A Lattice Cipher Modular Multiplier Based on Parallel K-RED Modular Reduction Algorithm

Abstract

The invention discloses a lattice cipher modular multiplier based on a parallel K-RED modular reduction algorithm, comprising a first-level pipeline module, a second-level pipeline module, a third-level pipeline module and a correction module; the first-level pipeline module divides an input x into high 11 bits and low 12 bits, respectively multiplying them with a 23-bit input y, and correspondingly obtaining c and d; the second-level pipeline module applies the K-RED algorithm to the results c and d respectively, and calculates an intermediate result t; the third-level pipeline module applies the K-RED algorithm to t again to obtain a reduction result r; the correction module corrects the reduction result r to obtain a 23-bit modular multiplication output result ranging from 0 to the modulus q. The invention uses two DSP units in parallel to process data, effectively shortens the critical path, and can quickly and efficiently complete the modular multiplication operation in the lattice cipher digital signature scheme.

Description

Technical Field

[0001] The invention relates to the technical field of hardware security, and in particular to a lattice cipher module multiplier based on a parallel K-RED module reduction algorithm. Background Art

[0002] With the rapid development of science and technology, in the context of a highly information-based era, the issue of information security has become extremely important. At the same time, human society is becoming more and more dependent on smart devices. Whether it is small terminal devices such as mobile phones and tablets in daily life, or large server terminals in specific scenarios such as supercomputers and satellite equipment, various encryption technologies are used to ensure reliability and security. Traditional encryption schemes are still prevalent in important scenarios such as information transmission, data storage, and digital signatures. These encryption schemes rely on complex mathematical problems that are difficult to solve. However, with the rapid development of quantum computing technology, quantum computers combined with the quantum algorithm proposed by Shor as early as 1994 can solve traditional cryptographic systems based on complex mathematical problems such as large number problems and elliptic curves in a short period of time, which greatly reduces the security of such public key cryptographic systems. At the same time, the security of applications that rely on these systems is also greatly reduced, which poses a serious security threat to traditional cryptographic systems. In this case, studying post-quantum cryptographic technology that can effectively resist quantum computer attacks has become a major research focus in the field of cryptography.

[0003] In order to avoid potential vulnerabilities and security threats in the current cryptographic system, the National Institute of Standards and Technology of the United States began the standardization selection of post-quantum cryptography in 2016. After four rounds of evaluation, the Crystals-Dilithium post-quantum digital signature algorithm became one of the four standardized post-quantum cryptography in July 2022. In the Dilithium algorithm, NTT ring polynomial multiplication is the module with the highest resource consumption, and modular multiplication is an important core unit based on polynomial multiplication that requires intensive calculations. The core step of modular multiplication is modular reduction, which is to reduce the result of multiplying two numbers to obtain a value within the required modulus range.

[0004] The modular reduction methods commonly used in existing modular multiplication techniques include Barrett algorithm, Montgomery algorithm, Karatsuba algorithm and K 2-RED algorithm. Barrett algorithm converts the operation of modulus q into shift addition to reduce the modulus, which has high computational complexity. Montgomery algorithm converts the input integer into "Montgomery form", and then needs to convert the result from Montgomery form back to normal expression form. It is suitable for application scenarios that require a large number of continuous modular multiplications, but is not suitable for hardware implementation. Karatsuba algorithm can effectively reduce the critical path through the idea of ​​divide and conquer, but it consumes a lot of resources. K 2 Compared with other reduction algorithms, the -RED algorithm is easier to implement and consumes less hardware resources. The additional parameter k introduced by the K-RED incomplete modular reduction algorithm twice in a row can also be eliminated by pre-calculating the rotation factors in the lattice cryptographic algorithm without the need for additional hardware resource consumption.

[0005] In the hardware implementation of the Dilithium digital signature algorithm, the multiplication calculation for 23×23-bit coefficients is performed using a DSP unit. However, a DSP unit can process a maximum of 25×18-bit coefficient calculations at a time. When directly calculating the multiplication of 23×23-bit coefficients, the system defaults to using two DSP units in series to calculate in order to accommodate the increased number of bits. Therefore, the second DSP unit has to wait for the previous DSP unit to finish calculating. This sequential data processing method reduces the speed of the multiplication unit calculation. Existing modular multiplication technology often directly multiplies 23×23-bit coefficients in multiplication calculations, and the calculation speed is relatively low. How to make full use of the performance of the DSP unit and design circuits for parallel processing of multiplication unit data is of great significance to improving the performance of Dilithium modular multiplication. Summary of the invention

[0006] The purpose of the present invention is to provide a lattice cryptographic modular multiplier based on a parallel K-RED modular reduction algorithm, which makes full use of the performance of the DSP unit and uses two DSP units in parallel to execute the 23×23-bit coefficient multiplication in the Dilithium post-quantum digital signature algorithm, thereby reducing the waiting time of one DSP unit, effectively shortening the critical path, and quickly and efficiently completing the modular multiplication operation in the lattice cryptographic digital signature scheme.

[0007] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0008] A lattice cipher module multiplier based on a parallel K-RED module reduction algorithm, the lattice cipher module multiplier comprising a first-stage pipeline module, a second-stage pipeline module, a third-stage pipeline module and a correction module;

[0009] The first-stage pipeline module divides the input 23-bit modular multiplier x into the upper 11 bits x[22:12] and the lower 12 bits x[11:0], and multiplies them with the input 23-bit modular multiplier y to be input, and obtains c[33:0] and d[34:0] accordingly;

[0010] The second-stage pipeline module uses the K-RED algorithm to process c[33:0] and d[34:0] output by the first-stage pipeline module to obtain the signed number and :

[0011]

[0012]

[0013] Will Shift left 12 bits and add Calculate the intermediate result t: ;

[0014] The third-stage pipeline module processes t using the K-RED algorithm to obtain the reduced result r: ;

[0015] The correction module corrects the reduction result r to obtain a 23-bit modular multiplication output result res in the range of 0 to the modulus q: .

[0016] Further, the first pipeline module includes a first multiplier, a second multiplier, a first register and a second register;

[0017] The two input ports of the first multiplier are respectively used to receive the upper 11 bits of the to-be-modulated multiplier x and the to-be-modulated multiplier y, and the output port is connected to the input port of the first register to store the multiplication result in the first register;

[0018] The two input ports of the second multiplier are respectively used to receive the lower 12 bits of the modular multiplier x and the modular multiplier y, and the output port is connected to the input port of the second register to store the multiplication result in the second register.

[0019] Further, the second-stage pipeline module includes a first shifter, a first subtractor, a second subtractor, a second shifter, a third shifter, a third subtractor, a fourth subtractor, a first adder and a third register;

[0020] The input port of the first shifter is connected to the low-order output port of the first register, and is used to shift the low 13 bits c[12:0] of the data in the first register to the left by 10 bits; the two input ports of the first subtracter are respectively connected to the output port of the first shifter and the low-order output port of the first register, and are used to receive the data output by the first shifter and the low 13 bits c[12:0] of the data in the first register, and perform a subtraction operation; the two input ports of the second subtracter are respectively connected to the output port of the first subtracter and the high-order output port of the first register, and are used to receive the output data of the first subtracter and the high 21 bits c[33:13] of the data in the first register, and perform a subtraction operation; the output port of the second subtractor is connected to the input end of the second shifter, and the second shifter is used to shift the output data of the second subtractor to the left by 12 bits;

[0021] The input port of the third shifter is connected to the low-order output port of the second register, and is used to shift the low-order 13 bits d[12:0] of the data in the second register to the left by 10 bits; the two input ports of the third subtractor are respectively connected to the output port of the third shifter and the low-order output port of the second register, and are used to receive the data output by the third shifter and the low-order 13 bits d[12:0] of the data in the second register, and perform a subtraction operation; the two input ports of the fourth subtractor are respectively connected to the output port of the third subtractor and the high-order output port of the second register, and are used to receive the output data of the third subtractor and the high-order 20 bits d[34:13] of the data in the second register, and perform a subtraction operation;

[0022] The two input ports of the first adder are respectively connected to the output port of the second shifter and the output port of the fourth subtractor, and the output port is connected to the input port of the third register, so that the addition result is stored in the third register.

[0023] Further, the third-stage pipeline module includes a fourth shifter, a fifth subtractor, a sixth subtractor and a fourth register;

[0024] The fourth shifter is connected to the low-order output port of the second-stage pipeline module, and is used to shift the low 13 bits t[12:0] of the intermediate result t output by the second-stage pipeline module left by 10 bits; the two input ports of the fifth subtractor are respectively connected to the output port of the fourth shifter and the low-order output port of the second-stage pipeline module, and are used to receive the data of the fourth shifter and the low 13 bits t[12:0] of the intermediate result t, and perform a subtraction operation; the two input ports of the sixth subtractor are respectively connected to the output port of the fifth subtractor and the high-order output port of the second-stage pipeline module, and the output port is connected to the input port of the fourth register, and is used to receive the subtraction result of the fifth subtractor and the high 24 bits t[36:13] of the intermediate result t, and perform a subtraction operation, and store the calculated reduction result r in the fourth register.

[0025] Further, the correction module includes a second adder and a two-to-one multiplexer;

[0026] The two input ports of the second adder are respectively connected to the output port of the third-stage pipeline module and the input end of the modulus q, so as to receive the modulus q and the reduction result r output by the third-stage pipeline module, and perform a summation operation;

[0027] The two input ports of the two-to-one multiplexer are respectively connected to the output port of the third-stage pipeline module and the output port of the second adder, and output the modular multiplication result res of the two data to be modularly multiplied and the modulus q.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] The lattice cipher modular multiplier based on the parallel K-RED modular reduction algorithm of the present invention optimizes the design of the traditional K-RED algorithm, fully utilizes the performance of the DSP unit, uses two DSP units in parallel to process data, reduces the waiting time of one DSP unit, effectively shortens the critical path, and can quickly and efficiently complete the modular multiplication operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a pseudo code diagram of the traditional incomplete modular reduction algorithm based on the K-RED algorithm;

[0031] Figure 2 It is a pseudo code schematic diagram of the parallel K-RED modular reduction algorithm proposed in the present invention;

[0032] Figure 3 The present invention is a schematic diagram of the circuit structure of a lattice cipher modular multiplier based on a parallel K-RED modular reduction algorithm. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0034] The present invention discloses a lattice cipher module multiplier based on a parallel K-RED module reduction algorithm, wherein the lattice cipher module multiplier comprises a first-stage pipeline module, a second-stage pipeline module, a third-stage pipeline module and a correction module;

[0035] The first-stage pipeline module divides the input 23-bit modular multiplier x into the upper 11 bits x[22:12] and the lower 12 bits x[11:0], and multiplies them with the input 23-bit modular multiplier y to be input, and obtains c[33:0] and d[34:0] accordingly;

[0036] The second-stage pipeline module uses the K-RED algorithm to process c[33:0] and d[34:0] output by the first-stage pipeline module to obtain the signed number and :

[0037] ;

[0038] ;

[0039] Will Shift left 12 bits and add Calculate the intermediate result t: ;

[0040] The third-stage pipeline module processes t using the K-RED algorithm to obtain the reduced result r: ;

[0041] The correction module corrects the reduction result r to obtain a 23-bit modular multiplication output result res in the range of 0 to the modulus q: .

[0042] like Figure 1 The figure shows a pseudo code diagram of a traditional modular reduction operation method based on the K-RED algorithm.

[0043] The traditional modular reduction operation method based on the K-RED algorithm is an incomplete modular reduction algorithm. The modulus q in the lattice cryptographic algorithm can be written as A special form of , for two numbers x and y in the range 0 to q, their product is a number t = (d1, d0) with a bit width of w, by using The property transformation can be obtained:

[0044]

[0045] Where d0 is the lower m bits of t, and d1 is the upper wm bits of t. Since the final return value of the K-RED algorithm needs to be multiplied by k, the parameter k needs to be eliminated when using this algorithm. In the Dilithium post-quantum digital signature algorithm, the 23-bit modulus q=8380417, so the parameters k=1023 and m=13.

[0046] In Dilithium's modular multiplication unit, the 46-bit multiplication result of two 23-bit input data needs to be reduced to 23 bits. Because the K-RED algorithm is an incomplete modular reduction algorithm, the 46-bit result cannot be directly reduced to 23 bits. It is often necessary to use the K-RED algorithm twice in succession to get the correct result in the range of 0 to q, that is, K 2 -RED algorithm. When implementing the modular multiplier in hardware, the multiplication calculation for 23×23-bit coefficients is performed using a DSP unit. However, a DSP unit can process a maximum of 25×18-bit coefficient calculations at a time. When directly calculating the 23×23-bit coefficient multiplication, two DSP units in series are required to accommodate the increased number of bits. Therefore, the second DSP unit has to wait for the previous DSP unit to finish calculating. This sequential data processing method reduces the speed of the multiplication unit calculation.

[0047] Therefore, in order to make full use of the performance of the DSP unit, shorten the critical path, and speed up the operation, the present invention designs a parallel K 2 -RED modular reduction algorithm to process the data.

[0048] The pseudo code of the parallel K-RED modular reduction algorithm proposed in the present invention is as follows: Figure 2 shown.

[0049] The input 23-bit number x is divided into the upper 11 bits x[22:12] and the lower 12 bits x[11:0], and the upper and lower bits are multiplied with the input 23-bit number y to obtain c[33:0] and d[34:0] respectively. Because the intermediate process involves negative numbers, signed numbers are introduced, and the K-RED algorithm is used to reduce the bit width of c and d respectively to obtain signed numbers t0 and t1:

[0050] ;

[0051] ;

[0052] Shift t0 left by 12 bits and add it to t1 to get the intermediate result t: , and then apply the K-RED algorithm to t to get the reduced result r:

[0053] ;

[0054] Finally, the reduction result r is corrected to obtain a 23-bit modular multiplication output result res in the range of 0 to q: The additional parameter k introduced in the K-RED algorithm can be eliminated by preprocessing the rotation factors in the Dilithium algorithm without the need for additional hardware resource consumption.

[0055] Figure 3 The schematic diagram of the circuit structure of the lattice cipher modular multiplier based on the parallel K-RED modular reduction algorithm of the present invention specifically includes: two two-input multipliers, two two-input adders, six two-input subtractors, a two-to-one multiplexer and four registers. The total input of the modular multiplier is two 23-bit modular multiplication data x and y and the modulus q=8380417, and the total output is a 23-bit modular multiplication calculation result res. The entire modular multiplier circuit is divided into a three-stage pipeline.

[0056] In the first-stage pipeline module, the two input ports of multiplier 1 are used to receive the upper 11 bits of the modular multiplier x and the modular multiplier y, and the output port stores the multiplication result in register 1. The two input ports of multiplier 2 are used to receive the lower 12 bits of the modular multiplier x and the modular multiplier y, and the output port stores the multiplication result in register 2.

[0057] In the second-stage pipeline module, the two input ports of subtractor 1 are used to receive the data of shifter 1 and the lower 13 bits of the data in register 1. The two input ports of subtractor 2 are used to receive the output data of subtractor 1 and the upper 21 bits of the data in register 1. The output port of subtractor 2 is connected to shifter 2. The two input ports of subtractor 3 are used to receive the data of shifter 3 and the lower 13 bits of the data in register 2. The two input ports of subtractor 4 are used to receive the output data of subtractor 3 and the upper 20 bits of the data in register 2. The two input ports of adder 1 are used to receive the data of shifter 2 and the output data of subtractor 4, and the output port stores the result in register 3.

[0058] In the third-stage pipeline module, the two input ports of subtractor 5 are used to receive the data of shifter 4 and the lower 13 bits of the data in register 3. The two input ports of subtractor 6 are used to receive the output data of subtractor 5 and the upper 24 bits of the data in register 3, and the output port stores the result in register 4.

[0059] In the correction module, the two input ports of adder 2 are respectively used to receive the data in register 4 and the modulus q, the two input ports of the two-to-one multiplexer are respectively used to receive the data in register 4 and the output result of adder 2, and the output port of the two-to-one multiplexer is used to output the multiplication result res of the two data to be multiplied and the modulus q.

[0060] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present application may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0061] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0062] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0063] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0064] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0065] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A lattice cipher modular multiplier based on a parallel K-RED modular reduction algorithm, characterized in that: The lattice code module multiplier includes a first-stage pipeline module, a second-stage pipeline module, a third-stage pipeline module and a correction module; The first-stage pipeline module divides the input 23-bit modular multiplier x into the upper 11 bits x[22:12] and the lower 12 bits x[11:0], and multiplies them with the input 23-bit modular multiplier y to be input, and obtains c[33:0] and d[34:0] accordingly; The second-stage pipeline module uses the K-RED algorithm to process c[33:0] and d[34:0] output by the first-stage pipeline module to obtain signed numbers t0 and t1: t0=(2 10 -1)c[12:0]-c[33:13] t1=(2 10 -1)d[12:0]-d[34:13] Shift t0 left by 12 bits and add it to t1 to calculate the intermediate result t: t=t0<<12+t1; The third-stage pipeline module uses the K-RED algorithm to process t and obtains the reduction result r: r = (2 10 -1)t[12:0]-t[36:13]; The correction module corrects the reduction result r to obtain a 23-bit modular multiplication output result res in the range of 0 to the modulus q: res=(r>0)? r:(r+q); The first-stage pipeline module includes a first multiplier, a second multiplier, a first register and a second register; The two input ports of the first multiplier are respectively used to receive the upper 11 bits of the to-be-modulated multiplier x and the to-be-modulated multiplier y, and the output port is connected to the input port of the first register to store the multiplication result in the first register; The two input ports of the second multiplier are respectively used to receive the lower 12 bits of the modular multiplier x and the modular multiplier y, and the output port is connected to the input port of the second register to store the multiplication result in the second register; The second-stage pipeline module includes a first shifter, a first subtractor, a second subtractor, a second shifter, a third shifter, a third subtractor, a fourth subtractor, a first adder and a third register; The input port of the first shifter is connected to the low-order output port of the first register, and is used to shift the low 13 bits c[12:0] of the data in the first register to the left by 10 bits; the two input ports of the first subtracter are respectively connected to the output port of the first shifter and the low-order output port of the first register, and are used to receive the data output by the first shifter and the low 13 bits c[12:0] of the data in the first register, and perform a subtraction operation; the two input ports of the second subtracter are respectively connected to the output port of the first subtracter and the high-order output port of the first register, and are used to receive the output data of the first subtracter and the high 21 bits c[33:13] of the data in the first register, and perform a subtraction operation; the output port of the second subtractor is connected to the input end of the second shifter, and the second shifter is used to shift the output data of the second subtractor to the left by 12 bits; The input port of the third shifter is connected to the low-order output port of the second register, and is used to shift the low-order 13 bits d[12:0] of the data in the second register to the left by 10 bits; the two input ports of the third subtractor are respectively connected to the output port of the third shifter and the low-order output port of the second register, and are used to receive the data output by the third shifter and the low-order 13 bits d[12:0] of the data in the second register, and perform a subtraction operation; the two input ports of the fourth subtractor are respectively connected to the output port of the third subtractor and the high-order output port of the second register, and are used to receive the output data of the third subtractor and the high-order 20 bits d[34:13] of the data in the second register, and perform a subtraction operation; The two input ports of the first adder are respectively connected to the output port of the second shifter and the output port of the fourth subtractor, and the output port is connected to the input port of the third register, and the addition result is stored in the third register; The third-stage pipeline module includes a fourth shifter, a fifth subtractor, a sixth subtractor and a fourth register; The fourth shifter is connected to the low-order output port of the second-stage pipeline module, and is used to shift the low 13 bits t[12:0] of the intermediate result t output by the second-stage pipeline module left by 10 bits; the two input ports of the fifth subtractor are respectively connected to the output port of the fourth shifter and the low-order output port of the second-stage pipeline module, and are used to receive the data of the fourth shifter and the low 13 bits t[12:0] of the intermediate result t, and perform a subtraction operation; the two input ports of the sixth subtractor are respectively connected to the output port of the fifth subtractor and the high-order output port of the second-stage pipeline module, and the output port is connected to the input port of the fourth register, and is used to receive the subtraction result of the fifth subtractor and the high 24 bits t[36:13] of the intermediate result t, and perform a subtraction operation, and store the calculated reduction result r in the fourth register.

2. The lattice cipher modular multiplier based on the parallel K-RED modular reduction algorithm according to claim 1, characterized in that: The correction module includes a second adder and a two-to-one multiplexer; The two input ports of the second adder are respectively connected to the output port of the third-stage pipeline module and the input end of the modulus q, so as to receive the modulus q and the reduction result r output by the third-stage pipeline module, and perform a summation operation; The two input ports of the two-to-one multiplexer are respectively connected to the output port of the third-stage pipeline module and the output port of the second adder, and output the modular multiplication result res of the two data to be modularly multiplied and the modulus q.

Images