Hardware circuit of ntt polynomial multiplier for post-quantum encryption kyber scheme

Abstract

The application discloses a kind of hardware circuits of NTT polynomial multiplier of post-quantum encryption Kyber scheme, including: state machine control module, index generation module, rotation factor address generation module, rotation factor ROM, storage mapping module, BANK selection module, RAM group, butterfly input selection module, butterfly module, butterfly output selection module;State machine control module realizes state transition and generates signal;Index generation module generates a pair of indexes;Rotation factor address generation module generates corresponding address;Rotation factor ROM addresses data;Storage mapping module maps index into address and BANK number;BANK selection module adjusts mapping address;RAM group addresses data;Butterfly input selection module puts data into input end;Butterfly module carries out the butterfly operation of data;Butterfly output selection module stores output data back to RAM group.The application can improve the performance of polynomial multiplier, speed up the calculation speed, reduce resource consumption as much as possible, shorten time period.

Description

Technical Field

[0001] This invention relates to the field of encryption hardware circuit design technology, specifically to a hardware circuit for an NTT polynomial multiplier oriented towards the post-quantum encryption Kyber scheme. Background Technology

[0002] With the construction and use of quantum computers, public-key encryption algorithms such as RSA and elliptic curve cryptography (ECC) will be broken by Shor's quantum algorithms. Furthermore, symmetric cryptography and hash algorithms will also be broken by Grover's quantum algorithms. To address these threats to data security, NIST is currently screening post-quantum encryption algorithms. In July 2022, four algorithms were identified for standardization, along with four additional algorithms as candidates for the fourth round.

[0003] The key encapsulation mechanism CRYSTALS-Kyber, also known simply as Kyber, is one of the public-key encryption algorithms that is about to be standardized. It is based on the Module Learning With Errors (MLWE) problem in ideal lattices. The basic algebraic structure of MLWE is b = A*s + e, where b, s, and e are all k-dimensional polynomial vectors, A is a k×k-dimensional polynomial matrix, and k is the security level in the Kyber algorithm. Through analysis of the software part, it was found that the most time-consuming and critical part of the entire encryption algorithm is the polynomial multiplication, that is, the basic algebraic structure part. Therefore, accelerating it is of great significance.

[0004] Initially, only a few researchers performed rudimentary hardware acceleration of the Kyber algorithm. In the last two years, however, some research has focused on accelerating polynomial multiplication to optimize key components. Some studies use ping-pong operations for memory access, which effectively solves the memory access conflict problem and doubles the bandwidth, but this operation consumes significant storage resources. Therefore, other studies use pseudo-dual-port addressing for memory access, but this still consumes substantial hardware resources due to memory access conflicts. Of course, some studies do not use BRAM to store intermediate data, but the designed architecture consumes significant hardware resources. Therefore, designing an efficient memory access mechanism is crucial.

[0005] In addition to optimizing modular addition, modular subtraction, modular multiplication, and the overall architecture, the resource efficiency of polynomial multipliers can also be improved. Currently, while some studies have achieved good resource efficiency in the NTT process, the polynomial multiplication process consumes a significant number of cycles, thus affecting overall resource efficiency. Therefore, designing a resource-efficient polynomial multiplier is also crucial. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, this invention proposes a hardware circuit for an NTT polynomial multiplier oriented towards the post-quantum cryptography Kyber scheme, aiming to improve the performance of the polynomial multiplier, accelerate the calculation speed, minimize resource consumption, and shorten the time cycle.

[0007] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0008] The hardware circuit of an NTT polynomial multiplier for the post-quantum cryptography Kyber scheme, as described in this invention, is characterized by comprising: a state machine control module, an index generation module, a twitch factor address generation module, a storage mapping module, a bank selection module, a RAM group, a twitch factor ROM, a butterfly input selection module, a butterfly output selection module, and a butterfly module. The butterfly module includes: a first butterfly unit and a second butterfly unit; each butterfly unit includes: a modular addition module, a modular subtraction module, and a modular multiplication module.

[0009] The state machine control module transitions the current state based on external signals and generates the transitioned state, sel selection signal, stage p, group number k, and round number m; the states include: NTT state, PWM0 state, PWM1 state, and INTT state;

[0010] The index generation module generates a pair of indices i and j based on the state after the transition, the sel selection signal, the stage p, the number of groups k, and the number of rounds m.

[0011] The storage mapping module maps a pair of indices i and j to a pair of addresses a0 and a1 and a pair of BANK numbers b0 and b1, respectively.

[0012] The BANK selection module processes a pair of BANK numbers b0 and b1 and a pair of addresses a0 and a1 to obtain the selected addresses a0' and a1'.

[0013] If the state after the transfer is NTT, then the RAM group addresses the corresponding 2d bits of data S according to a pair of BANK numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 2d-bit data S 2l+1 S 2l Where d represents the bit width;

[0014] The butterfly input selection module will input data S 2k+1 S 2k and data S 2l+1 S 2l Data S split into 4 d bits 2k+1 Data S 2k Data S2l+1 Data S 2l Then put the data S 2k+1 and data S 2l+1 Insert the data into the first butterfly unit and store the data S. 2k and data S 2l Insert the second butterfly unit;

[0015] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0016] The rotation factor ROM reads the d-bit rotation factor w based on the rotation factor address. i ;

[0017] For the first butterfly unit, the first modular multiplication module will use the d-bit rotation factor w i Data S with d bits 2l+1 Multiplying them together yields a 2d-bit multiplication result X1 = w i ×S 2l+1 After processing X1 using a lookup table and Barrett's subtraction, data Y0 with a modulus less than q is obtained; the first modulus addition module processes the d-bit data S 2k+1 After adding the data Y0 of d bits, the addition result S is obtained. 2k+1 +Y0, determine S 2k+1 Does +Y0 exceed q? If it does, then S 2k+1 +Y0 minus q, otherwise, S 2k+1 +Y0 remains unchanged, thus obtaining the output result S' 2k+1 The first module will reduce S 2k+1 Subtracting Y0 from Y0 yields the subtraction result S. 2k+1 -Y0, and determine S 2k+1 Is -Y0 less than 0? If it is, then S 2k+1 -Y0 plus q, otherwise S 2k+1 -Y0 remains unchanged, thus obtaining an output S' with a modulus within q. 2l+1 ;

[0018] For the second butterfly unit, the second modular multiplication module will use the d-bit rotation factor w i Data S with d bits 2l Multiplying them together yields a 2d-bit multiplication result X0 = w i ×S 2l After processing X0 using a lookup table and Barrett's subtraction, data Y1 with a modulus less than q is obtained; the second modulus addition module processes the d-bit data S 2k After adding the result Y1 of the multiplication with d bits, we get the addition result S. 2k +Y1, determine S 2k Does +Y1 exceed q? If it does, then S2k +Y1 minus q, otherwise, S 2k +Y1 remains unchanged, thus obtaining the output result S' 2k The second module will reduce S 2k Subtracting Y1 from Y1 yields the subtraction result S. 2k -Y1, determine S 2k Is -Y1 less than 0? If it is, then S 2k -Y1 plus q, otherwise S 2k -Y1 remains unchanged, thus obtaining an output S' with a modulus within q. 2l ;

[0019] The butterfly output selection module selects the 4d-bit output result S' 2k+1 Output result S' 2k Output result S' 2l+1 Output result S' 2l Merged into 2d bits of data S' 2k+1 S' 2k and 2d-bit data S' 2l+1 S' 2l And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 2d-bit data S' 2k+1 'S' 2k and data S' 2l+1 S' 2l Save back to RAM;

[0020] If the transition state is PWM0, then the RAM group addresses the corresponding 2d bits of data S according to a pair of BANK numbers b0, b1 and a pair of addresses a0', a1'. 2k+1 S 2k And 2d-bit data A 2k+1 A 2k ;

[0021] The butterfly input selection module will select 2d-bit data S 2k+1 S 2k And 2d-bit data A 2k+1 A 2k Data S split into 4 d bits 2k+1 Data S 2k Data A 2k+1 Data A 2k Then put the data S 2k+1 Data S 2k Data A 2k+1 Insert the data into the first butterfly unit and put the data A into the first butterfly unit. 2k+1 Data A 2k Data S 2k Insert the second butterfly unit;

[0022] For the first butterfly unit, the first module adds d bits of data S. 2k+1 and d-bit data S 2k After adding them, we get the addition result S. 2k+1 +S 2k Determine S 2k+1 +S 2k Does it exceed q? If it does, then S 2k+1 +S 2k Subtract q, otherwise, S 2k+1 +S 2k Keeping it unchanged, we obtain an output S' with a modulus less than or equal to q. 2k The first modular multiplication module will convert the d-bit data A 2k+1 Data S with d bits 2k+1 Multiplying them together yields a 2d-digit multiplication result: X2 = A 2k+1 ×S 2k+1 By processing X2 using a lookup table and Barrett's subtraction, an output result M with a modulus less than or equal to q is obtained. 2k ;

[0023] For the second butterfly unit, the second module adds d bits of data A. 2k+1 and d-bit data A 2k After adding them, we get the addition result A. 2k+1 +A 2k Determine A 2k+1 +A 2k Does it exceed q? If it does, then A 2k+1 +A 2k Subtract q, otherwise, A 2k+1 +A 2k The modulus remains unchanged, thus obtaining an output S' with a modulus less than or equal to q. 2k+1 The second modular multiplication module will convert the d-bit data A 2k Data S with d bits 2k Multiplying them together, we get a 2d-digit multiplication result X3 = A 2k ×S 2k By processing X3 using a lookup table and Barrett's subtraction, we obtain an output M with a modulus less than or equal to q. 2k+1 ;

[0024] The butterfly output selection module selects the 4d-bit output result S' 2k+1 Output result S' 2k Output result M 2k+1 Output result M 2k Merged into 2d bits of data S' 2k+1 S' 2k and 2d-bit data M 2k+1 M 2kAnd based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 2d-bit data S' 2k+1 S' 2k and data M 2k+1 M 2k Save back to RAM;

[0025] If the state after the transition is PWM1, then the RAM group addresses the corresponding 2d bits of data S according to a pair of BANK numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 2d-bit data M 2k+1 M 2k ;

[0026] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0027] The rotation factor ROM reads the d-bit rotation factor w from the address generated by the rotation factor address. i ;

[0028] The butterfly input selection module will select 2d-bit data S 2k+1 S 2k and 2d-bit data M 2k+1 M 2k Data S split into 4 d bits 2k+1 Data S 2k Data M 2k+1 Data M 2k Then M 2k S 2k S 2k+1 Insert the first butterfly unit, and place M 2k M 2k+1 w i Insert the second butterfly unit;

[0029] For the first butterfly unit, the first modular multiplication module will convert the d-bit data S 2k+1 Data S with d bits 2k After multiplication, the result is a 2d-bit multiplication: X4 = S 2k+1 ×S 2k The process involves using a lookup table and Barrett's subtraction X4 to obtain an output result p1 with a modulus less than or equal to q. The first modulus addition module then adds M... 2k After adding p0, the addition result M is obtained. 2k +p0, determine M 2k Does +p0 exceed q? If it does, then M 2k +p0 minus q, otherwise, M 2k +p0 remains unchanged, thus obtaining the output result h with a modulus within q. 2i+1 ;

[0030] For the second butterfly unit, the second module adds d bits of data M. 2k+1 Data M with d bits 2k Add them together to get the result M. 2k+1 +M 2k Determine M 2k+1 +M 2k Does it exceed q? If it does, then M 2k+1 +M2 minus q, otherwise M 2k+1 +M2 remains unchanged, thus the output result r is within the modulus of q; the second modular multiplication module will use the d-bit rotation factor w. i M with d position 2k+1 After multiplication, we get a 2d-bit multiplication result X5 = w i ×M 2k+1 The first module uses a lookup table and Barrett's subtraction X5 to process the data, obtaining an output result p1 with a modulus less than q. The second module subtracts p0 from r to obtain the subtraction result r-p0. It then checks if r-p0 is less than 0. If it is, r-p0 is added to q; otherwise, r-p0 remains unchanged, thus obtaining an output result h with a modulus less than q. 2i ;

[0031] The butterfly module interacts with p1 and p0 to obtain the output result h' of the first butterfly unit. 2i+1 =S 2i ×S 2i+1 -(M 2i +M 2i+1 The second butterfly unit outputs the result h'. 2i =M 2i +M 2i+1 ×w i ;

[0032] The butterfly output selection module will select the h' of the d-bit of the butterfly module. 2i+1 and h' of position d 2i Merge into a 2d-bit data h' 2i+1 h' 2i And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the 2d-bit data h' 2i+1 h' 2i Save back to RAM;

[0033] If the state after the transfer is INTT, then the RAM group addresses the corresponding 2d bits of data S according to a pair of BANK numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 2d-bit data S 2l+1 S 2l ;

[0034] The butterfly input selection module will input data S 2k+1 S 2k and data S 2l+1 S 2l Data S split into 4 d bits 2k+1 Data S 2k Data S 2l+1 Data S 2l Then put the data S 2k+1 Data S 2l+1 Insert the data into the first butterfly unit and store the data S. 2k Data S 2l Insert the second butterfly unit;

[0035] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0036] The rotation factor ROM reads the d-bit rotation factor w based on the rotation factor address. i ;

[0037] For the first butterfly unit, the first module adds d bits of data S. 2k+1 and d-bit data S 2l+1 After adding them, we get the addition result S. 2k+1 +S 2l+1 If S 2k+1 +S 2l+1 If the number is even, the result is (S). 2k+1 +S 2l+1 ) / 2; if S 2k+1 +S 2l+1 If it is an odd number, then determine S. 2k+1 +S 2l+1 Does it exceed q? If it exceeds q, then obtain the result (S). 2k+1 +S 2l+1 ) / 2-f, otherwise, the result is (S) 2k+1 +S 2l+1 ) / 2+e, thus obtaining the output result S' with a modulus less than or equal to q. 2k+1 The first module will reduce S 2k+1 With S 2l+1 After subtracting, we get the result S. 2k+1 -S 2l+1 Determine S 2k+1 -S 2l+1 Is it less than 0? If it is, then S 2k+1 -S 2l+1 Add q, otherwise, S 2k+1 -S 2l+1The value remains unchanged, thus obtaining an output result c2 with a modulus within q; if c2 is odd, then divide c2 by 2 and add e, i.e., c2 / 2+e; if it is even, then divide c2 by 2, i.e., c2 / 2, thus obtaining an output result c3 with a modulus within q; the first modular multiplication module takes the d-bit rotation factor w i Multiplying by c3 (digit d) yields a 2d-digit multiplication result X6 = w i ×c3, denoted as , after processing X6 using a lookup table and Barrett's subtraction, we obtain the output result S' with a modulus less than q. 2l+1 ;

[0038] For the second butterfly unit, the second module will add d bits of S 2k and d-position S 2l After adding them, we get the addition result S. 2k +S 2l If S 2k +S 2l If the number is even, the result is (S). 2k +S 2l ) / 2; if S 2k +S 2l If it is an odd number, then determine S. 2k +S 2l Does it exceed q? If it exceeds q, then obtain the result (S). 2k +S 2l ) / 2-f, otherwise, the result is (S) 2k +S 2l ) / 2+e, thus obtaining the output result S' with a modulus less than or equal to q. 2k+1 The second module will reduce the S value of the d-bit. 2k S with d position 2l After subtracting, we get the result S. 2k -S 2l Determine S 2k -S 2l Is it less than 0? If it is, then S 2k -S 2l Add q, otherwise, S 2k -S 2l The modulus remains unchanged, thus obtaining an output result c0 with a modulus within q; if it is odd, then c0 is divided by 2 and e is added, i.e., c0 / 2+e; if it is even, then c0 is divided by 2, i.e., c0 / 2, thus obtaining an output result c1 with a modulus within q; the second modular multiplication module takes the d-bit rotation factor w i Multiplying by c1 (which has 2d bits) yields a multiplication result X7 = w. i After processing X7 using a lookup table and Barrett's subtraction, ×c1 yields an output S' with a modulus less than or equal to q. 2l ;

[0039] The butterfly output selection module selects the 4d-bit output result S' 2k+1 S' 2k S' 2l+1 S' 2l Merged into 2d bits of data S' 2k+1 S' 2k and 2d-bit data S' 2l+1 S' 2l And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 2d-bit data S' 2k+1 S' 2k and S' 2l+1 S' 2l Save back to the RAM group.

[0040] The hardware circuit for the NTT polynomial multiplier for the post-quantum cryptography Kyber scheme described in this invention is also characterized in that the lookup table and Barrett subtraction obtain data Y0 with a modulus less than q in the following steps:

[0041] Step 1: Calculate the fixed value v using formula (1) to obtain the fixed value 2v and the fixed value 3v, and store them together in the lookup table;

[0042]

[0043] Step 2: Split the 2d-bit data X1 into d two-bit data x. d-1 ,x d-2 ,…,x0;where x d-2 This represents the second two-digit data;

[0044] Step 3, x d-1 x d-2 …x0 is multiplied by v, and based on the three fixed values ​​v, 2v, and 3v in the lookup table, d distinct data x's are obtained. d-1 ,x' d-2 …x'0; where x' d-2 This represents the (d-2)th fixed value;

[0045] Step 4: Transfer the data x' d-1 ,x' d-3 …after shifting x'1 left by d / 6 bits, and then comparing it with the data x' d-2 , x' d-4 …x'0 are added together to get d / 4 addition results y d / 2-1 ,y d / 2-2 …y0; where y d / 2-2 This indicates the result of the second addition;

[0046] Step 5: Add the result y of the first addition. d / 2-1The result of the third addition is y. d / 2-3 The result of the d / 4-1th addition, y1, is shifted left by d / 3 bits and compared with the result of the 2nd addition, y1. d / 2-2 The result of the fourth addition is y. d / 2-4 The d / 4th addition result y0 is added together to obtain the new 1st addition result y'. d / 4-1 The new second addition result y' d / 4-2 The new d / 8th addition result is y'0;

[0047] Step 6: Transfer the new second addition result y' d / 4-2 After shifting left by 2d / 3 bits, add it to the new d / 8th addition result y'0 to obtain the data z0;

[0048] Step 7: Transfer the new first addition result y' d / 4-1 After shifting left by 4d / 3 bits, add it to the data z0 to get the result z1; and complete the multiplication operation between the 2d-bit X1 and v.

[0049] Step 8: Shift the result z1 to the right by 2d bits to obtain the data z2;

[0050] Step 9: Based on the characteristics of modulo q, shift the data z2 left by a, b, and c bits respectively to obtain data z3, data z4, and data z5. Then, add the data z2, data z3, data z4, and data z5 together to obtain the result T. Thus, the multiplication operation between z2 and q is completed using equation (2).

[0051] q=2 a +2 b +2 c +1 (2)

[0052] In equation (2), a, b, and c represent the number of bits shifted to the left;

[0053] Step 10: Subtract the data X1 from the result T to obtain the subtraction result U = X1 - T;

[0054] Step 11: Subtract the subtraction result U from the modulus q to obtain the subtraction result V = Uq;

[0055] Step 12: Determine whether the subtraction result V is greater than or equal to 0. If so, assign V to Y0; otherwise, assign U to Y0.

[0056] Compared with the prior art, the beneficial technical effects of the present invention are reflected in:

[0057] 1. This invention designs a resource-efficient Barrett reduction circuit based on a lookup table. Compared to the classic Barrett reduction circuit, this method can save two DSP resources, thereby reducing the overall circuit resource consumption.

[0058] 2. This invention addresses the issue that the division by N operation in the INTT process requires additional computation cycles. It designs a modular addition and subtraction circuit that integrates the division by 2 operation. This ensures that the computation cycle can be theoretically reduced with minimal resource consumption.

[0059] 3. This invention designs a configurable, compact butterfly unit with an interaction port. During NTT and INTT operations, the two butterfly units operate independently and in parallel; during polynomial multiplication, the two butterfly units exchange data through the interaction port. Compared to two butterfly units, polynomial multiplication reduces the computation cycle, thereby improving the overall circuit's computation speed. Attached Figure Description

[0060] Figure 1 The overall hardware architecture diagram of the polynomial multiplier used in this invention;

[0061] Figure 2 The flowchart used in this invention is based on lookup tables and Barrett reduction;

[0062] Figure 3 The present invention uses a modular addition / subtraction circuit diagram;

[0063] Figure 4 The circuit diagram for the two stages of polynomial multiplication operation used in this invention;

[0064] Figure 5 The data storage distribution diagram used in this invention. Detailed Implementation

[0065] In this embodiment, as Figure 1As shown, the hardware circuit of the NTT polynomial multiplier in a post-quantum encryption Kyber scheme first performs the NTT forward transformation of the two-dimensional private key polynomial vector s, then performs the polynomial multiplication of matrix A and vector s, and finally performs the NTT inverse transformation of the multiplication result. Specifically, the circuit includes: a state machine control module (FSM control), an index generator module, a rotatable factor address generator module (ROF address generator), a memory map module, a RAM group, a bank selection module (Bank sel), a rotatable factor ROM (ROFROM), a butterfly input selection module (BF_in sel), a butterfly output selection module (BF_out sel), and a butterfly module (BFgroup). The butterfly module includes: a first butterfly unit (BF0) and a second butterfly unit (BF1). Each butterfly unit includes: a modular addition module, a modular subtraction module, and a modular multiplication module. First, the 256 terms of polynomial s are divided into 128 odd and 128 even terms. The odd and even terms are subjected to NTT transformation in parallel using two butterfly units, with the coefficients of each term being within 3329. The two 12-bit data of the odd and even terms of the polynomial are concatenated into 24-bit data and stored in the RAM group, such as... Figure 5 As shown, for example, the 24-bit data of polynomial S1S0 is stored in BANK0 at address 0, and the matrix A1A0 is stored in BANK1 at address 64.

[0066] The state machine control module transitions the current state based on external signals and generates the transitioned state, sel selection signal, stage p, group number k, and round number m; the states include: NTT state, PWM0 state, PWM1 state, and INTT state;

[0067] The index generation module generates a pair of indices i and j based on the state after the transition, the sel selection signal, the stage p, the number of groups k, and the number of rounds m.

[0068] The storage mapping module maps a pair of indices i and j to a pair of addresses a0 and a1 and a pair of bank numbers b0 and b1, respectively.

[0069] The BANK selection module processes a pair of addresses a0 and a1 based on a pair of BANK numbers b0 and b1 to obtain the selected addresses a0' and a1'.

[0070] If the state after the transfer is NTT, then the RAM bank addresses the corresponding 24-bit data S according to a pair of bank numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 24-bit data S 2l+1 S 2l;

[0071] The butterfly input selection module will input data S 2k+1 S 2k and S 2l+1 S 2l Split into 4 12-bit data S 2k+1 ,S 2k ,S 2l+1 ,S 2l Then put the data S 2k+1 ,S 2l+1 Insert the data into the first butterfly unit and store the data S. 2k ,S 2l Insert the second butterfly unit;

[0072] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0073] The rotation factor ROM reads the 12-bit rotation factor w from the rotation factor address. i ;

[0074] For the first butterfly unit, the 12-bit rotation factor w i With 12-bit S 2l+1 Multiplying them together yields a 24-bit multiplication result X1 = w i ×S 2l+1 After processing X1 using a lookup table and Barrett's subtraction, data Y0 with a modulus within 3329 is obtained; the modulus addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0, and the 12-bit S 2k+1 Adding it to the 12-bit Y0 yields the 13-bit addition result S. 2k+1 +Y0, denoted as c1, let c * =c1[12:1], which means c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d1, determine whether d1

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c1. Otherwise, keep c1 unchanged, thus obtaining the result S' with a modulus of less than 3329. 2k+1 ; Modular reduction module, such as Figure 3 As shown in part b, INTT_en = 0, which gives s0 = 0 and s1 = 0. Then S... 2k+1 Subtracting from Y0, we get the 13-bit S. 2k+1 -Y0, denoted as d0, determine whether d0

[12] is 1. If it is 1, add 3329 to d0. Otherwise, d0 remains unchanged, thus obtaining the output result S' with a modulus of less than 3329. 2l+1 ;

[0075] For the second butterfly unit, the 12-bit rotation factor w i With 12-bit S 2l Multiplying them together yields a 24-bit multiplication result X0 = w i ×S 2l After processing X0 using a lookup table and Barrett's subtraction, Y1 with a modulus within 3329 is obtained; the modulus addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0, and use the modulo-add module to convert the 12-bit S 2k Adding it to the 12-bit Y1 yields a 13-bit addition result S. 2k +Y1, denoted as c0, let c * =c0[12:1], then c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d3, determine whether d3

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c0. Otherwise, c0 remains unchanged, thus obtaining the output result S' within 3329. 2k ; Modular reduction module, such as Figure 3 As shown in part b, INTT_en = 0, which gives s0 = 0 and s1 = 0. Then S... 2k Subtracting from Y1 yields a 13-bit S. 2k -Y1, denoted as d2, determine whether d2

[12] is 1. If it is 1, add 3329 to c0. Otherwise, keep c0 unchanged, thus obtaining the output result S' with a modulus of less than 3329. 2l ;

[0076] The butterfly output selection module selects four 12-bit data S' 2k+1 S' 2k S' 2l+1 S' 2l Combined into 24-bit data S' 2k+1 S' 2k and 24-bit data S' 2l+1 S' 2l And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 24-bit data S' 2k+1 S' 2k and S' 2l+1 S' 2l Save back to RAM;

[0077] If the transition state is PWM0, then the RAM group addresses the corresponding 24-bit S based on a pair of BANK numbers b0, b1 and a pair of addresses a0', a1'. 2k+1 S 2k And 24-bit A2k+1 A 2k ;

[0078] The butterfly input selection module will select the 24-bit S 2k+1 S 2k And 24-bit A 2k+1 A 2k Split into 4 12-bit data S 2k+1 S 2k A 2k+1 A 2k Then S 2k+1 ,S 2k A 2k+1 Place the first butterfly unit, A 2k+1 A 2k ,S 2k Place the second butterfly unit; as follows Figure 4 As shown;

[0079] For the first butterfly unit, the module addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0, and the 12-bit S 2k+1 And 12-bit S 2k The two numbers are added together to obtain a 13-bit addition result S. 2k+1 +S 2k Let c be denoted as c1, and let c * =c1[12:1], which means c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d1, determine whether d1

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c1. Otherwise, keep c0 unchanged, thus obtaining the output result S' within 3329. 2k Then, the modular multiplication module is used to multiply the 12-bit A... 2k+1 With 12-bit S 2k+1 Multiplying them together, we get the result X2 = A. 2k+1 ×S 2k+1 After processing X2 using a lookup table and Barrett's subtraction, we obtain M with a modulus less than 3329. 2k ;

[0080] For the second butterfly unit, the module addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0, and then the 12-bit A 2k+1 And 12-digit A 2k The two numbers are added together to obtain a 13-bit addition result A. 2k+1 +A 2k Let c be denoted as c0, and let c * =c0[12:1], then c* Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d3, determine whether d3

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c0. Otherwise, c0 remains unchanged, thus obtaining the output result S' within 3329. 2k+1 Then, the modular multiplication module is used to multiply the 12-bit A... 2k With 12-bit S 2k Multiplying them together, we get a 24-bit multiplication result: X3 = A 2k ×S 2k After processing X3 using a lookup table and Barrett's subtraction, we obtain M with a modulus less than 3329. 2k+1 ;

[0081] The butterfly output selection module selects the four 12-bit data S' from the butterfly module. 2k+1 S' 2k M 2k+1 M 2k Combined into a 24-bit S' 2k+1 S' 2k And 24-bit M 2k+1 M 2k And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 24-bit data S' 2k+1 S' 2k and M 2k+1 M 2k Save back to RAM;

[0082] If the transition state is PWM1, then the RAM group addresses the corresponding 24-bit data S based on a pair of BANK numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 24-bit data M 2k+1 M 2k ;

[0083] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0084] The rotation factor ROM reads the d-bit rotation factor w from the address generated by the rotation factor address. i ;

[0085] The butterfly input selection module selects the 24-bit S of the RAM group. 2k+1 S 2k And 24-bit M 2k+1 M 2k The data is split into four 12-bit data S 2k+1 ,S 2k M 2k+1 M 2kThen M 2k ,S 2k ,S 2k+1 Insert the first butterfly unit, M 2k M 2k+1 ,w i Place the second butterfly unit; as follows Figure 4 As shown;

[0086] For the first butterfly unit, the modular multiplication module is first used to multiply the 12-bit S... 2k+1 With 12-bit S 2k Multiplying them together, we get a 24-bit multiplication result: X4 = S 2k+1 S 2k After processing X4 using a lookup table and Barrett's subtraction, p1 with a modulus within 3329 is obtained; the modulus addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0, and then use the module to add M 2k Adding it to p0 yields a 13-bit addition result M. 2k +p0, denoted as c1, let c * =c1[12:1], which means c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d1, determine whether d1

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c1. Otherwise, keep c1 unchanged, thus obtaining data with a modulus of less than 3329, denoted as h. 2i+1 ;

[0087] For the second butterfly unit, the module addition module is as follows: Figure 3 As shown in part a, INTT_en = 0, we can get s0 = 0, s1[1] = 0. First, we use the modulo-add module to convert the 12-bit M 2k+1 With 12-bit M 2k The two numbers are added together to obtain a 13-bit addition result M. 2k+1 +M 2k Let c be denoted as c0, and let c * =c0[12:1], then c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d0, determine whether d0

[12] is 0. If it is 0, then s1[0] = 1, subtract 3329 from c0. Otherwise, keep c0 unchanged, thus obtaining r with a modulus within 3329. The modular multiplication module will use the 12-bit rotation factor w i With 12-bit M 2k+1 Multiplying them together, we get a 24-bit multiplication result: X5 = w i ×M 2k+1After processing X5 using a lookup table and Barrett's subtraction, p1 with a modulus within 3329 is obtained; the modulus subtraction module is as follows: Figure 3 As shown in part b, INTT_en = 0, so s0 = 0 and s1 = 0. The modulus subtraction module subtracts r from p0 to get a 13-bit r-p0, denoted as d2[12:0]. It checks whether d2

[12] is 1. If it is 1, it adds 3329 to c0. Otherwise, c0 remains unchanged, thus obtaining the output result h with a modulus within 3329. 2i ;

[0088] The butterfly module interacts with p1 and p0, and the first butterfly unit outputs h'. 2i+1 =S 2i ×S 2i+1 -(M 2i +M 2i+1 The output of the second butterfly unit is h' 2i =M 2i +M 2i+1 ×w i ;

[0089] The butterfly output selection module will select the 12-bit h' of the butterfly module. 2i+1 and 12-bit h' 2i Combined into a single 24-bit data h' 2i+1 h' 2i Based on the pair of addresses a0, a1 and the pair of BANK numbers b0, b1 from the previous storage mapping module, the data is stored back into the RAM group.

[0090] If the state after the transfer is INTT, then the RAM bank addresses the corresponding 24-bit data S based on a pair of bank numbers b0, b1 and addresses a0', a1'. 2k+1 S 2k and 24-bit data S 2l+1 S 2l ;

[0091] The butterfly input selection module will input data S 2k+1 S 2k and S 2l+1 S 2l Split into 4 12-bit data S 2k+1 ,S 2k ,S 2l+1 ,S 2l Then put the data S 2k+1 ,S 2l+1 Insert the data into the first butterfly unit and store the data S. 2k ,S 2l Insert the second butterfly unit;

[0092] The rotation factor address generation module generates the corresponding rotation factor address based on stage p and group number k.

[0093] The rotation factor ROM reads the 12-bit rotation factor w from the rotation factor address. i ;

[0094] For the first butterfly unit, the module addition module is as follows: Figure 3 As shown in part a, INTT_en = 1, we can get s0 = 1, and then use the 12-bit S 2k+1 And 12-bit S 2l+1 The two numbers are added together to obtain a 13-bit addition result S. 2k+1 +S 2l+1 Let c be denoted as c1, and let c * =c1[12:1], if c1[0]=0, then s1[1]=0, s1[0]=0, directly output c * If c1[0] = 1, then c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d1, determine whether d1

[12] is 0. If it is 0, then s1[1] = 1, s1[0] = 0, subtract 1664 from c1. Otherwise, then s1[1] = 1, s1[0] = 1, add 1665 to c1, thus obtaining S' with a modulus of less than 3329. 2k+1 ; Modular reduction module, such as Figure 3 As shown in part b, INTT_en = 1, which gives s0 = 1. Therefore, S... 2k+1 With S 2l+1 Subtracting them gives us the 13-bit S. 2k -S 2l+1 Let c2 be the modulus of 3329. Determine if c2

[12] is 1. If it is 1, add 3329 to c2. Otherwise, keep c2 unchanged. Thus, the output result with modulus of 3329 is obtained and denoted as d0. Let d * =d0[11:1], and then perform different operations according to the parity of d0. If d0[0] = 0, then s1 = 0, then directly take d * Otherwise, d * Adding it to 1665 yields an output with a modulus of 3329, denoted as c3; the modular multiplication module is then used to multiply the 12-bit rotation factor w. i With 12-bit S 2l+1 Multiplying them together, we get the result X6 = w i ×c3, after processing X6 using a lookup table and Barrett's subtraction, yields S' with a modulus less than 3329. 2l+1 ;

[0095] For the second butterfly unit, the module addition module is as follows: Figure 3As shown in part a, INTT_en = 1, we can get s0 = 1, and then use the 12-bit S 2k And 12-bit S 2l The two numbers are added together to obtain a 13-bit addition result S. 2k +S 2l Let c be denoted as c3, and let c * =c3[12:1], if c3[0]=0, then s1[1]=0, s1[0]=0, directly output c * If c3[0] = 1, then c * Subtracting from 1665 gives a 13-bit c. * -1665, denoted as d3, determine whether d3

[12] is 0. If it is 0, then s1[1] = 1, s1[0] = 0, subtract 1664 from c3. Otherwise, then s1[1] = 1, s1[0] = 1, add 1665 to c3, thus obtaining an output result with a modulus of 3329, denoted as S'. 2k ; Modular reduction module, such as Figure 3 As shown in b, INTT_en = 1, which gives s0 = 1. Then S... 2k+1 With S 2l Subtracting them gives us the 13-bit S. 2k -S 2l Let c2 be the modulus of 3329. Determine if c2

[12] is 1. If it is 1, add 3329 to c2. Otherwise, keep c2 unchanged. Thus, the output result with modulus of 3329 is obtained and denoted as d2. Let d * =d2[11:1], and then perform different operations according to the parity of d2. If d2[0] = 0, then s1 = 0, then directly take d * Otherwise, d * Adding it to 1665 yields an output with a modulus of 3329, denoted as c1; then, the modular multiplication module is used to multiply the 12-bit rotation factor w. i Multiplying by the 12-bit c1, we get the multiplication result X7 = w i ×c1, after processing X7 using a lookup table and Barrett's subtraction, yields S' with a modulus less than 3329. 2l ;

[0096] The butterfly output selection module selects four 12-bit data S' 2k+1 S' 2k S' 2l+1 S' 2l Combined into 24-bit data S' 2k+1 S' 2k and 2d-bit data S' 2l+1 S' 2l And based on a pair of addresses a0, a1 and a pair of bank numbers b0, b1, the two 24-bit data S'2k+1 S' 2k and S' 2l+1 S' 2l Save back to RAM;

[0097] In this embodiment: the butterfly module includes: a first butterfly unit and a second butterfly unit; each butterfly unit includes: a modular addition module, a modular subtraction module, and a modular multiplication module; the modular multiplication module is as follows: Figure 2 As shown, the steps to obtain Y0 with a modulus less than q from X1 using a lookup table and Barrett's subtraction are as follows:

[0098] Step 1: Calculate the fixed value v using formula (1) to obtain the fixed value 2v and the fixed value 3v, and store them together in the lookup table; where d = 12 and q = 3329;

[0099]

[0100] Step 2: Split the 24-bit data X1 into 12 two-bit data x. 11 x 10 , x9, x8, x7, x6, x5, x4, x3, x2, x1, x0;

[0101] Step 3, x 11 x 10 x9, x8, x7, x6, x5, x4, x3, x2, x1, and x0 are multiplied by v respectively, and based on the three fixed values ​​v, 2v, and 3v in the lookup table, 12 different data x's are obtained. 11 , x' 10 , x'9, x'8, x'7, x'6, x'5, x'4, x'3, x'2, x'1, x'0;

[0102] Step 4, x' 11 , x'9, x'7, x'5, x'3, x'1 shifted left by 2 bits, respectively with x' 10 Adding x'8, x'6, x'4, x'2, and x'0 together yields six addition results: y5, y4, y3, y2, y1, and y0.

[0103] Step 5: Shift y5, y3, and y1 left by 4 bits, and add them to y4, y2, and y0 respectively to obtain 3 addition results y'2, y'1, and y'0;

[0104] Step 6: Shift y'1 left by 8 bits and add it to y'0 to get z0;

[0105] Step 7: Shift y'2 left by 16 bits and add it to z0 to get z1; complete the multiplication operation between the 24-bit X1 and v.

[0106] Step 8: Shift z1 right by 24 bits to obtain data z2;

[0107] Step 9: Finally, based on the characteristics of modulo q, shift the data z2 left by 11, 10, and 8 bits respectively to obtain data z3, data z4, and data z5. Then add the data z2, data z3, data z4, and data z5 together to obtain the result T. Thus, the multiplication operation between z2 and q is completed using equation (2).

[0108] q=2 a +2 b +2 c +1 (2)

[0109] In equation (2), a, b, and c represent the number of bits to shift left; and a = 11, b = 10, and c = 8.

[0110] Step 10: Subtract T from X1 to obtain the subtraction result U = X1 - T;

[0111] Step 11: Subtract the subtraction result U from the modulus 3329 to obtain the subtraction result V = U - 3329;

[0112] Step 12: Determine whether the subtraction result V is greater than or equal to 0. If so, assign V to Y0; otherwise, assign U to Y0.

Claims

1. A hardware circuit of NTT polynomial multiplier for post-quantum encryption Kyber scheme, characterized in that, It comprises: A state machine control module, an index generation module, a rotation factor address generation module, a storage mapping module, a BANK selection module, a RAM group, a rotation factor ROM, a butterfly input selection module, a butterfly output selection module, a butterfly module, wherein the butterfly module comprises: a first butterfly unit, a second butterfly unit; each butterfly unit comprises: a module addition module, a module subtraction module, a module multiplication module; The state machine control module transfers the current state according to an external signal, and generates the transferred state, the sel selection signal, the stage p, the group number k and the round number m; the state comprises: the NTT state, the PWM0 state, the PWM1 state and the INTT state; The index generation module generates a pair of indexes i, j according to the transferred state and the sel selection signal, the stage p, the group number k and the round number m; The storage mapping module maps the pair of indexes i, j into a pair of addresses a0, a1 and a pair of BANK numbers b0, b1, respectively; The BANK selection module processes the pair of BANK numbers b0, b1 and the pair of addresses a0, a1 to obtain the selected addresses a0', a1'; If the state after the transfer is the NTT state, the RAM group addresses the corresponding 2d-bit data S according to a pair of BANK numbers b0, b1 and addresses a0', a1' 2k+1 S 2k and 2d-bit data S 2l+1 S 2l ; wherein d represents the bit width The butterfly input selection module splits data S 2k+1 S 2k and data S 2l+1 S 2l into four d-bit data S 2k+1 , data S 2k , data S 2l+1 , data S 2l , data S 2k+1 and data S 2l+1 , and puts data S 2k and data S 2l into the first butterfly unit and the second butterfly unit; The rotation factor address generation module generates the corresponding rotation factor address according to the stage p and the group number k; The rotation factor ROM reads out a rotation factor w of d bits according to a rotation factor address i ; For the first butterfly unit, the first modulo multiplication module multiplies a d-bit rotation factor w i with data S 2l+1 to obtain a 2d-bit multiplication result X1 = w i × S 2l+1 , and processes X1 through a lookup table and a Barrett reduction to obtain data Y0 within a modulus q; the first modulo addition module adds d-bit data S 2k+1 and d-bit data Y0 to obtain an addition result S 2k+1 + Y0, judges whether S 2k+1 + Y0 exceeds q, if yes, S 2k+1 + Y0 is reduced by q, otherwise, S 2k+1 + Y0 remains unchanged, thereby obtaining an output result S' 2k+1 ; the first modulo subtraction module subtracts Y0 from S 2k+1 to obtain a subtraction result S 2k+1 - Y0, and judges whether S 2k+1 - Y0 is less than 0, if yes, S 2k+1 - Y0 is added by q, otherwise, S 2k+1 - Y0 remains unchanged, thereby obtaining an output result S' 2l+1 within the modulus q; For the second butterfly unit, the second modulo multiplication module multiplies the d-bit rotation factor w i with the d-bit data S 2l to obtain a 2d-bit multiplication result X0=w i ×S 2l , and processes X0by using a lookup table and a Barrett reduction to obtain data Y1within the modulus q; the second modulo addition module adds the d-bit data S 2k and the d-bit multiplication result Y1to obtain an addition result S 2k +Y1, judges whether S 2k +Y1exceeds q, if yes, S 2k +Y1is reduced by q, otherwise, S 2k +Y1remains unchanged, thereby obtaining an output result S' 2k ; the second modulo subtraction module subtracts S 2k from Y1to obtain a subtraction result S 2k -Y1, judges whether S 2k -Y1is less than 0, if yes, S 2k -Y1is added by q, otherwise, S 2k -Y1remains unchanged, thereby obtaining an output result S' 2l within the modulus q; The butterfly output selection module combines the 4 d-bit output results S' 2k+1 , output results S' 2k , output results S' 2l+1 , output results S' 2l into 2 d-bit data S' 2k+1 S' 2k and 2 d-bit data S' 2l+1 S' 2l , and according to a pair of addresses a0, a1 and a pair of BANK numbers b0, b1, stores the two 2 d-bit data S' 2k+1 'S' 2k and data S' 2l+1 S' 2l back to the RAM group; If the state after the transition is the PWM0 state, then the RAM bank is addressed to the corresponding 2d-bit data S according to a pair of BANK numbers b0, b1 and a pair of addresses a0', a1' 2k+1 S 2k and 2d-bit data A 2k+1 A 2k ; The butterfly input selection module will select 2d-bit data S 2k+1 S 2k And 2d-bit data A 2k+1 A 2k Data S split into 4 d bits 2k+1 Data S 2k Data A 2k+1 Data A 2k Then put the data S 2k+1 Data S 2k Data A 2k+1 Insert the data into the first butterfly unit and put the data A into the first butterfly unit. 2k+1 Data A 2k Data S 2k Insert the second butterfly unit; For the first butterfly unit, the first module adds d bits of data S. 2k+1 and d-bit data S 2k After adding them, we get the addition result S. 2k+1 +S 2k Determine S 2k+1 +S 2k Does it exceed q? If it does, then S 2k+1 +S 2k Subtract q, otherwise, S 2k+1 +S 2k Keeping it unchanged, we obtain an output S' with a modulus less than or equal to q. 2k The first modular multiplication module will convert the d-bit data A 2k+1 Data S with d bits 2k+1 Multiplying them together yields a 2d-digit multiplication result: X2 = A 2k+1 ×S 2k+1 By processing X2 using a lookup table and Barrett's subtraction, an output result M with a modulus less than or equal to q is obtained. 2k ; For the second butterfly unit, the second module adds d bits of data A. 2k+1 and d-bit data A 2k After adding them, we get the addition result A. 2k+1 +A 2k Determine A 2k+1 +A 2k Does it exceed q? If it does, then A 2k+1 +A 2k Subtract q, otherwise, A 2k+1 +A 2k The modulus remains unchanged, thus obtaining an output S' with a modulus less than or equal to q. 2k+1 The second modular multiplication module will convert the d-bit data A 2k Data S with d bits 2k Multiplying them together, we get a 2d-digit multiplication result X3 = A 2k ×S 2k By processing X3 using a lookup table and Barrett's subtraction, we obtain an output M with a modulus less than or equal to q. 2k+1 ; The butterfly output selection module combines the 4 d-bit output results S' 2k+1 , output results S' 2k , output results M 2k+1 , and output results M 2k into 2 d-bit data S' 2k+1 S' 2k and 2 d-bit data M 2k+1 M 2k , and stores the two 2 d-bit data S' 2k+1 S' 2k and data M 2k+1 M 2k into the RAM bank according to a pair of addresses a0, a1 and a pair of BANK numbers b0, b1. If the state after the transition is the PWM1 state, the RAM bank addresses the corresponding 2d-bit data S according to the pair of BANK numbers b0, b1 and the addresses a0', a1' 2k+1 S 2k and the 2d-bit data M 2k+1 M 2k ; The rotation factor address generation module generates the corresponding rotation factor address according to the stage p and the group number k; The rotation factor ROM reads out a d-bit rotation factor w according to an address generated by a rotation factor address i ; The butterfly input selection module splits 2d-bit data S 2k+1 S 2k and 2d-bit data M 2k+1 M 2k into 4 d-bit data S 2k+1 , data S 2k , data M 2k+1 , data M 2k , and M 2k , S 2k , S 2k+1 are put into a first butterfly unit, and M 2k , M 2k+1 , w i are put into a second butterfly unit; For the first butterfly unit, the first modular multiplication module will convert the d-bit data S 2k+1 Data S with d bits 2k After multiplication, the result is a 2d-bit multiplication: X4 = S 2k+1 ×S 2k The process involves using a lookup table and Barrett's subtraction X4 to obtain an output result p1 with a modulus less than or equal to q. The first modulus addition module then adds M... 2k After adding p0, the addition result M is obtained. 2k +p0, determine M 2k Does +p0 exceed q? If it does, then M 2k +p0 minus q, otherwise, M 2k +p0 remains unchanged, thus obtaining the output result h with a modulus within q. 2i+1 ; For the second butterfly unit, the second module adds d bits of data M. 2k+1 Data M with d bits 2k Add them together to get the result M. 2k+1 +M 2k Determine M 2k+1 +M 2k Does it exceed q? If it does, then M 2k+1 +M2 minus q, otherwise M 2k+1 +M2 remains unchanged, thus the output result r is within the modulus of q; the second modular multiplication module will use the d-bit rotation factor w. i M with d position 2k+1 After multiplication, we get a 2d-bit multiplication result X5 = w i ×M 2k+1 The first module uses a lookup table and Barrett's subtraction X5 to process the data, obtaining an output result p1 with a modulus less than q. The second module subtracts p0 from r to obtain the subtraction result r-p0. It then checks if r-p0 is less than 0. If it is, r-p0 is added to q; otherwise, r-p0 remains unchanged, thus obtaining an output result h with a modulus less than q. 2i ; The butterfly module interacts p1 with p0 to obtain a first butterfly unit output result h' 2i+1 = S 2i × S 2i+1 - (M 2i + M 2i+1 ), a second butterfly unit output result h' 2i = M 2i + M 2i+1 × w i ; The butterfly output selection module combines the h' of the d bit of the butterfly module and the h' of the d bit into a 2d bit data h' 2i+1 h' 2i h' 2i+1 h' 2i and according to a pair of addresses a0, a1 and a pair of BANK numbers b0, b1, stores the 2d bit data h' 2i+1 h' 2i h' back to the RAM group; If the state after the transition is the INTT state, then the RAM bank addresses the corresponding 2d-bit data S according to a pair of BANK numbers b0, b1 and addresses a0', a1 ’ S 2k+1 S 2k S 2l+1 S 2l ; The butterfly input selection module splits data S 2k+1 S 2k and data S 2l+1 S 2l into four d-bit data S 2k+1 , data S 2k , data S 2l+1 , data S 2l , data S 2k+1 , data S 2l+1 into a first butterfly unit, and data S 2k , data S 2l into a second butterfly unit; The rotation factor address generation module generates the corresponding rotation factor address according to the stage p and the group number k; The rotation factor ROM reads out a rotation factor w of d bits according to a rotation factor address i ; For the first butterfly unit, the first module adds d bits of data S. 2k+1 and d-bit data S 2l+1 After adding them, we get the addition result S. 2k+1 +S 2l+1 If S 2k+1 +S 2l+1 If the number is even, the result is (S). 2k+1 +S 2l+1 ) / 2; if S 2k+1 +S 2l+1 If it is an odd number, then determine S. 2k+1 +S 2l+1 Does it exceed q? If it exceeds q, then obtain the result (S). 2k+1 +S 2l+1 ) / 2-f, otherwise, the result is (S) 2k+1 +S 2l+1 ) / 2+e, thus obtaining the output result S' with a modulus less than or equal to q. 2k+1 The first module will reduce S 2k+1 With S 2l+1 After subtracting, we get the result S. 2k+1 -S 2l+1 Determine S 2k+1 -S 2l+1 Is it less than 0? If it is, then S 2k+1 -S 2l+1 Add q, otherwise, S 2k+1 -S 2l+1 The value remains unchanged, thus obtaining an output result c2 with a modulus within q; if c2 is odd, then divide c2 by 2 and add e, i.e., c2 / 2+e; if it is even, then divide c2 by 2, i.e., c2 / 2, thus obtaining an output result c3 with a modulus within q; the first modular multiplication module takes the d-bit rotation factor w i Multiplying by c3 (digit d) yields a 2d-digit multiplication result X6 = w i ×c3, denoted as , after processing X6 using a lookup table and Barrett's subtraction, we obtain the output result S' with a modulus less than q. 2l+1 ; For the second butterfly unit, the second module will add d bits of S 2k and d-position S 2l After adding them, we get the addition result S. 2k +S 2l If S 2k +S 2l If the number is even, the result is (S). 2k +S 2l ) / 2; if S 2k +S 2l If it is an odd number, then determine S. 2k +S 2l Does it exceed q? If it exceeds q, then obtain the result (S). 2k +S 2l ) / 2-f, otherwise, the result is (S) 2k +S 2l ) / 2+e, thus obtaining the output result S' with a modulus less than or equal to q. 2k+1 The second module will reduce the S value of the d-bit. 2k S with d position 2l After subtracting, we get the result S. 2k -S 2l Determine S 2k -S 2l Is it less than 0? If it is, then S 2k -S 2l Add q, otherwise, S 2k -S 2l The modulus remains unchanged, thus obtaining an output result c0 with a modulus within q; if it is odd, then c0 is divided by 2 and e is added, i.e., c0 / 2+e; if it is even, then c0 is divided by 2, i.e., c0 / 2, thus obtaining an output result c1 with a modulus within q; the second modular multiplication module takes the d-bit rotation factor w i Multiplying by c1 (which has 2d bits) yields a multiplication result X7 = w. i After processing X7 using a lookup table and Barrett's subtraction, ×c1 yields an output S' with a modulus less than or equal to q. 2l ; The butterfly output selection module combines the 4 d-bit output results S' 2k+1 , S' 2k , S' 2l+1 , S' 2l into 2 d-bit data S' 2k+1 S' 2k and 2 d-bit data S' 2l+1 S' 2l , and according to a pair of addresses a0, a1 and a pair of BANK numbers b0, b1, stores the two 2 d-bit data S' 2k+1 S' 2k and S' 2l+1 S' 2l back to the RAM group.

2. The hardware circuit for NTT polynomial multiplier for post-quantum cryptography Kyber scheme according to claim 1, characterized in that the lookup table And the Barrett reduction is obtained by the following steps to obtain the data Y0 within the modulus q: Step 1, calculate the fixed value v using formula (1), so as to obtain the fixed value 2v, the fixed value 3v, and store them in the lookup table together; Step 2, split the 2d-bit data X1 into d 2-bit data x d-1 ,x d-2 ,…,x0; wherein x d-2 represents the 2nd 2-bit data; Step 3, x d-1 , x d-2 …x0 are multiplied by v respectively, and according to the 3 fixed values v, 2v, 3v of the look-up table, d different data x' d-1 ,x' d-2 …x’0 are obtained; wherein x' d-2 represents the d-2th fixed value; Step 4, add the data x' d-1 ,x' d-3 …x'1 left shifted by d / 6 bits to the data x' d-2 , x' d-4 …x'0, to obtain d / 4 addition results y d / 2-1 ,y d / 2-2 …y0; wherein y d / 2-2 represents the second addition result; Step 5, the first addition result y d / 2-1 , the third addition result y d / 2-3 , the d / 4-1th addition result y1 is left shifted by d / 3 bits, the second addition result y d / 2-2 , the fourth addition result y d / 2-4 , the d / 4th addition result y0 is added, to obtain a new first addition result y' d / 4-1 , a new second addition result y' d / 4-2 , a new d / 8th addition result y'0; Step 6, add the new 2nd addition result y' d / 4-2 After left shifting 2d / 3 bits, add the new d / 8th addition result y'0 to obtain data z0; Step 7, add the new first addition result y' to the data z0 after shifting left 4d / 3 bits to get the result z1, and complete the multiplication of 2d bits of X1 and v. d / 4-1 After shifting left 4d / 3 bits, add the data z0 to get the result z1, and complete the multiplication of 2d bits of X1 and v. Step 8, shift the result z1 to the right by 2d bits to obtain data z2; Step 9, according to the characteristics of the modulus q, shift the data z2 to the left by a, b, c bits respectively to obtain data z3, data z4, data z5, then add the data z2, data z3, data z4, data z5 to obtain the result T; so as to complete the multiplication operation of z2 and q by using formula (2); q＝2 a +2 b +2 c +1 (2) In formula (2), a, b, c represent the number of left shift bits; Step 10, subtract the data X1 from the result T to obtain the subtraction result U = X1-T; Step 11, subtract the modulus q from the subtraction result U to obtain the subtraction result V = U-q; Step 12, judge whether the subtraction result V is greater than or equal to 0, if yes, assign V to Y0, otherwise, assign U to Y0.

Images