An efficient hash computation unit for kyber algorithm

Abstract

The application discloses a kind of high-efficiency Hash calculation unit for Kyber algorithm, including data interaction unit, Keccak-1600 module, first data selector, rejection sampling module and central binomial distribution sampling module, data interaction unit can receive external data, can also receive the acquisition completion signal and Keccak-1600 calculation completion signal sent by Keccak-1600 module, and output save completion signal to Keccak-1600 module, so as to realize that Keccak-1600 calculation is executed in parallel with absorption, extrusion and sampling operation, simultaneously, data interaction unit saves the output data of Keccak-1600 module, outputs the data required by rejection sampling module and central binomial distribution sampling module, rejection sampling module and central binomial distribution sampling module can be calculated in parallel with Keccak-1600 module, and rejection sampling module introduces rescue data and module reduction calculation;Advantages are that hardware resource consumption can be reduced, calculation speed is fast, calculation efficiency is higher, and rejection adoption rate is lower, and pseudo-random number resource waste rate can be reduced.

Description

Technical Field

[0001] This invention relates to hash calculation units, and more particularly to an efficient hash calculation unit for the Kyber algorithm. Background Technology

[0002] As the performance of quantum computers continues to improve, traditional cryptographic systems relying on factorization, discrete logarithms, and elliptic cryptography algorithms face the risk of being cracked. To address this issue, the National Institute of Standards and Technology (NIST) launched a global competition for post-quantum secure algorithms. The CRYSTALS-KYBER (Kyber) algorithm, a lattice-based post-quantum modular error-learning algorithm, won in the third round of the competition due to its efficiency, scalability, and simplicity. NIST has now launched the fourth round of the competition and will adopt the Kyber algorithm as a standardized public-key encryption and key exchange algorithm.

[0003] In the key generation, encryption / decryption, and key exchange processes of the post-quantum Kyber algorithm, the Hash module, based on the Keccak algorithm, plays a crucial role. The Hash module utilizes the sponge algorithm to configure keccak-1600[r,c] into four hash functions (SHAKE-128, SHAKE-256, SHA3-256, and SHA3-512) for pseudo-random number generation and various hash value calculations. After pseudo-random number generation, a polynomial coefficient sampling process is performed, generating a matrix A / A through rejection sampling. T Three noise vectors r, s, and e are generated by sampling through the central binomial distribution (CBD). The sampling process often requires multiple rounds of hash calculations to generate sufficient random number resources.

[0004] The paper "A High Throughput and Configurable Pseudo-random Number ExtensionGenerator for Lattice-based Post-quantum Cryptography" discloses a high-throughput configurable pseudo-random number extension generator (i.e., a hash computation unit). The hash module can be configured to meet the random number generation requirements of the module rounding learning algorithm and the module error-based learning algorithm. To increase throughput, this high-throughput configurable pseudo-random number extension generator concatenates two circular functions. In addition, to increase configurability, a rejection sampling module and a central binomial distribution sampling module are configured after the Keccak-1600 module for sampling computation. While this high-throughput configurable pseudorandom number generator increases throughput and configurability to some extent, it still suffers from the following problems: First, regarding the hardware implementation of the Kyber algorithm, the configurable modular rounding learning algorithm cannot be directly applied to the Kyber algorithm's computation process, requiring additional hardware configuration, which increases hardware resource consumption. Second, the high-throughput configurable pseudorandom number generator uses a linear process structure, resulting in longer computation time and lower computational efficiency due to the absorption, squeezing, and sampling processes in the hash calculation and the computation of the Keccak-1600 module. Third, the rejection sampling module used by this high-throughput configurable pseudorandom number generator employs a naive rejection sampling structure with a rejection rate as high as 18.7%, resulting in a significant waste of pseudorandom number resources. This indirectly increases the number of calculations required by the Keccak-1600 module, further increasing computation time and reducing computational efficiency. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide an efficient hash calculation unit for the Kyber algorithm that can reduce hardware resource consumption, have fast calculation speed, high calculation efficiency, low rejection rate, and reduce pseudo-random number resource waste rate.

[0006] The technical solution adopted by this invention to solve the above-mentioned technical problems is as follows: a high-efficiency hash calculation unit for the Kyber algorithm, comprising a data interaction unit, a Keccak-1600 module, a first data selector M1, a rejection sampling module, and a central binomial distribution sampling module; the data interaction unit has four working modes: SHAKE-128 mode, SHAKE-256 mode, SHA3-256 mode, and SHA3-512 mode; the data interaction unit has four output methods: hash value output method, rejection sampling output method, central binomial distribution sampling output method with η equal to 2, and central binomial distribution sampling output method with η equal to 3; the working mode and output method of the data interaction unit are set according to the calculation requirements of the Kyber algorithm; the input bit width of the data interaction unit is 64 bits. When the output mode of the data interaction unit is set to Hash value output mode, its working mode is set to SHA3-256 mode or SHA3-512 mode, and the output bit width is 64 bits; when the output mode of the data interaction unit is set to rejection sampling output mode, its working mode is set to SHAKE-128 mode, and the output bit width is 72 bits; when the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η equal to 2, its working mode is set to SHAKE-256 mode, and the output bit width is 144 bits; when the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η equal to 3, its working mode is set to SHAKE-256 mode, and the output bit width is 144 bits; the data interaction unit has an absorption stage and an extrusion stage.When the data interaction unit is working, it first enters the absorption phase. During this phase, external data is output to the data interaction unit, which then begins receiving the external data. For every r bits of data received, the data interaction unit saves those r bits, completing one data absorption process. After each absorption process, the data interaction unit sends a signal indicating data saving is complete to the Keccak-1600 module, notifying it to collect the r bits of data saved during the current absorption process. Once the Keccak-1600 module has collected the r bits of data saved during the current absorption process, the data interaction unit first clears the r bits and then enters the next absorption process, repeating this cycle until the last bit of external data is received. At this point, the data interaction unit is in the last data absorption process. If the number of bits received in the last absorption process is less than r, the received data is then padded. The data is filled into r bits for storage. The filling rule is to first add a 1 bit after the last input data, then add several 0 bits, and finally add another 1 bit to make the total data length r. If it equals r, it is saved directly, completing the last data absorption process. A signal indicating that the data storage is complete is sent to the Keccak-1600 module, notifying the Keccak-1600 module to collect the r bits of data saved in the last data absorption process. After the Keccak-1600 module has completed collecting the r bits of data saved in the last data absorption process, the data interaction unit first clears the r bits of data saved in the last data absorption process, and then enters the extrusion stage. Among them, when the working mode of the data interaction unit is SHAKE-128 mode, r = 1344; when the working mode of the data interaction unit is SHAKE-256 mode, r = 1088; when the working mode of the data interaction unit is SHA3-256 mode, r = 1088; when the working mode of the data interaction unit is SHA3-512 mode, r = 576.The Keccak-1600 module has an initial working phase and a later working phase. In the initial working phase, the Keccak-1600 module receives a data saving completion signal from the data interaction unit. Each time the Keccak-1600 module receives a data saving completion signal, it can acquire one r bits of data from the data interaction unit. Each time the Keccak-1600 module acquires one r bits of data from the data interaction unit, it sends an acquisition completion signal to the data interaction unit, enabling the data interaction unit to begin clearing its stored r bits of data. Simultaneously, it uses the currently acquired r bits of data as input data to perform a calculation. Each time the Keccak-1600 module completes a calculation, it outputs a Keccak-1600 calculation completion signal to the data interaction unit. It also checks whether the next data saving completion signal has been received. If so, it acquires another r bits of data from the data interaction unit, repeating this process until the last r bits of data are acquired and a calculation is completed. At this point, the Keccak-1600 module... The Keccak-1600 module enters the later working stage. Specifically, the Keccak-1600 module uses the currently acquired r-bit data as input data for a calculation. The specific process is as follows: the currently acquired r-bit data is XORed with its internal register data, and then the r-bit data is permuted and its internal register data is updated using Keccak-1600 operations. When the Keccak-1600 module enters the later working stage, it first transmits the current register data as the calculation data to the data exchange... The data interaction unit then periodically performs Keccak-1600 operations on its internal register data to update the internal register data. After each cycle of Keccak-1600 operation is completed, the currently updated register data is transmitted to the data interaction unit as the operation data again, and a Keccak-1600 operation completion signal is output to the data interaction unit. The Keccak-1600 module stops working when the amount of operation data output by the Keccak-1600 module meets the amount required by the Kyber algorithm.After the data interaction unit enters the extrusion stage, upon receiving a computational data and a Keccak-1600 computation completion signal from the Keccak-1600 module, the data interaction unit outputs the computational data according to the currently set output method. Specifically: if the data interaction unit is currently set to Hash value output mode and its operating mode is SHA3-256 mode, the data interaction unit outputs the currently received computational data directly from low to high bits at a rate of 64 bits per cycle, stopping output when a total of 256 bits of data have been output; if the data interaction unit... If the data interaction unit is currently set to Hash value output mode and operates in SHA3-512 mode, then the data interaction unit outputs the currently received computation data directly from low to high bits at a rate of 64 bits per cycle, stopping output when a total of 512 bits of data have been output. If the data interaction unit is currently set to reject sampling output mode, then the data interaction unit operates in SHAKE-128 mode. In this case, the data interaction unit receives 1344 bits of computation data, and the data interaction unit selects the reject sampling module through the first data selector M1, outputting the currently received 1344 bits of data. The data is divided into two parts. The first 1152 bits, starting from the least significant bit, are used as the sampled data. This sampled data is output to the rejection sampling module at a rate of 72 bits per cycle, from least significant bit to most significant bit. The remaining 192 bits, starting from the most significant bit, are used as salvage data, which is output according to the requirements of the rejection sampling module. If the data interaction unit is currently set to a central binomial distribution sampling output mode with η equal to 2, then the data interaction unit operates in SHAKE-256 mode. In this mode, the data interaction unit receives 1088 bits of data for computation. The data interaction unit selects the central binomial distribution using the first data selector M1. The sampling module outputs the currently received 1088-bit data to the central binomial distribution sampling module at a rate of 48 bits per cycle, from the least significant bit to the most significant bit. If the data interaction unit is currently set to a central binomial distribution sampling output mode with η equal to 3, then the working mode of the data interaction unit is SHAKE-256 mode. In this case, the data interaction unit receives 1088-bit data, and the data interaction unit selects the central binomial distribution sampling module through the first data selector M1, outputting the currently received 1088-bit data to the central binomial distribution sampling module at a rate of 72 bits per cycle, from the least significant bit to the most significant bit.When the data interaction unit outputs its sampled data from low to high bits at a rate of 72 bits per cycle to the rejection sampling module, the rejection sampling module, upon receiving a 72-bit data output from the data interaction unit, divides the 72-bit data into 6 groups of 12 bits each, according to the input order. Then, it performs two comparison calculations on each group. The first comparison calculation involves comparing the 12-bit data with the modulus q (q = 3329) of the Kyber algorithm. If the 12-bit data in the group is greater than or equal to q, the first comparison fails, and a request is immediately sent to the data interaction unit. The four-bit data is used as its rescue data. At this time, the data interaction unit outputs the four-bit data from the least significant bit to the most significant bit of its current rescue data to the rejection sampling module, clears the four-bit data, and updates its internal rescue data. When the rejection sampling module receives the four-bit data, it first adds the received four-bit data to the most significant bit of the 12-bit data group to obtain 16-bit data. Then, it performs modulo reduction calculation on the 16-bit data to calculate the 12-bit remainder and the 5-bit quotient. If the 12-bit data group is less than q, the first comparison is successful. It directly pads the most significant bit of the 12-bit data group with zeros to obtain 16-bit data. Then, it performs modulo reduction calculation on the 16-bit data. Modular reduction calculation yields a 12-bit remainder and a 5-bit quotient. The second comparison calculation involves comparing the 5-bit quotient from the first comparison with 19. If the 5-bit quotient is less than 19, the second comparison succeeds, and the 12-bit remainder from the first comparison is output as a valid rejection result. If the 5-bit quotient is greater than or equal to 19, the second comparison fails, and 0 is output as an invalid rejection result. The rejection sampling module stops working when it outputs 256 valid rejection results. The data interaction unit processes its internal data from low to high bits in cycles. When 48-bit data is output to the central binomial distribution sampling module, the central binomial distribution sampling module enters the central binomial distribution sampling mode with η equal to 2. Each time the central binomial distribution sampling module receives a 48-bit data output from the data interaction unit, it divides the received 48-bit data into 12 groups of 4 bits each, from low to high bit. It performs central binomial distribution sampling calculation on each group of data to obtain a 12-bit central binomial distribution sampling result with η equal to 2 for each group of data, until the number of output 12-bit central binomial distribution sampling results meets the requirements of the Kyber algorithm.When the data interaction unit outputs its internally processed data from low to high bits at a rate of 72 bits per cycle to the central binomial distribution sampling module, the central binomial distribution sampling module enters a central binomial distribution sampling mode with η equal to 3. Each time the central binomial distribution sampling module receives a 72-bit data output from the data interaction unit, it divides the received 72-bit data into 12 groups of 6 bits each, from low to high bits. It then performs central binomial distribution sampling calculations on each group, obtaining a 12-bit central binomial distribution sampling result with η equal to 3 for each group, until the number of output 12-bit central binomial distribution sampling results meets the requirements of the Kyber algorithm.

[0007] The data interaction unit includes a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, an enable terminal for receiving an enable signal, a mode selection terminal for receiving a mode selection signal, an output control terminal for receiving an output control signal, a write enable terminal for outputting a write enable signal, a read enable terminal for outputting a read enable signal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a first signal output terminal, and a second signal output terminal. The mode selection signal is a two-bit binary number used to set the data interaction unit. The operating mode is as follows: when the mode selection signal is binary number 00, the data interaction unit is set to SHAKE-128 mode; when the mode selection signal is binary number 01, the data interaction unit is set to SHAKE-256 mode; when the mode selection signal is binary number 10, the data interaction unit is set to SHA3-256 mode; and when the mode selection signal is binary number 11, the data interaction unit is set to SHA3-512 mode. The output control signal is a two-bit binary number used to set the output mode of the data interaction unit. When the output control signal is binary number 00, the output mode of the data interaction unit is set to Hash value output mode. When the output control signal is binary number 01, the output mode of the data interaction unit is set to reject sampling output mode. When the output control signal is binary number 10, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with parameter η = 2 (value range [-2, 2]). When the output control signal is binary number 11, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η = 3 (value range [-3, 3]). The write enable signal is used to control the writing of external data. When the write enable signal is valid, external... External data can be output to the data interaction unit. When the write enable signal is invalid, external data cannot be output to the data interaction unit. The read enable signal is used to control other corresponding modules of the Kyber algorithm to read data output from the first data output terminal of the data interaction unit. When the read enable signal is valid, other corresponding modules of the Kyber algorithm can read data output from the first data output terminal of the data interaction unit. When the read enable signal is invalid, other corresponding modules of the Kyber algorithm cannot read data output from the first data output terminal of the data interaction unit. The first data input terminal of the data interaction unit is 64 bits wide and is used to access external data.The second data input terminal of the data interaction unit is 1344 bits wide and is used to receive the computational data output by the Keccak-1600 module; the first data output terminal of the data interaction unit is 64 bits wide, and when the data interaction unit is working in Hash value output mode, the first data output terminal is used to output 64 bits of data; the second data output terminal of the data interaction unit is 1344 bits wide and is used to output the saved r bits of data; the third data output terminal of the data interaction unit is 24 bits wide, where every 4 bits are used to output a group of 4 bits of data as rescue data, and the third data output terminal of the data interaction unit can be used with... The system outputs 6 sets of 4-bit data as rescue data; the fourth data output terminal of the data interaction unit is 72 bits wide and is used to output the data to be sampled; the first signal input terminal of the data interaction unit is used to input the end signal, which indicates that the current input of external data is the last bit. When the data interaction unit receives the end signal, it indicates that all data in the last data absorption process has been received; the second signal input terminal of the data interaction unit is used to input the acquisition completion signal output by the Keccak-1600 module; the third signal input terminal of the data interaction unit is used to input the Keccak-1600 module output. The data interaction unit has a 6-bit wide fourth signal input terminal, used to input the requirement signal for whether the rejection sampling unit outputs a rescue signal; the data interaction unit has a fifth signal input terminal, used to input a satisfied signal. When the satisfied signal is input to the fifth signal input terminal of the data interaction unit, it indicates that the number of valid rejection sampling results output by the rejection sampling module has reached 256 or the 12-bit central binomial distribution sampling result output by the central binomial distribution sampling module has met the requirements of the Kyber algorithm; the data interaction unit has a first signal output terminal, used to output a data saving complete signal; and a second signal output terminal, used to output a data saving complete signal. The terminal is used to output a data interaction unit calculation end signal; the Keccak-1600 module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, a first signal input terminal, a first signal output terminal, and a second signal output terminal; the first data selector M1 has a first data input terminal, a first data output terminal, a second data output terminal, and a control terminal for inputting and outputting control signals; the rejection sampling module has a clock terminal for receiving a clock signal, a first data input terminal, a second data input terminal, a first data output terminal, a first signal output terminal, and a second signal output terminal for outputting whether the rejection sampling result is valid;The central binomial sampling module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, and a first signal input terminal for receiving a central binomial sampling mode selection signal. When the output mode of the data interaction unit is a central binomial sampling output mode with η equal to 2, the central binomial sampling mode selection signal is used to enable the central binomial sampling module to enter the central binomial sampling mode with η equal to 2. When the output mode of the data interaction unit is a central binomial sampling output mode with η equal to 3, the central binomial sampling mode selection signal is used to enable the central binomial sampling module to enter the central binomial sampling mode with η equal to 3. The first signal output terminal of the data interaction unit is connected to the first signal input terminal of the Keccak-1600 module, and the second data output terminal of the data interaction unit is connected to the first data input terminal of the Keccak-1600 module. The second data input terminal of the data interaction unit is connected to the first data output terminal of the Keccak-1600 module; the second signal input terminal of the data interaction unit is connected to the first signal output terminal of the Keccak-1600 module; the third signal input terminal of the data interaction unit is connected to the second signal output terminal of the Keccak-1600 module; the fourth data output terminal of the data interaction unit is connected to the first data input terminal of the first data selector M1; the fourth signal input terminal of the data interaction unit is connected to the first signal output terminal of the rejection sampling module; the third data output terminal of the data interaction unit is connected to the first data input terminal of the rejection sampling module; the first data output terminal of the first data selector M1 is connected to the second data input terminal of the rejection sampling module; the second data output terminal of the first data selector M1 is connected to the first data input terminal of the central binomial distribution sampling module.

[0008] The data interaction unit includes a state machine and a buffer. The buffer has four storage modes: SHAKE-128, SHAKE-256, SHA3-256, and SHA3-512. The buffer also has four output modes: hash value output, rejection sampling output, central binomial distribution sampling output with η equal to 2, and central binomial distribution sampling output with η equal to 3. When the data interaction unit is set to SHAKE-128 mode by the Kyber algorithm, the buffer's storage mode is SHAKE-128, and the buffer uses the rejection sampling output mode. When the data interaction unit is set to SHAKE-256 mode and the output method is a central binomial distribution sampling output method with η equal to 2, the buffer's storage mode is SHAKE-256 mode, and the output method is a central binomial distribution sampling output method with η equal to 2. When the data interaction unit is set to SHAKE-256 mode by the Kyber algorithm and the output method is a central binomial distribution sampling output method with η equal to 3, the buffer's storage mode is SHAKE-256 mode, and the output method is a central binomial distribution sampling output method with η equal to 3. When the data interaction unit is set to SHA3-256 mode by the Kyber algorithm, the buffer's storage mode is SHA3-256 mode. The buffer is configured to output hash values. When the data interaction unit is set to SHA3-512 mode by the Kyber algorithm, the buffer's storage mode is SHA3-512 mode, and the buffer's output mode is hash value output. The state machine has a clock terminal, a reset terminal, an enable terminal, a mode selection terminal, a write enable terminal, a read enable terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a sixth signal input terminal, a first signal output terminal, a second signal output terminal, a third signal output terminal, a fourth signal output terminal, and a fifth signal output terminal. The buffer has a clock terminal, a reset terminal, a mode selection terminal, and an output control terminal. The system comprises a control terminal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, an empty signal output terminal, a full signal output terminal, an absorption enable terminal, an extrusion enable terminal, a sampling enable terminal, an end signal input terminal, and a first signal input terminal. The clock terminal of the state machine is connected to the clock terminal of the buffer, and its connection terminal is the clock terminal of the data interaction unit. The reset terminal of the state machine is the reset terminal of the data interaction unit. The enable terminal of the state machine is the enable terminal of the data interaction unit. The mode selection terminal of the state machine is connected to the mode selection terminal of the buffer, and its connection terminal is the mode selection terminal of the data interaction unit.The write enable terminal of the state machine is the write enable terminal of the data interaction unit, and the read enable terminal of the state machine is the read enable terminal of the data interaction unit. The first signal input terminal of the state machine is connected to the end signal input terminal of the buffer, and its connection terminal is the first signal input terminal of the data interaction unit. The second signal input terminal of the state machine is the second signal input terminal of the data interaction unit. The third signal input terminal of the state machine is the third signal input terminal of the data interaction unit. The fourth signal input terminal of the state machine is connected to the full signal output terminal of the buffer, and its connection terminal is the first signal output terminal of the data interaction unit. The fifth signal input terminal of the state machine... The input terminal is the fifth signal input terminal of the data interaction unit; the sixth signal input terminal of the state machine is connected to the empty signal output terminal of the buffer; the first signal output terminal of the state machine is connected to the reset terminal of the buffer; the second signal output terminal of the state machine is the second signal output terminal of the data interaction unit; the third signal output terminal of the state machine is connected to the absorb enable terminal of the buffer; the fourth signal output terminal of the state machine is connected to the extrusion enable terminal of the buffer; the fifth signal output terminal of the state machine is connected to the sampling enable terminal of the buffer; the output control terminal of the buffer is the output control terminal of the data interaction unit; the buffer's... The first data input terminal is the first data input terminal of the data interaction unit; the first data output terminal of the buffer is the first data output terminal of the data interaction unit; the second data input terminal of the buffer is the second data input terminal of the data interaction unit; the second data output terminal of the buffer is the second data output terminal of the data interaction unit; the third data output terminal of the buffer is the third data output terminal of the data interaction unit; the fourth data output terminal of the buffer is the fourth data output terminal of the data interaction unit; and the first signal input terminal of the buffer is the fourth signal input terminal of the data interaction unit. The state machine has four states: waiting state, absorbing state, and absorbing state. The data interaction unit is configured to operate in three states: absorption, extrusion, and sampling. When the data interaction unit is in the absorption phase, the state machine only transitions between the waiting and absorption states. When the data interaction unit is in the extrusion phase, if the data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine only transitions between the waiting and extrusion states; if the data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine only transitions between the waiting and sampling states. When the state machine is in the waiting state, the buffer neither writes data to nor reads data from the outside.The state machine retains its internally stored data unchanged. Its initial state is a waiting state. When an external enable signal is output to the state machine, it transitions from the waiting state to the absorbing state, simultaneously outputting a write enable signal to the outside and an absorb enable signal to the buffer. At this time, the data interaction unit enters the absorption phase, and external data is output to the buffer. The buffer begins to periodically receive data. For every r bits of data received, the buffer stores those r bits and outputs a full signal to the state machine. After receiving the full signal from the buffer, the state machine transitions from the absorbing state to the waiting state, and the buffer completes one data absorption cycle. The data interaction module completes a data absorption process. At this time, the state machine sends the received full signal as a storage completion signal to the Keccak-1600 module. Whenever the state machine receives a data acquisition completion signal from the Keccak-1600 module, it outputs a reset signal to the buffer. Each time the buffer receives a reset signal, it clears the data stored within and begins the next data reception cycle. This process repeats until the state machine receives the last signal, indicating that the current input of external data is the last bit. The state machine then transitions from the absorption state to the waiting state. If the number of data bits received by the buffer is less than r, then the received data... The data is padded with zeros at the high bits to create r bits of data for storage. The padding rule is to first add a 1 bit after the last input data, then add several 0 bits, and finally add another 1 bit to make the total data length r. If it equals r, it is saved directly. Then, a full signal is output to the state machine and externally to complete the last data absorption. At this point, the data interaction unit completes the last data absorption process and enters the extrusion stage. At the beginning of the extrusion stage, the buffer does not store any data and always sends an empty signal to the state machine through its empty signal output terminal. The state machine will remain in a waiting state. When the buffer receives the output from the Keccak-1600 module... After processing a set of data, the buffer no longer sends empty signals to the state machine. If the current data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine transitions from a waiting state to a sampling state, outputting a sampling enable signal to the buffer. The buffer then outputs the processed data according to the currently set output method. Specifically, when the buffer is set to reject sampling output mode, it divides the currently received 1344 bits of data into two parts. The first 1152 bits, starting from the least significant bit, are used as the data to be sampled. This data is output to the reject sampling module from the least significant bit to the most significant bit at a rate of 72 bits per cycle.The first 192 bits of data, starting from the most significant bit, are used as salvage data, which is output according to the requirements of the rejection sampling module. When the buffer is set to a center binomial distribution sampling output mode with η equal to 2, the buffer outputs the currently received 1088 bits of data to the center binomial distribution sampling module at a rate of 48 bits per cycle from the least significant bit to the most significant bit. When the buffer is set to a center binomial distribution sampling output mode with η equal to 3, the buffer outputs the currently received 1088 bits of data to the center binomial distribution sampling module at a rate of 72 bits per cycle from the least significant bit to the most significant bit. During the data output process, if the state machine receives a satisfaction signal from the fifth signal input terminal of the data interaction unit, indicating that the buffer output has met the Kyber algorithm requirements, the state machine transitions from the sampling state to the waiting state. It then outputs a data interaction unit calculation completion signal through the second signal output terminal of the data interaction unit and sends a reset signal to the buffer, clearing the data stored in the buffer. If the buffer has finished outputting all its currently stored computational data or sampled data, and the state machine still has not received a satisfaction signal from the fifth signal input terminal of the data interaction unit, the buffer outputs an empty signal to the state machine. The state machine then transitions from the sampling state to the waiting state, waiting for the buffer to receive computational data from the Keccak-1600 module again. If the data interaction unit is currently set to SHAKE-256 mode or SHA3-512 mode, the state machine transitions from the waiting state to the extrusion state, outputs an extrusion enable signal to the buffer, and sends a read enable signal externally. The buffer will then output 64 bits of computational data per cycle. The data interaction unit is set to SHA3-256 mode. When the buffer has accumulated 256 bits of output, the state machine transitions from the squeezed state to the waiting state and outputs a completion signal. Simultaneously, it sends a reset signal to the buffer, clearing its internally stored data. Similarly, if the data interaction unit is set to SHA3-512 mode, when the buffer has accumulated 512 bits of output, the state machine transitions from the squeezed state to the waiting state and outputs a completion signal. Simultaneously, it sends a reset signal to the buffer, clearing its internally stored data. The state machine and buffer in this independent data unit are composed of the end signal from the first signal input terminal, the acquisition completion signal from the second signal input terminal, the Keccak-1600 calculation completion signal from the third signal input terminal, the full and empty signals generated by the buffer, the satisfied signal from the fifth signal input terminal, and the mode selection signal from the mode selection terminal.The control state machine transitions between waiting, absorption, extrusion, and sampling states. The state machine does not contain the operational states of the Keccak-1600 module; instead, it coordinates only through indirect signals. This structure ensures that absorption, extrusion, and sampling operations can be executed in parallel with the Keccak-1600 module's substitution operations. While this advantage may not be significant for hash calculations of short data, it is amplified when calculating hashes of long data, effectively reducing computation time and improving efficiency. Furthermore, the data interaction unit uses only one state machine to control external data input, Keccak-1600 calculation data input, the output of data to be sampled, and the direct output of hash values. This process reuses buffer storage resources as much as possible, reducing control logic and effectively saving memory consumption. By configuring the buffer's storage depth and output direction, it meets the Kyber algorithm's requirements for various hash algorithms, offering greater flexibility.

[0009] The rejection sampling module comprises six structurally identical rejection sampling units, referred to as the first rejection sampling unit, the second rejection sampling unit, the third rejection sampling unit, the fourth rejection sampling unit, the fifth rejection sampling unit, and the sixth rejection sampling unit. Each rejection sampling unit has a clock terminal, a signal input terminal to be sampled, a rescue data input terminal, a sampled data output terminal, a first signal output terminal, and a second signal output terminal. The clock terminals of the six rejection sampling units are connected, and their connection terminals are the clock terminals of the rejection sampling module. The rescue data input terminals of the rejection sampling units are 4 bits wide, and the rescue data input terminals of the six rejection sampling units are connected, and their connection terminals are the first data input terminals of the rejection sampling module. The signal input terminals to be sampled of each rejection sampling unit are 12 bits wide, and the signal input terminals to be sampled of the six rejection sampling units are connected, and their connection terminals are the second data input terminals of the rejection sampling module. The rejection sampling output terminal of each rejection sampling unit... All are 12-bit wide, and the rejection sampling output terminals of the six rejection sampling units are connected, with their connection terminals being the first data output terminals of the rejection sampling module. The first signal output terminals of the rejection sampling units are all 1-bit wide, and the first signal output terminals of the six rejection sampling units are connected, with their connection terminals being the first signal output terminals of the rejection sampling module. The second signal output terminals of the rejection sampling units are all 1-bit wide, and the second signal output terminals of the six rejection sampling units are connected, with their connection terminals being the second signal output terminals of the rejection sampling module. When the rejection sampling module receives a 72-bit data output from the data interaction unit, the 72-bit data is divided into six groups of 12 bits each according to the input order. These groups are then input one-to-one from the data input terminals of the six rejection sampling units. Each rejection sampling unit compares and calculates the received 12-bit data twice to obtain a valid rejection sampling result or an invalid rejection sampling result, which is then output through its sampling output terminal. The rejection sampling module contains 6 rejection sampling units, which can process 6 12-bit data to be sampled simultaneously. It can complete the processing of the data generated by the previous Keccak-1600 calculation within the time it takes for the Keccak-1600 module to perform calculations. This enables the rejection sampling to run in parallel with the Keccak-1600, effectively saving computation time and increasing computational efficiency.

[0010] Each of the aforementioned rejection sampling units includes a first comparator, a second comparator, a modulo simplex element, a second data selector M2, a first D flip-flop, and a second D flip-flop; the first comparator has a first input terminal, a second input terminal, a first output terminal, a second output terminal, and a clock terminal; the second comparator has a clock terminal, a first input terminal, a second input terminal, a first output terminal, and a second output terminal; both the first and second D flip-flops have input terminals, output terminals, and clock terminals; the second data selector M2 has a data selection terminal, a first input terminal, a second input terminal, and an output terminal; the modulo simplex element has an input terminal, a clock terminal, a first output terminal, and a second output terminal; the clock terminal of the first comparator, the... The clock terminals of the second comparator, the modulo simple element, the first D flip-flop, and the second D flip-flop are connected, and their connection terminals are the clock terminals of the rejection sampling unit. The first input terminal of the first comparator is the input terminal of the data to be sampled in the rejection sampling unit. The second input terminal of the first comparator is used to input the clock input modulus q (q = 3329). The first output terminal of the first comparator is the first signal output terminal of the rejection sampling unit. The second output terminal of the first comparator is connected to the input terminal of the first D flip-flop, and the output terminal of the first D flip-flop is connected to the input terminal of the second D flip-flop. The output terminal is connected to the input terminal of the modulo simple element, and its connection terminal is the rescue data input terminal of the rejection sampling unit. The first output terminal of the modulo simple element is connected to the first input terminal of the second comparator. The second output terminal of the modulo simple element is connected to the first input terminal of the second data selector M2. The second input terminal of the second comparator always inputs 19. The first output terminal of the second comparator is the second signal output terminal of the rejection sampling unit. The second output terminal of the second comparator is connected to the data selection terminal of the second data selector M2. The second input terminal of the second data selection segment M2 always inputs 0. The output terminal of the second data selector M2 is the rejection data input terminal of the rejection sampling unit. The sampling output terminal of the rejection sampling unit; when the input terminal of the rejection sampling unit receives 12 bits of data, it will perform two comparison calculations. The first comparison calculation is as follows: the 12 bits of data are transmitted to the first comparator, which compares the 12 bits of data with the modulus q (q = 3329) of the Kyber algorithm. If the 12 bits of data are greater than or equal to q, the first comparator sends a comparison failure signal through its first output terminal to request data recovery from the data interaction unit. The data interaction unit outputs 4 bits of data as recovery data to the recovery data input terminal of the rejection sampling unit, and sends the 12 bits of data through its second output terminal to the first D flip-flop.Subsequently, the first D flip-flop sends 12 bits of data to the second D flip-flop through its output. The second D flip-flop uses the 12 bits as the least significant bit and concatenates them with the 4 bits of data arriving at the rescue data input as the most significant bit to form a 16-bit data set, which is then output to the second comparator. If this 12-bit data set is less than q, the first comparison is successful, and the first comparator directly sends the 12-bit data set to the first D flip-flop through its second output. The first D flip-flop then sends the 12-bit data set to the second D flip-flop through its output. The second D flip-flop uses the 12-bit data set as the least significant bit and the four 0 bits as the most significant bit to concatenate them together to form a 16-bit data set. This concatenated 16-bit data set is then fed into the modulo simplex unit for modulo simplex calculation (modulus q). The unit performs a modulo reduction operation on the 16-bit data to obtain a 12-bit remainder and a 5-bit quotient. The unit then transmits the 12-bit remainder to the second data selector and the 5-bit quotient to the second comparator. The second comparator compares the 5-bit quotient with 19. When the 5-bit quotient equals 19, the second output of the second comparator outputs 0; when the 5-bit quotient is less than 19, the second output of the second comparator outputs 1. When the data selection terminal of the second data selector M2 is connected to 1, it indicates that the remainder is valid as a rejection sample result, and the second data selector outputs the received 12-bit remainder as a valid rejection sample result. When the data selection terminal of the second data selector M2 is connected to 0, it indicates that the remainder is invalid as a rejection sample result, and the output of the second data selector outputs an invalid rejection sample result of 0. This rejection sampling unit, by adding salvage data and modulo reduction simple elements, allows the 12 bits of data that should have been discarded in the first comparison failure to be reused through modulo reduction calculations by adding salvage data to the high-order bits. This structure reduces the rejection rate from the original 18.72% to (2^16 mod q) / (2^16-3329) × 18.7% = 0.68%, significantly reducing the rejection rate of rejection sampling. This means that by using 4 bits of salvage data, the 12 bits of data that failed in the comparison can be reused, effectively reducing the waste of pseudo-random number resources and indirectly reducing the time required to generate pseudo-random number data, thus increasing computational efficiency.

[0011] Compared with existing technologies, the advantages of this invention lie in its data interaction unit. This unit can receive external data as well as acquisition completion signals and calculation completion signals from the Keccak-1600 module, and outputs a save completion signal to the Keccak-1600 module. This allows for the parallel execution of Keccak-1600 calculations with absorption, extrusion, and sampling operations, significantly improving computational efficiency. Simultaneously, the data interaction unit absorbs external data, saves the output data from the Keccak-1600 module, and outputs data to the rejection sampling module and the central binomial distribution sampling module. The required data is output, effectively reducing the consumption of storage resources. The rejection sampling module processes 72 bits of data to be sampled at a time. It can complete the processing of the output data of the previous Keccak-1600 module during the Keccak-1600 module's Keccak-1600 calculation, effectively improving the computational efficiency. The data interaction unit divides the data to be sampled into 6 groups and performs two comparison calculations on each group. By introducing rescue data and modulo reduction calculation, compared with the traditional rejection sampling structure that only uses one comparison, the rejection sampling module reduces the rejection rate from 18.72% of the traditional rejection sampling structure to (2^16mod q) / (2^16-3329)×18.7%=0.68%. At the same time, by adding rescue data, the data that should have been discarded after the first comparison can play a role again, reducing the waste of pseudo-random number data resources. Thus, this invention can reduce hardware resource consumption, has a fast calculation speed, high calculation efficiency, low rejection rate, and can reduce the waste rate of pseudo-random number resources. Attached Figure Description

[0012] Figure 1 This is a structural principle block diagram of the efficient hash calculation unit for the Kyber algorithm of the present invention;

[0013] Figure 2 This is a structural principle block diagram of the data interaction unit of the efficient Hash calculation unit for the Kyber algorithm of the present invention;

[0014] Figure 3(a) is a structural principle block diagram of the rejection sampling module of the efficient Hash calculation unit for the Kyber algorithm of the present invention;

[0015] Figure 3(b) is a structural principle block diagram of the rejection sampling unit of the rejection sampling module of the efficient Hash calculation unit for Kyber algorithm of the present invention;

[0016] Figure 4 The simulation waveform diagram shows the external data input and parallel execution of the efficient hash calculation unit for the Kyber algorithm of the present invention with Keccak-1600 calculation.

[0017] Figure 5 The simulation waveform diagram shows the output of the sampled data of the efficient hash calculation unit for the Kyber algorithm of this invention and the parallel execution of the calculation by Keccak-1600. Detailed Implementation

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0019] Example 1: As Figure 1As shown, an efficient hash calculation unit for the Kyber algorithm includes a data interaction unit, a Keccak-1600 module, a first data selector M1, a rejection sampling module, and a central binomial distribution sampling module. The data interaction unit has four operating modes: SHAKE-128 mode, SHAKE-256 mode, SHA3-256 mode, and SHA3-512 mode. It also has four output methods: hash value output, rejection sampling output, central binomial distribution sampling output with η equal to 2, and central binomial distribution sampling output with η equal to 3. The operating modes and output methods of the data interaction unit are designed according to the computational requirements of the Kyber algorithm. The data interaction unit is configured as follows: when its output mode is set to Hash value output, its operating mode is set to SHA3-256 or SHA3-512; when its output mode is set to rejection sampling output, its operating mode is set to SHAKE-128; when its output mode is set to central binomial distribution sampling output with η equal to 2, its operating mode is set to SHAKE-256; when its output mode is set to central binomial distribution sampling output with η equal to 3, its operating mode is set to SHAKE-256. The data interaction unit has an absorption phase and an extrusion phase.When the data interaction unit is working, it first enters the absorption phase. During this phase, external data is output to the data interaction unit, which then begins receiving it. For every r bits of data received, the data interaction unit saves those r bits, completing one data absorption process. After each absorption process, the data interaction unit sends a signal indicating data saving is complete to the Keccak-1600 module, notifying it to collect the r bits of data saved during the current absorption process. Once the Keccak-1600 module has collected the r bits of data saved during the current absorption process, the data interaction unit first clears the r bits and then enters the next absorption process. This cycle repeats until the last bit of external data is received. At this point, the data interaction unit is in the last data absorption process. If the number of bits received in the last absorption process is less than r, the received data is padded with zeros to make r bits. The data is saved using the following filling rule: first, add one '1' to the last input data, then add several '0' bits, and finally add another '1' to make the total data length 'r'. If the total length is equal to 'r', it is saved directly, completing the last data absorption process. A signal indicating data saving is complete is sent to the Keccak-1600 module, notifying it to collect the 'r' bits of data saved in the last data absorption process. After the Keccak-1600 module has collected the 'r' bits of data saved in the last data absorption process, the data interaction unit first clears the 'r' bits of data saved in the last data absorption process and then enters the extrusion stage. Specifically, when the data interaction unit is in SHAKE-128 mode, r = 1344; when it is in SHAKE-256 mode, r = 1088; when it is in SHA3-256 mode, r = 1088; and when it is in SHA3-512 mode, r = 576.The Keccak-1600 module has a pre-operation phase and a post-operation phase. In the pre-operation phase, the Keccak-1600 module receives a data saving completion signal from the data interaction unit. Each time the Keccak-1600 module receives a data saving completion signal, it acquires one r bits of data from the data interaction unit. When it acquires one r bits of data from the data interaction unit, it sends an acquisition completion signal to the data interaction unit, enabling the unit to clear its stored r bits of data. Simultaneously, it uses the currently acquired r bits of data as input data to perform a calculation. Each time a block completes a calculation, it checks if it has received a signal indicating that the next data storage is complete. If so, it acquires another r bits of data from the data interaction unit, repeating this process until the last r bits of data are acquired and a calculation is completed. At this point, the Keccak-1600 module enters the later working stage. The specific process of the Keccak-1600 module using the currently acquired r bits of data as input for a calculation is as follows: the currently acquired r bits of data are XORed with its internal register data, and then the r bits of data are permuted and their internal register data is updated using Keccak-1600 operations. When the Keccak-1600 module enters the later working stage, Ke... The ccak-1600 module first transmits its current registered data as computation data to the data interaction unit. Then, it periodically performs Keccak-1600 operations on its internal registered data to update it. After each Keccak-1600 cycle, the updated registered data is transmitted back to the data interaction unit as computation data. This continues until the amount of computation data output by the Keccak-1600 module meets the requirements of the Kyber algorithm, at which point the Keccak-1600 module stops working. Once the data interaction unit enters the extrusion phase, it processes each computation data output from the Keccak-1600 module according to... The calculated data is output according to the currently set output method, specifically: if the data interaction unit is currently set to Hash value output mode and the working mode of the data interaction unit is SHA3-256 mode, then the data interaction unit will directly output the currently received calculated data from low bit to high bit at a rate of 64 bits per cycle, and stop outputting when a total of 256 bits of data have been output; if the data interaction unit is currently set to Hash value output mode and the working mode of the data interaction unit is SHA3-512 mode, then the data interaction unit will directly output the currently received calculated data from low bit to high bit at a rate of 64 bits per cycle, and stop outputting when a total of 512 bits of data have been output.If the data interaction unit is currently set to reject sampling output mode, its operating mode is SHAKE-128 mode. In this mode, the data interaction unit receives 1344 bits of data. The data interaction unit selects the reject sampling module through the first data selector M1, dividing the received 1344 bits of data into two parts. The first 1152 bits, starting from the least significant bit, are used as the sampled data, which is output to the reject sampling module at a rate of 72 bits per cycle from least significant bit to most significant bit. The remaining 192 bits, starting from the most significant bit, are used as salvage data, which is output according to the requirements of the reject sampling module. If the data interaction unit is currently set to a central binomial distribution with η equal to 2... If the data interaction unit operates in SHAKE-256 mode, it receives 1088 bits of data. The unit then selects the central binomial distribution sampling module via the first data selector M1, outputting the received 1088 bits of data to the central binomial distribution sampling module at a rate of 48 bits per cycle, from least significant bit to most significant bit. If the data interaction unit is currently set to a central binomial distribution sampling output mode with η equal to 3, it operates in SHAKE-256 mode. In this mode, the unit receives 1088 bits of data, and the unit selects the central binomial distribution sampling module via the first data selector M1. The binomial sampling module outputs the currently received 1088 bits of data to the central binomial sampling module at a rate of 72 bits per cycle, from least significant bit to most significant bit. When the data interaction unit outputs its data to be sampled to the rejection sampling module at a rate of 72 bits per cycle, the rejection sampling module, upon receiving a 72-bit data output from the data interaction unit, divides the 72-bit data into 6 groups of 12 bits each, according to the input order. Then, it performs two comparison calculations on each group. The first comparison calculation involves comparing the 12-bit data with the modulus q (q = 3329) of the Kyber algorithm. If the 12-bit data in the group is greater than or equal to q, the first comparison is successful. If the comparison fails, the system immediately requests four bits of data from the data interaction unit as its salvage data. At this time, the data interaction unit outputs the four bits of its current salvage data, starting from the least significant bit, to the rejection sampling module, clears these four bits, and updates its salvage data. When the rejection sampling module receives the four bits of data, it first adds the received four bits to the high-order bits of the 12-bit data set, resulting in 16 bits of data. Then, it performs modulo reduction on the 16 bits of data to calculate the 12-bit remainder and the 5-bit quotient. If the 12-bit data set is less than q, the first comparison is successful. The system directly pads the high-order bits of the 12-bit data set with zeros to obtain 16 bits of data. Then, it performs modulo reduction on the 16 bits of data to calculate the 12-bit remainder and the 5-bit quotient.The second comparison calculation process is as follows: The 5-bit quotient obtained from the first comparison calculation is compared with 19. If the 5-bit quotient is less than 19, the second comparison is successful, and the 12-bit remainder obtained from the first comparison calculation is output as a valid rejection sample result. If the 5-bit quotient is greater than or equal to 19, the second comparison fails, and 0 is output as an invalid rejection sample result. The rejection sample module stops working when it outputs 256 valid rejection sample results. When the data interaction unit outputs its internally processed data from low to high bits at a rate of 48 bits per cycle to the central binomial distribution sampling module, the central binomial distribution sampling module enters the central binomial distribution sampling mode with η equal to 2. Each time the central binomial distribution sampling module receives a 48-bit data output from the data interaction unit, it divides the received 48 bits into 12 groups of 4 bits each, from low to high bits, and processes each group... The data is sampled and calculated using a central binomial distribution, resulting in a 12-bit central binomial distribution sampling result with η equal to 2 for each group of data. This process continues until the number of 12-bit central binomial distribution sampling results output satisfies the requirements of the Kyber algorithm. When the data interaction unit outputs its internally processed data to the central binomial distribution sampling module from low to high bits at a rate of 72 bits per cycle, the central binomial distribution sampling module enters a central binomial distribution sampling mode with η equal to 3. Each time the central binomial distribution sampling module receives a 72-bit data output from the data interaction unit, it divides the received 72-bit data into 12 groups of 6 bits each, from low to high bits. Central binomial distribution sampling is then performed on each group of data, resulting in a 12-bit central binomial distribution sampling result with η equal to 3 for each group of data. This process continues until the number of 12-bit central binomial distribution sampling results output satisfies the requirements of the Kyber algorithm.

[0020] In this embodiment, the data interaction unit has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, an enable terminal for receiving an enable signal, a mode selection terminal for receiving a mode selection signal, an output control terminal for receiving an output control signal, a write enable terminal for outputting a write enable signal, a read enable terminal for outputting a read enable signal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a first signal output terminal, and a second signal output terminal. The mode selection signal is a two-bit binary number used for... The data interaction unit's operating mode is set as follows: when the mode selection signal is binary 00, the data interaction unit is set to SHAKE-128 mode; when the mode selection signal is binary 01, the data interaction unit is set to SHAKE-256 mode; when the mode selection signal is binary 10, the data interaction unit is set to SHA3-256 mode; and when the mode selection signal is binary 11, the data interaction unit is set to SHA3-512 mode. The output control signal is a two-bit binary number used to set the output mode of the data interaction unit. When the output control signal is binary 00, the data interaction unit's output... The output mode is set to Hash value output mode. When the output control signal is binary number 01, the output mode of the data interaction unit is set to reject sampling output mode. When the output control signal is binary number 10, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with parameter η = 2 (value range [-2, 2]). When the output control signal is binary number 11, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η = 3 (value range [-3, 3]). The write enable signal is used to control the writing of external data. When the write enable signal is valid, external data can be output to the data interaction unit. When the write enable signal is invalid, external data cannot be written. Data cannot be output to the data interaction unit; the read enable signal is used to control other corresponding modules of the Kyber algorithm to read the data output from the first data output terminal of the data interaction unit. When the read enable signal is valid, other corresponding modules of the Kyber algorithm can read the data output from the first data output terminal of the data interaction unit; when the read enable signal is invalid, other corresponding modules of the Kyber algorithm cannot read the data output from the first data output terminal of the data interaction unit; the first data input terminal of the data interaction unit is 64 bits wide and is used to access external data; the second data input terminal of the data interaction unit is 1344 bits wide and is used to access the computational data output by the Keccak-1600 module.The first data output terminal of the data interaction unit is 64 bits wide. When the data interaction unit operates in Hash value output mode, the first data output terminal is used to output 64 bits of data. The second data output terminal of the data interaction unit is 1344 bits wide and is used to output the r bits of data that have been saved. The third data output terminal of the data interaction unit is 24 bits wide, where every 4 bits are used to output a group of 4 bits of data as rescue data. The third data output terminal of the data interaction unit can output 6 groups of 4 bits of data as rescue data simultaneously. The fourth data output terminal of the data interaction unit is 72 bits wide and is used to output the data to be sampled. The first signal input terminal of the data interaction unit is used to input the end signal. The end signal indicates that the current input of external data is the last bit. When the data interaction unit receives the end signal, it indicates that all data in the last data absorption process has been received. The second signal input terminal of the data interaction unit is used to input the acquisition completion signal output by the Keccak-1600 module. The third signal input terminal of the data interaction unit is used to input the acquisition completion signal output by the Keccak-1600 module. The fourth signal input terminal of the data interaction unit is 6 bits wide and is used to input the rejection sample. The output of the module indicates whether a rescue signal is needed; the fifth signal input terminal of the data interaction unit is used to input a satisfaction signal. When the fifth signal input terminal of the data interaction unit receives a satisfaction signal, it indicates that the valid rejection sampling results output by the rejection sampling module have reached 256 or the 12-bit central binomial distribution sampling results output by the central binomial distribution sampling module have met the requirements of the Kyber algorithm; the first signal output terminal of the data interaction unit is used to output a data saving completion signal; the second signal output terminal of the data interaction unit is used to output a data interaction unit calculation end signal; the Keccak-1600 module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, a first signal input terminal, a first signal output terminal, and a second signal output terminal; the first data selector M1 has a first data input terminal, a first data output terminal, a second data output terminal, and a control terminal for inputting and outputting control signals; the rejection sampling module has a clock terminal for receiving a clock signal, a first data input terminal, a second data input terminal, a first data output terminal, a first signal output terminal, and a second signal output terminal for outputting whether the rejection sampling result is valid;The center binomial sampling module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, and a first signal input terminal for receiving a center binomial sampling mode selection signal. When the output mode of the data interaction unit is a center binomial sampling output mode with η equal to 2, the center binomial sampling mode selection signal is used to enable the center binomial sampling module to enter the center binomial sampling mode with η equal to 2. When the output mode of the data interaction unit is a center binomial sampling output mode with η equal to 3, the center binomial sampling mode selection signal is used to enable the center binomial sampling module to enter the center binomial sampling mode with η equal to 3. The first signal output terminal of the data interaction unit is connected to the first signal input terminal of the Keccak-1600 module, and the second data output terminal of the data interaction unit is connected to the Keccak-1600 module. The first data input terminal of the data interaction unit is connected to the first data input terminal of the Keccak-1600 module; the second data input terminal of the data interaction unit is connected to the first signal output terminal of the Keccak-1600 module; the third signal input terminal of the data interaction unit is connected to the second signal output terminal of the Keccak-1600 module; the fourth data output terminal of the data interaction unit is connected to the first data input terminal of the first data selector M1; the fourth signal input terminal of the data interaction unit is connected to the first signal output terminal of the rejection sampling module; the third data output terminal of the data interaction unit is connected to the first data input terminal of the rejection sampling module; the first data output terminal of the first data selector M1 is connected to the second data input terminal of the rejection sampling module; the second data output terminal of the first data selector M1 is connected to the first data input terminal of the central binomial distribution sampling module.

[0021] like Figure 2As shown, in this embodiment, the data interaction unit includes a state machine and a buffer. The buffer has four storage modes: SHAKE-128 mode, SHAKE-256 mode, SHA3-256 mode, and SHA3-512 mode. The buffer also has four output modes: hash value output mode, rejection sampling output mode, central binomial distribution sampling output mode with η equal to 2, and central binomial distribution sampling output mode with η equal to 3. When the data interaction unit is set to SHAKE-128 mode by the Kyber algorithm, the buffer's storage mode is SHAKE-128 mode, and the buffer uses the rejection sampling output mode. When the data interaction unit is set to SHAKE-256 mode by the Kyber algorithm, and the output mode is the central binomial distribution sampling output mode with η equal to 2, the buffer... The buffer's storage mode is SHAKE-256, and its output mode is a central binomial distribution sampling output mode with η equal to 2. When the data interaction unit is set to SHAKE-256 mode by the Kyber algorithm, and its output mode is a central binomial distribution sampling output mode with η equal to 3, the buffer's storage mode is also SHAKE-256, and its output mode is a central binomial distribution sampling output mode with η equal to 3. When the data interaction unit is set to SHA3-256 mode by the Kyber algorithm, the buffer's storage mode is also SHA3-256, and the buffer outputs hash values. When the data interaction unit is set to SHA3-512 mode by the Kyber algorithm, the buffer's storage mode is also SHA3-512, and the buffer outputs hash values.The state machine has a clock terminal, a reset terminal, an enable terminal, a mode select terminal, a write enable terminal, a read enable terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a sixth signal input terminal, a first signal output terminal, a second signal output terminal, a third signal output terminal, a fourth signal output terminal, and a fifth signal output terminal. The buffer has a clock terminal, a reset terminal, a mode select terminal, an output control terminal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, an empty signal output terminal, a full signal output terminal, an absorb enable terminal, an extrusion enable terminal, a sampling enable terminal, and an end signal input terminal. The first signal input terminal includes a state machine whose clock input is connected to the buffer's clock input, and this connection is also the clock input of the data interaction unit. The state machine's reset input is the reset input of the data interaction unit, and its enable input is the enable input of the data interaction unit. The state machine's mode selection input is connected to the buffer's mode selection input, and this connection is also the mode selection input of the data interaction unit. The state machine's write enable input is the write enable input of the data interaction unit, and its read enable input is the read enable input of the data interaction unit. The state machine's first signal input terminal is connected to the buffer's last signal input terminal, and this connection is also the first signal input terminal of the data interaction unit. The state machine's second signal input terminal is the... The state machine has two signal input terminals. The third signal input terminal is the third signal input terminal of the data interaction unit. The fourth signal input terminal is connected to the full signal output terminal of the buffer, and its connection terminal is the first signal output terminal of the data interaction unit. The fifth signal input terminal is the fifth signal input terminal of the data interaction unit. The sixth signal input terminal is connected to the empty signal output terminal of the buffer. The first signal output terminal is connected to the reset terminal of the buffer. The second signal output terminal is the second signal output terminal of the data interaction unit. The third signal output terminal is connected to the absorb enable terminal of the buffer. The fourth signal output terminal is connected to the expulsion enable terminal of the buffer. The fifth signal output terminal is connected to the sampling enable terminal of the buffer. The output control terminal of the buffer is the output control terminal of the data interaction unit. The first data input terminal of the buffer is the first data input terminal of the data interaction unit. The first data output terminal of the buffer is the first data output terminal of the data interaction unit. The second data input terminal of the buffer is the second data input terminal of the data interaction unit. The second data output terminal of the buffer is the second data output terminal of the data interaction unit. The third data output terminal of the buffer is the third data output terminal of the data interaction unit. The fourth data output terminal of the buffer is the fourth data output terminal of the data interaction unit. The first signal input terminal of the buffer is the fourth signal input terminal of the data interaction unit.The state machine has four states: waiting, absorbing, extruding, and sampling. When the data interaction unit is in the absorbing phase, the state machine only transitions between the waiting and absorbing states. When the data interaction unit is in the extruding phase, if the data interaction unit is set to SHAKE-128 mode or SHAKE-256 mode, the state machine only transitions between the waiting and extruding states; if the data interaction unit is set to SHAKE-128 mode or SHAKE-256 mode, the state machine only transitions between the waiting and sampling states. When the state machine is in the waiting state, the buffer neither writes data to nor reads data from the outside, and the state machine retains its internal storage data unchanged.The initial state of the state machine is a waiting state. When an external enable signal is output to the state machine, the state machine transitions from the waiting state to the absorb state. Simultaneously, it outputs a write enable signal to the outside and an absorb enable signal to the buffer. At this time, the data interaction unit enters the absorb phase, and external data is output to the buffer. The buffer begins to periodically receive data. Every r bits of data received, the buffer saves the received r bits of data and outputs a full signal to the state machine. After receiving the full signal from the buffer, the state machine transitions from the absorb state to the waiting state. The buffer completes one data absorption cycle, and the data interaction module completes one data absorption process. At this point, the state machine sends the received full signal as a save completion signal to Keccak-1. In the Keccak-1600 module, whenever the state machine receives a data acquisition completion signal from the Keccak-1600 module, it outputs a reset signal to the buffer. Each time the buffer receives a reset signal, it clears the data stored within and begins the next data reception cycle. This process repeats until the state machine receives the final signal, indicating that the current input data has reached its last bit. The state machine then transitions from the absorption state to the waiting state. If the number of data bits received by the buffer is less than r, the received data is padded with zeros to obtain r bits of data for storage. The padding rule is to first add a 1 bit, then several 0 bits, and finally add another 1 bit to make the total data length r. If the data length is equal to r, it is stored directly. Then, it outputs a full signal to the state machine and the outside world, completing the last data absorption. At this point, the data interaction unit enters the extrusion phase. At the start of the extrusion phase, the buffer has no stored data and continuously sends empty signals to the state machine through its empty signal output. The state machine remains in a waiting state. When the buffer receives a computational data output from the Keccak-1600 module, it no longer sends empty signals to the state machine. If the current data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine transitions from the waiting state to the sampling state and outputs a sampling enable signal to the buffer. The buffer will output the calculated data according to the currently set output mode. Specifically: when the buffer is set to reject sampling output mode, the buffer will divide the currently received 1344 bits of data into two parts. The first 1152 bits of data, starting from the least significant bit, will be used as the data to be sampled. This data will be output to the reject sampling module at a rate of 72 bits per cycle from the least significant bit to the most significant bit. The remaining 192 bits of data, starting from the most significant bit, will be used as the rescue data. This rescue data will be output according to the requirements of the reject sampling module. When the buffer is set to a central binomial distribution sampling output mode with η equal to 2, the buffer will output the currently received 1088 bits of data to the central binomial distribution sampling module at a rate of 48 bits per cycle from the least significant bit to the most significant bit.When the buffer is set to a central binomial distribution sampling output mode with η equal to 3, the buffer outputs the currently received 1088 bits of data to the central binomial distribution sampling module at a rate of 72 bits per cycle, from least significant bit to most significant bit. During data output, if the state machine receives a satisfaction signal from the fifth signal input terminal of the data interaction unit (meaning the buffer output meets the Kyber algorithm requirements), the state machine transitions from the sampling state to the waiting state. It then outputs a data interaction unit calculation completion signal through the second signal output terminal of the data interaction unit and sends a reset signal to the buffer, clearing the data stored in the buffer. If the buffer has finished outputting its currently stored computational data or sampled data, and the state machine still has not received a satisfaction signal from the fifth signal input terminal of the data interaction unit, the buffer outputs an empty signal to the state machine, and the state machine transitions from the sampling state to the waiting state, waiting for the buffer to... The system receives computation data from the Keccak-1600 module. If the current data interaction unit is set to SHAKE-256 or SHA3-512 mode, the state machine transitions from the waiting state to the extrusion state, outputting an extrusion enable signal to the buffer and a read enable signal to the outside. The buffer will output 64 bits of computation data per cycle. If the data interaction unit is set to SHA3-256 mode, when the buffer has accumulated 256 bits of output, the state machine transitions from the extrusion state to the waiting state, outputs a computation completion signal, and simultaneously sends a reset signal to the buffer, clearing its internally stored data. If the data interaction unit is set to SHA3-512 mode, when the buffer has accumulated 512 bits of output, the state machine transitions from the extrusion state to the waiting state, outputs a computation completion signal, and simultaneously sends a reset signal to the buffer, clearing its internally stored data.

[0022] Example 2: This example is basically the same as Example 1, except that, as shown in Figure 3(a), in this example, the rejection sampling module includes six identical rejection sampling units, referred to as the first rejection sampling unit, the second rejection sampling unit, the third rejection sampling unit, the fourth rejection sampling unit, the fifth rejection sampling unit, and the sixth rejection sampling unit. Each rejection sampling unit has a clock terminal, a signal input terminal to be sampled, a rescue data input terminal, a sampled data output terminal, a first signal output terminal, and a second signal output terminal. The clock terminals of the six rejection sampling units are connected, and their connection terminals are the clock terminals of the rejection sampling module. The rescue data input terminals of the rejection sampling units are 4 bits wide, and the rescue data input terminals of the six rejection sampling units are connected, and their connection terminals are the first data input terminals of the rejection sampling module. The signal input terminals to be sampled of the rejection sampling units are all 12 bits wide, and the signal input terminals to be sampled of the six rejection sampling units are connected, and their connection terminals are the second data input terminals of the rejection sampling module. The input terminals and rejection sampling output terminals of the rejection sampling units are all 12 bits wide. The rejection sampling output terminals of the six rejection sampling units are connected, and their connection terminals are the first data output terminals of the rejection sampling module. The first signal output terminals of the rejection sampling units are all 1 bit wide. The first signal output terminals of the six rejection sampling units are connected, and their connection terminals are the first signal output terminals of the rejection sampling module. The second signal output terminals of the rejection sampling units are all 1 bit wide. The second signal output terminals of the six rejection sampling units are connected, and their connection terminals are the second signal output terminals of the rejection sampling module. When the rejection sampling module receives a 72-bit data output from the data interaction unit, the 72-bit data is divided into six groups of 12 bits each according to the input order. These groups are then input one-to-one from the data input terminals of the six rejection sampling units. Each rejection sampling unit compares and calculates the received 12-bit data twice to obtain a valid rejection sampling result or an invalid rejection sampling result, which is then output through its sampling output terminal.

[0023] As shown in Figure 3(b), in this embodiment, each rejection sampling unit includes a first comparator U1, a second comparator U2, a modulo-reduction element, a second data selector M2, a first D flip-flop D1, and a second D flip-flop D2. The first comparator U1 has a first input terminal, a second input terminal, a first output terminal, a second output terminal, and a clock terminal. The second comparator U2 has a clock terminal, a first input terminal, a second input terminal, a first output terminal, and a second output terminal. Both the first D flip-flop D1 and the second D flip-flop D2 have an input terminal, an output terminal, and a clock terminal. The second data selector M2 has a data selection terminal, a first input terminal, a second input terminal, and an output terminal. The modulo-reduction element has an input terminal, a clock terminal, a first output terminal, and a second output terminal. The clock terminals of the first comparator U1, the second comparator U2, the modulo-reduction element, the first D flip-flop D1, and the second D flip-flop D2 are connected, and their connection terminals are the clock terminals of the rejection sampling unit. The first input terminal of the first comparator U1 is the input terminal of the data to be sampled in the rejection sampling unit. The second input terminal of the first comparator U1 is used to input the clock input modulus q (q = 3329). The first output terminal of the first comparator U1 is the first signal output terminal of the rejection sampling unit. The second output terminal of the first comparator U1 is connected to the input terminal of the first D flip-flop D1. The output terminal of the first D flip-flop D1 is connected to the input terminal of the second D flip-flop D2. The output terminal of the second D flip-flop D2 is connected to the input terminal of the modulo simple element, and its connection terminal is the rescue data input terminal of the rejection sampling unit. The first output terminal of the modulo simple element is connected to the first input terminal of the second comparator U2. The second output terminal of the modulo simple element is connected to the first input terminal of the second data selector M2. The second input terminal of the second comparator U2 always inputs 19. The first output terminal of the second comparator U2 is the second signal output terminal of the rejection sampling unit. The second output terminal of the second comparator U2 is connected to the data selection terminal of the second data selector M2. The second input terminal of the second data selection segment M2 always inputs 0. The output terminal of the second data selector M2 is the sampling output terminal of the rejection sampling unit.When the input terminal of the rejection sampling unit receives 12 bits of data, it will perform two comparison calculations. The first comparison calculation involves transmitting the 12 bits of data to the first comparator U1. The first comparator U1 compares the 12 bits of data with the modulus q (q = 3329) of the Kyber algorithm. If the 12 bits of data are greater than or equal to q, the first comparator U1 sends a comparison failure signal through its first output terminal to request data recovery from the data interaction unit. The data interaction unit will output 4 bits of data as recovery data to the recovery data input terminal of the rejection sampling unit. On the other hand... The first comparator sends 12 bits of data to the first D flip-flop D1 through its second output. The first D flip-flop D1 then sends the 12 bits of data to the second D flip-flop through its output. The second D flip-flop uses the 12 bits of data as the least significant bit and concatenates them with the 4 bits of data arriving at the rescue data input as the most significant bit, forming a 16-bit data set, which is then output to the second comparator U2. If this 12-bit data set is less than q, the first comparison is successful. The first comparator U1 then directly sends the 12 bits of data to the first D flip-flop D1 through its second output. The first D flip-flop... D1 sends 12 bits of data to the second D flip-flop through its output. The second D flip-flop concatenates this 12 bits as the least significant bit and four zeros as the most significant bit to form a 16-bit data set. This 16-bit data set is then fed to a modulo simplex unit for modulo reduction (modulus q). The modulo simplex unit performs the modulo reduction operation on the 16-bit data set, obtaining a 12-bit remainder and a 5-bit quotient. The modulo simplex unit then transmits the 12-bit remainder to the second data selector M2 and the 5-bit quotient to the second comparator U2. The second comparator U2 compares the 5-bit quotient with 19. When the 5-bit quotient equals 19, the second output of the second comparator U2 outputs 0; when the 5-bit quotient is less than 19, the second output of the second comparator U2 outputs 1. When the data selection terminal of the second data selector M2 is connected to 1, it indicates that the remainder is valid as a rejection sample result, and the second data selector M2 outputs the received 12-bit remainder as a valid rejection sample result through its output terminal. When the data selection terminal of the second data selector M2 is connected to 0, it indicates that the remainder is invalid as a rejection sample result, and the output terminal of the second data selector M2 outputs an invalid rejection sample result of 0.

[0024] To verify the performance of the efficient hash calculation unit for the Kyber algorithm of this invention, the efficient hash calculation unit for the Kyber algorithm was first designed in Visual Studio Code software, and simulation tests were performed in the Vivado 2022.2 environment. Simulation waveforms of the efficient hash unit of this invention in parallel execution of data absorption and Keccak-1600 computation, and in parallel execution of the output of the sampled data and Keccak-1600 computation were obtained. The simulation waveforms of the efficient hash unit of this invention in parallel execution of data absorption and Keccak-1600 computation are shown in the figure. Figure 4 As shown, the simulation waveform of the sampled data output of the high-efficiency Hash unit of this invention and the parallel execution of calculation by Keccak-1600 is as follows. Figure 5 As shown.

[0025] Figure 4 The simulation waveform diagram of parallel execution of data absorption and Keccak-1600 computation shown is as follows: the first row of waveforms represents the clock signal; the second row represents the final signal input to the first signal input terminal of the data interaction unit; the third row represents the write enable signal output from the write enable terminal of the data interaction unit; the fourth row represents the external data input to the first data input terminal of the data interaction unit; the fifth row represents the full signal output from the full signal output terminal of the buffer; and the sixth row represents the different working stages of the internal state machine of the Keccak-1600 module. Analysis Figure 4 As can be seen, the figure shows the simulation waveform of the data interaction unit writing external data and the operation of the Keccak-1600 module during the time period before and after the arrival of the final signal. Before the arrival of the final signal, the write enable signal is 1, and external data is written at this time. Subsequently, the full signal is 1, and the write enable signal is also zero, and external data is no longer written. At this time, the Keccak-1600 module has not yet completed data acquisition, and the full signal is maintained. When the Keccak-1600 completes the data acquisition calculation, the full signal is 0, the write enable signal is 1, and external data starts to be written again. At the same time, the Keccak-1600 module starts to perform Keccak-1600 calculation on the acquired data. Before the Keccak-1600 calculation is completed, the final signal arrives, and no more external data is written afterward. The full signal immediately becomes 1 and is maintained, waiting for the Keccak-1600 module to acquire the r-bit data. This demonstrates that the absorption process of the efficient hash calculation unit for the Kyber algorithm of the present invention can be executed in parallel with the Keccak-1600 calculation, effectively accelerating the computational efficiency of the efficient hash calculation unit for the Kyber algorithm.

[0026] Figure 5The simulation waveform diagram of the parallel execution of the sampled data output and Keccak-1600 computation is shown below. The first row of waveforms represents the clock signal; the second row represents the final signal input to the first signal input terminal of the data interaction unit; the third row represents the sampling enable signal received by the buffer of the data interaction unit from the sampling enable terminal; the fourth row represents the sampled data output from the fourth data output terminal of the data interaction unit; the fifth row represents the empty signal output from the empty signal output terminal of the buffer; and the sixth row represents the different working stages of the internal state machine of the Keccak-1600 module. Analysis Figure 5 As can be seen, the figure shows the simulation waveform of the data interaction unit's output of the data to be sampled and the operation of the Keccak-1600 module during the time period after the arrival of the final signal. When the final signal arrives, the data interaction unit needs to wait for the Keccak-1600 module to complete its calculation. When the Keccak-1600 module has completed the acquisition and calculation of the last group of r-bit data, the buffer in the data interaction unit receives the data. At this time, the sampling enable signal is 1, and the data to be sampled begins to be output. At the same time, the Keccak-1600 module updates the value in its internal status register and calculates the next group of data to be sampled. When the buffer in the data exchange unit has finished outputting the data to be sampled, the empty signal is 1, the sampling enable signal is 0, and it waits for the Keccak-1600 module to input data. This shows that the sampling process of the efficient Hash calculation unit for the Kyber algorithm of the present invention can be executed in parallel with the Keccak-1600 calculation, effectively accelerating the computational efficiency of the efficient Hash calculation unit for the Kyber algorithm.

[0027] To verify the hardware overhead of the efficient hash calculation unit for the Kyber algorithm of this invention, logic synthesis was performed using TSMC's 65nm process to obtain the area consumption of the efficient hash calculation unit. The area of ​​each module was converted into equivalent logic gates. The hash part, composed of the data interaction unit and the Keccak-1600 module, consumed 31.9k equivalent logic gates, while the sampling part, composed of the rejection sampling module and the central binomial distribution sampling module, consumed 4.5k equivalent logic gates. Therefore, the efficient hash calculation unit for the Kyber algorithm of this invention consumes a total of 35.4k equivalent logic gates, achieving lower hardware resource consumption.

Claims

1. A high-efficiency hash calculation unit for the Kyber algorithm, characterized in that... The system includes a data interaction unit, a Keccak-1600 module, a first data selector M1, a rejection sampling module, and a central binomial distribution sampling module. The data interaction unit has four operating modes: SHAKE-128 mode, SHAKE-256 mode, SHA3-256 mode, and SHA3-512 mode. It also has four output methods: hash value output, rejection sampling output, central binomial distribution sampling output with η equal to 2, and central binomial distribution sampling output with η equal to 3. The operating modes and output methods of the data interaction unit are set according to the calculation requirements of the Kyber algorithm. The input bit width of the data interaction unit is 64 bits. When the output mode is set to Hash value output mode, its working mode is set to SHA3-256 mode or SHA3-512 mode, and the output bit width is 64 bits; when the output mode of the data interaction unit is set to rejection sampling output mode, its working mode is set to SHAKE-128 mode, and the output bit width is 72 bits; when the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η equal to 2, its working mode is set to SHAKE-256 mode, and the output bit width is 144 bits; when the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η equal to 3, its working mode is set to SHAKE-256 mode, and the output bit width is 144 bits. The data interaction unit has an absorption phase and an extrusion phase. When the data interaction unit is working, it first enters the absorption phase. During this phase, external data is output to the data interaction unit, which then begins receiving external data. For every r bits of data received, the data interaction unit saves those r bits, completing one data absorption process. After each absorption process, the data interaction unit sends a signal indicating data saving completion to the Keccak-1600 module, notifying it to collect the r bits of data saved during the current absorption process. Once the Keccak-1600 module has collected all r bits of data saved during the current absorption process, the data interaction unit first clears the r bits and then enters the next absorption process, repeating this cycle until the last bit of external data is received. At this point, the data interaction unit is in the last data absorption process. If the number of data bits received in the last absorption process is less than r, then... The received data is padded with zeros at the high-order bits to obtain r bits of data for storage. The padding rule is as follows: first, add a 1 bit after the last input data, then add several 0 bits, and finally add another 1 bit to make the total data length r. If it equals r, it is saved directly, completing the last data absorption process. A signal indicating that data storage is complete is sent to the Keccak-1600 module, notifying the Keccak-1600 module to collect the r bits of data saved in the last data absorption process. When the Keccak-1600 module has completed collecting the last data absorption... After saving r bits of data in the process, the data interaction unit first clears the r bits of data saved in the last data absorption process, and then enters the extrusion stage; wherein, when the working mode of the data interaction unit is SHAKE-128 mode, r = 1344; when the working mode of the data interaction unit is SHAKE-256 mode, r = 1088; when the working mode of the data interaction unit is SHA3-256 mode, r = 1088; and when the working mode of the data interaction unit is SHA3-512 mode, r = 576.The Keccak-1600 module has an initial working phase and a later working phase. In the initial working phase, the Keccak-1600 module receives a data saving completion signal from the data interaction unit. Each time the Keccak-1600 module receives a data saving completion signal, it can acquire r bits of data from the data interaction unit. Each time the Keccak-1600 module acquires r bits of data from the data interaction unit, it sends an acquisition completion signal to the data interaction unit, enabling the data interaction unit to begin clearing its stored r bits of data. Simultaneously, it uses the currently acquired r bits of data as input data. Each time the Keccak-1600 module completes a calculation, it outputs a Keccak-1600 calculation completion signal to the data interaction unit. Simultaneously, it checks if it has received the next data saving completion signal. If so, it collects another r bits of data from the data interaction unit, repeating this process until the last r bits of data are collected and a calculation is completed. At this point, the Keccak-1600 module enters the later working stage. Specifically, the Keccak-1600 module uses the currently collected r bits of data as input data for a calculation. The specific process is as follows: the currently collected r bits of data are XORed with the data stored in its internal register, and then processed through K... The Keccak-1600 operation permutes r bits of data and updates its internal register data. When the Keccak-1600 module enters the later working stage, it first transmits the current register data as computation data to the data interaction unit, and then periodically performs Keccak-1600 operations on its internal register data to update it. After each cycle of Keccak-1600 operation is completed, the currently updated register data is transmitted again as computation data to the data interaction unit, and a Keccak-1600 calculation completion signal is output to the data interaction unit until the Keccak-1600 module outputs a completion signal. Once the amount of computational data output meets the requirements of the Kyber algorithm, the Keccak-1600 module stops working. After the data interaction unit enters the extrusion stage, each time it receives a piece of computational data output from the Keccak-1600 module, the data interaction unit outputs the computational data according to the currently set output method. Specifically, if the data interaction unit is currently set to Hash value output mode and the working mode of the data interaction unit is SHA3-256 mode, the data interaction unit will output the currently received computational data directly from low bit to high bit at a rate of 64 bits per cycle, and stop outputting when a total of 256 bits of data have been output.If the data interaction unit is currently set to Hash value output mode and its operating mode is SHA3-512 mode, the data interaction unit will directly output the currently received computation data from low to high bits at a rate of 64 bits per cycle, stopping output when a total of 512 bits of data have been output. If the data interaction unit is currently set to rejection sampling output mode, its operating mode is SHAKE-128 mode. In this case, the data interaction unit receives 1344 bits of computation data. The data interaction unit selects the rejection sampling module through the first data selector M1, dividing the currently received 1344 bits of data into two parts. The first 1152 bits of data, starting from the low bit, are used as the data to be sampled. This data is output to the rejection sampling module from low to high bits at a rate of 72 bits per cycle. The remaining 192 bits of data, starting from the high bit, are used as rescue data, which is output according to the requirements of the rejection sampling module. If the data interaction unit is currently set to a central binomial distribution sampling output mode with η equal to 2, then the working mode of the data interaction unit is SHAKE-256 mode. In this case, the data interaction unit receives 1088 bits of data. The data interaction unit selects the central binomial distribution sampling module through the first data selector M1 and outputs the currently received 1088 bits of data to the central binomial distribution sampling module at a rate of 48 bits per cycle from low to high bits. If the data interaction unit is currently set to a central binomial distribution sampling output mode with η equal to 3, then the working mode of the data interaction unit is SHAKE-256 mode. In this case, the data interaction unit receives 1088 bits of data. The data interaction unit selects the central binomial distribution sampling module through the first data selector M1 and outputs the currently received 1088 bits of data to the central binomial distribution sampling module at a rate of 72 bits per cycle from low to high bits.When the data interaction unit outputs its sampled data from low to high bits at a rate of 72 bits per cycle to the rejection sampling module, the rejection sampling module, upon receiving a 72-bit data output from the data interaction unit, divides the 72-bit data into 6 groups of 12 bits each, according to the input order. Then, it performs two comparison calculations on each group. The first comparison calculation involves comparing the 12-bit data with the modulus q (q = 3329) of the Kyber algorithm. If the 12-bit data in the group is greater than or equal to q, the first comparison fails, and a request is immediately sent to the data interaction unit. The four-bit data is used as its rescue data. At this time, the data interaction unit outputs the four-bit data from the least significant bit to the most significant bit of its current rescue data to the rejection sampling module, clears the four-bit data, and updates its internal rescue data. When the rejection sampling module receives the four-bit data, it first adds the received four-bit data to the most significant bit of the 12-bit data group to obtain 16-bit data. Then, it performs modulo reduction calculation on the 16-bit data to calculate the 12-bit remainder and the 5-bit quotient. If the 12-bit data group is less than q, the first comparison is successful. It directly pads the most significant bit of the 12-bit data group with zeros to obtain 16-bit data. Then, it performs modulo reduction calculation on the 16-bit data. Modular reduction calculation yields a 12-bit remainder and a 5-bit quotient. The second comparison calculation involves comparing the 5-bit quotient from the first comparison with 19. If the 5-bit quotient is less than 19, the second comparison succeeds, and the 12-bit remainder from the first comparison is output as a valid rejection result. If the 5-bit quotient is greater than or equal to 19, the second comparison fails, and 0 is output as an invalid rejection result. The rejection sampling module stops working when it outputs 256 valid rejection results. The data interaction unit processes its internal data from low to high bits in cycles. When 48-bit data is output to the central binomial distribution sampling module, the central binomial distribution sampling module enters the central binomial distribution sampling mode with η equal to 2. Each time the central binomial distribution sampling module receives a 48-bit data output from the data interaction unit, it divides the received 48-bit data into 12 groups of 4 bits each, from low to high bit. It performs central binomial distribution sampling calculation on each group of data to obtain a 12-bit central binomial distribution sampling result with η equal to 2 for each group of data, until the number of output 12-bit central binomial distribution sampling results meets the requirements of the Kyber algorithm.When the data interaction unit outputs its internally processed data from low to high bits at a rate of 72 bits per cycle to the central binomial distribution sampling module, the central binomial distribution sampling module enters a central binomial distribution sampling mode with η equal to 3. Each time the central binomial distribution sampling module receives a 72-bit data output from the data interaction unit, it divides the received 72-bit data into 12 groups of 6 bits each, from low to high bits. It then performs central binomial distribution sampling calculations on each group, obtaining a 12-bit central binomial distribution sampling result with η equal to 3 for each group, until the number of output 12-bit central binomial distribution sampling results meets the requirements of the Kyber algorithm.

2. The efficient hash calculation unit for the Kyber algorithm according to claim 1, characterized in that... The data interaction unit includes a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, an enable terminal for receiving an enable signal, a mode selection terminal for receiving a mode selection signal, an output control terminal for receiving an output control signal, a write enable terminal for outputting a write enable signal, a read enable terminal for outputting a read enable signal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a first signal output terminal, and a second signal output terminal. The mode selection signal is a two-bit binary number used to set the... The data interaction unit operates in the following modes: when the mode selection signal is binary number 00, the data interaction unit is set to SHAKE-128 mode; when the mode selection signal is binary number 01, the data interaction unit is set to SHAKE-256 mode; when the mode selection signal is binary number 10, the data interaction unit is set to SHA3-256 mode; and when the mode selection signal is binary number 11, the data interaction unit is set to SHA3-512 mode. The output control signal is a two-bit binary number used to set the output direction of the data interaction unit. In this formula, when the output control signal is binary number 00, the output mode of the data interaction unit is set to Hash value output mode; when the output control signal is binary number 01, the output mode of the data interaction unit is set to reject sampling output mode; when the output control signal is binary number 10, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with parameter η = 2 (value range [-2, 2]); when the output control signal is binary number 11, the output mode of the data interaction unit is set to central binomial distribution sampling output mode with η = 3 (value range [-3, 3]); the write enable signal is used for The system controls the writing of external data. When the write enable signal is valid, external data can be output to the data interaction unit; when the write enable signal is invalid, external data cannot be output to the data interaction unit. The read enable signal controls other corresponding modules of the Kyber algorithm to read data output from the first data output terminal of the data interaction unit. When the read enable signal is valid, other corresponding modules of the Kyber algorithm can read data output from the first data output terminal of the data interaction unit; when the read enable signal is invalid, other corresponding modules of the Kyber algorithm cannot read data output from the first data output terminal of the data interaction unit. The data interaction unit has a first data input terminal with a width of 64 bits for receiving external data; a second data input terminal with a width of 1344 bits for receiving computational data output from the Keccak-1600 module; a first data output terminal with a width of 64 bits, used to output 64-bit data when the data interaction unit is operating in Hash value output mode; a second data output terminal with a width of 1344 bits for outputting r-bit data that has been saved; and a third data output terminal with a width of 24 bits. Each 4-bit wide segment is used to output a set of 4-bit data as salvage data. The third data output terminal of the data interaction unit can simultaneously output 6 sets of 4-bit data as salvage data. The fourth data output terminal of the data interaction unit is 72-bit wide and is used to output the data to be sampled. The first signal input terminal of the data interaction unit is used to input the last signal, which indicates that the current input of external data is the last bit. When the data interaction unit receives the last signal, it indicates that all data in the last data absorption process has been received. The second signal input terminal of the data interaction unit is used to input the sampled data output by the Keccak-1600 module. The data interaction unit has several input terminals: a completion signal and a satisfaction signal. The third input terminal is used to input the Keccak-1600 operation completion signal output by the Keccak-1600 module. The fourth input terminal, 6 bits wide, is used to input the demand signal (whether a rescue signal is needed) output by the rejection sampling unit. The fifth input terminal is used to input a satisfaction signal; when the fifth input terminal receives a satisfaction signal, it indicates that the rejection sampling module has output 256 valid rejection sampling results, or the 12-bit central binomial distribution sampling module has output a satisfactory result. The distributed sampling results already meet the requirements of the Kyber algorithm; the first signal output terminal of the data interaction unit is used to output a data saving completion signal; the second signal output terminal of the data interaction unit is used to output a data interaction unit calculation end signal; the Keccak-1600 module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, a first signal input terminal, a first signal output terminal, and a second signal output terminal; the first data selector M1 has a first data input terminal, a first data output terminal, a second data output terminal, and a control terminal for inputting and outputting control signals; The rejection sampling module has a clock terminal for receiving a clock signal, a first data input terminal, a second data input terminal, a first data output terminal, a first signal output terminal, and a second signal output terminal for outputting whether the rejection sampling result is valid; the center binomial distribution sampling module has a clock terminal for receiving a clock signal, a reset terminal for receiving a reset signal, a first data input terminal, a first data output terminal, and a first signal input terminal for receiving a center binomial distribution sampling mode selection signal. When the output mode of the data interaction unit is a center binomial distribution sampling output mode with η equal to 2, the center binomial distribution sampling mode selection signal is used to enable the center binomial distribution sampling module to enter the center binomial distribution sampling mode with η equal to 2. When the output mode of the data interaction unit is a center binomial distribution sampling output mode with η equal to 3, the center binomial distribution sampling mode selection signal is used to enable the center binomial distribution sampling module to enter the center binomial distribution sampling mode with η equal to 3. The first signal output terminal of the data interaction unit is connected to the first signal input terminal of the Keccak-1600 module. The second data output terminal of the unit is connected to the first data input terminal of the Keccak-1600 module; the second data input terminal of the data interaction unit is connected to the first data output terminal of the Keccak-1600 module; the second signal input terminal of the data interaction unit is connected to the first signal output terminal of the Keccak-1600 module; the third signal input terminal of the data interaction unit is connected to the second signal output terminal of the Keccak-1600 module; the fourth data output terminal of the data interaction unit is connected to the first data input terminal of the first data selector M1; the fourth signal input terminal of the data interaction unit is connected to the first signal output terminal of the rejection sampling module; the third data output terminal of the data interaction unit is connected to the first data input terminal of the rejection sampling module; the first data output terminal of the first data selector M1 is connected to the second data input terminal of the rejection sampling module; the second data output terminal of the first data selector M1 is connected to the first data input terminal of the central binomial distribution sampling module.

3. The efficient hash calculation unit for the Kyber algorithm according to claim 2, characterized in that... The data interaction unit includes a state machine and a buffer. The buffer has four storage modes: SHAKE-128, SHAKE-256, SHA3-256, and SHA3-512. The buffer also has four output modes: hash value output, rejection sampling output, central binomial distribution sampling output with η equal to 2, and central binomial distribution sampling output with η equal to 3. When the data interaction unit is set to SHAKE-128 mode by the Kyber algorithm, the buffer's storage mode is SHAKE-128, and the buffer uses the rejection sampling output mode. When the data interaction unit is set to SHAKE-256 mode and the output method is a central binomial distribution sampling output method with η equal to 2, the buffer's storage mode is SHAKE-256 mode, and the output method is a central binomial distribution sampling output method with η equal to 2. When the data interaction unit is set to SHAKE-256 mode by the Kyber algorithm and the output method is a central binomial distribution sampling output method with η equal to 3, the buffer's storage mode is SHAKE-256 mode, and the output method is a central binomial distribution sampling output method with η equal to 3. When the data interaction unit is set to SHA3-256 mode by the Kyber algorithm, the buffer's storage mode is SHA3-256 mode. The buffer is configured to output hash values. When the data interaction unit is set to SHA3-512 mode by the Kyber algorithm, the buffer's storage mode is SHA3-512 mode, and the buffer's output mode is hash value output. The state machine has a clock terminal, a reset terminal, an enable terminal, a mode selection terminal, a write enable terminal, a read enable terminal, a first signal input terminal, a second signal input terminal, a third signal input terminal, a fourth signal input terminal, a fifth signal input terminal, a sixth signal input terminal, a first signal output terminal, a second signal output terminal, a third signal output terminal, a fourth signal output terminal, and a fifth signal output terminal. The buffer has a clock terminal, a reset terminal, a mode selection terminal, and an output control terminal. The system comprises a control terminal, a first data input terminal, a second data input terminal, a first data output terminal, a second data output terminal, a third data output terminal, a fourth data input terminal, an empty signal output terminal, a full signal output terminal, an absorption enable terminal, an extrusion enable terminal, a sampling enable terminal, an end signal input terminal, and a first signal input terminal. The clock terminal of the state machine is connected to the clock terminal of the buffer, and its connection terminal is the clock terminal of the data interaction unit. The reset terminal of the state machine is the reset terminal of the data interaction unit. The enable terminal of the state machine is the enable terminal of the data interaction unit. The mode selection terminal of the state machine is connected to the mode selection terminal of the buffer, and its connection terminal is the mode selection terminal of the data interaction unit.The write enable terminal of the state machine is the write enable terminal of the data interaction unit, and the read enable terminal of the state machine is the read enable terminal of the data interaction unit. The first signal input terminal of the state machine is connected to the end signal input terminal of the buffer, and its connection terminal is the first signal input terminal of the data interaction unit. The second signal input terminal of the state machine is the second signal input terminal of the data interaction unit. The third signal input terminal of the state machine is the third signal input terminal of the data interaction unit. The fourth signal input terminal of the state machine is connected to the full signal output terminal of the buffer, and its connection terminal is the first signal output terminal of the data interaction unit. The fifth signal input terminal of the state machine... The input terminal is the fifth signal input terminal of the data interaction unit; the sixth signal input terminal of the state machine is connected to the empty signal output terminal of the buffer; the first signal output terminal of the state machine is connected to the reset terminal of the buffer; the second signal output terminal of the state machine is the second signal output terminal of the data interaction unit; the third signal output terminal of the state machine is connected to the absorb enable terminal of the buffer; the fourth signal output terminal of the state machine is connected to the extrusion enable terminal of the buffer; the fifth signal output terminal of the state machine is connected to the sampling enable terminal of the buffer; the output control terminal of the buffer is the output control terminal of the data interaction unit; the buffer's... The first data input terminal is the first data input terminal of the data interaction unit; the first data output terminal of the buffer is the first data output terminal of the data interaction unit; the second data input terminal of the buffer is the second data input terminal of the data interaction unit; the second data output terminal of the buffer is the second data output terminal of the data interaction unit; the third data output terminal of the buffer is the third data output terminal of the data interaction unit; the fourth data output terminal of the buffer is the fourth data output terminal of the data interaction unit; and the first signal input terminal of the buffer is the fourth signal input terminal of the data interaction unit. The state machine has four states: waiting state, absorbing state, and absorbing state. The data interaction unit is configured to operate in three states: absorption, extrusion, and sampling. When the data interaction unit is in the absorption phase, the state machine only transitions between the waiting and absorption states. When the data interaction unit is in the extrusion phase, if the data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine only transitions between the waiting and extrusion states; if the data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine only transitions between the waiting and sampling states. When the state machine is in the waiting state, the buffer neither writes data to nor reads data from the outside.The state machine retains its internally stored data unchanged. Its initial state is a waiting state. When an external enable signal is output to the state machine, it transitions from the waiting state to the absorbing state, simultaneously outputting a write enable signal to the outside and an absorb enable signal to the buffer. At this time, the data interaction unit enters the absorption phase, and external data is output to the buffer. The buffer begins to periodically receive data. For every r bits of data received, the buffer stores those r bits and outputs a full signal to the state machine. After receiving the full signal from the buffer, the state machine transitions from the absorbing state to the waiting state, and the buffer completes one data absorption cycle. The data interaction module completes a data absorption process. At this time, the state machine sends the received full signal as a storage completion signal to the Keccak-1600 module. Whenever the state machine receives a data acquisition completion signal from the Keccak-1600 module, it outputs a reset signal to the buffer. Each time the buffer receives a reset signal, it clears the data stored within and begins the next data reception cycle. This process repeats until the state machine receives the last signal, indicating that the current input of external data is the last bit. The state machine then transitions from the absorption state to the waiting state. If the number of data bits received by the buffer is less than r, then the received data... The data is padded with zeros at the high bits to create r bits of data for storage. The padding rule is to first add a 1 bit after the last input data, then add several 0 bits, and finally add another 1 bit to make the total data length r. If it equals r, it is saved directly. Then, a full signal is output to the state machine and externally to complete the last data absorption. At this point, the data interaction unit completes the last data absorption process and enters the extrusion stage. At the beginning of the extrusion stage, the buffer does not store any data and always sends an empty signal to the state machine through its empty signal output terminal. The state machine will remain in a waiting state. When the buffer receives the output from the Keccak-1600 module... After processing a set of data, the buffer no longer sends empty signals to the state machine. If the current data interaction unit is set to SHAKE-128 or SHAKE-256 mode, the state machine transitions from a waiting state to a sampling state, outputting a sampling enable signal to the buffer. The buffer then outputs the processed data according to the currently set output method. Specifically, when the buffer is set to reject sampling output mode, it divides the currently received 1344 bits of data into two parts. The first 1152 bits, starting from the least significant bit, are used as the data to be sampled. This data is output to the reject sampling module from the least significant bit to the most significant bit at a rate of 72 bits per cycle.The first 192 bits of data, starting from the most significant bit, are used as salvage data, which is output according to the requirements of the rejection sampling module. When the buffer is set to a center binomial distribution sampling output mode with η equal to 2, the buffer outputs the currently received 1088 bits of data to the center binomial distribution sampling module at a rate of 48 bits per cycle from the least significant bit to the most significant bit. When the buffer is set to a center binomial distribution sampling output mode with η equal to 3, the buffer outputs the currently received 1088 bits of data to the center binomial distribution sampling module at a rate of 72 bits per cycle from the least significant bit to the most significant bit. During the data output process, if the state machine receives a satisfaction signal from the fifth signal input terminal of the data interaction unit, indicating that the buffer output has met the Kyber algorithm requirements, the state machine transitions from the sampling state to the waiting state. It then outputs a data interaction unit calculation completion signal through the second signal output terminal of the data interaction unit and sends a reset signal to the buffer, clearing the data stored in the buffer. If the buffer has finished outputting all its currently stored computational data or sampled data, and the state machine still has not received a satisfaction signal from the fifth signal input terminal of the data interaction unit, the buffer outputs an empty signal to the state machine. The state machine then transitions from the sampling state to the waiting state, waiting for the buffer to receive computational data from the Keccak-1600 module again. If the data interaction unit is currently set to SHAKE-256 mode or SHA3-512 mode, the state machine transitions from the waiting state to the extrusion state, outputs an extrusion enable signal to the buffer, and sends a read enable signal externally. The buffer will then output 64 bits of computational data per cycle. The data interaction unit is set to SHA3-256 mode. When the buffer has accumulated 256 bits of output, the state machine transitions from the squeezed state to the waiting state and outputs a completion signal. Simultaneously, it sends a reset signal to the buffer, clearing its internally stored data. Similarly, if the data interaction unit is set to SHA3-512 mode, when the buffer has accumulated 512 bits of output, the state machine transitions from the squeezed state to the waiting state and outputs a completion signal. Simultaneously, it sends a reset signal to the buffer, clearing its internally stored data.

4. The efficient hash calculation unit for the Kyber algorithm according to claim 2, characterized in that... The rejection sampling module comprises six structurally identical rejection sampling units, referred to as the first rejection sampling unit, the second rejection sampling unit, the third rejection sampling unit, the fourth rejection sampling unit, the fifth rejection sampling unit, and the sixth rejection sampling unit. Each rejection sampling unit has a clock terminal, a signal input terminal to be sampled, a rescue data input terminal, a sampled data output terminal, a first signal output terminal, and a second signal output terminal. The clock terminals of the six rejection sampling units are connected, and their connection terminals are the clock terminals of the rejection sampling module. The rescue data input terminals of the rejection sampling units are 4 bits wide, and the rescue data input terminals of the six rejection sampling units are connected, and their connection terminals are the first data input terminals of the rejection sampling module. The signal input terminals to be sampled of each rejection sampling unit are 12 bits wide, and the signal input terminals to be sampled of the six rejection sampling units are connected, and their connection terminals are the second data input terminals of the rejection sampling module. The rejection sampling output terminal of each rejection sampling unit... All are 12-bit wide, and the rejection sampling output terminals of the six rejection sampling units are connected, with their connection terminals being the first data output terminals of the rejection sampling module. The first signal output terminals of the rejection sampling units are all 1-bit wide, and the first signal output terminals of the six rejection sampling units are connected, with their connection terminals being the first signal output terminals of the rejection sampling module. The second signal output terminals of the rejection sampling units are all 1-bit wide, and the second signal output terminals of the six rejection sampling units are connected, with their connection terminals being the second signal output terminals of the rejection sampling module. When the rejection sampling module receives a 72-bit data output from the data interaction unit, the 72-bit data is divided into six groups of 12 bits each according to the input order. These groups are then input one-to-one from the data input terminals of the six rejection sampling units. Each rejection sampling unit compares and calculates the received 12-bit data twice to obtain a valid rejection sampling result or an invalid rejection sampling result, which is then output through its sampling output terminal.

5. The efficient hash calculation unit for the Kyber algorithm according to claim 4, characterized in that... Each of the aforementioned rejection sampling units includes a first comparator, a second comparator, a modulo simple element, a second data selector M2, a first D flip-flop, and a second D flip-flop. The first comparator has a first input, a second input, a first output, a second output, and a clock input. The second comparator has a clock input, a first input, a second input, a first output, and a second output. Both the first and second D flip-flops have inputs, outputs, and clock inputs. The second data selector M2 has a data selection input, a first input, a second input, and an output. The modulo simple element has an input, a clock input, a first output, and a second output. The clock inputs of the first and second comparators, the modulo simple element, the first D flip-flop, and the second D flip-flop are connected, and their connection point is the clock input of the rejection sampling unit. The first input of the first comparator is the input terminal for the data to be sampled in the rejection sampling unit, and the second input of the first comparator is used for clock input. The modulus is q (q = 3329). The first output of the first comparator is the first signal output of the rejection sampling unit. The second output of the first comparator is connected to the input of the first D flip-flop. The output of the first D flip-flop is connected to the input of the second D flip-flop. The output of the second D flip-flop is connected to the input of the modulo simple element, and its connection point is the rescue data input of the rejection sampling unit. The first output of the modulo simple element is connected to the first input of the second comparator. The second output of the modulo simple element is connected to the first input of the second data selector M2. The second input of the second comparator always inputs 19. The first output of the second comparator is the second signal output of the rejection sampling unit. The second output of the second comparator is connected to the data selection terminal of the second data selector M2. The second input of the second data selection segment M2 always inputs 0. The output of the second data selector M2 is the sampling output of the rejection sampling unit.When the input terminal of the rejection sampling unit receives 12 bits of data, it will perform two comparison calculations. The first comparison calculation involves transmitting the 12 bits of data to the first comparator. The first comparator compares the 12 bits of data with the modulus q (q = 3329) of the Kyber algorithm. If the 12 bits of data are greater than or equal to q, the first comparator sends a comparison failure signal through its first output terminal to request data recovery from the data interaction unit. The data interaction unit will then output 4 bits of data as recovery data to the recovery number of the rejection sampling unit. According to the input terminal, on the other hand, 12 bits of data are sent to the first D flip-flop through its second output terminal. The first D flip-flop then sends the 12 bits of data to the second D flip-flop through its output terminal. The second D flip-flop uses the 12 bits of data as the low-order bit and concatenates them with the 4 bits of data arriving at the rescue data input terminal as the high-order bit to form a 16-bit data output to the second comparator. If this 12-bit data is less than q, the first comparison is successful. The first comparator then directly sends the 12 bits of data to the first D flip-flop through its second output terminal. Subsequently, the first D flip-flop... The 12-bit data is sent to the second D flip-flop through its output terminal. The second D flip-flop concatenates the 12-bit data as the low-order bit and four 0 bits as the high-order bit to form a 16-bit data. The concatenated 16-bit data is then sent to the modulo simplex unit for modulo reduction calculation (modulus is q). The modulo simplex unit performs modulo reduction on the 16-bit data to obtain a 12-bit remainder and a 5-bit quotient. Subsequently, the modulo simplex unit transmits the 12-bit remainder to the second data selector and the 5-bit quotient to the second comparator. The second comparator compares the 5-bit quotient with 19. When 5... When the 5-bit quotient equals 19, the second output of the second comparator outputs 0. When the 5-bit quotient is less than 19, the second output of the second comparator outputs 1. When the data selection terminal of the second data selector M2 is connected to 1, it indicates that the remainder is valid as a rejection sample result, and the second data selector outputs the received 12-bit remainder as a valid rejection sample result through its output terminal. When the data selection terminal of the second data selector M2 is connected to 0, it indicates that the remainder is invalid as a rejection sample result, and the output terminal of the second data selector outputs an invalid rejection sample result of 0.

Images