Saber hardware accelerator and encryption and decryption method based on improved Schoolbook algorithm

Abstract

The application provides a Saber hardware accelerator and encryption and decryption method based on an improved Schoolbook algorithm, and constructs a high-throughput and scalable Saber hardware accelerator based on the high-parallelism and scalable Schoolbook algorithm of Winograd, designs a highly parallel pipeline structure, and expands the inner loop of Schoolbook through a parallel core module in hardware implementation, so that repeated reading of a polynomial is avoided. In addition, due to the highly parallel pipeline structure, only one output is generated in each cycle, the reading and writing of intermediate calculation results are avoided, and the demand for on-chip memory is reduced.

Description

Technical Field

[0001] This invention relates to polynomial multipliers and post-quantum cryptography hardware accelerators, specifically to a Saber hardware accelerator and encryption / decryption method based on an improved Schoolbook algorithm. Background Technology

[0002] The development of quantum computers has posed a serious security threat to traditional public-key cryptography. To address this issue, a series of post-quantum cryptography (PQC) schemes resistant to quantum attacks have been proposed, with lattice-based schemes being the mainstream PQC methods. The security of lattice-based cryptography (LBC) mainly stems from fault-tolerant learning (LWE) and rounding learning (LWR) and their variants. Saber, based on Module-LWR, is one of the most promising PQC schemes, exhibiting excellent encryption and decryption performance due to its efficient modular reduction. However, polynomial multiplication remains the main performance bottleneck for Saber, requiring further research and optimization. Number-theoretic transformations (NTTs) are commonly used algorithms for accelerating polynomials, but Saber's modulus is in the form of powers of 2, which cannot directly satisfy the requirement that the NTT modulus must be prime. Schoolbook polynomial multiplication, on the other hand, has no restrictions and possesses the potential for extremely high parallelism; therefore, increasing research focuses on using Schoolbook polynomial multipliers to accelerate the Saber scheme. It is clear from existing research that Schoolbook polynomial multiplication has been widely used in the hardware implementation of Saber due to its extremely wide applicability. However, due to the high complexity and large amount of computation of the algorithm itself, very high throughput is required to achieve high-speed operation. At the same time, since PQC or LBC has a wide range of applications, the scalability of the hardware architecture also needs to be considered so that it can adapt to different hardware platforms.

[0003] However, most existing Saber accelerators based on Schoolbook polynomial multiplication struggle to balance high throughput and scalability, and suffer from the following problems: 1. The algorithm complexity of Schoolbook is too high and needs to be optimized; 2. The throughput is not high enough to meet the speed requirements for encryption and decryption; 3. It lacks scalability and cannot be deployed across FPGA platforms. Summary of the Invention

[0004] To address the problems of the prior art, this invention provides a Saber hardware accelerator and encryption / decryption method based on an improved Schoolbook algorithm, which features high throughput and scalability, and can significantly improve Saber's computational performance.

[0005] This invention is achieved through the following technical solution: The Saber hardware accelerator based on the improved Schoolbook algorithm includes: an input Tile loading and conversion module, an input Filter conversion module, a parallel core module, and a result accumulation module; The input filter transformation module is used to decompose and evaluate the first polynomial to obtain the first univariate polynomial; extract the column vector filter based on the first univariate polynomial, and perform input transformation. The input tile loading and transformation module is used to decompose and evaluate the second polynomial to obtain the second single-variable polynomial; extract multiple column vector tiles based on the second single-variable polynomial, and perform input transformation. The parallel core module is configured in several ways, and these parallel core modules perform operations in parallel: transforming the column vector after input conversion... and multiple column vectors Perform Winograd convolution operation; The result accumulation module is used to add the operation results of each parallel core module, and also to accumulate the result obtained from the previous loop operation of the parallel core module to obtain the output polynomial multiplication result.

[0006] Preferably, the parallel core module includes an EWM modular multiplier, an EWM output conversion module, and a data reconstruction module; The EWM modular multiplier is used to transform column vectors after input conversion. and column vectors Perform element-wise multiplication; The EWM output conversion module is used to perform output transformation on the results of the EWM modular multiplier. The data reconstruction module is used to perform local vector folding on the output transformation results of the EWM output conversion module.

[0007] Preferably, the number of parallel core modules is 2, 4 or 8.

[0008] Preferably, it also includes a polynomial cache module for storing the input polynomial data.

[0009] Preferably, the first polynomial is a public polynomial and the second polynomial is a secret polynomial.

[0010] An encryption / decryption method based on an improved Schoolbook algorithm includes: S1, Obtain information, process the information to obtain the first polynomial and the second polynomial; S2, split the first polynomial and the second polynomial to obtain the first split result and the second split result; S3, evaluate the first and second splitting results to obtain the first and second univariate polynomials; S4, perform Winograd convolution on the first and second univariate polynomials in a parallel loop to obtain the result; S5 performs output transformation, interpolation, and polynomial recombination on the result of S4 to obtain the polynomial multiplication result; Wherein, when the information is information to be encrypted, the first polynomial and the second polynomial are the plaintext information and the encryption key, respectively, and the result of the polynomial multiplication is the ciphertext; when the information is ciphertext, the first polynomial and the second polynomial are the ciphertext and the decryption key, respectively, and the result of the polynomial multiplication is the decrypted information.

[0011] Preferably, the first polynomial is The second polynomial is ; S4 specifically includes: 1) If If the length of the vector is odd, then let the vector be... ;like If the length of the vector is even, then let the vector be an even number. ; 2) If If the length of the vector leaves a remainder of 0 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 1 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 2 when divided by 3, then let the vector... ; 3) Order For vectors Length, For vectors Length; let , ; 4) Convert the column vector Initialize as a zero vector of length 2 , column vector Initialize as a zero vector of length 4 , will vector Initialize as a zero vector of length 3 , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector ; 5) Initialization , , Set the number of parallel cores ; 6) Transfer the data , Concatenate them in order to form a column vector , data Concatenate them in order to form a column vector For column vectors Perform input transformation on column vectors Perform an input transformation, and let the column vector after the input transformation be... and Perform element-wise multiplication of the vectors, transform the result, and obtain the vector. , will vector Assign values ​​in sequence ; Let the variable Repeat the above steps in step 6) until... ; For vectors Perform local vector folding to obtain vectors ; Let the variable , Repeat the above steps in step 6) until... ; For vectors Perform global vector folding to obtain vectors ; Let the variable Repeat the above steps in step 6) until... .

[0012] Furthermore, step 6) specifically includes: when At that time, the outer loop is executed: when At that time, execute parallel loops: when At that time, the inner loop is executed: Let column vector

[0013] Let column vector

[0014] Let vector

[0015] Let vector

[0016] make

[0017] Inner loop ends Let vector

[0018] Let vector

[0019] Let vector

[0020] make ,

[0021] Parallel loop ends Let vector

[0022] Let vector

[0023] make

[0024] The outer loop has ended.

[0025] Compared with the prior art, the present invention has the following beneficial effects: This invention constructs a high-throughput, scalable Saber hardware accelerator based on Winograd's highly parallel and scalable Schoolbook algorithm. A highly parallel pipeline structure is designed, and the inner loop of Schoolbook is expanded through a parallel core module in the hardware implementation, thereby avoiding repeated readings of polynomials. Furthermore, thanks to the highly parallel pipeline structure, each loop produces only one output, avoiding the reading and writing of intermediate calculation results and reducing the demand for on-chip memory.

[0026] This invention proposes a highly parallel and scalable Schoolbook algorithm based on Winograd. In terms of accelerating Saber, the improved Schoolbook can reduce the amount of multiplication operations by 32.18% compared with the conventional Schoolbook. Attached Figure Description

[0027] Figure 1 The overall architecture of the high-throughput, scalable Saber hardware accelerator constructed for this invention. Detailed Implementation

[0028] To further understand the present invention, the present invention will be described below with reference to embodiments. These descriptions are only for further explaining the features and advantages of the present invention and are not intended to limit the claims of the present invention.

[0029] The original TC4 algorithm is as follows.

[0030] For polynomials on the ring and If you want to calculate First, decompose the polynomial.

[0031] 1) Preprocessing: Polynomial decomposition: , and Rewrite it in the following form: (1) (2) (3) (4) in, , Similarly, N is the length of the polynomial. , Indicates the parameters of the Toom-Cook algorithm. This represents the modulus of the polynomial coefficients.

[0032] The above process is encapsulated into a function for easy subsequent calls. The parameters are all polynomial data, and its function form is as follows: Polynomial-Split(input A(x), output A0(x), output A1(x), output A2(x), output A3(x)).

[0033] 2) Preprocessing for polynomial evaluation: Select 7 y-values ​​for evaluation and substitute them into... , The following results can be obtained: (5) The above process is encapsulated as a function, with the following function form: `Evaluation(input A0(x), input A1(x), input A2(x), input A3(x), output ...` , output , output , output , output , output , output ).

[0034] 3) Low-level Schoolbook: (6) 4) Post-processing interpolation: (7) 5) Post-processing polynomial reconstruction: (8) The two processes mentioned above, 4) and 5), are encapsulated into a function, with the following function form: Postprocessing(input) input input input input input input , output C0, output C1, output C2, output C3).

[0035] That is, the original Schoolbook algorithm is as follows, taking Saber's Public and Secret polynomials as examples.

[0036] For Public polynomials and Secret polynomial If you want to calculate The calculation formula using the Schoolbook algorithm is as follows:

[0037] This invention proposes an improved Schoolbook algorithm based on Winograd with high parallelism and scalability, using Saber's Public and Secret polynomials as examples.

[0038] The input is a public polynomial. and Secret polynomial Output N is the length of the polynomial. This represents the modulus of the polynomial coefficients.

[0039] 1) If If the length of the vector is odd, then let the vector be... ;like If the length of the vector is even, then let the vector be an even number. .

[0040] 2) If If the length of the vector leaves a remainder of 0 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 1 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 2 when divided by 3, then let the vector... .

[0041] 3) Order For vectors Length, For vectors The length of . Let , .

[0042] 4) Convert the vector Initialize as a zero vector of length 2 , will vector Initialize as a zero vector of length 4 , will vector Initialize as a zero vector of length 3 , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector .

[0043] 5) Let the matrix .

[0044] 6) Initialization , , Set the number of parallel cores .

[0045] 7) First, perform data selection, selecting the data... , Concatenate them in order to form a column vector , data Concatenate them in order to form a column vector Then, the core operations are performed on the column vectors. Perform an input transformation, let the Tile input transformation matrix be... With column vectors Perform matrix multiplication on column vectors Similarly, perform the input transformation, and let the filter input transformation matrix... With column vectors Perform matrix multiplication, let the column vectors after the input transformation... and Perform element-wise multiplication of the vector, i.e. ,in This represents an element-wise multiplication (EWM) of two vectors, followed by an output transformation on the result of the vector EWM, with the output transformation matrix being... Performing matrix multiplication with it yields a vector. Finally, output a portion of the results, converting the vector... Assign values ​​in sequence .

[0046] Let the variable Repeat the above steps until... .

[0047] Next, for vectors Perform local vector folding when When, let vector equal to vector sum vector The result of vector subtraction is to let the vector equal to vector Vector; when When, let vector Equal to zero vector and vector The result of vector subtraction is to let the vector equal to vector sum vector The result of vector subtraction is to let the vector equal to vector .

[0048] Let the variable , Repeat the above steps until... .

[0049] Finally, for vectors Perform global vector folding, let vector equal to vector sum vector The result of vector subtraction, with each element moduloed, is given by the vector... equal to vector sum vector The result of vector subtraction, with each element moduloed.

[0050] Let the variable Repeat the above steps until... .

[0051] Specifically, the calculation process in step 7) includes: when At that time, the outer loop is executed: when At that time, execute parallel loops: when At that time, the inner loop is executed: Let column vector

[0052] Let column vector

[0053] Let vector

[0054] Note: This represents element-wise multiplication (EWM) of two vectors. Let vector

[0055] make

[0056] Inner loop ends Let vector

[0057] Let vector

[0058] Let vector

[0059] make ,

[0060] Parallel loop ends Let vector

[0061] Let vector

[0062] make

[0063] Outer loop ends 8) Return the output result .

[0064] When applied to accelerate Saber, compared to the regular Schoolbook, the improved Schoolbook not only reduces multiplication operations by 32.18%, but is also extremely hardware-friendly. The improved Schoolbook introduces a scalable layer of parallel loops, making it easier for hardware implementations to set the number of parallel cores based on the number of resources. At the same time, the inner loop is located within the parallel loop, which facilitates loop unrolling in the hardware, improving the throughput and speed of the hardware accelerator.

[0065] The Saber hardware accelerator architecture implemented in this invention is as follows: Figure 1 As shown.

[0066] This invention provides a hardware implementation of the improved Schoolbook algorithm and a high-throughput, scalable polynomial multiplier to accelerate Saber. The invention features a highly parallel pipelined architecture and expands the inner loop of the Schoolbook in the hardware implementation, thereby avoiding repeated readings of the public and secret polynomials. Furthermore, thanks to the highly parallel pipelined architecture, each loop produces only one output, avoiding the reading and writing of intermediate calculation results and reducing the demand for on-chip memory.

[0067] The top-level architecture of the hardware accelerator implemented in this invention is as follows: Figure 1 As shown, it mainly consists of 7 parts: 1. Public Polynomial Cache Module: Used to store input public polynomial data, with a width of 104 bits and a depth of 32. Its implementation is constructed from Block RAM, such as... Figure 1 .

[0068] 2. Secret Polynomial Buffer Module: Used to store the input Secret polynomial data, it is essentially a 1024-bit register or register array, such as... Figure 1 (b).

[0069] 3. Input Tile Loading and Conversion Module: This module processes the input Secret polynomial (splits and evaluates it), extracts all necessary tiles at once, and performs input tile conversion, such as... Figure 1 (b) and (c).

[0070] 4. Input Filter Transformation Module: Used to decompose and evaluate the Public polynomial, read a certain number of filters, and transform the input filter polynomial, such as... Figure 1 (a).

[0071] 5. Parallel Core Module: The core computing unit, containing numerous modular multipliers for EWM, as well as EWM output conversion and data reconstruction modules. Once the pipeline is fully populated, a single parallel core module can complete all computations for one parallel loop within one cycle.

[0072] 6. Result Accumulation Module: This module sums the results of each parallel core module and accumulates them with the results of the previous batch of calculations in the parallel core modules to obtain the final output polynomial.

[0073] 7. Controller composition: The main functions include address generation for each memory, data path selection, task scheduling, and pre-calculation of some fixed values.

[0074] This invention is implemented on a Xilinx Virtex-UltraScale+ VCU118 FPGA. In the Saber scheme, the order of the polynomials is 256, the public polynomial coefficient width is set to 13 bits, and the secret polynomial coefficient width is set to 4 bits. Table 1 shows the results for 2-parallel-core, 4-parallel-core, and 8-parallel-core implementations. When using the accelerator and acceleration method of this invention on a Xilinx UltraScale+ FPGA, compared with existing designs, the 2-parallel-core version of this invention reduces computation latency by 25.2% to 88.8% and increases throughput by 1.3 to 8.9 times; the 4-parallel-core version reduces computation latency by 58.4% to 93.8% and increases throughput by 2.4 to 16 times; and the 8-parallel-core version reduces computation latency by 78.2% to 96.7% and increases throughput by 4.6 to 30.5 times.

[0075] Table 1 Acceleration performance of the accelerator

[0076] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A Saber hardware accelerator based on an improved Schoolbook algorithm, characterized in that, include: The module includes input tile loading and conversion, input filter conversion, parallel kernel, and result accumulation. The input filter transformation module is used to decompose and evaluate the first polynomial to obtain the first univariate polynomial; extract the column vector filter based on the first univariate polynomial, and perform input transformation. The input tile loading and transformation module is used to decompose and evaluate the second polynomial to obtain the second single-variable polynomial; extract multiple column vector tiles based on the second single-variable polynomial, and perform input transformation. The parallel core module is configured in several ways, and these parallel core modules perform operations in parallel: transforming the column vector after input conversion... and multiple column vectors The Winograd convolution operation is performed; the parallel kernel module includes an EWM modular multiplier, an EWM output transformation module, and a data reconstruction module; the EWM modular multiplier is used to transform the column vector after input transformation. and column vectors Perform element-wise multiplication; the EWM output transformation module is used to transform the output of the EWM modular multiplier; the data reconstruction module is used to perform local vector folding on the output transformation result of the EWM output transformation module; Result accumulation module; This is used to add the results of the operations of each parallel core module, and also to accumulate the results obtained from the previous loop operation of the parallel core module, to obtain the output polynomial multiplication result.

2. The Saber hardware accelerator based on the improved Schoolbook algorithm according to claim 1, characterized in that, The number of parallel core modules is 2, 4, or 8.

3. The Saber hardware accelerator based on the improved Schoolbook algorithm according to claim 1, characterized in that, It also includes a polynomial cache module for storing the input polynomial data.

4. The Saber hardware accelerator based on the improved Schoolbook algorithm according to claim 1, characterized in that, The first polynomial is the Public polynomial, and the second polynomial is the Secret polynomial.

5. A method for encryption and decryption based on the improved Schoolbook algorithm using the Saber hardware accelerator based on the improved Schoolbook algorithm as described in claim 1, characterized in that, include: S1, Obtain information, process the information to obtain the first polynomial and the second polynomial; S2, split the first polynomial and the second polynomial to obtain the first split result and the second split result; S3, evaluate the first and second splitting results to obtain the first and second univariate polynomials; S4, perform Winograd convolution on the first and second univariate polynomials in a parallel loop to obtain the result; S5 performs output transformation, interpolation, and polynomial recombination on the result of S4 to obtain the polynomial multiplication result; Wherein, when the information is information to be encrypted, the first polynomial and the second polynomial are the plaintext information and the encryption key, respectively, and the result of the polynomial multiplication is the ciphertext; when the information is ciphertext, the first polynomial and the second polynomial are the ciphertext and the decryption key, respectively, and the result of the polynomial multiplication is the decrypted information.

6. The encryption / decryption method based on the improved Schoolbook algorithm according to claim 5, characterized in that, The first polynomial is The second polynomial is The output is N is the length of the polynomial. Represents the modulus of the polynomial coefficients; S4 specifically includes: 1) If If the length of the vector is odd, then let the vector be... ;like If the length of the vector is even, then let the vector be an even number. ; 2) If If the length of the vector leaves a remainder of 0 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 1 when divided by 3, then let the vector... ;like If the length of the vector leaves a remainder of 2 when divided by 3, then let the vector... ; 3) Order For vectors Length, For vectors Length; let , ; 4) Convert the column vector Initialize as a zero vector of length 2 , column vector Initialize as a zero vector of length 4 , will vector Initialize as a zero vector of length 3 , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector , will vector Initialized to a length of zero vector ; 5) Initialization , , Set the number of parallel cores ; 6) Transfer the data , Concatenate them in order to form a column vector , data Concatenate them in order to form a column vector For column vectors Perform input transformation on column vectors Perform an input transformation, and let the column vector after the input transformation be... and Perform element-wise multiplication of the vectors, transform the result, and obtain the vector. , will vector Assign values ​​in sequence ; Let the variable Repeat the above steps in step 6) until... ; For vectors Perform local vector folding to obtain vectors ; Let the variable , Repeat the above steps in step 6) until... ; For vectors Perform global vector folding to obtain vectors ; Let the variable Repeat the above steps in step 6) until... .

7. The encryption / decryption method based on the improved Schoolbook algorithm according to claim 6, characterized in that, Step 6) specifically includes: when At that time, the outer loop is executed: when At that time, execute parallel loops: when At that time, the inner loop is executed: Let column vector Let column vector Let vector Let vector make Inner loop ends Let vector Let vector Let vector make , Parallel loop ends Let vector Let vector make The outer loop has ended.

Images