A lightweight and efficient encryption / decryption coprocessor and method based on RLWE assumption

Abstract

The application provides a lightweight and efficient encryption / decryption coprocessor and method based on an RLWE assumption, and a good balance between performance and resource utilization is achieved. The application develops a lightweight and efficient RLWE cryptographic coprocessor based on a Schoolbook algorithm, the time complexity of Schoolbook polynomial multiplication is greatly reduced by improving the parallelism of Schoolbook polynomial multiplication, a CDT Gaussian sampler is used for key generation, and redundant data in the structure of the classical CDT Gaussian sampler is further compressed, so that the storage resources are significantly saved. Therefore, the application achieves a good balance between performance and resource utilization, has high hardware efficiency, and can greatly improve the resource utilization.

Description

TECHNICAL FIELD

[0001] The present application relates to a polynomial multiplier and a post-quantum cryptography hardware accelerator, in particular to a lightweight and efficient encryption / decryption coprocessor and method based on the RLWE hypothesis. BACKGROUND

[0002] With the continuous development of quantum computing, efficient quantum algorithms can break the mathematical difficulty problems of mainstream RSA, ECC and other public key cryptography systems, making the public key cryptography system no longer secure. Therefore, in the post-quantum era, developing a more secure cryptography system has become a new focus. The cryptography scheme based on the lattice (RLWE) is becoming the mainstream cryptography scheme. NIST began to collect new generation public key cryptography algorithm standards in 2016, and among the many cryptography schemes published, the cryptography system based on the lattice problem occupies the largest proportion due to its many advantages.

[0003] Polynomial multiplication is the core computing module of lattice cryptography, which directly affects the overall computing speed of the cryptography system. Usually, polynomial multiplication is realized through Schoolbook or NTT algorithm. NTT algorithm has lower complexity and can better improve the operation speed of Schoolbook polynomial multiplication, but it is limited by selected parameters and the algorithm is relatively complex, which is not suitable for lightweight devices. Schoolbook algorithm is relatively simple to implement, and its low resource consumption makes it applicable to resource-constrained devices.

[0004] There are many works focusing on implementing polynomial multiplication based on Schoolbook algorithm. The Schoolbook algorithm-based multiplier is widely used due to its wide applicability, but previous researches only focus on high performance or lightweight design, and existing works are difficult to achieve a good trade-off between performance and resources. SUMMARY

[0005] In order to solve the above technical problems of the prior art, the present application provides a lightweight and efficient encryption / decryption coprocessor and method based on the RLWE hypothesis, which achieves a good balance between performance and resource utilization.

[0006] The present application is implemented by the following technical solutions:

[0007] The present application provides a lightweight and efficient encryption / decryption coprocessor based on the RLWE hypothesis, comprising: a CDT Gaussian sampler, a first polynomial multiplication module, an encoder, a first modulo addition module, a second polynomial multiplication module, a decoder and a second modulo addition module.

[0008] The CDT Gaussian sampler is used for sampling the input random number according to the probability value in the pre-stored probability pre-stored table, to obtain a key vector; wherein the probability value is obtained by compressing N consecutive 1s in the Freq(cur) function value into one 1;

[0009] The encoder is used for encoding the plaintext vector to obtain a plaintext polynomial;

[0010] The first polynomial multiplication module is used for performing Schoolbook polynomial multiplication operation on the public key vector and the key vector in a multi-parallel manner, to obtain a first polynomial multiplication operation result;

[0011] The first modulo addition module is used for performing modulo addition operation on the plaintext polynomial and the first polynomial multiplication operation result, to obtain a ciphertext polynomial;

[0012] The second polynomial multiplication module is used for performing Schoolbook polynomial multiplication operation on the ciphertext polynomial and the external input secret vector in a multi-parallel manner, to obtain a second polynomial multiplication operation result;

[0013] The second modulo addition module is used for performing modulo addition operation on the ciphertext polynomial and the second polynomial multiplication operation result, to obtain a decrypted plaintext polynomial;

[0014] The decoder is used for decoding the decrypted plaintext polynomial to obtain a decrypted plaintext vector.

[0015] Preferably, N≥4.

[0016] Preferably, the first polynomial multiplication module and the second polynomial multiplication module both include a PE multiplication unit, a modulo addition unit and an accumulation unit.

[0017] The PE multiplication unit is used for performing multiplication operation.

[0018] The modulo addition unit is used for performing modulo addition operation on the operation result of the PE multiplication unit.

[0019] The accumulation unit is used for accumulating the operation result of the modulo addition unit until the current polynomial multiplication matrix dimension is accumulated to output the accumulated result.

[0020] Further, the PE multiplication unit is composed of a lookup table and a flip-flop.

[0021] Preferably, the multi-parallel degree is 8 parallel degree.

[0022] Preferably, the lightweight and efficient encryption / decryption coprocessor based on the RLWE assumption further comprises a data storage module for storing the key vector and the public key vector.

[0023] Preferably, the data storage module stores the key vector in a format of four data in a group.

[0024] Preferably, the lightweight and efficient encryption / decryption coprocessor based on the RLWE assumption further comprises a ciphertext storage for storing the ciphertext polynomial obtained by the first modular addition module.

[0025] The present application provides a lightweight and efficient encryption / decryption method based on the RLWE assumption, based on the encryption / decryption coprocessor as described above, comprising:

[0026] The key vector is obtained by sampling through a CDT Gaussian sampler, and the public key vector is generated offline; the plaintext vector is obtained by encoding through an encoder;

[0027] The public key vector and the key vector are imported into the first polynomial multiplication module in a fixed order, and Schoolbook polynomial multiplication is performed in a multi-parallel manner to obtain a first polynomial multiplication result;

[0028] The first polynomial multiplication result is subjected to modular addition operation with the plaintext polynomial to obtain a ciphertext polynomial;

[0029] The ciphertext polynomial is imported into the second polynomial multiplication module with an external input secret vector, and Schoolbook polynomial multiplication is performed in a multi-parallel manner to obtain a second polynomial multiplication result;

[0030] The second polynomial multiplication result is subjected to modular addition operation with the ciphertext polynomial to obtain a decrypted plaintext polynomial, and the final plaintext result is output after decoding.

[0031] Preferably, the multi-parallel degree is 8 parallel degree, and the Schoolbook polynomial multiplication is performed in a multi-parallel manner, specifically comprising:

[0032] public key vector key vector polynomial multiplication result n is the polynomial dimension;

[0033] The Schoolbook polynomial multiplication specifically comprises:

[0034] When i

[0035] When j

[0036] (1) In a single clock cycle, read data, including a[j], a[(j+n / 2)mod n], b[(i-j)mod n], b[(i-j+1)mod n], b[(i-j+2)mod n], b[(i-j+3)mod n]

[0037] (2) Perform 12bit*5bit multiplication operation, calculate 8 partial products, and perform modulo addition on the partial products;

[0038] (3) Accumulate the modulo addition result of the partial products;

[0039] When the inner loop ends, output eight calculation results

[0040] When the outer loop ends, all result calculations are completed.

[0041] Compared with the prior art, the present application has the following beneficial effects:

[0042] The present application develops a lightweight and efficient RLWE cryptographic coprocessor based on the Schoolbook algorithm. By improving the parallelism of the Schoolbook polynomial multiplication operation, the time complexity of the Schoolbook polynomial multiplication is greatly reduced. In addition, a CDT Gaussian sampler is used for key generation, and the redundant data in the classical CDT Gaussian sampler structure is further compressed, so that the storage resources are reduced by 22.2%, thereby significantly saving storage resources. Therefore, this cryptographic coprocessor achieves a good balance between performance and resource utilization, has high hardware efficiency, and can greatly improve resource utilization.

[0043] Further, the present application uses lookup table (LUT) and flip-flop (FF) resources to replace digital signal processing (DSP) to realize the multiplication unit, effectively saving computing resources, reducing the design area, and improving resource utilization.

[0044] Further, the data storage module stores the key vector in a format of four data groups, and saves repeated data groups. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0046] Figure 1 The overall architecture of the lightweight encryption / decryption processor constructed by the present application.

[0047] Figure 2 The hardware structure diagram of the CDT Gaussian sampler constructed according to the present application.

[0048] Figure 3 The hardware structure diagram of the polynomial multiplication module constructed according to the present application. DETAILED DESCRIPTION

[0049] The present application is described and explained more fully with reference to the following detailed description. Other advantages of the present application will be more fully appreciated by reference to the following detailed description.

[0050] It should be noted that the process equipment or devices not specifically mentioned in the following examples are all conventional equipment or devices in the art.

[0051] It should be noted that the terms "comprising" and "having" and any variations thereof are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or apparatus that comprises a list of steps or units not necessarily limited to those explicitly listed, but can include other steps or units not expressly listed or inherent to such processes, methods, products or apparatus. In addition, unless otherwise specified, the numbering of the steps of each method is only a convenient tool for identifying the steps of the method, and is not intended to limit the arrangement order of the steps of the method or to limit the scope of the application, and changes or adjustments of the relative relationship, without substantial changes in the technical content, are also considered as the scope of the application.

[0052] The algorithm 1 of the key generation, encryption and decryption of the present application is shown in Table 1 below.

[0053] Table 1 Algorithm of key generation, encryption and decryption

[0054]

[0055] In algorithm 1, the input is composed of a public key vector, a key vector sampled by CDT Gaussian and a plaintext vector. After completing the above calculation process, the decrypted plaintext vector m' is generated as the output.

[0056] In algorithm 1, the multi-bit plaintext vector m is converted into a polynomial where q is the modulus of polynomial multiplication, as shown in the formula.

[0057]

[0058] The decrypted plaintext c is converted into a plaintext vector m' by the decoder, as shown below.

[0059]

[0060] The current discrete Gaussian sampling algorithm mainly includes rejection sampling method, Bernoulli sampling method, Knuth-Yao sampling method and CDT Gaussian sampling method. The CDT Gaussian sampling method is widely favored due to its simple hardware implementation. The algorithm flow of the CDT Gaussian sampler of the present application is shown in Algorithm 2. In Algorithm 2, a 36-bit random number r is generated using a random number generator. If r satisfies formula (3), the sampling value x=k.

[0061] Freq(k-1)≤r≤Freq(k)#(3)

[0062] Table 2 Algorithm of CDT Gaussian sampler

[0063]

[0064] The lightweight and efficient encryption / decryption coprocessor architecture based on RLWE assumption realized by the present application is shown in Figure 1

[0065] The lightweight and efficient encryption / decryption coprocessor based on RLWE assumption comprises a CDT Gaussian sampler, a first polynomial multiplication module, an encoder, a first modulo addition module, a ciphertext memory, a second polynomial multiplication module, a second modulo addition module, a decoder, and a data storage module.

[0066] The CDT Gaussian sampler is used to sample the input random number according to the probability value in the pre-stored probability pre-stored table, take the sampled random number as an address, and obtain the corresponding sampling value according to the address to obtain a key vector and store it in a data storage module. The probability value is obtained by compressing N consecutive 1s in the Freq(cur) function value into one 1, and N≥4.

[0067] The encoder is used to encode the plaintext vector to obtain a plaintext polynomial.

[0068] The first polynomial multiplication module is used to perform Schoolbook polynomial multiplication operation on the public key vector and the key vector in a multi-parallel manner to obtain a first polynomial multiplication operation result.

[0069] The first modulo addition module is used to perform modulo addition operation on the plaintext polynomial and the first polynomial multiplication operation result to obtain a ciphertext polynomial and store it in the ciphertext memory.

[0070] The second polynomial multiplication module is used to perform Schoolbook polynomial multiplication operation on the ciphertext polynomial and the external input secret vector in a multi-parallel manner to obtain a second polynomial multiplication operation result.​

[0071] The second module is used for performing modulo addition operation on the ciphertext polynomial and the second polynomial multiplication operation result to obtain a decrypted plaintext polynomial.

[0072] The decoder is used for decoding the decrypted plaintext polynomial to obtain a decrypted plaintext vector.

[0073] The data storage module is used for storing the public key vector and the key vector.

[0074] The application proposes an optimized CDT Gaussian sampler structure, which saves storage resources. The original CDT Gaussian sampler needs to store 24 probability values in a probability pre-storage table, and each value contains 36 bits. This requirement may consume a large amount of storage resources on lightweight devices. In order to solve this problem, the application uses compression technology to eliminate redundant information in the probability value and improve the utilization efficiency of storage resources. When the probability value is close to 1, the function Freq(x) shows more and more 1s in the high bits, therefore, the application eliminates the redundant information in the probability value by compressing N consecutive 1s in the Freq(cur) function value into one 1 data compression method. That is, the application compresses a plurality of 1s in a group as one 1 by taking N consecutive 1s as a group. In the embodiment of the application, 4 1s are taken as a group for compression, of course, N can be selected according to the actual situation, and it is not particularly limited that N must be equal to 4.

[0075] Based on the proposed data compression method, in Figure 2 The CDT Gaussian sampler scheme of the application is given in the application, which mainly consists of the following four steps, and the specific process is shown in Algorithm 2: (1) comparing the input random number r with the probability value read from the probability pre-storage table (corresponding to Algorithm 2 line 3). (2) Different comparison results enable the DMUX and MUX selectors to change the values of the parameters max, min and cur (corresponding to Algorithm 2 lines 4-8). (3) Only when min+1==max, the data valid signal will be pulled up. (4) output the correct sampling value. Steps (2)-(4) are conventional techniques, and will not be discussed in detail here.

[0076] The CDT Gaussian sampler optimization method proposed in the application has been applied to various parameter sets, and the optimization results show that this method can save up to 27.4% of the flip-flop resources. The data recovery module in the CDT Gaussian sampler can restore the compressed probability value to its original standard bit width.

[0077] The application is based on the structure of the RLWE-based lightweight and efficient encryption / decryption coprocessor, utilizes the calculation characteristics of polynomial multiplication to realize parallel design and improve calculation efficiency. The parallel degree of the application can be set according to actual conditions. In the embodiment of the application, the parallel degree of the two polynomial multiplication modules is set to 8, and of course, other parallel degrees can also be selected according to actual conditions.

[0078] The hardware structure of the polynomial multiplication module with a parallel degree of 8 proposed in the application is shown in Figure 3

[0079] The first polynomial multiplication module and the second polynomial multiplication module described in the application each include a PE multiplication unit, a modulo addition unit and an accumulation unit.

[0080] The PE multiplication unit is used for multiplication operation.

[0081] The modulo addition unit is used for modulo addition operation on the operation result of the PE multiplication unit.

[0082] The accumulation unit is used for accumulation of the operation result of the modulo addition unit until the accumulation result is output when the accumulation reaches the current polynomial multiplication matrix dimension.

[0083] The PE multiplication unit described in the application is composed of a lookup table and a flip-flop.

[0084] In the structure realized in the application, eight parallel PE multiplication units are used to concurrently execute eight 12bit*5bit multiplications, and the time complexity is reduced from n^2 to n^2 / 8. The polynomial coefficients a(x) and b(x) are respectively stored in two data storage modules (BRAM modules) as the multiplier and the multiplicand in advance. In each cycle, eight partial product results are calculated, then simple modulo addition (modular addition) is performed in the modulo addition unit, and then input into eight accumulation units. After all iterations are completed, eight coefficients of the polynomial c(x) are generated as the output.

[0085] The polynomial multiplication module structure proposed in the application is synthesized and realized on the Xilinx Kintex-7 FPGA platform. Table 3 provides detailed information about the hardware implementation results, including resource consumption, performance indicators (frequency, delay, throughput) and throughput per slice (TPS) as an indication of hardware efficiency. In order to make a fair comparison, the FPGABRAM and DSP are converted into an equivalent number of slices, so the larger the equivalent number of slices, the larger the area occupied by the structure. The delay reflects the difference in encryption and decryption speed, so the higher the delay, the slower the calculation speed. TPS is a balanced design method considering both throughput and hardware resource consumption, and a high TPS value represents a good balanced design.

[0086] Table 3 Accelerator performance comparison​

[0087]

[0088] As can be seen from Table 1, compared with the current mainstream Schoolbook polynomial multiplication accelerator, the polynomial multiplication module structure proposed in the application realizes 2.3 times performance acceleration and 2.7 times hardware efficiency of the encryption core. In addition, it also realizes 2.4 times performance acceleration and 3.2 times hardware efficiency improvement of the decryption core.

[0089] Based on the above lightweight and efficient encryption / decryption coprocessor, the lightweight and efficient encryption / decryption method based on the RLWE assumption of the application comprises:

[0090] S1, a key vector is obtained by sampling through a CDT Gaussian sampler, and a public key vector is generated offline; the public key vector and the key vector are stored in a data storage module; a plaintext vector is encoded by an encoder to obtain a plaintext polynomial;

[0091] S2, the public key vector and the key vector are imported into a first polynomial multiplication module in a fixed order, and Schoolbook polynomial multiplication operations (modular multiplication, modular addition, accumulation operation) are performed in a multi-parallel mode to obtain a first polynomial multiplication operation result;

[0092] S3, the first polynomial multiplication operation result is subjected to a modular addition operation with the plaintext polynomial, and the obtained ciphertext polynomial is stored in a ciphertext storage;

[0093] S4, the ciphertext polynomial stored in the ciphertext storage and an external input secret vector are imported into a second polynomial multiplication module, and Schoolbook polynomial multiplication operations (modular multiplication, modular addition, accumulation operation) are performed in a multi-parallel mode to obtain a second polynomial multiplication operation result;

[0094] S5, the second polynomial multiplication operation result is subjected to a modular addition operation with the ciphertext polynomial, and a decrypted plaintext polynomial is obtained and imported into a decoder, and the final plaintext result is output after decoding.

[0095] The Schoolbook polynomial multiplication operation adopted in the embodiment of the application specifically comprises:

[0096] Public key vector Key vector Polynomial multiplication operation result n is the polynomial dimension, q is the modulus of the modular operation; j is an index value, ranging from 0 to n;

[0097] S2 and S4 specifically comprise:

[0098] When i < n-4, the outer loop is executed

[0099] When j < n, the inner loop is executed

[0100] (1) In a single clock cycle, read data from the data storage module, including a[j], a[(j+n / 2)mod n], b[(i-j)mod n], b[(i-j+1)mod n], b[(i-j+2)mod n], b[(i-j+3)mod n]

[0101] (2) Perform 12bit*5bit multiplication operation, calculate 8 partial products, and perform modulo addition on the partial products;

[0102] (3) Accumulate the modulo result of the partial product;

[0103] When the inner loop ends, output eight calculation results

[0104] When the outer loop ends, all result calculations are completed.

[0105] The structure of the lightweight and efficient encryption / decryption coprocessor based on RLWE of the application utilizes the calculation characteristics of polynomial multiplication to realize parallel design, shortens the iteration period to 1 / 8, compresses the memory resources of the CDT Gaussian sampler, and effectively balances the performance and resource utilization. The structure proposed in the application is superior to other structures in terms of performance and efficiency indicators.

Claims

1. A lightweight and efficient encryption / decryption co-processor based on the RLWE assumption, characterized in that, The encryption / decryption coprocessor comprises: a CDT Gaussian sampler, a first polynomial multiplication module, an encoder, a first modulo addition module, a second polynomial multiplication module, a decoder and a second modulo addition module; the CDT Gaussian sampler is used for sampling an input random number according to a probability value in a pre-stored probability pre-storage table to obtain a key vector, wherein the probability value is obtained by compressing N continuous 1s in a Freq(cur) function value into one 1; the encoder is used for encoding a plaintext vector to obtain a plaintext polynomial; the first polynomial multiplication module is used for performing Schoolbook polynomial multiplication operation on the public key vector and the key vector in a multi-parallel mode to obtain a first polynomial multiplication operation result; the first modulo addition module is used for performing modulo addition operation on the plaintext polynomial and the first polynomial multiplication operation result to obtain a ciphertext polynomial; the second polynomial multiplication module is used for performing Schoolbook polynomial multiplication operation on the ciphertext polynomial and an externally input secret vector in a multi-parallel mode to obtain a second polynomial multiplication operation result; the second modulo addition module is used for performing modulo addition operation on the ciphertext polynomial and the second polynomial multiplication operation result to obtain a decrypted plaintext polynomial; the decoder is used for decoding the decrypted plaintext polynomial to obtain a decrypted plaintext vector.

2. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 1, wherein, N≥4。 3. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 1, wherein, The first polynomial multiplication module and the second polynomial multiplication module each comprise a PE multiplication unit, a modulo addition unit and an accumulation unit; the PE multiplication unit is used for performing multiplication operation; the modulo addition unit is used for performing modulo addition operation on an operation result of the PE multiplication unit; the accumulation unit is used for accumulating an operation result of the modulo addition unit until the accumulation reaches the current polynomial multiplication matrix dimension, and then outputting the accumulation result.

4. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 3, wherein, The PE multiplication unit is composed of a lookup table and a flip-flop.

5. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 1, wherein, The multi-parallel degree is 8 parallel degree.

6. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 1, wherein, The encryption / decryption coprocessor further comprises a data storage module, which is used for storing the key vector and the public key vector.

7. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 6, wherein, The data storage module stores the key vector in a format of four data in a group.

8. The RLWE assumption based lightweight and efficient encryption / decryption co-processor according to claim 1, wherein, The encryption / decryption coprocessor further comprises a ciphertext storage, and the ciphertext polynomial obtained by the first modulo addition module is stored in the ciphertext storage.

9. A lightweight and efficient encryption / decryption method based on the RLWE assumption, characterized by, The encryption / decryption coprocessor according to any one of claims 1-8 comprises: a key vector is obtained by sampling through a CDT Gaussian sampler, and a public key vector is generated offline; a plaintext vector is encoded by an encoder to obtain a plaintext polynomial; the public key vector and the key vector are introduced into a first polynomial multiplication module in a fixed order, and Schoolbook polynomial multiplication operation is performed in a multi-parallel mode to obtain a first polynomial multiplication operation result; the first polynomial multiplication operation result is subjected to modulo addition operation with the plaintext polynomial to obtain a ciphertext polynomial; the ciphertext polynomial is introduced into a second polynomial multiplication module with an externally input secret vector, and Schoolbook polynomial multiplication operation is performed in a multi-parallel mode to obtain a second polynomial multiplication operation result; and The second polynomial multiplication operation result is subjected to a modulo addition operation with the ciphertext polynomial to obtain a decrypted plaintext polynomial, and the final plaintext result is output after decoding. 10.The RLWE assumption based lightweight and efficient encryption / decryption method according to claim 9, wherein, The Schoolbook polynomial multiplication operation adopts a multi-parallelism mode, and specifically includes: Public key vector Key vector Polynomial multiplication operation result n is a polynomial dimension; The Schoolbook polynomial multiplication operation specifically includes: When i < n-4, the outer loop is executed When j < n, the inner loop is executed (1) In a single clock cycle, data is read, including a[j], a[(j+n / 2)mod n], b[(i-j)mod n], b[(i-j+1)mod n], b[(i-j+2)mod n], and b[(i-j+3)mod n] (2) 12bit*5bit multiplication operation is performed to calculate eight partial products, and the partial products are subjected to modulo addition; (3) The modulo addition results of the partial products are accumulated; When the inner loop ends, eight calculation results are output When the outer loop ends, all result calculations are completed.

Images