Processor for encryption and decryption, chip and electronic equipment

Abstract

The invention provides a processor for encryption and decryption, a chip and electronic equipment. The processor comprises a plurality of butterfly-shaped units, a plurality of operation subunits of the butterfly-shaped units are connected with one another, a switch piece between any two operation subunits is used for connection or disconnection, and the operation subunits perform operation based on corresponding first operators; the processor adjusts the state of each switch piece in each butterfly unit based on the mode selection signal so as to adjust the connection relation between the operation subunits to be matched with the mode selection signal, and the operation mode corresponding to the mode selection signal comprises at least one of a plurality of preset operation modes. The connection relation of the operation subunits of the butterfly units can be adjusted to adapt to different operation modes, so that the number of the butterfly units is greatly reduced, the cost can be reduced, the circuit complexity can be reduced, operation is executed in a hardware mode, the operation speed of the encryption and decryption process is greatly improved, and the encryption and decryption efficiency is improved.

Description

Technical Field

[0001] The present application relates to the fields of post-quantum cryptographic algorithms, information security, cryptographic processors, and hardware circuit design and implementation, and in particular to a processor, chip, and electronic device for encryption and decryption. Background Art

[0002] In order to cope with the security threats brought by the rapid development of quantum computing technology to the traditional public key cryptography system, the transition of existing encryption technology to quantum-safe post-quantum cryptography (PQC) technology is becoming a research hotspot in the field of international cryptography theory and technology.

[0003] However, existing processors used for encryption and decryption have poor flexibility and slow computing speed when processing post-quantum cryptographic algorithms, and are not sufficient to perform encryption and decryption efficiently and quickly. Summary of the invention

[0004] The embodiments of the present application provide a processor, a chip, and an electronic device for encryption and decryption, which reduces the number of butterfly units, improves the computing speed, and can implement encryption and decryption quickly and efficiently.

[0005] An embodiment of the present application provides a processor for encryption and decryption, including multiple butterfly units, wherein the butterfly units include a hardware structure unit for performing butterfly operations and inverse butterfly operations, wherein the butterfly units include multiple operator units and switch elements, wherein the multiple operator units are interconnected, wherein the switch element is provided between any two of the operator units, wherein the switch element is used to turn on or off the connection between the corresponding two operator units, wherein the operator units perform operations based on the corresponding first operator; wherein the processor adjusts the states of the switch elements in each of the butterfly units based on a mode selection signal, so as to adjust the connection relationship between each of the operator units to match the mode selection signal, wherein the operation mode corresponding to the mode selection signal includes at least one of multiple preset operation modes.

[0006] In some embodiments, when the connection relationship between the operator units of the butterfly unit is different, the corresponding operations in the corresponding first operator and / or second operator can be executed, and the second operator includes multiple first operators.

[0007] In some embodiments, the first operator includes at least one of a modular addition operation, a modular subtraction operation, a modular multiplication operation, and a 1 / 2 modular multiplication operation, and the second operator includes at least one of a modular reduction operation, a butterfly operation, an inverse butterfly operation, an NTT operation, an inverse number-theoretic transform (INTT) operation, a polynomial phase multiplication (PWM) operation, a compression operation, and a decompression operation.

[0008] In some embodiments, each of the operation modes has a corresponding pipeline, and the processor is used to process input data based on the pipeline corresponding to the operation mode to output an operation result.

[0009] In some embodiments, the pipeline includes a plurality of stages, each of the stages is executed by a corresponding butterfly unit, and an operator of the butterfly unit corresponding to each of the stages matches an operator preset in each of the stages.

[0010] In some embodiments, the pipeline is a 5-stage pipeline, and the pipeline includes 5 stages.

[0011] In some embodiments, the stage includes a modular reduction stage, each of the pipelines includes 3 modular reduction stages, the modular reduction stage is implemented by a remainder operation, and the operation result of the previous modular reduction stage serves as the input of the next modular reduction stage.

[0012] In some embodiments, the 1 / 2 modular multiplication operation is implemented based on a shift operation, an addition operation, and a logical AND operation.

[0013] In some implementations, the memory pre-stores preset compression parameters generated based on a preset modulus corresponding to the compression operation, so that the division operation in the compression operation becomes a shift operation.

[0014] In certain embodiments, the modular reduction uses a Barrett modular reduction algorithm.

[0015] In some embodiments, the operation modes include an INTT mode, an NTT mode, a first polynomial bitwise multiplication mode, and a second polynomial bitwise multiplication mode.

[0016] In some embodiments, the memory pre-stores the result parameters of the preset polynomial coefficients corresponding to the INTT mode after 1 / 2 modular multiplication; the processor reads the result parameters stored in the memory, and processes the input data based on the result parameters and the INTT mode to output the operation results.

[0017] The present application also provides a processor including any one of the above embodiments.

[0018] In some embodiments, the chip also includes a first memory and a second memory, and each of the operation modes has a corresponding polynomial; when calculating the odd terms of the polynomial, the processor reads the input data from the first memory and stores the operation results corresponding to the input data in the second memory; when calculating the even terms of the polynomial, the processor reads the input data from the second memory and stores the operation results corresponding to the input data in the first memory.

[0019] In some embodiments, the chip also includes a register, and the input data read by the processor from the target memory is cached in the register, the target memory is the first memory or the second memory, the input data includes a first part of data and a second part of data, and the operation result includes a first operation result and a second operation result. The processor is also used to: read the first part of data from the register in the Kth cycle, and process the first part of data based on the pipeline corresponding to the operation mode to obtain a first operation result; in the K+1th cycle, process the second part of data based on the pipeline corresponding to the operation mode to obtain a second operation result.

[0020] The present application also provides an electronic device, comprising a chip according to any of the above embodiments.

[0021] The processor, chip and electronic device for encryption and decryption of the present application generate a mode selection signal corresponding to the operation mode by analyzing the various operations required in the encryption and decryption process, and adjust the connection relationship between the various operation sub-units of multiple butterfly units based on the mode selection signal. Compared with the existing butterfly units, the general connection relationship is fixed, and each operation mode requires a specific number of butterfly units. Since a large number of butterfly units are required, the connection relationship of the operation sub-units of the butterfly units can be adjusted to adapt to different operation modes, thereby greatly reducing the number of butterfly units, which can not only reduce costs, but also reduce circuit complexity, and perform operations in hardware, which greatly improves the operation speed of the encryption and decryption process and improves the efficiency of encryption and decryption.

[0022] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0024] Figure 1 is a schematic diagram of a processor structure for encryption and decryption in certain implementation modes of the present application;

[0025] Figure 2 is a schematic diagram of a butterfly unit of a processor for encryption and decryption in certain embodiments of the present application;

[0026] Figure 3 It is a schematic diagram of the hardware structure of a modular addition operation of a processor for encryption and decryption in certain embodiments of the present application;

[0027] Figure 4 It is a pipeline diagram of a processor for encryption and decryption in certain embodiments of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and cannot be understood as limiting the embodiments of the present application.

[0029] In the present application, unless otherwise clearly specified and limited, a first feature being “above” or “below” a second feature may mean that the first and second features are in direct contact, or the first and second features are in indirect contact through an intermediate medium. Moreover, a first feature being “above”, “above”, and “above” a second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the first feature is higher in level than the second feature. A first feature being “below”, “below”, and “below” a second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the first feature is lower in level than the second feature.

[0030] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one feature. In the description of this application, the meaning of "plurality" is at least two, such as two, three, unless otherwise clearly and specifically defined.

[0031] See also Figure 1 , the embodiment of the present application provides a processor for encryption and decryption, including:

[0032] A plurality of butterfly units, wherein the butterfly units include a plurality of operator units and switch elements, wherein the plurality of operator units are connected to each other, and a switch element is provided between any two operator units, and the switch element is used to switch on or off the connection between the corresponding two operator units, and the operator unit performs operations based on the corresponding first operator;

[0033] Optionally, the butterfly unit may be a hardware structure unit for performing butterfly operations and inverse butterfly operations.

[0034] Specifically, in the algorithm based on lattice cryptography, polynomial multiplication is a key step, which consumes most of the time and resources, while the number theory transformation (NTT) based on butterfly operation can quickly implement polynomial multiplication. Therefore, a butterfly unit is designed based on the calculation process of the lattice cryptography algorithm. The butterfly unit includes multiple operator units, such as modular addition operator unit, modular subtraction operator unit, modular multiplication operator unit, etc. Each operator unit corresponds to each first operator and performs the operation corresponding to each first operator.

[0035] For example, the first operator corresponding to the modular addition operator unit is a modular addition operator. The modular addition operator unit uses a simple adder and subtractor to perform processing and judgment based on whether there is a borrow in the subtractor result to implement the modular addition operation.

[0036] For another example, the first operator corresponding to the modular subtraction operator unit is a modular subtraction operator. The modular subtraction operator unit uses a simple comparator and adder to perform processing and judgment based on whether there is a borrow in the subtractor result. If there is a borrow, the modulus is added to implement the modular subtraction operation.

[0037] In order to ensure that the butterfly unit can adapt to various operation modes, multiple operator units in the butterfly unit are connected to each other, and a switch device (such as a bipolar transistor (Bipolar Junction Transistor, BJT) and a field-effect transistor (Field-Effect Transistor, FET), an insulated gate bipolar transistor (IGBT, Insulated Gate Bipolar Transistor), etc.) is arranged between any two operator units. The switch device is used to turn on or off the connection between the corresponding two operator units, thereby changing the connection relationship and sequence between the multiple operator units.

[0038] For example, the butterfly unit includes a modular addition operator unit A, a modular subtraction operator unit D, and a modular multiplication operator unit X. Since the three are interconnected, and the input and output ends of the butterfly unit can also be selectively connected to the three, the input of the butterfly unit can selectively enter any one of the three, and the output of any one of the three can be used as the final output. The connection relationship and the order of connection can be input, ADX, output; input, AXD, output; input, DAX, output; input, DXA, output; input, XAD, output; input, XDA, output.

[0039] The processor adjusts the states of the switches in the butterfly units based on the mode selection signal to adjust the connection relationship between the operation sub-units to match the mode selection signal. The operation mode corresponding to the mode selection signal includes at least one of a plurality of preset operation modes.

[0040] Optionally, the mode selection signal may be a signal for selecting an operation mode performed by the butterfly unit, and the butterfly unit selects a corresponding operation mode according to the mode selection signal and performs a corresponding operation.

[0041] Optionally, the preset operation mode may be various operation modes implemented based on the butterfly unit, such as an NTT operation mode, an inverse numerological transform (INTT) operation mode, a polynomial phase-to-phase multiplication (PWM) operation mode, and the like.

[0042] Specifically, the processor needs to perform different operations at different stages of the encryption and decryption process, such as NTT operation, INTT operation, PWM operation, etc. There are different connection relationships between the various operation sub-units of the butterfly unit. The processor can adjust the connection relationship between the various operation sub-units in each butterfly unit based on the mode selection signal, so that the connection relationship and sequence of the butterfly unit conform to the operator structure required by the corresponding operation mode, so that each butterfly unit can perform the operation of the corresponding operation mode based on the adjusted connection relationship and sequence between the various operation sub-units.

[0043] For example, see Figure 2 , the connection relationship between each operator unit of the butterfly unit in the NTT operation mode and the INTT operation mode, where the left side is the connection relationship between each operator unit in the NTT operation mode, and the right side is the connection relationship between each operator unit in the INTT operation mode.

[0044] Currently, in the process of encryption and decryption, executing some operations in software requires a lot of time and resources, making the efficiency of encryption and decryption extremely low.

[0045] The processor for encryption and decryption of the present application generates a mode selection signal corresponding to the operation mode by analyzing various operations required in the encryption and decryption process, and adjusts the connection relationship between each operation sub-unit of multiple butterfly units based on the mode selection signal. Compared with the existing butterfly units, the general connection relationship is fixed, and each operation mode requires a specific number of butterfly units. Since a large number of butterfly units are required, the connection relationship of the operation sub-units of the butterfly units can be adjusted to adapt to different operation modes, thereby greatly reducing the number of butterfly units, which can not only reduce costs, but also reduce circuit complexity, and perform operations by hardware, which greatly improves the operation speed of the encryption and decryption process and improves the efficiency of encryption and decryption.

[0046] In some embodiments, when the connection relationship between the operator units of the butterfly unit is different, the corresponding operations in the corresponding first operator and / or second operator can be executed, and the second operator includes multiple first operators.

[0047] Specifically, the various operator units in the butterfly unit can be connected and combined in different ways. The implementation of the first operator function is based on the connection and combination of the various operator units in the butterfly unit, and the implementation of the function of the second operator can be based on the connection and combination of multiple first operators. Based on the operation process of each first operator, the various operator units in the butterfly unit are connected accordingly, and the butterfly unit performs corresponding operations according to the connection relationship of each operator unit to realize the function of the corresponding first operator.

[0048] For example, see Figure 3 A hardware structure for performing modular addition operation. If the first operator of the modular addition operation needs to be performed, the adder and the subtractor in the operator unit in the butterfly unit are connected and logically combined accordingly, and the processing judgment is performed according to whether the operation result exceeds the range of the prime number q.

[0049] In some embodiments, the first operator includes at least one of modular addition operation, modular subtraction operation, modular multiplication operation and 1 / 2 modular multiplication operation, and the second operator includes at least one of modular reduction operation, butterfly operation, inverse butterfly operation, NTT operation, INTT operation, polynomial bitwise multiplication operation PWM, compression operation and decompression operation.

[0050] Specifically, the first operator is various basic operators, and the first operator includes at least one of a modular addition operation, a modular subtraction operation, a modular multiplication operation, and a 1 / 2 modular multiplication operation.

[0051] The modular addition operation refers to the operation of taking the remainder of two integers with respect to a given positive integer (called the modulus) after the addition operation.

[0052] Modular subtraction refers to the operation of taking the remainder of a given positive integer (modulus) after subtracting two integers. For example, see Table 1 for pseudocodes of modular addition and modular subtraction.

[0053]

[0054] Table 1

[0055] Modular multiplication refers to the operation of taking the modulus of a given positive integer (modulus) after multiplying two integers. 1 / 2 modular multiplication refers to dividing the input data by 2 and then taking the remainder of the modulus q, which can be expressed as: x / 2mod. For example, Table 2 is the pseudo code for 1 / 2 modular multiplication.

[0056]

[0057] Table 2

[0058] The second operator includes at least one of a modular reduction operation, a butterfly operation, an inverse butterfly operation, an NTT operation, an INTT operation, a polynomial bitwise multiplication operation PWM, a compression operation, and a decompression operation.

[0059] Modular reduction is a mathematical operation based on the concepts of division and remainder, which is an operation of dividing a large integer (or polynomial) by a smaller integer (or polynomial) and taking the remainder. The modular reduction operation process includes modular addition, modular subtraction, modular multiplication and modular operation.

[0060] The butterfly operation is a calculation method based on the fast Fourier transform algorithm. The butterfly operation operator is executed by generating a butterfly operation structure through logical combination of various operator units in the butterfly unit.

[0061] The inverse butterfly operation is an operation process of the inverse fast Fourier transform, which is the inverse operation of the fast Fourier transform. It adopts a butterfly operation structure similar to the butterfly operation, but the operation process and purpose are opposite to each other, and realizes the execution of the inverse butterfly operation operator.

[0062] The NTT operation is a fast transformation algorithm defined in the modular domain. It uses the properties of modular operations and concepts in number theory to implement fast convolution operations on integer sequences. The NTT operation operator is implemented based on multiple first operators.

[0063] The INTT operation is the inverse process of the NTT operation, which is the process of converting the result after the NTT transformation back to the original domain. In the modular operation environment, it is used to restore the original polynomial coefficients. The INTT operation uses a butterfly operation structure similar to NTT, including multiple first operators.

[0064] Polynomial bitwise multiplication PWM is to perform bitwise multiplication of the coefficients of two polynomials in the algorithm.

[0065] For example, see Table 3 for pseudo code of bitwise multiplication of PWM by polynomials.

[0066]

[0067] Table 3

[0068] Among them, the polynomials f(x) and g(x) both have 256 coefficients, br represents bit flipping, and the polynomial multiplication PWM operation of f(x) and g(x) is performed h(x)=f(x)*g(x), then the coefficients are:

[0069]

[0070] After expansion and modulus, the corresponding coefficients are equal:

[0071]

[0072] Compression operations mainly involve compressing encrypted data to reduce the storage space it occupies or improve transmission efficiency. The processor compresses the encrypted data through the compression operator to reduce the storage space occupied and improve transmission efficiency.

[0073] For example, see Table 4 for the pseudocode of the ciphertext compression and decompression functions.

[0074]

[0075] Table 4

[0076] Among them, the ciphertext compression function can be defined as:

[0077]

[0078] The decompression operation is an operation performed to restore the compressed ciphertext data to the original ciphertext data when it is received. In order to restore the compressed ciphertext data to the original, uncompressed ciphertext data, the processor selects a decompression algorithm that matches the compression algorithm selected by the compression operation and performs a decompression operation on the compressed ciphertext data.

[0079] For example, please refer to Table 4 again for the pseudo code of the ciphertext compression function and decompression function. q The ciphertext decompression function corresponding to (x,q) is:

[0080] Decompress q (x,d)=[q / 2 d ·x]

[0081] In this way, the operations of the basic operator (ie, the first operator) and the advanced operator (ie, the second operator) in the encryption and decryption process are performed in the hardware structure of the butterfly unit, which greatly improves the operation efficiency compared to performing the operations in software.

[0082] In some embodiments, each operation mode has a corresponding pipeline, and the processor is used to process input data based on the pipeline corresponding to the operation mode to output the operation result.

[0083] Optionally, the pipeline can be the operation process corresponding to each operation mode. Inside the butterfly unit, the operation process corresponding to each operation mode is decomposed into a series of continuous, overlapping steps or stages, and this series of continuous steps or stages constitutes the pipeline. Each stage of the pipeline is completed by a dedicated hardware circuit (i.e., an operation subunit), and these stages can process different instructions in parallel, thereby improving the execution efficiency of the butterfly unit.

[0084] Specifically, the butterfly unit can execute different operation modes based on the mode selection signal. In different operation modes, each operation that the butterfly unit needs to execute has a specific execution process, and these operation processes are closely related to the corresponding operation mode. Therefore, based on the execution process of each operation in each operation mode, the operation process of each operation mode is decomposed to generate a corresponding pipeline. When the input data is obtained, the input data is processed based on the pipeline corresponding to the operation mode to output the operation result.

[0085] For example, see Figure 4 , which is a pipeline schematic diagram corresponding to the NTT operation mode, INTT operation mode, PWM0 operation mode, and PWM1 operation mode.

[0086] Among them, the operation process corresponding to the NTT operation mode is multiplication operation, modular reduction operation, modular addition operation and modular subtraction operation. Based on the pipeline corresponding to the NTT operation mode, the input data is processed according to the operation sequence corresponding to the pipeline, and finally the operation result corresponding to the INTT operation mode is output.

[0087] In some embodiments, the pipeline includes multiple stages, each stage is executed by a corresponding butterfly unit, and the operator of the butterfly unit corresponding to each stage matches the operator preset in each stage.

[0088] Specifically, each stage of the pipeline corresponds to the operation that the butterfly unit needs to perform, and the butterfly unit decomposes the operation process corresponding to the operation mode contained in the pipeline into various stages, that is, corresponding to each stage of the pipeline. The operation of each stage of the pipeline needs to be executed by the operator corresponding to the butterfly unit, and the operator of the butterfly unit matches the preset operator of each stage of the pipeline.

[0089] For example, see again Figure 4 The NTT operation first calculates modular multiplication and then modular reduction, while the INTT operation first calculates modular addition and subtraction and then modular multiplication. The order of calculation of the two is different. The butterfly unit corresponding to the first stage of the NTT operation pipeline presets the modular addition operator and the modular subtraction operator, and the butterfly unit corresponding to the first stage of the INTT operation pipeline presets the modular multiplication operator.

[0090] In this way, the butterfly units and operators corresponding to each stage of the pipeline are matched, so that the butterfly units execute the corresponding operators, and the orderly execution of each operation mode is realized.

[0091] Optionally, a cache register is inserted after the butterfly operator unit that executes the modular addition and subtraction operator and the modular multiplication operator to cache intermediate values ​​calculated by operators corresponding to different pipeline stages, and execute them sequentially according to the pipeline order.

[0092] In some embodiments, the pipeline is a 5-stage pipeline, and the pipeline includes 5 stages.

[0093] For details, please refer again to Figure 4 In order to realize the orderly operation of each operation mode, multiple cache registers are inserted in the butterfly operation unit to cache the intermediate results and perform arbitration output according to the control signal. Based on multiple cache registers, the pipeline is divided into five stages. The operation results of each stage are cached in the cache register, and the subsequent corresponding operations are performed based on the operation mode.

[0094] In this way, by inserting multiple cache registers in the butterfly operation unit, the five-stage division of the pipeline is realized, the critical path length is reduced, and the butterfly unit inputs new operation data every cycle, which greatly improves the operation efficiency.

[0095] In some embodiments, the stage includes a modular reduction stage, each pipeline includes 3 modular reduction stages, the modular reduction stage is implemented by taking the remainder operation, and the operation result of the previous modular reduction stage is used as the input of the next modular reduction stage.

[0096] Specifically, in the pipeline corresponding to each operation mode, a modular reduction operation process is included. Since there are intermediate values ​​in the modular reduction operation process, the modular reduction operation process is divided into three consecutive modular reduction stages. Each modular reduction stage performs the corresponding operation, and the operation result of the previous modular reduction stage is temporarily stored in the cache register. The next modular reduction stage reads the operation result from the cache register and uses it as the input of this modular reduction stage.

[0097] In this way, by dividing the modular reduction operation process into three modular reduction stages, the intermediate values ​​calculated in the modular reduction operation process are temporarily stored in the cache register. After the calculation of the previous modular reduction stage is completed, new operation data can be input and the corresponding operation can be performed without waiting for the completion of the subsequent modular reduction stage operation. This not only improves the operation efficiency of the modular reduction operation process, but also realizes the precise control and orderly execution of the modular reduction operation process, thereby improving the accuracy of the modular reduction operation process.

[0098] In some embodiments, the 1 / 2 modular multiplication operation is implemented based on a shift operation, an addition operation, and a logical AND operation.

[0099] Specifically, please refer to Table 5, which is the pseudo code for the 1 / 2 modular multiplication operation.

[0100]

[0101] Table 5

[0102] The 1 / 2 modular multiplication operation needs to process the parity of x separately. When x is an even number, x / 2 can be directly shifted; however, when x is an odd number, since there is a decimal term after the shift, x needs to be changed to an even number modulo q and then shifted. x+q is an even number modulo q. After completing the shift operation, the result of the 1 / 2 modular multiplication operation is obtained based on the logical and budget.

[0103] In some embodiments, the memory pre-stores preset compression parameters generated based on a preset modulus corresponding to the compression operation, so that the division operation in the compression operation becomes a shift operation.

[0104] Specifically, during the encryption and decryption process, the ciphertext needs to be compressed, and the ciphertext compression function is:

[0105]

[0106] Where x is the input data of the compression operation, and d may take values ​​of 1, 4, 5, 10, or 11. In the compression ciphertext function, 2 d / q is a division operation, which takes a long time to operate. Therefore, based on the preset modulus q, the preset compression parameter 2580335 is stored in the memory. d / q is replaced by 2580335 / 2 33-d .2580335 / 2 33-d The operation can be directly shifted to obtain, thus, the original complex division operation 2 d / q is replaced with a simple shift operation, which improves the operational efficiency of the ciphertext compression function.

[0107] In some embodiments, the modular reduction employs Barrett's modular reduction algorithm.

[0108] Specifically, please refer to Table 6, the pseudocode of the Barrett modular reduction operator.

[0109]

[0110]

[0111] Table 6

[0112] Modular reduction is an operation that divides a large integer (or polynomial) by a smaller integer (or polynomial) and takes the remainder. The Barrett modular reduction algorithm avoids directly performing the division operation by precomputation and constructing an approximate quotient. By choosing an appropriate base and precomputation, the algorithm can transform the division into multiplication, addition, and shift operations, thereby improving the computational efficiency.

[0113] For example, for 0 ≤ x < q and 0 ≤ y < q, then xy < q 2 . To calculate the remainder of xy mod q, let res = xy mod q and prod = xy. Then there exist 0 ≤ quo, res < q such that prod = q · quo + res. Since Thus, for a fixed modulus q, a fixed value can be precomputed Using this fixed value μ to estimate the quotient, that is The approximate quotient dif can be obtained: belongs to [-3q, 2q). The approximate quotient dif approximates the true quotient. Therefore, by handling different concentrated cases separately, the remainder res can be obtained.

[0114] In this way, in the modular reduction algorithm, the Barrett modular reduction algorithm is adopted to transform the division into multiplication, addition, and shift operations, avoiding directly performing the division operation and improving the computational efficiency.

[0115] In some embodiments, the operation modes include the INTT mode, the NTT mode, the first polynomial bitwise multiplication mode, and the second polynomial bitwise multiplication mode.

[0116] Specifically, the operations that consume a long time and resources in the encryption and decryption processes mainly include INTT operations, NTT operations, and polynomial bitwise multiplication operations. The butterfly unit can perform different operations through the connection and logical combination of each operation sub-unit in the butterfly unit. Therefore, the processor matches the butterfly unit to the corresponding operation mode according to the mode signal. The operations implemented based on the butterfly unit include the INTT mode, the NTT mode, the first polynomial bitwise multiplication mode, and the second polynomial bitwise multiplication mode. Among them, the intermediate variable obtained by the first polynomial bitwise multiplication operation is used as the input data for the second polynomial bitwise multiplication mode.

[0117] In this way, the operations that consume a long time and resources in the encryption and decryption processes are executed by the butterfly unit, greatly improving the operation speed and the encryption and decryption efficiency.

[0118] In some embodiments, the memory pre-stores the result parameters after performing 1 / 2 modular multiplication on the preset polynomial coefficients corresponding to the INTT mode; the processor reads the result parameters stored in the memory and processes the input data based on the result parameters and the INTT mode to output the operation result.

[0119] Specifically, The INTT is represented as:

[0120]

[0121] Among them, ζ=17 is the 256th primitive root of unity modulo q, and brv(i) represents the bit flip of the k-1-bit binary representation of i. In the INTT calculation process, the polynomial coefficients need to be 1 / 2 modular multiplication, and the result of the 1 / 2 modular multiplication of the preset polynomial coefficients can be pre-stored in the storage, so that there is no need to perform 1 / 2 modular multiplication operation in the INTT calculation process, which saves a 1 / 2 modular multiplication operator and improves the calculation efficiency.

[0122] The embodiment of the present application further provides a chip, which includes a processor for encryption and decryption according to any of the above embodiments, which will not be described in detail here for the sake of brevity.

[0123] Among them, chips, also known as integrated circuits (ICs), microcircuits or microchips, are the core components of modern electronic devices. They are made of semiconductor materials (usually silicon) and integrate millions or even billions of microelectronic components (such as transistors, resistors, capacitors, etc.) through a series of complex manufacturing processes to form an electronic circuit with specific functions. These components and their interconnections are manufactured on the same small silicon wafer. They are small in size, light in weight, but powerful in function. They are the basis of various electronic products such as computers, smart phones, home appliances, automobiles, medical equipment, etc.

[0124] In some embodiments, the chip further includes a first memory and a second memory, and each operation mode has a corresponding polynomial;

[0125] When calculating the odd terms of the polynomial, the processor reads input data from the first memory and stores the operation results corresponding to the input data in the second memory;

[0126] When calculating the even terms of the polynomial, the processor reads input data from the second memory and stores the operation results corresponding to the input data in the first memory.

[0127] Optionally, during the encryption and decryption process, a corresponding polynomial needs to be generated and stored in a memory, and is read from or written into the memory when a corresponding operation mode is executed.

[0128] Specifically, when reading and writing to the memory, only read operations and write operations can be performed at the same time. To prevent read-write conflicts, a first memory and a second memory are set, which are used to store the odd-numbered coefficients and even-numbered coefficients of the polynomial, respectively. When calculating the odd-numbered terms of the polynomial, the processor reads data from the first memory, performs corresponding operations on the read data, and inputs the executed operation results into the second memory; when calculating the even-numbered terms of the polynomial, the processor reads data from the second memory, performs corresponding operations on the read data, and inputs the executed operation results into the first memory. In this way, in the process of calculating the polynomial, data is read from one of the first memory and the second memory, and after reading the data, the intermediate result of the operation is input as input data into the other memory, and the operation is repeated until the final result is obtained. The problem of read-write conflicts in the process of polynomial operation is solved, and the read-write efficiency is greatly improved, and the improvement of data read-write efficiency in the encryption and decryption process is achieved, so as to achieve the effect of improving the encryption and decryption efficiency.

[0129] In some embodiments, the chip further includes a register, input data read by the processor from the target memory is cached in the register, the target memory is the first memory or the second memory, the input data includes the first part of data and the second part of data, the operation result includes the first operation result and the second operation result, and the processor is further used to:

[0130] In the Kth cycle, a first portion of data is read from the register, and the first portion of data is processed based on a pipeline corresponding to the operation mode to obtain a first operation result;

[0131] In the K+1th cycle, the second part of the data is processed based on the pipeline corresponding to the operation mode to obtain a second operation result.

[0132] Optionally, the register may be used to store and temporarily save data read from the memory.

[0133] Specifically, during the encryption and decryption process, when processing the polynomial, it is necessary to read the input data from the first memory or the second memory, and the memory to be read is the target memory. The input data read contains two parts of data, and the two parts of data need to be processed separately. Therefore, the read input data is temporarily stored in a register, and the two parts of data are processed in one processing cycle. In the kth cycle, the first part of the data is read, and the first part of the data is processed based on the pipeline corresponding to the operation mode being executed by the processor to obtain the first processing result; in the k+th cycle, the second part of the data is read, and the second part of the data is processed based on the pipeline corresponding to the operation mode being executed by the processor to obtain the second processing result. In this way, the two parts of the read data are processed accordingly to obtain the processing results.

[0134] For example, when reading input data from the first memory, the target memory is the first memory. The input data read is 24 bits in total, of which the lower 12 bits are the first part of the data and the upper 12 bits are the second part of the data. The read input data is temporarily stored in a register. In the first cycle, the lower 12 bits in the register are read, and the read data is processed based on the corresponding pipeline to obtain the processing result of the lower 12 bits of the data; in the second cycle, the upper 12 bits in the register are read, and the read data is processed based on the corresponding pipeline to obtain the processing result of the upper 12 bits of the data.

[0135] The embodiment of the present application also provides an electronic device for encryption and decryption, including a chip according to any of the above embodiments, that is, the chip is installed in the electronic device, which will not be described in detail here for the sake of brevity.

[0136] Among them, electronic devices may include but are not limited to: smart phones (such as Android phones, IOS phones, etc.), tablet computers, laptops, desktop computers, smart speakers, smart watches, portable personal computers, mobile Internet devices (Mobile Internet Devices, referred to as MID), intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, wearable devices, etc., and the embodiments of the present application do not limit this.

[0137] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0138] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0139] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A processor for encryption and decryption, characterized in that: include: A plurality of butterfly units, wherein the butterfly units include a hardware structure unit for performing butterfly operations and inverse butterfly operations, wherein the butterfly units include a plurality of operator units and a switch element, wherein the plurality of operator units are connected to each other, wherein the switch element is provided between any two of the operator units, wherein the switch element is used to switch on or off the connection between the corresponding two operator units, and wherein the operator unit performs operations based on the corresponding first operator; The processor adjusts the state of each of the switch elements in each of the butterfly units based on the mode selection signal to adjust the connection relationship between each of the operating sub-units to match the mode selection signal, and the operating mode corresponding to the mode selection signal includes at least one of multiple preset operating modes.

2. The processor for encryption and decryption according to claim 1, characterized in that: When the connection relationship between the operator units of the butterfly unit is different, the corresponding operation in the corresponding first operator and / or second operator can be executed, and the second operator includes multiple first operators.

3. The processor for encryption and decryption according to claim 2, characterized in that: The first operator includes at least one of modular addition operation, modular subtraction operation, modular multiplication operation and 1 / 2 modular multiplication operation, and the second operator includes at least one of modular reduction operation, butterfly operation, inverse butterfly operation, number theoretic transformation operation, inverse number theoretic transformation operation, polynomial bitwise multiplication operation, compression operation and decompression operation.

4. The processor for encryption and decryption according to claim 2 or 3, characterized in that: Each of the operation modes has a corresponding pipeline, and the processor is used to process input data based on the pipeline corresponding to the operation mode to output an operation result.

5. The processor for encryption and decryption according to claim 4, characterized in that: The pipeline includes multiple stages, each of which is executed by the corresponding butterfly unit, and the operator of the butterfly unit corresponding to each stage matches the operator preset in each stage.

6. The processor for encryption and decryption according to claim 4 or 5, characterized in that: The pipeline is a 5-stage pipeline, and the pipeline includes 5 stages.

7. The processor for encryption and decryption according to claim 4 or 5, characterized in that: The stages of the pipeline include modular reduction stages. Each pipeline includes three modular reduction stages. The modular reduction stages are implemented by remainder operations. The operation result of the previous modular reduction stage serves as the input of the next modular reduction stage.

8. The processor for encryption and decryption according to claim 3, characterized in that: The 1 / 2 modular multiplication operation is implemented based on a shift operation, an addition operation and a logical AND operation.

9. The processor for encryption and decryption according to claim 3, characterized in that: The memory pre-stores a preset compression parameter generated based on a preset modulus corresponding to the compression operation, so that the division operation in the compression operation is changed into a shift operation.

10. The processor for encryption and decryption according to claim 3, characterized in that: The modular reduction adopts the Barrett modular reduction algorithm.

11. The processor for encryption and decryption according to claim 1, characterized in that: The operation modes include an inverse number theoretic transformation mode, a number theoretic transformation mode, a first polynomial bitwise multiplication mode, and a second polynomial bitwise multiplication mode.

12. The processor for encryption and decryption according to claim 10, characterized in that: The memory pre-stores result parameters of 1 / 2 modular multiplication of preset polynomial coefficients corresponding to the inverse numerology transformation mode; the processor reads the result parameters stored in the memory, and processes the input data based on the result parameters and the inverse numerology transformation mode to output the operation result.

13. A chip, characterized in that: A processor comprising any one of claims 1 to 12.

14. The chip according to claim 13, characterized in that: It also includes a first memory and a second memory, and each of the operation modes has a corresponding polynomial; When calculating the odd terms of the polynomial, the processor reads input data from the first memory and stores the operation results corresponding to the input data in the second memory; When calculating the even terms of the polynomial, the processor reads input data from the second memory and stores the operation results corresponding to the input data in the first memory.

15. The chip according to claim 14, characterized in that: The processor further includes a register, input data read by the processor from a target memory is cached in the register, the target memory is the first memory or the second memory, the input data includes a first part of data and a second part of data, the operation result includes a first operation result and a second operation result, and the processor is further configured to: reading the first part of data from the register in the Kth cycle, and processing the first part of data based on the pipeline corresponding to the operation mode to obtain a first operation result; In the K+1th cycle, the second part of data is processed based on the pipeline corresponding to the operation mode to obtain a second operation result.

16. An electronic device, characterized in that: A chip comprising any one of claims 13-15.

Images