A high performance polynomial multiplication hardware acceleration architecture for lattice cryptography chips

Abstract

The application is a high-performance polynomial multiplication hardware acceleration architecture for lattice cipher chips. The application relates to the technical field of encryption calculation, and designs a lightweight polynomial hardware acceleration architecture, which can support NTT, INTT, point multiplication and other operations in polynomial multiplication under different bases. The core unit is a lightweight butterfly unit composed of four groups of small butterfly structures. Different scheduling modes are designed for various operations in polynomial multiplication. Finally, according to the polynomial multiplication module designed by the application, a corresponding conflict-free memory mapping scheme and data storage scheme are proposed. The scheme simplifies the read-write control of the stored data, and solves the problems of too complex address conversion and data conflict caused by a large amount of data interaction in the polynomial operation process.

Description

Technical Field

[0001] This invention relates to the field of cryptographic computing technology, and is a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips. Background Technology

[0002] Cryptographic algorithms, as the cornerstone of information security, determine the authenticity and validity of information based on their security and reliability. In reality, symmetric encryption algorithms are used in data encryption, while public-key cryptography algorithms are often used in digital signatures; together, they constitute the existing cryptographic algorithm system. However, the rapid development of quantum decryption algorithms such as Shor and Grover in recent years has brought a huge security challenge to the existing cryptographic system. Quantum computers use the 0s and 1s of qubits to replace the bits of traditional computers, achieving efficient parallel computation by sharing states with other spatially independent qubits. Most existing public-key cryptographic algorithms, such as RSA, can be broken by sufficiently large and stable quantum computers. Faced with this challenge, a new field of cryptographic research—post-quantum cryptography (PQC)—has emerged, primarily studying cryptographic algorithm schemes that can resist quantum computing attacks and execute on classical computers.

[0003] In 2016, the National Institute of Standards and Technology (NIST) solicited post-quantum public-key cryptography algorithms from scholars worldwide and developed cryptographic algorithm standards to resist quantum computing attacks. Among these, CRYSTALS-KYBER, CRYSTALS-Dilithium, and FALCON, three lattice-based post-quantum cryptographic algorithms, have been standardized. In 2020, the lattice-based cryptographic algorithms LAC and Aigis won first prize in the National Cryptographic Design Competition announced by the Chinese Association for Cryptologic Research. Lattice-based cryptosystems are often built upon unsolved lattice-based difficult problems such as Learning with Errors (LWE), Ring Learning with Errors (RLWE), and Module Learning with Errors (MLWE). These NP-hard problems in lattices often lack corresponding quantum algorithms that can compute them quickly, which ensures the security of lattice-based post-quantum cryptographic algorithms.

[0004] In the encryption and decryption process of the algorithm, the core operation of the key part is: ,in, , and It is a polynomial vector. Given a polynomial matrix. The most time-consuming part of the entire calculation is polynomial vector multiplication, with the traditional polynomial multiplication having a complexity of O(n log n). In lattice-based post-quantum cryptography algorithms, The value of is above 256, leading to excessively high complexity in polynomial multiplication. Furthermore, polynomial multiplication accounts for over 50% of the implementation time in lattice-based post-quantum cryptography algorithms, indicating that the computational efficiency of lattice-based post-quantum cryptography systems is fundamentally dependent on the computational efficiency of polynomial multiplication. Therefore, the design of high-performance polynomial multiplication hardware acceleration architectures is of great significance for the optimized implementation of lattice-based post-quantum cryptography algorithms.

[0005] Most polynomial multiplication in lattice cryptography algorithms is performed on polynomial rings. Current methods for polynomial multiplication include the Schoolbook algorithm, Karatsuba algorithm, Toom-Cook algorithm, and Number Theoretic Transform (NTT) algorithm. Among these, the Schoolbook algorithm is a classic polynomial multiplication method that multiplies coefficients pairwise in factorization form and then adds coefficients of the same degree to obtain the result. Its time complexity is O(n log n). The Karatsuba algorithm splits a large integer into two smaller bits and reduces its time complexity from [original value missing] to [new value missing] through three multiplications, a few additions, and shift operations. Reduce to However, it is only suitable for multiplying two large integers and not for polynomial multiplication in lattices. The Toom-Cook algorithm follows the divide-and-conquer approach of the Karatsuba algorithm, splitting large integers into multiple parts, typically three or four, and then converting them into multiple multiplicative operations. However, it is also only suitable for multiplying two large integers. The NTT fast algorithm is an algorithm that migrates the Fast Fourier Transform (FFT) algorithm from the complex domain to the integer domain, reducing the complexity of polynomial multiplication from... Reduce to This is well-suited for lattice cryptography algorithms based on the LWE problem. However, the NTT fast algorithm requires the lattice cryptography algorithm to use a specific modulus, such as... This form makes it impossible for lattice ciphers such as the Saber algorithm and the NTRU (Number Theory Research Unit) algorithm to use NTT fast multiplication.

[0006] Compared to software implementations, lattice cryptography algorithms offer significant advantages in resource consumption, security, power consumption, and speed when implemented in hardware. They can be applied to both traditional high-performance devices and resource-constrained IoT terminal devices. Current hardware research primarily focuses on overall architecture design, core computing module design, and modular arithmetic design. Overall architecture design often targets one or more specific lattice cryptography algorithms, achieving hardware-level acceleration through instruction set architectures such as RISC-V. Core computing modules can be further divided into hash function modules, polynomial sampling modules, polynomial computation modules, and encryption / decryption modules. Polynomial multiplication computation is more time-consuming and incompatible with existing instruction set architectures; therefore, research on optimizing the polynomial computation module accounts for the largest share. At the current hardware implementation level, the main design metrics are high performance, high energy efficiency, low power consumption, and reconfigurability.

[0007] Chen et al. proposed a polynomial multiplication module design scheme that avoids the bit-flipping overhead of NTT / INTT with arbitrary bases by rearranging the loop structure in the NTT algorithm and reusing the twiddle factor. However, this scheme suffers from slow computation speed and narrow applicability. In lattice cryptographic chips, the advantages of this scheme cannot be highlighted, and it is difficult to achieve speed matching with peripheral hardware devices.

[0008] Therefore, how to provide a low-resource-consumption, high-performance polynomial multiplication hardware architecture for use in lattice cryptography chips has become an urgent problem for researchers in this field. Summary of the Invention

[0009] To address the shortcomings of existing technologies and solve the aforementioned problems, this invention proposes a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips. This invention aims to improve the overall performance of polynomial multipliers and reduce hardware resource consumption.

[0010] This invention provides a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips, and the invention provides the following technical solutions: The architecture adopts a radix-2 & radix-4 hybrid NTT hardware module, which is a hardware implementation of the radix-2 & radix-4 hybrid NTT algorithm, including a control logic unit and an arithmetic logic unit. The control logic module includes a control unit, which controls the address generator to generate data addresses, the memory mapping unit to generate data write-back addresses, the butterfly unit to operate and input data, and the scheduling of the rotation factor through control signals. The arithmetic logic unit adopts a butterfly unit module, which includes modular addition, modular subtraction, modular multiplication, memory, and multiplexer.

[0011] Preferably, the radix-2 & radix-4 hybrid NTT hardware module needs to perform NTT operations, dot multiplication, INTT operations, and addition and subtraction operations on polynomial vectors; The NTT operation transforms a polynomial vector from a coefficient polynomial into a point-valued polynomial, while the INTT operation is the exact opposite. The dot product operation is the multiplication of two point-valued polynomial vectors, and the addition and subtraction operations are the addition and subtraction of two polynomial vectors.

[0012] Preferably, the butterfly unit is the core of the polynomial multiplication module architecture, which consists of four small butterfly units (BFUs), denoted as BFU0, BFU1, BFU2 and BFU3 respectively. Each BFU requires 6 clock cycles from input to output, and a different number of registers are inserted in each BFU.

[0013] Preferably, BFU0 and BFU3 are designed with a rotation factor module, and the butterfly unit supports polynomial vector radix-2 and radix-4-NTT algorithms as well as dot product operations.

[0014] Preferably, the randomly input polynomial coefficients and the twitch factors corresponding to the Kyber algorithm are placed into a Bank according to the corresponding rules for storage. The memory includes 4 Banks responsible for storage. The coefficients of the term polynomial vector are stored in each bank. The coefficients are generated by the address generator and the arbitration unit to produce four polynomial coefficients that participate in the butterfly unit operation. The four results of the butterfly operation will also be written back to the four banks through the data write-back unit.

[0015] Preferably, the address generator includes a coefficient base address generator, a memory mapping unit, and an arbitration unit. The coefficient base address generator generates four sets of base address signals for reading which coefficient under this clock cycle through the iterative loop signals p, k, and j of the state machine. The memory mapping unit maps the four sets of base address signals into read address signals and write address signals for the coefficients. The arbitration unit, together with the data reading unit, determines the order in which the four coefficients taken from the Bank are input into the butterfly unit based on the Bank index signal in the read address signal.

[0016] Preferably, the rotation factor module is divided into a rotation factor address generation module and a storage module. The rotation factor address generator is controlled by the control unit. When the polynomial multiplication module performs NTT, INTT, and PWM operations, it generates the address of the rotation factor. The rotation factor storage module ROM provides the corresponding primitive root of unity based on the address of the rotation factor, which participates in the modular multiplication operation in the butterfly unit and the point-by-point multiplication operation in Kyber.

[0017] Preferably, the control unit mainly consists of a state machine, which is programmed in a two-stage manner, allowing transitions between different states via signals. The control unit performs various computational operations through multiple states within the state machine and the transitions between states, thus completing a full polynomial multiplication.

[0018] The present invention has the following beneficial effects: Compared with the prior art, the present invention: This invention eliminates the preprocessing and postprocessing operations in NTT by changing the loop order and enables the reuse of rotation factors in NTT and INTT, allowing the Kyber public-key encryption algorithm and other lattice cryptography algorithms to use the radix-4-NTT algorithm, achieving computational dimensionality reduction. It also solves the problems that existing radix-4-NTT algorithms cannot be applied to Kyber algorithms, while the radix-2-NTT algorithm has high computational complexity.

[0019] This invention designs a lightweight polynomial hardware acceleration architecture that supports NTT, INTT, and dot product operations under different bases in polynomial multiplication. The core unit is a lightweight butterfly unit composed of four small butterfly structures. Different scheduling modes are designed for various operations in polynomial multiplication. Finally, based on the polynomial multiplication module designed according to this invention, a corresponding conflict-free memory mapping scheme and data storage scheme are proposed. This scheme simplifies the read / write control of stored data and solves the problems of overly complex address translation and data conflicts caused by a large amount of data interaction during polynomial operations.

[0020] The hardware architecture of this invention has high module reusability. When it is necessary to adjust the type of lattice cryptography algorithm, only the port bit width and control unit of some modules need to be adjusted, without redesigning, which can reduce the hardware development cost.

[0021] The hardware architecture of this invention is highly compact, making full use of existing hardware resources to efficiently complete various operations required in the polynomial multiplication process, thereby improving computational efficiency.

[0022] This invention has high applicability and features advantages such as high computing speed, low resource consumption, and low power consumption, which can meet the performance and power consumption requirements of IoT terminal devices. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the overall polynomial hardware acceleration architecture; Figure 2 A schematic diagram of the data flow of the radix-2 & radix-4-NTT hybrid algorithm with 8 points as an example; Figure 3 This is a schematic diagram of the internal structure of the butterfly-shaped unit; Figure 4 This is a schematic diagram of the scheduling of various modes of the butterfly unit; Figure 5 This is a schematic diagram of NTT / INTT address mutual exclusion connectivity in a 256-point polynomial; Figure 6 This is a schematic diagram of the arrangement of rotation factors in the polynomial multiplication module. Detailed Implementation

[0025] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0027] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0028] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0029] The present invention will be described in detail below with reference to specific embodiments. Specific Implementation Example 1: according to Figures 1 to 6 As shown, the specific optimization technical solution adopted by the present invention to solve the above-mentioned technical problems is: The present invention relates to a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips.

[0031] A high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips, the architecture adopts a radix-2 & radix-4 hybrid NTT hardware module, which is a hardware implementation of the radix-2 & radix-4 hybrid NTT algorithm, including a control logic unit and an arithmetic logic unit. The control logic module includes a control unit, which controls the address generator to generate data addresses, the memory mapping unit to generate data write-back addresses, the butterfly unit to operate and input data, and the scheduling of the rotation factor through control signals. The arithmetic logic unit adopts a butterfly unit module, which includes modular addition, modular subtraction, modular multiplication, memory, and multiplexer.

[0032] The radix-2 & radix-4 hybrid NTT hardware module needs to perform NTT operations, dot multiplication, INTT operations, and addition and subtraction operations on polynomial vectors. The NTT operation transforms a polynomial vector from a coefficient polynomial into a point-valued polynomial, while the INTT operation is the exact opposite. The dot product operation is the multiplication of two point-valued polynomial vectors, and the addition and subtraction operations are the addition and subtraction of two polynomial vectors.

[0033] The butterfly unit is the core of the polynomial multiplication module architecture. It consists of four small butterfly units (BFUs), denoted as BFU0, BFU1, BFU2 and BFU3. Each BFU requires 6 clock cycles from input to output, and a different number of registers are inserted into each BFU.

[0034] The BFU0 and BFU3 designs include a twitch factor module, and the butterfly unit supports radix-2 and radix-4 NTT algorithms for polynomial vectors, as well as dot product operations.

[0035] The randomly input polynomial coefficients and the twitch factors corresponding to the Kyber algorithm are placed into a Bank according to the corresponding rules. The memory consists of 4 Banks responsible for storage. The coefficients of the term polynomial vector are stored in each bank. The coefficients are generated by the address generator and the arbitration unit to produce four polynomial coefficients that participate in the butterfly unit operation. The four results of the butterfly operation will also be written back to the four banks through the data write-back unit.

[0036] The address generator includes a coefficient base address generator, a memory mapping unit, and an arbitration unit. The coefficient base address generator generates four sets of base address signals for reading which coefficient under this clock cycle through the iterative loop signals p, k, and j of the state machine. The memory mapping unit maps the four sets of base address signals into read address signals and write address signals for the coefficients. The arbitration unit, together with the data read-in unit, determines the order in which the four coefficients taken from the Bank are input into the butterfly unit based on the Bank index signal in the read address signal.

[0037] The twitch factor module is divided into a twitch factor address generation module and a storage module. The twitch factor address generator is controlled by the control unit. When the polynomial multiplication module performs NTT, INTT, and PWM operations, it generates the address of the twitch factor. The twitch factor storage module ROM provides the corresponding primitive root of unity based on the address of the twitch factor, which participates in the modular multiplication operation in the butterfly unit and the point-by-point multiplication operation in Kyber.

[0038] The control unit mainly consists of a state machine, which is programmed in two stages. Transitions between different states can be made via signals. The control unit performs various computational operations through multiple states in the state machine and the transitions between states, completing a full polynomial multiplication. Specific Implementation Example 2: The difference between Embodiment 2 and Embodiment 1 of the present invention lies only in: The technical solution adopted in this invention is as follows: The hardware architecture for polynomial multipliers used in lattice cryptographic chips is mainly a radix-2 & radix-4 hybrid NTT hardware module.

[0040] The radix-2 & radix-4 hybrid NTT hardware module is a hardware implementation of the radix-2 & radix-4 hybrid NTT algorithm, and can be divided into two main categories: control logic units and arithmetic logic units. The control logic module mainly consists of control units, which control the address generator to generate data addresses, the memory mapping unit to generate data write-back addresses, the butterfly unit's operating modulus and input data, and the scheduling of the spin factor, etc., through control signals. The arithmetic logic unit mainly consists of butterfly unit modules, which are composed of modular addition, modular subtraction, modular multiplication, memory, and multiplexers.

[0041] The radix-2 & radix-4 hybrid NTT hardware module needs to perform NTT operations, dot product operations, INTT operations, and addition and subtraction operations on polynomial vectors. The NTT operation is the process of converting a polynomial vector from a coefficient polynomial to a point-valued polynomial, while the INTT operation is the exact opposite; the dot product operation is the multiplication of two point-valued polynomial vectors, and the addition and subtraction operations are the addition and subtraction of two polynomial vectors.

[0042] The randomly input polynomial coefficients and the twitch factors corresponding to the Kyber algorithm are stored in a Bank according to the corresponding rules. The coefficient storage module consists of 4 banks and is responsible for storing... The coefficients of the term polynomial vector are stored in each bank. The coefficients are generated by the address generator and the arbitration unit to produce four polynomial coefficients that participate in the butterfly unit operation. The four results of the butterfly operation will also be written back to the four banks through the data write-back unit.

[0043] The address generation module consists of a coefficient base address generator, a memory mapping unit, and an arbitration unit. The coefficient base address generator generates four sets of base address signals for reading which coefficient is being read under this clock cycle through the iterative loop signals p, k, and j of the state machine. The memory mapping unit maps the four sets of base address signals into read address signals and write address signals for the coefficients. The arbitration unit, in conjunction with the data reading unit, determines the order in which the four coefficients retrieved from the Bank are input into the butterfly unit based on the Bank index signal in the read address signal.

[0044] The butterfly arithmetic unit is the core of the polynomial multiplication module architecture. It consists of four small butterfly units (BFUs), denoted as BFU0, BFU1, BFU2, and BFU3. The designs of the four BFUs are not entirely identical, but each BFU requires six clock cycles from input to output; therefore, a different number of registers are inserted into each BFU. BFU0 and BFU3 are identical except for their twiddle factors, while BFU1 and BFU2 differ in design. The butterfly arithmetic unit supports radix-2 and radix-4 NTT algorithms for polynomial vectors, as well as dot product operations.

[0045] The twitch factor module is divided into a twitch factor address generation module and a storage module. The twitch factor address generator is controlled by the control unit. When the polynomial multiplication module performs NTT, INTT, and PWM operations, it generates the address of the twitch factor. The twitch factor storage module ROM provides the corresponding primitive root of unity based on the address of the twitch factor, which participates in the modular multiplication operation in the butterfly unit and the point-by-point multiplication operation in Kyber.

[0046] The control unit mainly consists of a state machine, which is programmed in two stages. Transitions between different states can be achieved via signals. The control unit performs various computational operations through multiple states and transitions between them, completing a full polynomial multiplication.

[0047] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0048] like Figure 1As shown, the present invention is a hardware architecture for a polynomial multiplier suitable for lattice cryptographic chips. The overall architecture is divided into a control unit and an arithmetic unit, which consists of an address generator module, a twitch factor module, a memory mapping module, a data writing module, a data output module, a butterfly unit module, etc.

[0049] The butterfly unit module is the core module, which supports radix-2-NTT / INTT algorithms, radix-4-NTT / INTT algorithms, dot multiplication, etc.

[0050] Lattice-based post-quantum cryptography algorithms perform polynomial multiplication within a polynomial ring. In this context, NTT refers to the state of a finite field. The FFT defined above replaces the root of unity in the complex field with the primitive root in the finite field. In NTT, the original root Also called rotation factor Assuming a given number of computing points for NTT. Modulus and Corresponding primary root , original root Then it satisfies the four properties of zeroness, periodicity, symmetry, and reducibility, which can be expressed as follows:

[0051] For lattice-based post-quantum cryptography algorithms, in terms of modulus Once determined, the number of operands and the original root... It will also be fixed accordingly. It has been proven that the primitive root satisfies the property of the twitch factor in FFT; for ease of representation, we use the twitch factor. express primitive root of order unit, i.e. So, regarding The NTT and INTT calculations of the term polynomial vector can be expressed as follows, where Representing vectors The Term coefficient.

[0052]

[0053] Radix-2 NTT algorithm guided by time domain Dividing the polynomial into two parts based on the odd and even terms simplifies the operation. Applying this divide-and-conquer approach to the time domain... Dividing the polynomial into four parts further simplifies the multiplication operations in the NTT algorithm. If the above expression is interpreted according to time-domain guidelines... This summation is decomposed into four core residual groups, among which Indicates the first Term coefficient, for primitive root of order unit, for A primitive root of order unit, and satisfying As shown in the following formula:

[0054] To simplify the formula and make it easier to understand, let's remember... , , , They are respectively It can be simplified to:

[0055] According to the rotation factor With respect to zeroness and reducibility, we can derive , At the same time, due to The following results can be obtained:

[0056] Once the number of terms in the NTT algorithm is... Given that the number of modulo additions and subtractions is already determined, this is similar to the NTT being guided by the time domain. Divided into Partially irrelevant. However, with the base number... Increasing the number of iteration layers can effectively reduce the number of iterations, but this will also increase the input vector of the butterfly unit. and rotation factor The increased length leads to more nontrivial multiplications within the butterfly unit. Simultaneously, a higher cardinality... It also requires more data paths and interconnections for memory mapping, increasing the complexity of the control logic. The radix-4 NTT algorithm reduces the number of iterations by half compared to the radix-2 NTT algorithm, and the coefficients and twiddle factors... The number of full multiplications is greatly reduced, and the newly added constant multiplication can be implemented through addition and shifting, which reduces resource consumption.

[0057] However, the radix-4 NTT algorithm also has some problems. For a polynomial vector of terms, the number of iterations is This requires the number of terms in the polynomial to be a power of 4. For the Kyber and Dilithium algorithms, the number of polynomial terms is 256, satisfying the radix-4 NTT algorithm requirement. However, for lattice cryptography algorithms with 512 or 2048 polynomial terms, the radix-4 NTT algorithm is not applicable. Furthermore, the Kyber algorithm, in order to obtain shorter public key and ciphertext lengths, uses a modulus... The value is set to 3329, which results in only a primitive root of unity of order 256, and no primitive root of unity of order 512. Therefore, Kyber's algorithm cannot be directly used with the ordinary NTT algorithm. In practice, Kyber's algorithm often uses a reduced KNTT algorithm to divide the 256-term polynomial vector into odd and even parts, and treats each part as an independent 128-point NTT for calculation.

[0058] Therefore, this invention employs a hybrid radix-2 & radix-4 NTT algorithm, combining the radix-2 NTT algorithm with the radix-4 NTT algorithm. This algorithm... First use the term polynomial vector The radix-4-NTT algorithm is used, followed by two parallel radix-2-NTT butterfly calculations to obtain the point-valued polynomials. The product is then obtained by performing point-by-point multiplication on the two point-valued polynomials. In INTT, the radix-2 INTT algorithm is executed once first, followed by... The 4-INTT algorithm converts back to coefficient polynomials. Taking an 8-point polynomial vector as an example, the data flow diagram of the radix-2 & radix-4-NTT hybrid algorithm is as follows: Figure 2 As shown.

[0059] The radix-2 & radix-4-NTT hybrid algorithm combines the radix-2-NTT and radix-4-NTT algorithms in the polynomial coefficients. satisfy Under the given conditions, it absorbs the advantage of converting some full modular multiplications into semi-modular multiplications in radix 4-NTT, expands the applicability of the radix 4-NTT algorithm, and effectively reduces the complexity of the NTT algorithm.

[0060] The butterfly calculation in the radix-2 & radix-4 hybrid NTT algorithm consists of two steps. The first step calculates the intermediate value, where the intermediate value... and The calculation method is basically the same as the radix 2-CT butterfly calculation method, calculated in NTT mode. Calculation in INTT mode and At this point, the rotation factor is a constant. median value and The calculation method differs from both the CT butterfly calculation and the GS butterfly calculation under radix 2; the calculation is performed in NTT mode. This involves two modular multiplications and one modular addition, while the calculation in INTT mode... The first step only covers modular addition and modular subtraction. The second step uses the intermediate values ​​from the first step to calculate the final result of the butterfly calculation, where the result... and The calculation method is exactly the same as the 2-CT butterfly calculation method; results and The calculation method is basically the same as the 2-GS butterfly calculation method.

[0061] The butterfly unit design in this invention needs to support both radix-2 and radix-4 NTT algorithms simultaneously. Therefore, the entire butterfly structure consists of four small butterfly units, denoted as BFU0, BFU1, BFU2, and BFU3. The designs of the four BFUs are not entirely identical, but each BFU requires 6 clock cycles from input to output. Therefore, a different number of registers are inserted into each BFU. BFU0 and BFU3 are identical except for the twiddle factor; both are radix-2 NTT butterfly unit structures. BFU1 consists of one modular addition and one modular subtraction, without modular multiplication. To ensure data consistency, three sets of registers are set at the two inputs of BFU1 before the modular addition and subtraction units. Three sets of registers are also inserted after completing the modular addition and subtraction operations to ensure that data from the same clock cycle is always executed within the same cycle, preventing data from different cycles from being mixed up in multiple BFUs. BFU2 consists of two modular multiplications, one modular addition, and one modular subtraction. An additional modular multiplier module is needed to calculate the extra multiplication operations, and multiple multiplexers are needed to control the data flow. Meanwhile, the input to the rotation factor features a multi-level register and two multiplexers. In NTT and INTT modes, the registers are two-level registers to ensure that the polynomial coefficients correspond to the primitive root of unity during butterfly calculation. In PWM mode, a seven-level register is required, with the input being the coefficients of the point-valued polynomial, guaranteeing the correspondence between data. The hardware design of the overall butterfly unit under the NTT algorithm is as follows: Figure 3 As shown.

[0062] Since the butterfly unit in this invention should support multiple operations such as NTT, INTT, dot multiplication, addition, and subtraction, multiple modes are needed to control and schedule the four small BFU units. The butterfly unit configuration in NTT mode is as follows. Figure 3 As shown, in the INTT mode, the butterfly unit IBFU0 in INTT corresponds to the butterfly unit BFU1 in NTT, IBFU2 corresponds to BFU3, IBFU1 corresponds to BFU0, and IBFU3 corresponds to BFU2. In the dot product mode, since the dot-valued polynomial obtained after the coefficient polynomial vector in the Kyber algorithm undergoes the NTT transformation is not a nonlinear polynomial but a first-order polynomial, the dot product of its first-order polynomial is not a simple multiplication of each term, but consists of four modular multiplications, four modular additions, and one modular subtraction. The specific calculation process is shown in the following formula:

[0063] However, the dot product differs from NTT / INTT because it requires calculating the product of the two sets of corresponding position coefficients separately. and They also need to be summed. Therefore, it is not possible to obtain these three sets of results simultaneously using only a single butterfly element; additional modular elements are required for calculation and... Furthermore, the sum of the two sets of coefficients , Two sets of modular addition units are also needed for summation. Therefore, in the dot product mode design, this invention will not use the butterfly unit BFU1, but instead uses three sets of modular addition units to calculate these three sums. In the radix-2 NTT / INTT calculation, this invention uses two small butterfly unit structures, BFU0 and BFU2. BFU1 and BFU3 do not participate in the calculation at this time. BFU2 contains two modular multiplication units, one modular addition unit, and one modular subtraction unit, but at this time only one modular multiplication unit, one modular addition unit, and one modular subtraction unit are needed; the other modular multiplication unit can maintain its original output value. Specific scheduling details for different modes are as follows: Figure 4 As shown in the figure. Among them, u0, u1, v0, and v1 represent the input of the four coefficients in the entire butterfly unit at this time. Each small BFU has two output signals, denoted as up and low respectively. The four coefficients and the rotation factor are output as the result of this iteration after the butterfly calculation is completed, represented by the signals bf_0_lower, bf_1_lower, bf_0_upper, and bf_1_upper.

[0064] This invention also proposes a conflict-free memory mapping scheme to address the conflict problem between RAM read and write operations. (Taking Kyber as an example...) For a polynomial vector, the first polynomial is represented in binary. The coefficient of the term can be denoted as the first term. The coefficients are denoted as follows: the first coefficient is represented as the 0x00000001st coefficient. If the first of the four coefficients is taken as the base data, the remaining three coefficients can be represented based on the base data. For example, in the first round of radix-4-NTT, if the base data is 0x00XXXXXX, the other three coefficients can be denoted as 0x01XXXXXX, 0x10XXXXXX, and 0x11XXXXXX. Therefore, the order of base address transformations during the iteration process is as follows:

[0065] Among them, the number of iteration rounds is The first The addresses of the coefficients of the polynomial are represented in binary, such as addresses. Summing their addresses in pairs, i.e. Then, modulo this value by 4 to get the first value. The coefficient of a term should be placed in a Bank. For example, the address of the 35th coefficient can be recorded as 0x00100011. The sum of each pair of coefficients is 0+2+0+3=5, and 5%4=1. Therefore, the 35th coefficient should be stored in Bank1. Figure 5 The code lists the input coefficients for each iteration. The four coefficients input from the same clock group in the same iteration should be stored in four different banks with mutually exclusive addresses to avoid data conflicts. Therefore, the coefficients need to be stored in order of... The items are stored in different banks.

[0066] The twitch factors in radix-4 NTT mode and radix-2 NTT mode are not exactly the same. In radix-2 NTT mode, taking a 4-point NTT as an example, the twitch factor requires a 4th-order primitive root of unity, stored in ROM in bit-reversed order. In radix-4 NTT mode, the twitch factor of a 4-point NTT requires an 8th-order primitive root of unity and a fixed... The rotation factors are divided into three groups and stored in ROM. However, the rotation factors required for calculation are different in NTT and INTT. INTT requires the inverses of the rotation factors in NTT. If these inverses are calculated separately and stored in ROM, due to the multiplexing of the butterfly unit, not only is an additional signal needed to control the reading of the rotation factors, but it also results in wasted storage. This invention utilizes the periodicity of the rotation factors... By changing the order in which the twisters are accessed, the twisters in the NTT are reused in the INTT. In fixed multiplication, the twister multiplied by the NTT is... The twitch factor multiplied in INTT is Using the same twitch factor property, the original radix-4 NTT algorithm can be transformed. Adjusted to , change the original Adjusted to This fixes the twitch factor in INTT to be [value]. It is consistent with the NTT algorithm.

[0067] In the radix-2 & radix-4 NTT hybrid algorithm The NTT operation of term polynomial vectors requires Wheel-based 4-NTT iteration and 1-wheel-based 2-NTT iteration. In the iterative loop of the 4-NTT wheel base, a total of Group twitch factors, respectively corresponding to , , , The fundamental unit root of order, according to The arrangement pattern divides these primitive units of unity into three groups for storage. In the final round of the radix-2-NTT iteration loop, it is necessary to... There are 64 sets of twitch factors for the primitive root of unity, arranged in order of order. The arrangement pattern is stored. In the point-by-point multiplication PWM after NTT execution, a total of [number] operations are performed. This PWM operation requires The original unit root of order The rotation factors are stored in a bit-inverted order. It can be seen that the rotation factors used in PWM operations are exactly the same as those used in NTT / INTT operations except for the arrangement. However, to simplify the control logic of the rotation factors, this invention still stores the rotation factors used in PWM operations separately in an independent ROM in the hardware design. At the same time, a multiplexer is added to the data path of the rotation factors to select the corresponding rotation factor according to the different modes in the polynomial multiplication module. The specific arrangement of the rotation factors is as follows... Figure 6 As shown.

[0068] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or N embodiments or examples. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of the present invention, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified. Any process or method described in the flowcharts or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logical functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain. The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples of computer-readable media (a non-exhaustive list) include the following: electrical connections having one or N wires (electronic devices), portable computer disks (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM).Furthermore, the computer-readable medium can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory. It should be understood that various parts of the invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0069] The above description is merely a preferred embodiment of a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips. The scope of protection for such an architecture is not limited to the above embodiments; all technical solutions falling within this conceptual framework are within the protection scope of this invention. It should be noted that for those skilled in the art, any improvements and variations made without departing from the principles of this invention should also be considered within the protection scope of this invention.

Claims

1. A high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips, characterized by: The architecture adopts a radix-2 and radix-4 hybrid NTT hardware module, which is a hardware implementation of the radix-2 and radix-4 hybrid NTT algorithm, including a control logic unit and an arithmetic logic unit. The control logic unit includes a control unit, which controls the address generator to generate data addresses, the memory mapping unit to generate data write-back addresses, the butterfly unit to operate and input data, and the scheduling of the twitch factor through control signals; The arithmetic logic unit adopts a butterfly unit module, which includes modular addition, modular subtraction, modular multiplication, memory, and multiplexer; The butterfly unit is the core of the polynomial multiplication module architecture. It consists of four small butterfly units (BFUs), denoted as BFU0, BFU1, BFU2, and BFU3. Each BFU requires 6 clock cycles from input to output. A different number of registers are inserted into each BFU. BFU0 and BFU3 are both butterfly unit structures under radix-2 NTT. BFU1 consists of one modular addition and one modular subtraction. BFU2 consists of two modular multiplications, one modular addition, and one modular subtraction. BFU0 and BFU3 are equipped with a rotation factor module, and the butterfly unit supports polynomial vector radix-2 and radix-4-NTT algorithms as well as dot multiplication. The randomly input polynomial coefficients and the twitch factors corresponding to the Kyber algorithm are placed into a Bank according to the corresponding rules. The memory consists of 4 Banks responsible for storage. The coefficients of the term polynomial vector are stored in each bank. The coefficients are generated by the address generator and the arbitration unit to produce four polynomial coefficients that participate in the butterfly unit operation. The four results of the butterfly operation will also be written back to the four banks through the data write-back unit. The twitch factor module is divided into a twitch factor address generation module and a storage module. The twitch factor address generator is controlled by the control unit. When the polynomial multiplication module performs NTT, INTT, and point-by-point multiplication operations, it generates the address of the twitch factor. The twitch factor storage module ROM provides the corresponding primitive root of unity based on the address of the twitch factor, which participates in the modular multiplication operation in the butterfly unit and the point-by-point multiplication operation in Kyber.

2. The acceleration architecture according to claim 1, characterized in that: The radix-2 and radix-4 hybrid NTT hardware module needs to perform NTT operations, dot multiplication, INTT operations, and addition and subtraction operations on polynomial vectors. The NTT operation transforms a polynomial vector from a coefficient polynomial into a point-valued polynomial, while the INTT operation is the exact opposite. The dot product operation is the multiplication of two point-valued polynomial vectors, and the addition and subtraction operations are the addition and subtraction of two polynomial vectors.

3. The acceleration architecture according to claim 2, characterized in that: The control unit mainly consists of a state machine, and different states can be transitioned between each other through signals; The control unit performs various operations through multiple states in the state machine and the transitions between states, thus completing a full polynomial multiplication.

Images