084] 2

[0085] 3

[0086] 4 x←ω-r·q=ω-(r<<23-r<<13+r)

[0087] 5 WHILE x<0 DO

[0088] 6 x←x+q

[0089] 7 END WHILE

[0090] 8 WHILE x>q DO

[0091] 9 x←xq

[0092] 10 END WHILE

[0093] 11 RETURE x

[0094] Algorithm 5 takes the Dilithium algorithm as an example, where μ is a fixed value and the multiplication operation can be replaced by pre-calculated shifts and additions and subtractions. This module structure is also applicable to other module values. For Kyber module q = 3329 = 2 11 +2 10 +2 8 +2 0 ,That For Aigis modulus q = 7681 = 2 13 -2 9 +2 0 ,That Adjust the subsequent shift amount of the algorithm and preset different values ​​to reduce different modular values. The critical path from the input to the output port of the module contains 4 adders, 2 subtractors, and 2 multiplexers. In order to increase the maximum clock frequency of the module, 4 registers are inserted. The modular reduction operation takes a total of 4 clock cycles. The optimized circuit structure is as follows Figure 2 shown.

[0095] References

[0096] [1]Barrett P.Implementing the Rivest Shamir and Adleman Public KeyEncryption Algorithm on a Standard Digital Signal Processor[C].In:Odlyzko,A.M.(eds)Advances in Cryptology—CRYPTO’86.CRYPTO 1986.Lecture Notes inComputer Science,vol 263.Springer,Berlin,Heidelberg.https: / / doi.org / 10.1007 / 3-540-47721-7_24.

[0097] [2]Weimerskirch A.,Paar C.Generalizations of the karatsuba algorithmfor efficient implementations[J].IACR Cryptology ePrint Archive 2006:224。

Claims

1. An NTT hardware implementation system based on FPGA platform, characterized in that: include: Compact butterfly operation unit, reconfigurable modular reduction unit, cross-storage memory access mode, and multiple parallel acceleration structures to complete polynomial multiplication operations by reusing butterfly calculation units; The polynomial ring in the polynomial multiplication is in, represents the set of integers, n is a power of 2, and q is a prime number; Each element in is an n-dimensional polynomial with coefficients in middle; For standard NTT, the polynomial ring parameter satisfies q≡1(mod 2n); For truncated NTT, given some non-negative integer β, the parameters n and q of the polynomial ring satisfy Among them, the complexity is lowest when β = 1; For mixed NTT, given some non-negative integers α and β, the parameters of the polynomial ring satisfy Among them, the complexity is lowest when α=β=1; The compact butterfly operation unit module supports both CT and GS structures and corresponding dot multiplication operations, and realizes function switching through chip select signals; the forward NTT adopts the CT structure, with natural order input and bit-flipped order output; the reverse NTT adopts the GS structure, with bit-flipped order input and natural order output; The reconfigurable modular reduction unit module is a modular reduction unit suitable for multiple modular values ​​and can be executed in constant time. Specifically, it is a hardware circuit designed for the modified Barrett reduction algorithm. The multiplication calculation in the Barrett reduction algorithm is replaced by addition and shift operations, reducing the occupation of multiplier resources. The cross-storage memory access mode supports three types of NTT calculations simultaneously, with a memory utilization rate of 100%; the cross-storage structure uses dual-port RAM, each RAM is divided into Bank0 and Bank1, the read and write addresses of the two are consistent, and each unit in the bank stores a coefficient; during each layer of forward / reverse NTT, the two points of data read in the RAM are directly input into the butterfly unit, the calculated result is first delayed and beat, and the two adjacent points are cross-swapped and written to the RAM.

2. The NTT hardware implementation system according to claim 1, characterized in that: The compact butterfly operation unit module includes two modular adders, two modular subtracters, a multiplier, and a reduction unit. In order to shorten the data critical path, two levels of registers are inserted. Together with the multiplier and the reduction unit module, the butterfly operation unit consumes a total of 7 clock cycles. When the chip selection signal sel is 0, a forward NTT calculation is performed, and the polynomial coefficient pair stored in the BRAM is input from the a and b ports, and the primitive unit root ω stored in the ROM is input from the w port. At this time, A=a+b·ωmod q and B=ab·ωmod q. When the chip selection signal sel is 1, a reverse NTT calculation is performed, and at this time A=(a+b) / 2mod q and B=(a+b)·ω / 2mod q. The modular addition / subtraction calculation is completed by the modular adder / subtracter, the multiplication calculation is completed by the multiplier, and the modular operation is completed by the reduction unit. The 1 / 2mod q calculation in the formula can be realized by only shifting and modular addition operations during hardware design. When the prime number q is determined, 1 / 2mod q is equivalent to (q+1) / 2; when the processing number x is an even number, x / 2mod q is converted to x>>1; when x is an odd number, x / 2 becomes in, Convert to x>>1, (q+1) / 2 is a constant, preset.

3. The NTT hardware implementation system according to claim 2, characterized in that: The reconfigurable modular reduction unit module has a critical path from input to output port that includes four adders, two subtractors, and two multiplexers. To increase the maximum clock frequency of the module, four registers are inserted, and the modular reduction operation takes a total of four clock cycles. When performing NTT calculations, the intermediate result obtained by the multiplier is input into the module through port w. The data is then processed through modular addition / subtraction, shifting, and multiplexing operations to obtain the reduced modular value, and the result is output to the outside through port x.

4. The NTT hardware implementation system according to claim 3, characterized in that: In the cross-storage memory access mode, the dual-port RAM adopts a dual-port mode of port A and port B, wherein port A supports read and write operations, and port B only supports read operations, and read and write operations are performed on the BRAM simultaneously in the same clock cycle; the cross-storage structure polynomial coefficients are stored according to butterfly calculation pairs; for 256-dimensional polynomials, the initial storage method is Bank0 to store 0-127, and Bank1 to store 128-255; during each layer of forward / reverse NTT, the two points of data read in the RAM are directly input into the butterfly unit, and the calculated result is first delayed and beat, and the two adjacent points are cross-swapped and written to the RAM; the read address of the RAM is generated by real-time calculation, and the write address is the delay of the read address.

5. The NTT hardware implementation system according to claim 4, characterized in that: The polynomial multiplication operation is completed by a multi-parallel acceleration structure and multiplexing butterfly calculation units. Here, the two-parallel structure adopts two butterfly units, which are used within the layer, and two parallel accelerations are performed on each layer. One butterfly operation unit, denoted as BFU0, is used to process the first 64 pairs of data, and the other butterfly operation unit, denoted as BFU1, is used to process the last 64 pairs of data. The read and write logic of the two butterfly operation units is consistent. In order to ensure the data throughput of 4 inputs and 4 outputs in the same clock cycle of the two parallel operations, RAM0 is split into RAM0 and RAM2. The polynomial coefficients are stored according to the butterfly calculation pairs. For a 256-dimensional polynomial, the initial storage method is RAM0 Bank0 to store 0-63, RAM2 Bank0 to store 64-127, RAM0 Bank1 to store 128-191, and RAM2 Bank1 to store 192-255. Perform two parallel calculations on the coefficients in RAM, and store the results of each layer back into the original bank; The quad-parallel structure reuses four butterfly units, and the data flow optimization process is consistent with the dual-parallel structure. The difference is that the quad-parallel RAM storage structure is divided into 8 banks, each bank stores 32-point coefficients.

Images