A fast modular multiplication system based on transform bases

Abstract

The application provides a fast modular multiplication system based on a transform base, the fast modular multiplication system comprising a pre-computation layer for transform base processing of input first and second modular multiplication inputs A and B; a polynomial modular multiplication layer for sequentially performing grouping multiplication processing and recombination reduction processing on the first and second modular multiplication inputs A and B which have completed transform base processing; an iteration reduction layer for sequentially performing mapping wiring processing and accumulation processing several times on the polynomial comprising the first and second modular multiplication inputs A and B which have completed recombination reduction processing; and a base reduction layer for converting the polynomial comprising the first and second modular multiplication inputs A and B which have completed the last accumulation processing from X base to binary. The fast modular multiplication system reduces the use of circuit hardware, saves the area of the circuit, and has more advantages in area and speed compared with the traditional modular multiplication system.

Description

Technical Field

[0001] This invention relates to the fields of computer and integrated circuit technology, and in particular to a fast modular multiplication system based on a transformation basis. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptosystems based on large integer factorization and discrete logarithm problems, which are currently widely used, are at risk of being broken by quantum computers and becoming ineffective. This would seriously compromise the security, confidentiality, and integrity of digital communications. In recent years, the cryptographic community has actively researched new public-key cryptosystems that can resist quantum computing attacks and are therefore called "post-quantum cryptography." Among them, lattice-based encryption algorithms are among the most promising post-quantum cryptosystems due to their strong security and other advantages. Extensive research has been conducted in academia and industry to optimize these encryption algorithms.

[0003] In lattice cryptography, modular multiplication is one of the most crucial operations, consuming a significant portion of the cryptographic system's computation time and hardware resources. Therefore, optimizing modular multiplication can effectively improve the overall efficiency of the cryptographic system. Generally, there are two approaches to implementing modular multiplication: The first approach employs a "multiplication first, reduction later" method, where multiplication and reduction are relatively independent, known as non-interleaved modular multiplication. The reduction process is relatively complex and is the focus of optimization. Common reduction algorithms include the Montgomery reduction algorithm and the Barrett reduction algorithm. Additionally, a "table lookup-accumulation" method exists, which is highly effective for modulo operations over finite fields in lattice cryptography. The second approach employs a "multiplication and reduction simultaneously" method, combining multiplication and reduction through an interleaved approach, known as interleaved modular multiplication. A common algorithm for this is the Montgomery modular multiplication algorithm.

[0004] One proposed reduction method, "table lookup-accumulation," is used to address the characteristics of lattice cipher moduli, as described below:

[0005] For a fixed modulus q, its bit width can be expressed as: Then q can be expressed as follows:

[0006] q=2 N -δ(1≤δ<2 N-1 )

[0007] And thus obtain

[0008] 2 N ≡δ(mod q)

[0009] For the simplified number z[D-1:0] (D>N), we have:

[0010] z≡z[D-1:N]·2 N +z[N-1:0]

[0011] ≡z[D-1:N]·δ+z[N-1:0]

[0012] ≡z′[D′-1:N′]·2 N +z′[N′-1:0]+z[N-1:0]

[0013] ≡z′[D′-1:N′]·δ+z′[N′-1:0]+z[N-1:0]

[0014] ≡...(mod q)

[0015] The modulus of a lattice cryptosystem, based on the above expression, generally has the following two characteristics: (1) a small δ value, i.e., a small bit width; and (2) a low Hamming weight of δ, i.e., few non-zero bits. Therefore, this method can quickly reduce the bit width to achieve the purpose of modulus calculation. Compared with the traditional Barrett algorithm and Montgomery algorithm, it can save extra multiplication overhead, reduce area, and reduce latency, making it an extremely effective reduction method. However, this method also has obvious limitations. Under less than ideal conditions (larger or higher Hamming weight), reduction will face the problems of more iterations and more complex connections, leading to an increase in both area and time complexity. Therefore, there are very few modulus systems that can effectively use this method in practice. Summary of the Invention

[0016] This application provides a fast modular multiplication system based on transformation basis to solve the problems of numerous reduction iterations and complex connections in existing lattice cryptosystems.

[0017] The fast modular multiplication system includes:

[0018] The pre-computation layer is used to perform a base transformation process on the first modular multiplication input A and the second modular multiplication input B, thereby converting the first modular multiplication input A and the second modular multiplication input B from binary to base X. The first modular multiplication input A and the second modular multiplication input B are obtained based on the modulus q.

[0019] A polynomial modular multiplication layer, comprising several adders and multipliers, is used to perform grouped multiplication and recombination reduction processing on the intermediate coefficients of the first modular multiplication input A and the second modular multiplication input B, which have already undergone basis transformation processing, through built-in adders and multipliers, thereby reducing the polynomial degree containing the first modular multiplication input A and the second modular multiplication input B.

[0020] An iterative reduction layer, comprising several sub-iterative reduction layers, each having several adders; the iterative reduction layer is used to perform several mapping routing and accumulation processes on the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has already undergone recombination and reduction processing, through built-in adders, thereby shortening the coefficient bit width of the (n-1)th degree polynomial of X containing the first modular multiplication input A and the second modular multiplication input B;

[0021] The base reduction layer is used to convert the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has completed the last accumulation process, from base X to binary to obtain the actual modular multiplication result.

[0022] Preferably, the pre-computation layer is further used for:

[0023] Define the modulus q, the bit width N of the modulus q, the first modular multiplication input A, and the second modular multiplication input B in the modular multiplication operation;

[0024] The first modular multiplication input A and the second modular multiplication input B are transformed into a polynomial of X according to the transformation basis formula; the transformation basis formula is: X = 2 α -1, where α is a positive integer and α < N; the polynomial of X is q(X) = kX n -δ(X);

[0025] The first target polynomial is obtained based on the polynomial of X; the first target polynomial is composed of the initial polynomials of the first modular multiplication input A and the second modular multiplication input B, respectively:

[0026] The initial polynomial kX of modulus q n modq = δ(X);

[0027] The initial polynomial of the first modular input A

[0028] The initial polynomial of the second modular input B

[0029] Where δ(X) is a polynomial in X. a i and b i are the coefficients of polynomials A(X) and B(X), respectively, and i is a constant.

[0030] Preferably, the polynomial modular multiplication layer further includes a grouping multiplication layer and a recombination and reduction layer;

[0031] The grouped multiplication layer includes several adders and multipliers, and the recombination and reduction layer includes several adders;

[0032] The grouped multiplication layer is used to perform grouped multiplication on the first objective polynomial to obtain the second objective polynomial;

[0033] The recombination and reduction layer is used to recombine and reduce the second objective polynomial to obtain a (n-1) degree polynomial of X.

[0034] Preferably, the grouped multiplication layer is further used for:

[0035] The second objective polynomial is obtained by converting the computational relationships in the first objective polynomial from constant multiplication to polynomial multiplication and individual multiplication to grouped multiplication using built-in adders and multipliers.

[0036] Preferably, the recombination-reduction layer is further used for:

[0037] The second objective polynomial is reorganized and merged using a built-in adder to obtain a reorganized polynomial.

[0038] The recombined polynomial is reduced to obtain the reduced polynomial;

[0039] Substituting the reduced polynomial into the initial polynomial of the modulus q multiple times yields the (n-1)th degree polynomial of X.

[0040] Preferably, the second objective polynomial is

[0041] The recombination polynomial is:

[0042] The reduced polynomial is:

[0043] The (n-1)th degree polynomial of X is:

[0044] Among them, u i Let u be the new coefficient of the polynomial obtained by accumulating several terms. i Bit width is Bit, and c i The coefficients are 2M bits; n is a constant; a i For M bits; b i The coefficient is M bits, and k is the coefficient of the highest order term.

[0045] Preferably, the sub-iterative reduction layer includes a mapping and routing layer and an accumulation layer, wherein the accumulation layer includes a plurality of adders;

[0046] The mapping and routing layer is used to perform mapping and routing processing on the (n-1)th degree polynomial of X;

[0047] The accumulation layer is used to accumulate the (n-1)th degree polynomial of X that has already undergone one mapping and routing process.

[0048] Preferably, the iterative reduction layer is further used for:

[0049] The built-in adder performs several mapping and wiring processes and accumulation processes on the (n-1)th degree polynomial of X that has already undergone recombination and reduction.

[0050] When the bit width of the coefficients of the (n-1)th degree polynomial of X is reduced to the required range, the third objective polynomial is output.

[0051] Preferably, the iterative reduction layer is further used for:

[0052] The (n-1)th degree polynomial of X, which has already undergone recombination and reduction, is transformed into u. i A polynomial of the form u i The polynomial of the form is

[0053] The u i The polynomial of the form is repeatedly substituted into the initial polynomial of the modulus q and the (n-1) degree polynomial of X for reduction, to obtain the third objective polynomial, which is: Among them, z i is a coefficient.

[0054] Preferably, the base reduction layer is further used for:

[0055] Several addition and shift operations are performed on the third objective polynomial to obtain the actual modular multiplication result.

[0056] This application provides a fast modular multiplication system based on a transform basis. The fast modular multiplication system includes a pre-computation layer, which performs a transform basis process on the input modulus q, thereby converting the modulus q from binary to a number system; a polynomial modular multiplication layer, which includes several adders and multipliers; this polynomial modular multiplication layer uses built-in adders and multipliers to sequentially perform grouped multiplication and recombination reduction processing on the modulus q that has undergone the transform basis process, thereby reducing the polynomial degree containing the modulus q; and an iterative reduction layer. The iterative reduction layer includes several sub-iterative reduction layers, each with several adders. Each iterative reduction layer uses built-in adders to sequentially perform several mapping routing and accumulation processes on the polynomial containing the modulus q that has already undergone recombination and reduction processing, thereby shortening the coefficient bit width of the (n-1)th degree polynomial containing the modulus X. The radix restoration layer converts the polynomial containing the modulus q, which has undergone the last accumulation process, from radix X to binary to obtain the actual modular multiplication result. This application reduces the use of circuit hardware and saves circuit area through the above-described fast modular multiplication system, and it has advantages in both area and speed compared to traditional modular multiplication systems. Attached Figure Description

[0057] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a schematic diagram of a fast modular multiplication system based on transformation basis according to this application;

[0059] Figure 2 This is a logic flowchart of a fast modular multiplication system based on transformation basis according to this application. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] Figure 1 This is a schematic diagram of a fast modular multiplication system based on a transformation basis according to this application.

[0062] Figure 2 This is a logic flowchart of a fast modular multiplication system based on transformation basis according to this application.

[0063] See Figure 1 and Figure 2 As can be seen, this embodiment provides a fast modular multiplication system based on a transformation basis, the fast modular multiplication system comprising:

[0064] A pre-computation layer 100 is used to perform a basis transformation process on the first modular multiplication input A and the second modular multiplication input B, thereby converting the first modular multiplication input A and the second modular multiplication input B from binary to base X. The first modular multiplication input A and the second modular multiplication input B are obtained based on the modulus q. Specifically, in this embodiment, unlike the traditional binary representation method, this scheme requires a basis transformation process on the modulus and inputs before modular multiplication. The pre-computation layer 100 sets the modulus q, the bit width N of the modulus q, the first modular multiplication input A and the second modular multiplication input B in the modular multiplication operation, and converts the first modular multiplication input A and the second modular multiplication input B into a polynomial of X according to the basis transformation formula. The basis transformation formula is: X = 2^X. α -1, where α is a positive integer and α < N; the polynomial of X is q(X) = kX n -δ(X), and obtain the first target polynomial based on the polynomial of X, thereby performing base conversion on the first modular multiplication input A and the second modular multiplication input B.

[0065] It should be noted that the selection of the α value follows two principles: to minimize the "Hamming weight" of the δ(X) coefficient, i.e., |r i |(i=0,1,2...) should be as small as possible and equal to 0 to reduce the complexity of the connections; the binary bit width of δ(X) should be as small as possible to reduce the number of subsequent iterations.

[0066] The first objective polynomial is composed of the initial polynomials of the first modular multiplication input A and the second modular multiplication input B, respectively:

[0067] The initial polynomial kX of modulus q n modq = δ(X);

[0068] The initial polynomial of the first modular input A

[0069] The initial polynomial of the second modular input B

[0070] Where δ(X) is a polynomial in X. a i and b i are the coefficients of polynomials A(X) and B(X), respectively, and i is a constant.

[0071] It should be noted that the bit width of the first modular multiplication input A and the second modular multiplication input B is the same as the modulus q, which is N.

[0072] It should be noted that the modulus q can be determined according to the requirements, for example, in bank encryption systems, exchange encryption, etc.

[0073] For example, the input for base conversion is two data A[N-1:0] and B[N-1:0] to be modularly multiplied, which are then rewritten as base X.

[0074] The fast modular multiplication system also includes:

[0075] A polynomial modular multiplication layer 200 includes several adders and multipliers. This layer uses built-in adders and multipliers to sequentially perform grouped multiplication and recombination reduction processing on the intermediate coefficients of the first modular multiplication input A and the second modular multiplication input B, which have already undergone base transformation processing. This reduces the degree of the polynomial containing the first modular multiplication input A and the second modular multiplication input B. Specifically, in this embodiment, the polynomial modular multiplication layer 200 combines the polynomial after base transformation with a fast FIR algorithm, thereby reducing the number of multipliers used and thus reducing the circuit area.

[0076] The polynomial modular multiplication layer 200 further includes a grouped multiplication layer 210 and a recombination and reduction layer 220; the grouped multiplication layer 210 includes a plurality of adders and multipliers, and the recombination and reduction layer 220 includes a plurality of adders.

[0077] In this embodiment, the first target polynomial is processed by group multiplication through the group multiplication layer 210 to obtain the second target polynomial. Specifically, the group multiplication layer 210 uses built-in adders and multipliers to convert the calculation relationship in the first target polynomial from constant multiplication to polynomial multiplication and individual multiplication to group multiplication to obtain the second target polynomial.

[0078] In this embodiment, the second target polynomial is reorganized and reduced by the recombination and reduction layer 220 to obtain a (n-1) degree polynomial of X. Specifically, the recombination and reduction layer 220 reorganizes and merges the second target polynomial using a built-in adder to obtain a reorganized polynomial, and then reduces the reorganized polynomial to obtain a reduced polynomial. Finally, the reduced polynomial is substituted multiple times into the initial polynomial of the modulus q to obtain the (n-1) degree polynomial of X.

[0079] Wherein, the second objective polynomial is

[0080] The recombination polynomial is:

[0081] The reduced polynomial is:

[0082] The (n-1)th degree polynomial of X is:

[0083] Among them, u i Let u be the new coefficient of the polynomial obtained by accumulating several terms. i Bit width is Bit, and c i The coefficients are 2M bits; n is a constant; a i For M bits; b i The coefficient is M bits.

[0084] In this embodiment, a fast FIR algorithm is used for the polynomial multiplication, which can effectively reduce the number of multipliers. For example, if n = 2, the expression can be expanded using a 2-parallel fast FIR algorithm as follows:

[0085] (a1X+a0)(b1X+b0)=a1b1(X 2 )+[(a1+a0)(b1+b0)-a1b1-a0b0](X)+a0b0

[0086] The number of multiplications required has been reduced from 4 to 3, saving nearly 25% of hardware costs.

[0087] Specifically, the polynomial modular multiplication layer 200 essentially involves rewiring and adjusting the outputs of the preceding multipliers, then using them as inputs to n adders, the outputs of which are denoted as u. i (i = 0, 1, 2...n-1), bit width is Bit, and

[0088] The fast modular multiplication system also includes:

[0089] An iterative reduction layer 300 is provided, comprising several sub-iterative reduction layers, each having several adders. The iterative reduction layer 300 is used to perform several mapping and routing operations and accumulation operations on the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has undergone recombination and reduction processing, through built-in adders, thereby shortening the coefficient bit width of the (n-1)th degree polynomial containing the modulus X. Specifically, in this embodiment, the iterative reduction layer 300 shortens the coefficient bit width of the (n-1)th degree polynomial containing the modulus X.

[0090] The sub-iterative reduction layer includes a mapping and routing layer 310 and an accumulation layer 320. The accumulation layer 320 includes several adders. The mapping and routing layer 310 performs mapping and routing processing on the (n-1)th degree polynomial of X. The accumulation layer 320 performs accumulation processing on the (n-1)th degree polynomial of X that has completed one mapping and routing process.

[0091] In this embodiment, the iterative reduction layer 300 uses a built-in adder to perform several mapping routing and accumulation operations on the (n-1) degree polynomial of X that has already undergone recombination and reduction processing. When the coefficient bit width of the (n-1) degree polynomial of X is reduced to the required range, a third target polynomial is output, thereby completing the reduction of the coefficient bit width of the (n-1) degree polynomial of X. The specific method by which the iterative reduction layer 300 completes the reduction of the coefficient bit width of the (n-1) degree polynomial of X is as follows:

[0092] The (n-1)th degree polynomial of X, which has already undergone recombination and reduction, is transformed into u. i A polynomial of the form u i The polynomial of the form is and the u i The polynomial of the form is repeatedly substituted into the initial polynomial of the modulus q and the (n-1) degree polynomial of X for reduction, to obtain the third objective polynomial, which is: Among them, z i is a coefficient.

[0093] Specifically, the result obtained by the above modular multiplication is not sufficiently reduced. To further reduce it, we can also express u as a polynomial of X. i :

[0094]

[0095]

[0096]

[0097] in, will u i Substituting back into the original expression and repeatedly using the initial polynomial of the modulus q and the (n-1)th degree polynomial of X, this process essentially involves reorganizing and merging the coefficients by bit. After a certain mapping and wiring, the coefficients are accumulated to obtain a new set of coefficients, achieving the purpose of reduction. Iterating the above process, our ultimate goal is to reduce the bit width of the coefficients of the (n-1)th degree polynomial of X to the required range, i.e., M.

[0098] It should be noted that the input of each iteration in this part is the output of the n adders in the previous module, and then after certain wiring, it is finally connected to the output of the n adders.

[0099] The fast modular multiplication system also includes:

[0100] The base reduction layer 400 is used to convert the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has completed the last accumulation process, from base X to binary to obtain the actual modular multiplication result. Specifically, in this embodiment, the base reduction layer 400 performs several addition and shift operations on the third target polynomial to obtain the actual modular multiplication result.

[0101] The following is an exemplary embodiment of the overall solution:

[0102] Let the modulus q[22:0] = 8380417, and choose a new base X = 2. 11 -1, then q = 2X 2 -1, therefore:

[0103] 2X 2 modq = 1

[0104] Let the modular multiplication inputs be A[22:0] and B[22:0]. For ease of subsequent reduction, we use the following polynomials containing X to represent A and B:

[0105] A = a12X + a0

[0106] B = b12X + b0

[0107] Where a1, a0, b1, and b0 are all 12 bits wide, let the multiplication result be C[45:0]:

[0108] C = A·B = (a12X + a0)(b12X + b0)

[0109] Expanding and rearranging the expression using the fast FIR algorithm, we get:

[0110] C = 2a1b1(2X) 2 )+[(a1+a0)(b1+b0)-a1b1-a0b0](2X)+a0b0

[0111] The first reduction of C is performed using equation (3):

[0112] C mod q≡[(a1+a0)(b1+b0)-a1b1-a0b0](2X)+2a1b1+a0b0

[0113] Among them, [(a1+a0)(b1+b0)-a1b1-a0b0] has a maximum bit width of 25 bits, and (2a1b1+a0b0) has a maximum bit width of 26 bits, which can be represented by u1[24:0] and u0[25:0] respectively, and thus we have:

[0114] Cmod q≡u1[24:0](2X)+u0[25:0]

[0115] Rearranging and simplifying the coefficients of C, we get:

[0116] C mod q≡(u1[24:15]·2 15 +u1[14:0])(2X)+u0[25:14]·2 14 +u0[13:0]

[0117] ≡(u1[24:15](16X+16)+u1[14:0D(2X)+u0[25:14](8X+8)+u0[13:0]

[0118] ≡(16u1[24:15]+u1[14:0]+4u0[25:14])(2X)+16u1[24:15]+8u0[25:14]+u0[13:0]

[0119] The same principle applies to making

[0120] v1[15:0]=16u1[24:15]+u1[14:0]+4u0[25:14]

[0121] v0[15:0]=16u1[24:15]+8u0[25:14]+u0[13:0]

[0122] We can obtain:

[0123] C mod q≡v1[15:0](2X)+v0[15:0]

[0124] ≡(v1[15:11](X+1)+v1[10:0])(2X)+v0[15:12](2X+2)+v0[11:0]

[0125] ≡(v1[15:11]+v1[10:0]+v0[15:12D(2X)+v1[15:11]+2v0[15:12]+v0[11:0]

[0126] ≡w1[11:0](2X)+w0[12:0]

[0127] ≡(w1[11:0]+w0

[12] )(2X)+2w0

[12] +w0[11:0].

[0128] The advantages of this embodiment are:

[0129] This scheme makes the modulus more universal by performing a base-changing process on moduli that cannot be solved by the traditional "table lookup-accumulation" method.

[0130] Since the data is converted into a polynomial expression after the basis transformation, it can be combined with the fast FIR algorithm to further reduce the number of multiplications and the area of ​​the circuit through reuse.

[0131] An alternating modular multiplication architecture is proposed -> An alternating architecture for grouped modular multiplication is proposed.

Claims

1. A fast modular multiplication system based on a transformation basis, characterized in that, The fast modular multiplication system includes: A pre-computation layer (100) is used to perform a basis transformation process on the first modular multiplication input A and the second modular multiplication input B, thereby converting the first modular multiplication input A and the second modular multiplication input B from binary to binary. The first modular multiplication input A and the second modular multiplication input B are obtained based on the modulus q. A polynomial modular multiplication layer (200) includes several adders and multipliers. The polynomial modular multiplication layer (200) is used to perform group multiplication and recombination reduction processing on the intermediate coefficients of the first modular multiplication input A and the second modular multiplication input B, which have already undergone basis transformation processing, through built-in adders and multipliers, thereby reducing the polynomial degree of the first modular multiplication input A and the second modular multiplication input B. An iterative reduction layer (300) is provided, comprising several sub-iterative reduction layers, each having several adders. The iterative reduction layer (300) is used to perform several mapping and routing operations and accumulation operations on the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has undergone recombination and reduction processing, through built-in adders, thereby shortening the coefficient bit width of the (n-1)th degree polynomial of X containing the first modular multiplication input A and the second modular multiplication input B. The base reduction layer (400) is used to convert the polynomial containing the first modular multiplication input A and the second modular multiplication input B, which has completed the last accumulation process, from base X to binary to obtain the actual modular multiplication result; The pre-computation layer (100) is also used for: Define the modulus q, the bit width N of the modulus q, the first modular multiplication input A, and the second modular multiplication input B in the modular multiplication operation; The first modular multiplication input A and the second modular multiplication input B are transformed into a polynomial of X according to the transformation basis formula; the transformation basis formula is: , where α is a positive integer and α < N; the polynomial of X is ; According to the above The polynomial is used to obtain the first objective polynomial; the first objective polynomial is composed of the initial polynomials of the first modular multiplication input A and the second modular multiplication input B, respectively. Initial polynomial of modulus q The initial polynomial of the first modular input A The initial polynomial of the second modular input B ; in, For is a matter about polynomial, , , They are polynomials coefficient, i It is a constant.

2. The fast modular multiplication system based on transformation basis according to claim 1, characterized in that, The polynomial modular multiplication layer (200) also includes a grouped multiplication layer (210) and a recombination and reduction layer (220). The grouping multiplication layer (210) includes several adders and multipliers, and the recombination and reduction layer (220) includes several adders; The group multiplication layer (210) is used to perform group multiplication on the first objective polynomial to obtain the second objective polynomial; The recombination and reduction layer (220) is used to recombine and reduce the second objective polynomial to obtain a (n-1) degree polynomial of X.

3. The fast modular multiplication system based on a transformation basis according to claim 2, characterized in that, The group multiplication layer (210) is also used for: The second objective polynomial is obtained by converting the computational relationships in the first objective polynomial from constant multiplication to polynomial multiplication and individual multiplication to grouped multiplication using built-in adders and multipliers.

4. The fast modular multiplication system based on a transformation basis according to claim 3, characterized in that, The recombination reduction layer (220) is also used for: The second objective polynomial is reorganized and merged using a built-in adder to obtain a reorganized polynomial. The recombined polynomial is reduced to obtain the reduced polynomial; Substituting the reduced polynomial into the initial polynomial of the modulus q multiple times yields the (n-1)th degree polynomial of X.

5. A fast modular multiplication system based on a transformation basis according to claim 4, characterized in that, The second objective polynomial is ; The recombination polynomial is: ; The reduced polynomial is: ; The (n-1)th degree polynomial of X is: ; in, Let the new coefficients of the polynomial obtained by summing several terms be denoted as... Bit width is Bit, and ; The coefficients are 2M bits; n is a constant. It is M bits; The coefficient is M bits. k This is the coefficient of the highest-order term.

6. A fast modular multiplication system based on a transformation basis according to claim 5, characterized in that, The sub-iterative reduction layer includes a mapping and routing layer (310) and an accumulation layer (320), wherein the accumulation layer (320) includes a plurality of adders; The mapping and routing layer (310) is used to perform mapping and routing processing on the (n-1)th degree polynomial of X; The accumulation layer (320) is used to accumulate the (n-1)th degree polynomial of X that has already undergone one mapping and routing process.

7. A fast modular multiplication system based on a transformation basis according to claim 6, characterized in that, The iterative reduction layer (300) is also used for: The built-in adder performs several mapping and routing operations and accumulation operations on the (n-1)th degree polynomial of X that has already undergone recombination and reduction processing. When the bit width of the coefficients of the (n-1)th degree polynomial of X is reduced to the required range, the third objective polynomial is output.

8. A fast modular multiplication system based on a transformation basis according to claim 7, characterized in that, The iterative reduction layer (300) is also used for: The (n-1)th degree polynomial of X that has already undergone recombination and reduction is transformed into... polynomial of the form, the The polynomial of the form is ; The The polynomial of the form is repeatedly substituted into the initial polynomial of the modulus q and the (n-1) degree polynomial of X for reduction, to obtain the third objective polynomial, which is: ,in, is a coefficient.

9. A fast modular multiplication system based on a transformation basis according to claim 8, characterized in that, The base reduction layer (400) is also used for: Several addition and shift operations are performed on the third objective polynomial to obtain the actual modular multiplication result.

Images