Accelerator, chip and equipment supporting number theory transformation (NTT) and elliptic curve (EC) calculation

Abstract

The embodiment of the invention provides an accelerator supporting NTT and EC calculation, a chip and computer equipment, the accelerator comprises a computing resource pool, the computing resource pool comprises a computing unit, and the computing unit comprises a universal modular multiplier; the simplified modular multiplier is connected with the universal modular multiplier, and modular multiplication operation is carried out on a modular multiplication operation result of the universal modular multiplier and a preset constant; the modular subtractor is connected with the simplified modular multiplier and performs modular subtraction operation based on an operation result output by the simplified modular multiplier; the modular adder is connected with the simplified modular multiplier and performs modular addition operation based on an operation result output by the simplified modular multiplier; a scheduling unit that schedules the calculation unit from the calculation resource pool to perform a point addition calculation in which two points on the EC are added in the butterfly calculation in the NTT and / or the EC calculation; if the butterfly calculation is carried out, the preset constant is 1; if the point addition calculation is carried out, the preset constant is a constant related to a parameter in the equation representing the EC.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of cryptography technology, and more particularly to an accelerator, chip, and device that support number theoretic transformation NTT and elliptic curve EC calculations. Background Art

[0002] Elliptic Curve Cryptography (ECC) is a public key cryptography method based on the mathematical theory of elliptic curves. ECC is an alternative to traditional public key cryptography (such as RSA), with the advantages of short keys, small amount of calculation, and small storage space. Under the same security strength, the key length of elliptic curve cryptography is much shorter than that of most other public key cryptography.

[0003] The emergence of elliptic curve cryptography is mainly to solve the following problems:

[0004] Key length and security strength: With the development of computer technology, the key length required by traditional public key cryptography has been increasing to ensure sufficient security strength. However, the increase in key length also leads to an increase in computing power and storage space. Elliptic curve cryptography can achieve security strength comparable to that of traditional public key cryptography with a shorter key length, thereby improving efficiency.

[0005] Limitations of mobile devices: Mobile devices such as smartphones and tablets have relatively limited computing power and storage space. The application of traditional public key cryptography on these devices is limited. Elliptic curve cryptography is particularly suitable for use on mobile devices due to its high efficiency.

[0006] The threat of quantum computing: The development of quantum computers poses a potential threat to traditional public key cryptography. In theory, quantum computers can use Shor's algorithm to efficiently solve mathematical problems that cryptography such as RSA relies on. Elliptic curve cryptography is currently considered a promising solution to resist quantum computer attacks.

[0007] Elliptic curve cryptography uses the algebraic properties of points on elliptic curves defined over finite fields to build secure systems. Elliptic curves can be described by the following equation:

[0008] y 2 = x 3 + ax + b, where 4a 3 + 27b 2 ≠ 0 (1)

[0009] like Figure 1 In the figure, several different shapes of elliptic curves are listed, where b=1 and a decreases from 2 to -3.

[0010] from Figure 1 It can be seen that the characteristic of the elliptic curve is that it is symmetric about the x-axis. Thus, for a point T on one side of the x-axis on the elliptic curve, there is a point -T that is symmetric about the x-axis.

[0011] The following is an introduction to some of the basics of group theory.

[0012] A group in algebra is a set of elements and operations defined on these elements. For example, all integers form a group, and operations include addition. The set here is usually represented by G (group). For a set to become a group, it generally needs to satisfy the following properties:

[0013] 1. Closed: If a and b both belong to G, then a+b also belongs to G;

[0014] 2. Associative law: For any a, b, c belonging to G, (a+b)+c=a+(b+c);

[0015] 3. There exists an identity element O such that for any a∈G, a+O=O+a=a. For example, in real numbers, the identity element of addition is 0. In simple terms, in binary operations, the identity element allows operations to be performed on any element without changing the value of the element. Taking real numbers as an example, the identity element of multiplication is 1, and the identity element of addition is 0;

[0016] 4. Every element has an inverse element (also called inverse element or negative element, or simply inverse), that is, for any element a, there must be b such that a+b=O (O is the identity element).

[0017] A set that satisfies the above four properties is called a group.

[0018] There are also some special groups, such as the Abelian Group, which not only satisfies the basic properties of the group, but also satisfies the commutative law, that is, a+b=b+a. Therefore, the Abelian Group is also called the commutative Group.

[0019] Based on these properties, we can determine that the integer set Z is an Abelian group, but the natural number set N is not a group because it does not satisfy the property of the existence of inverse elements in Article 4.

[0020] The above is the basic knowledge of group theory. Although it seems simple, there are many complex features in group theory, which are temporarily omitted here. It should be noted that the elements in the group can not only be numbers, but also other types of elements, such as points in analytic geometry (represented in the form of coordinates).

[0021] With the basic knowledge of groups, we can further define groups on elliptic curves in a similar way.

[0022] As mentioned above, the elements of a group can be of any type. Here, the group elements on the elliptic curve are set to points on the elliptic curve. The identity element is set to the point at infinity and is denoted by O. The inverse of any point P on the elliptic curve is the symmetric point of the point about the x-axis.

[0023] The addition of elliptic curve groups is also different from the addition of integers. The addition of elliptic curve groups can be defined as: given three collinear non-zero points P, Q, R, their sum is P+Q+R=O. Figure 2 As shown, the geometric meaning of this addition is: draw a straight line L through points P and Q, which intersects the elliptic curve at a third point. The symmetric point of this point about the X-axis is the required point R.

[0024] Here are some exceptions:

[0025] 1. O+O=O, that is, for any P, P+O=P; O is regarded as the zero point;

[0026] 2. The negative element of P = (x, y) is the point -P = (x, -y) which is symmetric about the x-axis, not about the origin. P + (-P) = O, which can be regarded as the line connecting point P and point -P intersecting the elliptic curve at infinity.

[0027] 3. To calculate twice the value of point P (P≠O), we draw a tangent to the point on the elliptic curve, and then take the symmetric point -R of the intersection of the tangent and the elliptic curve about the X-axis, that is, 2P=P+P=-R. Its geometric meaning is as follows Figure 3 As shown, point -R is point 2P. Furthermore, the 2 times value can be recursively deduced to 2 n The calculation of the value can also be recursively used to calculate any integer multiple value.

[0028] The geometric explanation makes it easier to understand the meaning of point addition on an elliptic curve, while the algebraic explanation makes it easier to calculate. Points on the curve have coordinates on a two-dimensional plane, namely the coordinates of the x and y axes. Then, through two points P(x p ,y p ) and Q(x q ,y q ) to draw a straight line and find the third intersection point with the curve. This can be described algebraically, that is, to find the solution of the following two equations (2) and (3):

[0029] y 2 =x 3 +ax+b (2)

[0030] yy p =k(xx p ) (3)

[0031]

[0032] Where k is the slope.

[0033] Substituting (3) into (2), and then using the method of frequency alignment, it is easy to find the symmetric point of the third intersection about the x-axis, that is, point R(x r ,y r )for:

[0034] x r =k 2 -x p -x q (4)

[0035] y r =-y p +k(x p -x r ) (5)

[0036] If P = Q, then adding the two together is the multiplication. You can add multiple points to themselves repeatedly to get the multiplication result. For example, P + P = 2P = R, which is described algebraically as:

[0037]

[0038] So far, we have introduced the basic operations of elliptic curve group elements in the real number field. Addition operations in the real number field cannot meet the actual security needs, because real numbers are continuous, and the inverse operation can be used to solve the problem if the result is known. Therefore, in order to prevent reversibility, the next step is to discretize the coordinates of the elliptic curve points.

[0039] Here we first introduce the modulo prime number p operation. First, the modulo operation represents the remainder obtained by dividing a by p, which can be expressed as:

[0040] a mod p.

[0041] In cryptography, elliptic curves are used over finite fields, that is, the coefficients and variables of the elliptic equations are all within a finite range. The values ​​can be limited to the finite field Z by using a modulo prime number p. p Specifically, the modular operation is introduced into elliptic curve arithmetic by taking the variables and coefficients from the set [0, p-1] instead of taking the values ​​from the real numbers, and the field is finite (i.e., finite field). The equation on this field is transformed as follows:

[0042] y 2 mod p=(x 3 +ax+b)mod p, where (4a 3 +27b 2 )mod p≠0 (8)

[0043] The above formula (8) is often expressed as:

[0044] y 2 =(x 3 +ax+b)mod p.

[0045] All integer solutions (x, y) that satisfy the above equation, where x, y∈Zp, and the infinite point O, mathematically denoted by E p (a,b), which is a finite discrete (non-continuous) set of points.

[0046] If there is a point g in this finite field, such that every element in the group G can be written as a certain integer power of the point g (the power here is a generalized concept in the group, which describes the number of repetitions of the group operation; in the additive group it refers to the number of addition operations), that is:

[0047] G = {g 0 =O,g 1 =g,g 2 =2g,...,g n-1 =(n-1)·g},

[0048] Where n is the order of the group G (the order refers to the number of elements in the group), then this group is also called a cyclic group, denoted by E p (a,b), this point g is called a generator. Due to the effect of modulo, the points in this set are distributed in the quadrant from (0,0) to (p-1,p-1). Even if the value of k changes, the result is still cyclic in this quadrant. In fact, the set E p The addition operation of (a,b) modulo p forms a cyclic Abelian group, which is a subset of the quadrant (0,0) to (p-1,p-1), so this cyclic Abelian group is also called a cyclic subgroup.

[0049] Using a modulus prime number p ensures that the operation is consistent and reliable, and all non-zero elements have inverses, forming a good algebraic structure (finite field), so it is suitable for elliptic curve cryptography. If a non-prime number is used as a modulus, there will be problems of inconsistent operations and no inverses, resulting in a complex algebraic structure (finite ring), so it is not suitable for elliptic curve cryptography. In short, elliptic curve cryptography chooses a modulus prime number p instead of a non-prime number to ensure the reliability and security of mathematical operations. In addition, the order n of the selected cyclic subgroup is usually also selected as a prime number to obtain better security and efficiency.

[0050] E p The addition rule on (a,b) is similar to that in the real number domain, that is, similar to the above formulas (2) to (5). The difference is that there is an additional modulo operation. Similarly, by adding a modulo operation to formulas (6) and (7), we can obtain the multiplication result obtained by repeatedly adding multiple points in the discrete domain cyclic group.

[0051] Simply put, a point P on the elliptic curve and its k-fold point Q form the relationship:

[0052] Q=k·P,where Q,P∈E p (a,b),k <p (9)

[0053] For given k and P, it is easy to calculate Q; but conversely, given Q and P, it is quite difficult to calculate k. This is the discrete logarithm problem of elliptic curves. Constructing a mathematical problem to ensure the security of encryption is the main idea of ​​encryption algorithms in cryptography. Therefore, Q can be used as a public key and made public; k can be used as a private key and kept secret. It is quick and easy to obtain a public key through a private key, but it is very difficult to crack a private key through a public key.

[0054] In the above group addition operation, scalar multiplication is actually defined, that is, the same point is added multiple times. For example, the addition of k points p can be expressed as:

[0055] k·P=P+P+…+P (10)

[0056] The simplest way to calculate scalar multiplication is to add points one by one. It should be noted that, in fact, the points on the elliptic curve have coordinates. The calculation of the above formula (10) requires coordinate operations similar to those in formulas (6) and (7), including a large number of modular multiplication and modular addition operations, so the actual calculation is more complicated.

[0057] Although the number of addition operations can be reduced in some optimized algorithms, for example, 7P can be decomposed into 4P+2P+P, 2P requires one addition operation, and 4P=2P+2P requires another addition operation based on 2P. In this way, a total of 4 addition operations are required, which is 2 less than the original 6 addition operations of 7P=P+P+P+P+P+P+P (P+P=2P, 2P+P=3P, 3P+P=4P, 4P+P=5P, 5P+P=6P, 6P+P=7P), but from the perspective of the underlying coordinate operations, it still contains a large number of modular multiplication and modular addition operations.

[0058] In general, addition on elliptic curves requires a large number of modular multiplication and modular addition operations, and calculating one addition may require dozens of modular multiplication and modular addition operations; multiplication on elliptic curves (that is, the scalar multiplication mentioned above) requires an even larger number of modular multiplication and modular addition operations, and calculating one multiplication may require hundreds or more modular multiplication and modular addition operations.

[0059] The above scalar multiplication is a basic operation in elliptic curve cryptography, which is used in key generation, encryption, signature and other processes. Multi-Scalar Multiplication (MSM) is a generalization of scalar multiplication, which involves multiple points and multiple scalars. Specifically, given n points P1, P2, ..., P n and n integers k1, k2, ..., k n , the goal of multi-scalar multiplication is to compute:

[0060] Q=k1P1+k2P2+...+k n P n (11)

[0061] It can be seen that multi-scalar multiplication is the sum of the results of n scalar multiplications.

[0062] Multi-scalar multiplication is used in many cryptographic protocols based on elliptic curves, especially in those cases where multiple points and scalars need to be processed simultaneously. For example:

[0063] In some digital signature schemes, signature generation and verification requires computing linear combinations of multiple points.

[0064] In some key exchange protocols, the calculation of the shared secret key requires scalar multiplication of multiple public key points with the corresponding private key points and summing them.

[0065] In some zero-knowledge proof (ZKP) protocols, proof generation and verification requires computing linear combinations of multiple commitment values.

[0066] Taking zero-knowledge proof as an example, the role of MSM operation in zero-knowledge proof is explained. First, the protocol principle of ZKP is as follows Figure 4 shown.

[0067] There are provers and verifiers. The prover uses the proving key, private input (also called witness), and public input to create a proof through a program. The prover sends this proof to the verifier. The verifier can use the verification key and public input and verify the proof through a verifier, outputting true or false.

[0068] In the above process, the prover does not disclose the private input that he does not want to disclose, and the verifier can verify that the prover knows the private input by proving the proof, but the verifier cannot know what the private input is.

[0069] This property makes zero-knowledge proofs very useful in many scenarios, especially when the prover needs to prove that he has a secret but does not want to reveal any information about the secret. For example:

[0070] In identity verification, a prover can prove that he knows a secret associated with an identity (such as a private key) without revealing the secret.

[0071] In a privacy-preserving transaction, the prover can prove that the transaction is valid (e.g., prove that he has enough balance) without revealing the details of the transaction (e.g., the specific amount).

[0072] In privacy-preserving computation, a prover can prove that he performed a certain computation correctly (e.g., prove that he evaluated a certain function correctly) without revealing the inputs of the computation.

[0073] The premise of the above ZKP is the existence of a pair of proving keys and verification keys. Usually, the prover key and verification key can be generated in a centralized manner. This generation process is called a trusted setup process. The trusted setup process can be implemented by a trusted third party other than the prover and verifier to generate the proving key and verification key, and send the proving key to the prover and the verification key to the verifier respectively. The trusted setup process implemented by the trusted third party can be divided into two categories: general trusted setup and dedicated trusted setup process. The difference is:

[0074] In the universal trusted setup, the generation of the proof key and the verification key does not necessarily need to be based on a specific computing problem. This setup process is one-time, so it can save the overhead of repeated setup on each computing problem.

[0075] A dedicated trusted setup is a setup based on a specific computing problem. The generated proof key and verification key are generated for a specific computing problem. This means that these keys can only be used to prove and verify this specific problem and cannot be directly applied to other problems. On the other hand, these keys can only be used to prove and verify this specific problem and cannot be directly applied to other problems. In this way, even if others obtain these keys, they can only forge proofs for this specific problem and cannot affect other problems. At the same time, the efficiency of dedicated trusted setup is low, and the setup process needs to be implemented separately for each computing problem.

[0076] Take the general trusted settings as an example, Figure 4 As shown, for example, an algorithm in the ZK-Snark (Zero-Knowledge SuccinctNon-interractive Argument of Knowledge) protocol (such as Pinocchio, Groth16, Sonic, etc.) is selected. The trusted third party can generate a proof key and a verification key through a universal trusted setting. In addition, some public parameters, reference strings, constraint system templates, randomness proofs, security proofs, etc. are also involved (step ①). Furthermore, the trusted third party can send the generated proof key and some public parameters, reference strings, constraint system templates, randomness proofs, security proofs, etc. to the prover (step ②), and send the verification key to the verifier (step ②). The prover can create a proof based on the public input and private input of the computational problem and combined with the proof key (step ③), and send the proof to the verifier (step ④). The verifier verifies the truth of the proof through a verification program (also called a verifier) ​​based on the verification key, proof and public input, that is, verifies whether the prover really knows the solution (step ⑤).

[0077] Generally speaking, the process of generating a proof by the prover can include three parts. The first part is a process called arithmeticization, which converts the computational problem into a set of linear constraint vectors; the second part is to convert these linear constraint vectors into a "polynomial proof"; the third part is to convert the polynomial proof into a "non-interactive proof", which is the final proof. This process is also called "proof compilation".

[0078] Taking ZK-Snark as an example, the above process includes:

[0079] Step 1: Arithmetization. Arithmetization is the process of converting the original computational problem into a set of algebraic constraints. The core work of this process includes:

[0080] Represent the computational problem as an arithmetic circuit or a set of polynomial constraints. This typically involves defining the inputs, outputs, and intermediate variables of the circuit, and describing the arithmetic relationships between these variables.

[0081] ·Convert the circuit constraints into a special linear algebraic structure, usually called R1CS (Rank-1Constraint

[0082] This involves representing each constraint as a matrix and combining all the matrices into one large R1CS instance.

[0083] Convert the R1CS instance to a set of linear equations or polynomials. This is usually done using techniques such as Lagrange interpolation.

[0084] The goal of arithmeticization is to transform the original problem into an algebraic form that is more suitable for cryptographic processing. This lays the foundation for subsequent polynomial proof generation and proof compilation.

[0085] Step 2: Polynomial Proof Generation. In this step, the prover converts the linear constraint vector obtained by arithmetic transformation into a "polynomial proof". The core work of this process includes:

[0086] Randomize the linear constraints using so-called blinding factors. This is to hide the specific values ​​of the original constraints, thus achieving zero-knowledge.

[0087] Interpolate the randomized constraints into polynomials.

[0088] Operate on these polynomials to generate different parts of the proof, such as commitment, proof, reply, etc. This involves using cryptographic primitives such as homomorphic commitments, verifiable random functions, etc. Operations on polynomials are usually implemented using efficient algorithms such as Fast Fourier Transform (FFT) or Number-Theoretic Transform (NTT).

[0089] The goal of polynomial proof generation is to transform discrete linear constraints into a continuous polynomial form, which is more suitable for subsequent cryptographic processing. This process also introduces randomization and blinding, which is the key to achieving zero-knowledge.

[0090] The above NTT can be defined as the following formula (12):

[0091]

[0092] Vector a and vector Both contain N large integers, W N is the Nth root of unity in a finite field, is the twiddle factor (TF), and the multiplication symbol * indicates modular multiplication. Similar to FFT, the Cooley-Tukey algorithm can be applied to NTT, reducing its complexity from O(N 2) is reduced to O(NlogN). Unlike FFT, the calculations in NTT are performed in a finite field. Figure 5 The figure shows an NTT task of size 8. The core function in NTT is butterfly computing. An NTT task of size N can be decomposed into logN stages. In each stage, N / 2 butterfly computing is performed on the data with a constant step size. Optionally, each stage can reuse a butterfly computing unit. LogN stages can correspond to logN butterfly computing units, and these logN butterfly computing units can form a pipeline.

[0093] During the proof process, the size of the NTT may be in the billions or more. The data in the one-dimensional NTT is difficult to buffer on the chip memory. To solve this problem, a two-dimensional NTT is used in related work, which can decompose a larger NTT into multiple smaller NTTs. The two-dimensional NTT can be extended to a multi-dimensional NTT to further decompose the NTT. In the NTT accelerator, the decomposed NTT is usually implemented by a high-bandwidth pipeline architecture.

[0094] Step 3: Proof Compilation. In the last step, the prover converts the polynomial proof into a “non-interactive proof”, which is the final zk-SNARK proof. The core work of this process includes:

[0095] Use zk-SNARK protocols such as Pinocchio and Groth16 to convert the polynomial proof into a non-interactive, verifiable proof of computational integrity. This involves the use of advanced cryptographic primitives such as pairing-friendly elliptic curves and pairing operations.

[0096] Perform various optimizations, such as using multiple scalar multiplication (MSM) to speed up computations and using recursive techniques to compress proof size.

[0097] This is to improve the efficiency of proof generation and verification.

[0098] Package the optimized proof together with the public input of the original problem to form the final zk-SNARK proof.

[0099] It should also be noted that in the above process, public parameters, reference strings, constraint system templates, random proofs, security proofs, etc. (collectively referred to as artifacts together with the proof key and verification key) are also very important contents. The trusted third party needs to distribute appropriate artifacts to the prover and the verifier. As mentioned above, the third party sends the proof key and some artifacts (such as public parameters, reference strings, constraint system templates, random proofs and security proofs) to the prover, and the verification key is sent to the verifier. The following are the functions of the artifacts such as public parameters, reference strings, constraint system templates, random proofs and security proofs:

[0100] Public parameters: These parameters define the cryptographic primitives that zk-SNARKs are based on, such as elliptic curves, pairing-friendly curves, etc. These parameters are needed by the verifier to perform the verification algorithm, especially when checking certain cryptographic conditions (such as pairing equality).

[0101] Reference String: A reference string is a shared input between the prover and the verifier to coordinate their interactions.

[0102] The verifier needs to use the same reference string as the prover to verify the proof.

[0103] Constraint System Template: This template defines the general structure of computational problems that zk-SNARKs can handle. A verifier may need this template to check whether the structure of the public input is compatible with the proof.

[0104] Proof of Randomness and Proof of Security: These proofs provide proof of the integrity of the setup process and the security of the zk-SNARK.

[0105] These proofs may be required by validators to gain trust in the entire system.

[0106] The dedicated trusted setup is generally similar to the above process, but as mentioned above, the dedicated trusted setup process needs to be designed in combination with the computational problem. Therefore, the dedicated trusted setup process of the third party will combine the computational problem to generate the proof key and the verification key, which also means that the generated proof key and verification key will be closely bound to the specific circuit structure. In this process, the computational problem can be preprocessed, for example, the arithmetic setting can be set in the preprocessing process, because the arithmetic setting does not involve privacy input. Therefore, in the process of the prover generating the proof, the second and third steps mentioned above can be executed, and the second and third steps involve privacy input.

[0107] In the above process of the prover generating proof, NTT and MSM are the two parts with the largest amount of computation and the most time-consuming. In order to achieve a lower proof generation delay, both NTT and MSM require hardware accelerators to reduce processing time. Existing work usually designs independent MSM and NTT accelerators. Some system architectures of ZKP accelerator applications are as follows: Figure 6 As shown, two subsystems are designed on the chip: NTT accelerator and MSM accelerator. These two accelerators are completely independent and are just placed on the same chip.

[0108] As mentioned above, in the ZKP calculation process, the quotient polynomial is usually obtained through NTT / inverse NTT calculation, and then the final proof is calculated through MSM. The NTT and MSM accelerators will not work at the same time, that is, when the MSM accelerator is working, the NTT accelerator is idle, and vice versa. This results in low utilization of MSM and NTT, which greatly wastes precious chip area.

[0109] Therefore, if an accelerator is designed that allows NTT and MSM to share computing resources, the chip area can be reduced and chip utilization can be improved. However, it is very difficult to make NTT and MSM share computing resources. Because there are significant differences between the algorithm for implementing NTT's butterfly calculation and the algorithm for implementing MSM's PADD (point addition), existing chips are designed with independent NTT accelerators and MSM accelerators. There is almost no similarity between the hardware structures of the two, and the number of modular multipliers and modular adders required to implement butterfly calculations and point addition calculations is quite different.

[0110] After research, it was found that although the algorithms of MSM and NTT are very different, they both use the same computing units at the bottom layer, because both require a large number of prime field modular operations, especially modular multiplication operations. In both accelerators, the modular multiplication operation unit also accounts for the largest share of resources. Therefore, this provides an idea for NTT and MSM to share computing resources. During the research process, one idea could be to modify the MSM accelerator so that it can also support NTT; another idea could be to modify the NTT accelerator so that it can also support MSM.

[0111] For the first approach, the point addition calculation unit in the MSM accelerator is used to add two points P1 (x1, y1) and P2 (x2, y2) on the EC to obtain a point P3 (x3, y3) on the EC, that is:

[0112] P3(x3, y3)=P1(x1, y1)+P2(x2, y2)

[0113] Points on the EC can be represented by various coordinates. For example, affine coordinates (x, y) can be mapped to projective coordinates (X, Y, Z) to reduce the cost of point addition. The mapping from affine coordinates to projective coordinates can be expressed as (x, y) → (X, Y, Z), where x = X / Z and y = Y / Z. For the elliptic curve shown in the above formula (1), the point addition calculation can be:

[0114] X3=(X1Y2+X2Y1)(Y1Y2-a(X1Z2+X2Z1)-3bZ1Z2)-(Y1Z2+Y2Z1)(aX1X2+3b(X1Z2+X2Z1)-a 2 Z1Z2),

[0115] Y3=(3X1X2+aZ1Z2)(aX1X2+3b(X1Z2+X2Z1)-a 2 Z1Z2)+(Y1Y2+a(X1Z2+X2Z1)+3bZ1Z2)(Y1Y2-a(X1Z2+X2Z1)-3bZ1Z2),

[0116] Z3=(Y1Z2+Y2Z1)(Y1Y2+a(X1Z2+X2Z1)+3bZ1Z2)+(X1Y2+X2Y1)(3X1X2+aZ1Z2). (13)

[0117] In point addition calculation, the coordinate calculation involved is all calculation in the modular domain. The coordinate multiplication in formula (13) actually involves modular multiplication operation. The plus sign and the minus sign are essentially modular addition operations. Therefore, the point addition calculation in the above formula will be divided into multiple modular multiplication operations, and multiple modular addition operations / modular subtraction operations. Correspondingly, the point addition calculation module in the MSM accelerator usually requires a large number of modular multipliers, as well as modular adders / modular subtractors. Figure 7 It is a structural diagram of a point addition calculation unit in the related art, in which a circle containing M represents a modular multiplier, a circle containing A represents a modular adder, and a circle containing S represents a modular subtractor.

[0118] Figure 5 The dotted box in the middle is a butterfly calculation in NTT, including:

[0119]

[0120] The above formula means:

[0121] ① Operand "a[0]", operand "a[4]" and operand Perform modular addition on the modular multiplication result;

[0122] ② Operand "a[0]", operand "a[4]" and operand Perform modular subtraction on the result of modular multiplication.

[0123] Therefore, the butterfly computing unit in the NTT accelerator is usually composed of a modular multiplier, a modular adder, and a modular subtractor. It can be seen that implementing point addition calculations requires more modular multipliers and modular adders / modular subtractors than implementing butterfly calculations. The hardware resources of the point addition computing unit in the existing MSM accelerator cannot be fully reused by the butterfly computing unit in the NTT. Summary of the invention

[0124] In order to overcome the problems existing in the related art, this specification provides an accelerator, chip and device that supports number theoretic transformation NTT and elliptic curve EC calculation.

[0125] According to a first aspect of an embodiment of this specification, an accelerator supporting number theory transformation NTT and elliptic curve EC calculation is provided, including:

[0126] A computing resource pool, the computing resource pool comprising at least one computing unit, each of the computing units comprising:

[0127] Universal modular multiplier;

[0128] A simplified modular multiplier, connected to the universal modular multiplier, for performing modular multiplication on the modular multiplication result of the universal modular multiplier and a preset constant;

[0129] a modular subtractor, connected to the simplified modular multiplier, and configured to perform a modular subtraction operation based on an operation result output by the simplified modular multiplier; and

[0130] A modular adder connected to the simplified modular multiplier and configured to perform a modular addition operation based on an operation result output by the simplified modular multiplier;

[0131] a scheduling unit, configured to schedule a computing unit from the computing resource pool to perform a butterfly calculation in the NTT and / or a point addition calculation of adding two points on the EC in the EC calculation;

[0132] Wherein, if the butterfly calculation is performed, the preset constant is 1;

[0133] If the point addition calculation is performed, the preset constant is a constant related to the parameter in the equation representing the EC.

[0134] According to a second aspect of an embodiment of this specification, a chip is provided, the chip comprising the accelerator described in the first aspect.

[0135] According to a third aspect of an embodiment of this specification, a computer device is provided, the computer device comprising the accelerator described in the first aspect.

[0136] In the above embodiment, an accelerator is provided. In addition to the general modular multiplier, modular adder and modular subtractor, the computing unit of the accelerator is provided with a simplified modular multiplier for modularly multiplying the modular multiplication result of the general modular multiplier with a preset constant. The preset constant is set according to whether the computing task is an NTT task or an EC computing task, so that the computing unit can support both the butterfly computing in NTT and the dot addition computing in EC computing. In this way, the total chip area of ​​the accelerator can be effectively reduced. When executing EC computing tasks such as MSM or NTT tasks, the accelerator can achieve a high computing unit utilization rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0137] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0138] Figure 1 It is a schematic diagram of an elliptic curve;

[0139] Figure 2 It is a schematic diagram of the definition of addition on an elliptic curve;

[0140] Figure 3 It is a schematic diagram of defining double points on an elliptic curve;

[0141] Figure 4 is a flow chart of the zero-knowledge proof principle in one embodiment;

[0142] Figure 5 is a schematic diagram of an NTT task according to an exemplary embodiment of this specification;

[0143] Figure 6 is a schematic diagram of a chip structure according to an exemplary embodiment of this specification;

[0144] Figure 7 is a schematic diagram of a point-addition calculation unit according to an exemplary embodiment of the present specification;

[0145] Fig. 8A is a schematic diagram of the structure of FU in an accelerator according to an exemplary embodiment of the present specification;

[0146] Figure 8B is a structural schematic diagram of an accelerator according to an exemplary embodiment of this specification;

[0147] Fig.9A is a schematic structural diagram of another accelerator according to an exemplary embodiment of this specification;

[0148] Fig. 9B is a schematic diagram of a structure of a computing resource pool in an accelerator according to an exemplary embodiment of the present specification;

[0149] Fig. 9C is a schematic diagram of an NTT algorithm shown in this specification according to an exemplary embodiment;

[0150] Fig.9D It is a schematic diagram of the structure of FU in another accelerator shown in this specification according to an exemplary embodiment.

[0151] Fig.10 is a schematic diagram of a chip according to an exemplary embodiment of this specification;

[0152] Fig.11 It is a schematic diagram of a computer device shown in this specification according to an exemplary embodiment. DETAILED DESCRIPTION

[0153] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0154] Based on this, the accelerator of the embodiment of this specification is modified based on the butterfly computing unit in NTT to design a computing unit that supports both butterfly computing and point-add computing. Fig. 8A , is a schematic diagram of the structure of a computing unit in an accelerator according to an exemplary embodiment of the present specification. In this embodiment, a new computing unit (Functional Unit, FU) is designed, and the FU may include: a general modular multiplier, a simplified modular multiplier, a modular adder and a modular subtractor; wherein the general modular multiplier is connected to the simplified modular multiplier, and the simplified modular multiplier is connected to the modular adder and the modular subtractor respectively.

[0155] The simplified modular multiplier is used to perform modular multiplication operation on the modular multiplication operation result of the universal modular multiplier and a preset constant. The modular subtractor is used to perform modular subtraction operation based on the operation result output by the simplified modular multiplier; and the modular adder is used to perform modular addition operation based on the operation result output by the simplified modular multiplier.

[0156] like Fig. 8A As shown, compared with the existing NTT butterfly computing unit, the FU of this embodiment adds a simplified modular multiplier.

[0157] The core operator in NTT is butterfly, while the core operator in MSM is PADD. The functions that FU can achieve are similar to a stage in the aforementioned NTT pipeline, and the computing resources are also similar. In this embodiment, the computing resources used by FU can support butterfly operations, but there is no precedent in the industry for supporting PADD. This embodiment expands butterfly and adds a scale function, which is to multiply a fixed integer. The scale function is Fig. 8A The simplified modular multiplier implementation shown in .

[0158] The purpose of designing a simplified modular multiplier is because the point addition calculation involves modular multiplication of the result of modular multiplication with an integer. Taking "3bZ1Z2" in formula (13) as an example, two modular multiplications are involved here: modular multiplication of "Z1" and "Z2", and modular multiplication of "3b" and "Z1Z2".

[0159] In some examples, the internal structures of the general modular multiplier and the simplified modular multiplier are different, and the internal structure of the simplified modular multiplier can be smaller than that of the general modular multiplier to reduce resource waste. For example, in practical application scenarios such as zero-knowledge proof, "Z1" and "Z2" are large numbers input to the computing unit. For example, Z1 and Z2 are both 512 bits, with large values, and the specific values ​​are unknown to the computing unit, so the internal structure of the general modular multiplier will be relatively complex. "3b" is a relatively small integer, and after the EC equation is determined, the value of "3b" is fixed and known. Therefore, the modular multiplier that implements a known fixed value and another unknown input number can be optimized by an algorithm based on the fixed value. Therefore, the simplified modular multiplier can also be understood as a multiplier. Even assuming "3b = 3", the modular multiplication function in the simplified modular multiplier can also be implemented using two adders. Therefore, compared with the general modular multiplier that supports two unknown large numbers, the internal structure of the simplified modular multiplier can be much smaller.

[0160] In other examples, the simplified modular multiplier may also be a modular multiplier with the same structure as the universal modular multiplier. The universal modular multiplier supports modular multiplication of two unknown large numbers, and also supports modular multiplication of a known fixed value and another unknown input number, but computing resources will be wasted. Therefore, the "simplified" in the simplified modular multiplier in this embodiment is not used to limit the difference between its internal structure and that of the universal modular multiplier, but is only used to highlight that one of the inputs of the simplified modular multiplier is a "preset constant", which is different from the two unknown inputs of the universal modular multiplier.

[0161] However, the butterfly calculation does not require two modular multiplications. For example, in formula (14), after the two operands are calculated to obtain the modular multiplication result, modular addition and modular subtraction are performed respectively; therefore, the simplified modular multiplier of this embodiment is used in the butterfly calculation to realize the modular multiplication of the modular multiplication result and the integer 1. Therefore, both the butterfly calculation and the dot addition calculation can be realized by the FU.

[0162] like Figure 8B As shown, it is a structural schematic diagram of an accelerator shown in this specification according to an exemplary embodiment, and the accelerator includes: a computing resource pool and a scheduling unit; wherein the computing resource pool may include one or more computing units, and the number of FUs in the accelerator in actual applications may be arbitrary. The scheduling unit is used to schedule computing units from the computing resource pool to perform the butterfly calculation in the NTT and / or the point-add calculation in the EC calculation; wherein, if the butterfly calculation is performed, the preset parameter is 1; if the point-add calculation is performed, the preset parameter is a parameter related to the EC calculation.

[0163] As an example, the EC calculation in this embodiment may be the aforementioned MSM, or any calculation consisting of point addition calculations on the EC, which is not limited in this embodiment.

[0164] As an example, when the accelerator of this embodiment is applied, all or part of the computing units in the computing resource pool can perform NTT alone, or all or part of the computing units in the computing resource pool can perform EC calculation alone; or, some computing units in the computing resource pool can perform NTT, while some computing units can perform EC calculation. It can be flexibly implemented according to the actual application scenario, and this embodiment does not limit this.

[0165] In practical applications, the internal structure of the scheduling unit can be implemented as needed, as long as the scheduling function can be implemented. As an example, the scheduling unit may include an NTT scheduler and an EC calculation scheduler.

[0166] The NTT scheduler is used to schedule computing units from the computing resource pool to perform butterfly computing in the NTT;

[0167] The EC calculation scheduler is used to schedule computing units from the computing resource pool to perform point-add calculations in the EC calculations.

[0168] In this embodiment, corresponding schedulers can be set for NTT tasks and EC computing tasks, respectively, and the two schedulers respectively schedule the computing units to perform the corresponding tasks. As an example, the EC computing scheduler and the NTT scheduler can be responsible for the preprocessing and scheduling of the data of the EC task and the NTT task, respectively. Among them, it is clear to those skilled in the art that the EC computing scheduler and the NTT scheduler can flexibly implement the internal structure as needed, for example, they can refer to the existing NTT accelerator and MSM accelerator, etc., and this embodiment does not limit this.

[0169] As an example, the EC computing scheduler in the accelerator may be one or more, such as Fig.9A , which is a schematic diagram of the structure of another accelerator according to an exemplary embodiment of the present specification. EC calculation takes MSM as an example, and the accelerator may include multiple MSM schedulers (MSM Scheduler).

[0170] As an example, the EC calculation includes a multi-scalar multiplication calculation MSM, and the multi-scalar multiplication calculation can be split into multiple subtasks;

[0171] The computing resource pool includes multiple computing units, and there are multiple EC computing schedulers, each of which is used to execute one of the subtasks. Each of the EC computing schedulers schedules computing units from the computing resource pool respectively so that the multiple subtasks are executed in parallel.

[0172] In this embodiment, considering that there may be multiple MSM tasks in actual applications, or a large MSM task can be divided into several small subtasks, the accelerator can design multiple MSM schedulers, and the specific number can be flexibly set as needed. Multiple MSM tasks, or subtasks of an MSM task can be assigned to these multiple MSM schedulers for parallel processing to improve performance. As an example, the allocation of MSM tasks, the splitting of MSM tasks, and the allocation of subtasks to MSM schedulers can be performed by the upper processor of the accelerator in this embodiment.

[0173] As an example, in actual application, if there are multiple MSM tasks, based on the number of MSM tasks and the number of MSM schedulers, one MSM task is assigned to each MSM scheduler to achieve parallel processing of multiple MSM tasks.

[0174] In other examples, for example, when there is only one MSM task, one MSM task may be split into multiple subtasks corresponding to the number of MSM schedulers in the accelerator to achieve parallel computing.

[0175] The above two types of parallel computing can be implemented by multiple computing units of a computing resource pool. As an example, the computing resource pool includes multiple computing chains, each of which includes multiple cascaded computing units, each of which corresponds to an EC computing scheduler; each of which is connected to at least one computing unit in the corresponding computing chain.

[0176] The subtask includes multiple point-add calculations; the EC calculation scheduler is used to cascade the scheduled multiple calculation units into a calculation chain, so that each calculation unit in the calculation chain executes the multiple point-add calculations in the subtask in parallel.

[0177] In this embodiment, when calculating MSM, each FU can independently execute a complete PADD; multiple FUs can be cascaded as a calculation chain to execute multiple different PADDs at the same time to support parallel calculation of multiple PADDs. Fig. 9B As shown, it is a schematic diagram of the structure of the computing resource pool in the accelerator according to an exemplary embodiment of the present specification. The resource pool includes 24 FUs, including 3 computing chains PADD chains. The accelerator may include 3 EC computing schedulers, and each EC computing scheduler manages a computing chain. Fig. 9B In the example, each computing chain includes 8 FUs. In practical applications, the number of FUs included in each computing chain in the accelerator can be arbitrary, and the number of FUs included in each computing chain can also be different, which is not limited in this embodiment.

[0178] As an example, a computing chain may be composed of multiple adjacent FUs connected to each other, for example, Fig. 9B As shown in the figure, two adjacent FUs in the PADD chain are connected to each other, that is, Fig. 9B The solid line with arrows between FUs in the figure. Two adjacent FUs, one of which can transmit data to the other FU, can also receive data transmitted by the other FU. It should be noted that Fig. 9B The connection between the FUs shown in the figure is a logical connection. It is clear to those skilled in the art that the specific hardware connection method between the FUs in the accelerator can be implemented as needed, and this embodiment does not limit this.

[0179] As an example, each of the EC computing schedulers is connected to at least one computing unit in the corresponding computing chain, and there may be multiple implementations. For example, the EC computing scheduler may be connected to any computing unit in the corresponding computing chain, such as the first computing unit in the computing chain. Alternatively, the EC computing scheduler may be connected to multiple computing units in the corresponding computing chain, which is not limited in this embodiment.

[0180] In addition, an EC computing scheduler can also be connected to computing units in computing chains corresponding to other EC computing schedulers. Alternatively, it is also optional for an EC computing scheduler to be connected to all FUs; in actual applications, it can be set as needed, and this embodiment does not limit this.

[0181] Based on the above connection mode, parallel computing can be implemented in different practical application scenarios. For example, the EC computing includes multiple multi-scalar multiplication computing tasks; the multiple computing chains are used to process the multiple multi-scalar multiplication computing tasks in parallel. And / or, the EC computing includes multiple subtasks split from the multi-scalar multiplication computing tasks; the multiple computing chains are used to process the multiple subtasks in parallel.

[0182] In practical applications, the accelerator can implement the above two parallel processing methods separately or simultaneously; for example, in the computing resource pool of the accelerator, some computing chains are used to parallel process multiple MSM tasks, while some computing chains are used to parallel process multiple subtasks of one MSM.

[0183] As an example, a computing chain can execute a subtask of MSM, and a subtask can include multiple point-adding calculations. The EC computing scheduler can control the computing chain to implement the subtask. In a computing chain, each FU can perform the corresponding point-adding calculations respectively. Therefore, in the process of executing the MSM task, at some moments, some FUs may be in an idle state, while some FUs may be in a busy state in the calculation. As an example, assuming that FU_1 in the computing chain is connected to the EC computing scheduler, if FU_1 in a busy state receives a point-adding calculation task to be executed, the point-adding calculation task can be transmitted to the next FU_2; if the next FU_2 is in an idle state, the point-adding calculation task can be executed by the next FU_2, and the execution result can be transmitted back to FU_1. If FU_2 is also in a busy state, the point-adding calculation task can be further transmitted to FU_3, and so on. The execution result after the idle FU executes the point-adding calculation task can be returned to FU_1 along the connection path of each FU in the computing chain, and then transmitted to the EC computing scheduler by FU_1.

[0184] It can be seen from the above embodiments that the accelerator of this embodiment is adaptive to MSM tasks, and MSM tasks can be implemented by any number of FUs. Through the above structure, parallel computing capabilities can be provided for multiple MSM tasks, or large MSM tasks can be divided into multiple smaller sub-tasks, which can provide parallel computing capabilities.

[0185] As an example, there may be one or more NTT schedulers in the accelerator. Considering the high cost of parallel processing of NTT tasks, Fig.9AThe accelerator takes an NTT Scheduler as an example.

[0186] In some examples, the computing resource pool includes multiple NTT pipelines, each of which includes multiple computing units connected in sequence; the NTT scheduler is connected to at least the first computing unit and the last computing unit in each of the NTT pipelines, respectively.

[0187] For a single NTT task, since the input vector is long, some two-dimensional algorithms can be used to split the one-dimensional vector to reduce the data length; after two-dimensional splitting, the data length is the square root of the one-dimensional length. You can also use a three-dimensional algorithm to split, and the data length is reduced to the cube root of the one-dimensional length. Fig. 9C As shown in FIG. 1 , it is a schematic diagram of the NTT algorithm shown in this specification according to an exemplary embodiment. The schematic diagram takes a two-dimensional algorithm as an example. After decomposition, an NTT task can be decomposed into multiple I-sized NTT subtasks and multiple J-sized NTT subtasks shown in the figure. Each NTT subtask can be implemented by the NTT pipelin on the accelerator. Therefore, multiple NTT pipelins can realize parallel processing of NTT subtasks. Among them, after the NTT task is decomposed by using a two-dimensional algorithm or a three-dimensional algorithm, some FUs can be used to perform post-processing of the two-dimensional algorithm or the three-dimensional algorithm, for example Fig. 9C Some modular multiplication operations in step (2) of the NTT algorithm are shown in FIG.

[0188] like Fig. 9B As shown in the figure, when executing the NTT task, the 24 FUs in the computing resource pool can be scheduled into 2 parallel NTT pipelines, each pipeline includes 12 FUs. Multiple NTT pipeline lines are used to implement parallel processing of multiple NTT subtasks. Among them, the n stages in each subtask are executed sequentially, and the calculation of FU needs to rely on the calculation result of the previous FU. Therefore, each FU in a pipeline can be connected sequentially, that is, Fig. 9B The dashed lines with arrows between the FUs are shown.

[0189] In some examples, such as Fig.9A As shown, the accelerator also includes a storage unit share memory shared by the NTT scheduler and the EC calculation scheduler; the storage unit can be used to store: data required for executing the NTT, or data required for executing the EC calculation.

[0190] The NTT scheduler is used to schedule a computing unit from the computing resource pool to execute the butterfly calculation in the NTT based on the data required for executing the NTT stored in the storage unit;

[0191] The EC calculation scheduler is used to schedule a computing unit from the computing resource pool stored in the storage unit to perform the point-add calculation in the EC calculation based on the data required for performing the EC calculation stored in the storage unit.

[0192] In this way, the two types of schedulers can reduce the chip area by sharing storage units.

[0193] like Fig.9D FIG. 1 is a schematic diagram of another FU structure according to an exemplary embodiment of the present specification. In the FU, Fig.9D In , the universal modular multiplier is the circle containing x, the simplified modular multiplier is the rectangle containing scale, the modular adder is the circle containing +, and the modular subtractor is the circle containing -. Fig.9D In the invention, the module including the general modular multiplier, the simplified modular multiplier, the modular adder and the modular subtractor is called the extended butterfly unit.

[0194] In practical applications, FU includes Fig. 8A In addition to the four devices shown, other hardware units may be provided as required, which is not limited in this embodiment. As an example, the FU may further include a storage module, which may include at least three storage areas. Fig.9D The RAM_A, RAM_B, and RAM_C shown in the figure are three storage areas included in the storage module. In actual implementation, these different storage areas can be on one memory or on different memories, which is not limited in this embodiment.

[0195] A butterfly calculation involves three operands, such as the two vectors "a[0]" and "a[4]" shown in formula (14), and the rotation factor Therefore, the three operands that need to be calculated by butterfly can be stored in these three storage areas respectively. Fig.9D As shown in FIG. 1 , NTT_in represents the input of a butterfly calculation to be performed by the FU, RAM_A and RAM_B store vectors, and RAM_C stores rotation factors.

[0196] As shown in formula (14) and Figure 5As shown, in the butterfly calculation, each stage will perform N / 2 butterfly calculations on the data with a constant step size, so the switch module Switch can be used in the NTT accelerator to control the constant step size. The general modular multiplier has two inputs, namely the vector and the rotation factor. The input of the simplified modular multiplier is the modular multiplication result of the general modular multiplier. After the simplified modular multiplier multiplies the modular multiplication result of the general modular multiplier by 1, the result is input to the modular adder and the modular subtractor respectively; the vector stored in RAM_A will be input to the modular adder and the modular subtractor. The modular adder will perform modular addition operation on the vector input by RAM_A and the modular multiplication result input by the simplified modular multiplier. The modular subtractor will perform modular subtraction operation on the vector input by RAM_A and the modular multiplication result input by the simplified modular multiplier. The modular addition result and the modular subtraction result can be output, namely NTT_out in the figure. NTT_out can flow directly to the NTT scheduler.

[0197] As an example, the butterfly calculation may not be implemented by instructions, but may be implemented by FU in a pipeline manner.

[0198] In some examples, the point addition calculation algorithm shown in formula (13) involves multiple modular multiplication operations, modular addition operations, and modular subtraction operations, and the FU includes a general modular multiplier, a simplified modular multiplier, a modular adder, and a modular subtractor. Therefore, it is necessary to use the FU to implement a point addition calculation through multiple operations. As an example, Fig.9D As shown, the computing unit may further include:

[0199] An instruction storage module, storing an instruction sequence for implementing the point addition calculation;

[0200] The instruction execution module is used to control the general modular multiplier, the simplified modular multiplier, the modular adder and the modular subtractor to execute each instruction in the instruction sequence to realize the point addition calculation.

[0201] As an example, the instruction storage module may pre-store the instruction sequence required to implement the point addition calculation. If the parameters or algorithm of the point addition calculation are changed or optimized, it is only necessary to update the instruction sequence in the instruction storage unit.

[0202] As an example, Fig.9D As shown, an instruction reading module Fetch may also be included, which may be used to read instructions in an instruction sequence. For example, once the point addition computing task is started, the instruction reading module may sequentially read instructions in the instruction sequence from the instruction storage module.

[0203] As an example, Fig.9D As shown, an instruction parsing module may also be included, which is used to parse the instruction read by the instruction reading module and provide the parsing result to the instruction execution module.

[0204] As an example, as an example, the instruction sequence includes: a calculation instruction with parameter c, parameter d, parameter f and parameter scale as input and parameter r1 and parameter r2 as output;

[0205] Among them, r1=c+d*f*scale, r2=cd*f*scale; the parameters c, d and f are determined based on the coordinates of the two points to be calculated, and the parameter scale is the preset constant.

[0206] As an example, this embodiment refers to the above instruction as Extended butterfly instruction (EBF):

[0207] Input includes: c, d, f, scale

[0208] Output Output includes: (r1, r2)

[0209] r1=c+d*f*scale

[0210] r2=cd*f*scale

[0211] Taking the elliptic curve shown in formula (1) where a is 0 and b is 3 as an example, a point addition calculation can be implemented by the following 15 calculation instructions:

[0212] Input:P1=(X1,Y1,Z1),P2=(X2,Y2,Z2)

[0213] Output:P3=(X3,Y3,Z3)

[0214] 1(T1,-)=EBF(0,X1,Y2,1)

[0215] 2(T3,-)=EBF(0,Y1,Y2,1)

[0216] 3(T5,-)=EBF(0,Y1,Z2,1)

[0217] 4(T7,-)=EBF(0,X1,Z2,1)

[0218] 5(T11,-)=EBF(0,X1,X2,3)

[0219] 6(T2,-)=EBF(T1,Y1,X2,1)

[0220] 7(T4′,T4)=EBF(T3,Z1,Z2,9)

[0221] 8(T6,-)=EBF(T5,Y2,Z1,1)

[0222] 9(T8,-)=EBF(T7,X2,Z1,1)

[0223] 10(T9,-)=EBF(0,T4,T2,1)

[0224] 11(T12,-)=EBF(0,T4,T4′,1)

[0225] 12(T14,-)=EBF(0,T6,T4′,1)

[0226] 13(-,X3)=EBF(T9,T8,T6,9)

[0227] 14(Y3,-)=EBF(T12,T11,T8,9)

[0228] 15(Z3,-)=EBF(T14,T11,T2,1).

[0229] It can be understood that in actual applications, the multiple EBF instructions included in the instruction sequence can be determined according to the EC specified in the EC calculation task.

[0230] In the above example, the scale parameter includes three integers, 1, 3, and 9. The scale parameter can be determined according to the actually specified EC.

[0231] The above shows the calculation instruction EBF in the instruction sequence. Other types of instructions may be included as needed, such as instructions for assisting the calculation instruction to complete the point addition calculation. The specific instructions may be flexibly set in actual implementation, and this embodiment does not limit this.

[0232] It can be seen from the above embodiments that the calculation process of r1 and r2 in the calculation instruction is unified with the two calculations in the butterfly calculation shown in formula (14), except that the operation of "*scale" is added. This is also the reason why the butterfly calculation multiplies by 1 by simplifying the modular multiplier.

[0233] That is, in this embodiment, an instruction sequence for implementing point addition calculation is designed based on the calculation method of butterfly calculation. The instruction sequence can be implemented based on the aforementioned formula (13), and each instruction in the instruction sequence can be run in a calculation module that supports multiplying the modular multiplication result in butterfly calculation by 1, so as to implement a point addition calculation.

[0234] As an example, in addition to the above-mentioned calculation instructions, the instruction sequence may also include other types of instructions, such as control instructions that assist the calculation instructions to complete the elliptic curve calculation, such as jump instructions, wait instructions, etc. These auxiliary instructions can be used to support calculation processes such as loops and result outputs. In actual implementation, other instructions can be designed according to the algorithm used by the user to implement the elliptic curve calculation.

[0235] As an example, in the process of implementing the multi-scalar multiplication calculation, the at least three storage areas are respectively used to store at least three operands required for the dot addition calculation, and the at least three operands may be c, d and f in the aforementioned calculation instruction. Based on this, the instruction execution module generates storage addresses corresponding to the three operands to coordinate the execution of the extended butterfly module and other modules in the FU to implement the dot addition calculation.

[0236] As an example, Fig.9D As shown, FIFO can be used to buffer the input data PADD_in of the PADD chain. i , that is, each pair of points to be calculated in a subtask of MSM. The instruction execution module can determine the storage addresses of RAM_A, RAM_B and RAM_C, that is, the storage addresses of the three operands in an EBF instruction in these three storage areas. Fig.9D As shown in FIG. 1 , RAM_A can store parameter c in the EBF instruction, and RAM_B and RAM_C can store parameters d and f in the EBF instruction.

[0237] Each EBF may include calculations for r1 and r2. The general modular multiplier has two inputs, which are the parameters d and f in the EBF instruction. The input of the simplified modular multiplier is the modular multiplication result of the general modular multiplier. The simplified modular multiplier multiplies the modular multiplication result of the general modular multiplier by the scale in the EBF instruction, and then inputs the result to the modular adder and the modular subtractor respectively; the parameter c in the EBF instruction stored in RAM_A will be input to the modular adder and the modular subtractor. The modular adder will perform modular addition operations on the parameter c input by RAM_A and the modular multiplication result input by the simplified modular multiplier. The modular subtractor will perform modular subtraction operations on the parameter c input by RAM_A and the modular multiplication result input by the simplified modular multiplier. The modular addition results and the modular subtraction results can be output. For example, in PADD, the intermediate calculation results can be stored in RAMA / RAMB / RAMC of FU, and the final result is output through the output port. Fig.9D The Reorder module takes into account that the result of PADD must be kept in the form of three coordinates, so it implements the adjustment of the bit order.

[0238] As can be seen from the above embodiments, the embodiments of this specification provide an accelerator that can simultaneously support NTT and elliptic curve EC calculations such as MSM. The accelerator is based on the same underlying computing unit FU, which can support both MSM and NTT, thus reducing the total chip area. When executing EC computing tasks such as MSM or NTT tasks, the accelerator can achieve a high computing unit utilization rate.

[0239] In some examples, the accelerator of this embodiment may be pluggable; for example, the computing device of this embodiment may serve as a hardware accelerator of a host and may be set on the host in a pluggable manner. When the host needs it, the host may use the accelerator of this embodiment to perform NTT and EC calculations, such as for zero-knowledge proof tasks.

[0240] In some examples, the accelerator includes an application-specific integrated circuit (ASIC) or a hardware accelerator based on a field programmable gate array (FPGA).

[0241] In this embodiment, EC computing and NTT are organically integrated, and computing and storage resources are shared by the EC computing scheduler and the NTT scheduler. If only EC computing scheduling is working, the main computing and storage resources are also utilized, achieving a high resource utilization rate. Moreover, these computing and storage resources occupy most of the area in the accelerator chip. Experiments have shown that the accelerator with a unified architecture in this embodiment can reduce the chip area by 41% and improve the performance per unit area by 1.7x compared to MSM and NTT independent accelerators. Compared with similar accelerators, the performance and performance per unit area are also higher. The core computing unit FU of this embodiment realizes resource reuse with NTT, and develops an instruction-level architecture based on the computing unit to implement MSM. This architecture can flexibly increase or decrease the number of computing units while maintaining high utilization of computing units.

[0242] The embodiment of this specification also provides a chip, such as Fig.10 As shown, the chip may include an accelerator supporting number theory transformation NTT and elliptic curve EC calculation in any of the above embodiments. In practical applications, in addition to the above accelerator, the chip may also include other hardware units as needed, which is not limited in this embodiment.

[0243] The embodiment of this specification also provides a computer device, such as Fig.11 As shown, the computer device may include one or more accelerators supporting number theoretic transformation NTT and elliptic curve EC calculations in any of the aforementioned embodiments.

[0244] The embodiment of this specification also provides a calculation method, which can be applied to an accelerator in any of the above embodiments, the accelerator supports number theory transformation NTT and elliptic curve EC calculation, and the accelerator includes:

[0245] A scheduling unit and a computing resource pool, wherein the computing resource pool includes at least one computing unit, and each computing unit includes:

[0246] Universal modular multiplier;

[0247] A simplified modular multiplier, connected to the universal modular multiplier, for performing modular multiplication on the modular multiplication result of the universal modular multiplier and a preset constant;

[0248] a modular subtractor, connected to the simplified modular multiplier, and configured to perform a modular subtraction operation based on an operation result output by the simplified modular multiplier; and

[0249] A modular adder connected to the simplified modular multiplier and configured to perform a modular addition operation based on an operation result output by the simplified modular multiplier;

[0250] If an NTT computing task is received, the scheduling unit schedules a computing unit from the computing resource pool to perform the butterfly computing in the NTT, and the preset constant is 1;

[0251] If a point addition calculation task is received, the scheduling unit schedules a calculation unit from the calculation resource pool to perform the point addition calculation in the EC calculation to add two points on the EC, and the preset constant is a constant related to the parameters in the equation representing the EC.

[0252] In some examples, the scheduling unit includes:

[0253] An NTT scheduler, configured to schedule computing units from the computing resource pool to perform butterfly computing in the NTT; and

[0254] The EC computing scheduler is used to schedule computing units from the computing resource pool to perform point-to-point computing in the EC computing.

[0255] In some examples, the accelerator further includes a storage unit shared by the NTT scheduler and the EC compute scheduler;

[0256] The storage unit is used to store data required for executing the NTT or the data required for executing the EC calculation;

[0257] The NTT scheduler is used to schedule a computing unit from the computing resource pool to execute the butterfly computing in the NTT based on the data required for executing the NTT stored in the storage unit;

[0258] The EC calculation scheduler is used to schedule a computing unit from the computing resource pool stored in the storage unit to perform the point-add calculation in the EC calculation based on the data required for performing the EC calculation stored in the storage unit.

[0259] In some examples, the computing unit further includes:

[0260] An instruction storage module, storing an instruction sequence for implementing the point addition calculation;

[0261] The instruction execution module is used to control the general modular multiplier, the simplified modular multiplier, the modular adder and the modular subtractor to execute each instruction in the instruction sequence to realize the point addition calculation.

[0262] In some examples, the instruction sequence includes: a calculation instruction with parameters c, d, f and scale as inputs and parameters r1 and r2 as outputs; wherein,

[0263] r1=c+d*f*scale, r2=cd*f*scale;

[0264] The parameter c, parameter d and parameter f are determined based on the coordinates of the two points to be calculated on the EC, and the parameter scale is the preset constant.

[0265] In some examples, the computing unit further includes: a storage module, the storage module including at least three storage areas;

[0266] In the process of implementing the butterfly calculation, the at least three storage areas are respectively used to store at least three operands required to perform the butterfly calculation;

[0267] In the process of implementing the dot addition calculation, the at least three storage areas are respectively used to store at least three operands required for the dot addition calculation; wherein the at least three operands of the dot addition calculation include the parameter c, parameter d and parameter f.

[0268] In some examples, the computing resource pool includes a plurality of computing chains, each of which includes a plurality of cascaded computing units, and each of the computing chains corresponds to one of the EC computing schedulers;

[0269] Each of the EC computing schedulers is connected to at least one computing unit in the corresponding computing chain.

[0270] In some examples, the EC calculation includes a plurality of multi-scalar multiplication calculation tasks; the plurality of calculation chains are used to process the plurality of multi-scalar multiplication calculation tasks in parallel; and / or,

[0271] The EC calculation includes splitting a multi-scalar multiplication calculation task into multiple subtasks; the multiple calculation chains are used to process the multiple subtasks in parallel.

[0272] In some examples, the computing resource pool includes a plurality of NTT pipelines, and the NTT pipeline includes a plurality of computing units connected in sequence;

[0273] The NTT scheduler is connected to at least the first computing unit and the last computing unit in each of the NTT pipelines.

[0274] In some examples, the accelerator is used to perform zero-knowledge proof tasks.

[0275] In some examples, this embodiment may also provide a computing method, which is applied to a computer device, wherein the computer device includes at least one processor CPU and at least one accelerator of any of the aforementioned embodiments that communicates with the processor CPU.

[0276] In some examples, a processor CPU in a computer device may send an NTT task or an MSM task to one or more accelerators, specifically to a scheduling unit in the accelerator, so that the accelerator completes the NTT task or the MSM task.

[0277] In some examples, each accelerator may execute the calculation method of the aforementioned embodiment. For an NTT task, the NTT calculation result may be obtained through multiple butterfly calculations, and the accelerator may return the calculation result to the CPU.

[0278] In some examples, each accelerator may execute the calculation method of the aforementioned embodiment. For an MSM task, an MSM calculation result may be obtained through multiple point addition calculations, and the accelerator may return the calculation result to the CPU.

[0279] In some examples, the CPU can issue multiple MSM tasks, or a large MSM task can be divided into several small subtasks, and multiple MSM tasks or subtasks of an MSM task can be assigned to multiple MSM schedulers in the accelerator for parallel processing. The assignment of MSM tasks, the splitting of MSM tasks, and the assignment of subtasks to MSM schedulers can be flexibly configured as needed.

[0280] The computing resource pool in the accelerator includes multiple computing chains, each of which includes multiple cascaded computing units, each computing chain corresponds to an EC computing scheduler; each EC computing scheduler is connected to at least one computing unit in the corresponding computing chain. Multiple computing chains are used to process multiple subtasks in parallel.

[0281] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0282] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0283] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0284] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0285] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0286] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0287] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0288] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0289] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0290] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0291] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0292] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0293] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0294] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0295] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. An accelerator supporting number theory transformation NTT and elliptic curve EC calculation, the accelerator include: A computing resource pool, the computing resource pool comprising at least one computing unit, each of the computing units comprising: Universal modular multiplier; A simplified modular multiplier, connected to the universal modular multiplier, for performing modular multiplication on the modular multiplication result of the universal modular multiplier and a preset constant; a modular subtractor, connected to the simplified modular multiplier, and configured to perform a modular subtraction operation based on an operation result output by the simplified modular multiplier; and A modular adder connected to the simplified modular multiplier and configured to perform a modular addition operation based on an operation result output by the simplified modular multiplier; a scheduling unit, configured to schedule a computing unit from the computing resource pool to perform a butterfly calculation in the NTT and / or a point addition calculation of adding two points on the EC in the EC calculation; Wherein, if the butterfly calculation is performed, the preset constant is 1; If the point addition calculation is performed, the preset constant is a constant related to the parameter in the equation representing the EC.

2. The accelerator according to claim 1, wherein the scheduling unit include: An NTT scheduler, configured to schedule computing units from the computing resource pool to perform butterfly computing in the NTT; and The EC computing scheduler is used to schedule computing units from the computing resource pool to perform point-to-point computing in the EC computing.

3. The accelerator according to claim 2, further comprising a storage unit shared by the NTT scheduler and the EC computing scheduler; The storage unit is used to store data required for executing the NTT or the data required for executing the EC calculation; The NTT scheduler is used to schedule a computing unit from the computing resource pool to execute the butterfly computing in the NTT based on the data required for executing the NTT stored in the storage unit; The EC calculation scheduler is used to schedule a computing unit from the computing resource pool stored in the storage unit to perform the point-add calculation in the EC calculation based on the data required for performing the EC calculation stored in the storage unit.

4. The accelerator according to claim 1, wherein the computing unit further comprises: include: An instruction storage module, storing an instruction sequence for implementing the point addition calculation; The instruction execution module is used to control the general modular multiplier, the simplified modular multiplier, the modular adder and the modular subtractor to execute each instruction in the instruction sequence to realize the point addition calculation.

5. The accelerator according to claim 4, wherein the instruction sequence include: A calculation instruction with parameters c, d, f and scale as input and parameters r1 and r2 as output; wherein, r1=c+d*f*scale, r2=cd*f*scale; The parameter c, parameter d and parameter f are determined based on the coordinates of the two points to be calculated on the EC, and the parameter scale is the preset constant.

6. The accelerator according to claim 5, wherein the computing unit further comprises: include: A storage module, wherein the storage module includes at least three storage areas; In the process of implementing the butterfly calculation, the at least three storage areas are respectively used to store at least three operands required to perform the butterfly calculation; In the process of implementing the dot addition calculation, the at least three storage areas are respectively used to store at least three operands required for the dot addition calculation; wherein the at least three operands of the dot addition calculation include the parameter c, parameter d and parameter f.

7. The accelerator according to claim 2, wherein the computing resource pool comprises a plurality of computing chains, each of the computing chains comprises a plurality of cascaded computing units, and each of the computing chains corresponds to one of the EC computing schedulers; Each of the EC computing schedulers is connected to at least one computing unit in the corresponding computing chain.

8. The accelerator according to claim 7, wherein the EC calculation comprises a plurality of multi-scalar multiplication calculation tasks; and the plurality of calculation chains are used to process the plurality of multi-scalar multiplication calculation tasks in parallel. ； and / or, The EC calculation includes splitting a multi-scalar multiplication calculation task into a plurality of subtasks; The multiple computing chains are used to process the multiple subtasks in parallel.

9. The accelerator according to claim 1, wherein the computing resource pool comprises a plurality of NTT pipelines, and the NTT pipeline comprises a plurality of computing units connected in sequence; The NTT scheduler is connected to at least the first computing unit and the last computing unit in each of the NTT pipelines.

10. The accelerator according to claim 1, wherein the accelerator is used to perform a zero-knowledge proof task.

11. A chip, comprising an accelerator supporting number theoretic transformation NTT and elliptic curve EC calculation as claimed in any one of claims 1 to 10.

12. A computer device, comprising an accelerator supporting number theoretic transformation (NTT) and elliptic curve (EC) calculation according to any one of claims 1 to 10.

Images