Streamlined design circuit of NTT algorithm

Abstract

The invention discloses a streamlined design circuit of an NTT algorithm, and belongs to the technical field of integrated circuit design, the circuit comprises a streamlined butterfly unit, a data storage module, a butterfly address remapping module and a twiddle factor module, the circuit supports a forward NTT algorithm and a reverse NTT algorithm at the same time, supports operation of variable parameters on different domains, and adopts a streamlined method. Based on a single-port SRAM storage polynomial coefficient, a butterfly address remapping method is provided, and the method has the remarkable advantages of being small in circuit area and high in performance.

Description

Technical Field

[0001] The invention belongs to the technical field of integrated circuit design, and in particular relates to a pipelined design circuit of an NTT algorithm. Background Art

[0002] Since December 2016, the National Institute of Standards and Technology (NIST) has been publicly soliciting and developing post-quantum cryptographic algorithms worldwide. Among all candidate algorithms, post-quantum cryptographic algorithms based on lattice theory have a clear advantage in quantity. At the same time, mainstream integer and floating-point fully homomorphic cryptographic algorithms, such as BGV, BFV, and CKKS algorithms, are all cryptographic systems based on lattice theory. The calculation of lattice-based cryptographic schemes is mainly based on polynomial rings, involving addition / subtraction, multiplication, modular reduction and other operations on polynomial rings. The computational complexity of addition / subtraction is O(n), and the computational complexity of naive multiplication is O(n). 2 ), as the polynomial order n continues to increase, polynomial multiplication becomes extremely complicated.

[0003] Compared with post-quantum cryptographic algorithms such as CRYSTALS-KYBER, the order and modulus of the polynomials on the ring are smaller, and there is no bottleneck in resource utilization during hardware design. In fully homomorphic cryptographic algorithms, the order of the polynomials can reach tens of thousands, and the modulus can reach hundreds of bits. In the hardware implementation of the entire architecture, the polynomial multiplication part is the most time-consuming and resource-consuming module. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the prior art and provide a pipeline design circuit for the NTT algorithm, aiming to solve the read and write access conflict problem of butterfly operation under pipeline design.

[0005] The object of the present invention is achieved through the following technical solutions:

[0006] A pipeline design circuit for an NTT algorithm, the circuit comprising:

[0007] A rotation factor module, wherein the rotation factor module generates and stores the rotation factors and sends the rotation factors to the pipelined butterfly unit as input parameters of the operation, wherein the rotation factors include a forward NTT rotation factor and a reverse INTT rotation factor;

[0008] A pipelined butterfly unit, which performs multi-stage pipeline operations and pipeline modular multiplication operations, and stores input parameters and operation results in a data storage module;

[0009] A data storage module, wherein the data storage module stores polynomial coefficients of the NTT algorithm, and input parameters and operation results output by the pipelined butterfly unit;

[0010] A butterfly address remapping module adjusts the actual bit sequence of each layer of operation in the pipeline operation, and adjusts the data of the last layer of pipeline operation, and remaps the storage access address output by the pipelined butterfly unit to generate an address signal for accessing the data storage module.

[0011] Furthermore, the pipelined butterfly unit directly performs bit-reverse access to the storage address by avoiding the bit-reverse copy operation of the data.

[0012] Furthermore, when the pipelined butterfly unit performs the pipelined modular multiplication operation, a modular division by 2 operation is added to the butterfly operation of each layer, thereby omitting the modular inverse n operation of INTT on all polynomial ring coefficient parameters at the end.

[0013] Furthermore, the pipelined butterfly unit uses forward bit sequence data input and reverse bit sequence data output for NTT operation, and uses reverse bit sequence data input and forward bit sequence data output for INTT operation.

[0014] Furthermore, the performing of multi-stage pipeline operations specifically includes:

[0015] Perform 6-level pipeline operations, specifically:

[0016] First-level pipeline operation: execute two read operations in a single cycle;

[0017] Second-level pipeline operation: perform first-level multiplication;

[0018] The third-level pipeline operation: performs the second-level multiplication;

[0019] Fourth-level pipeline operation: perform third-level multiplication;

[0020] The fifth stage of pipeline operation: performs the last subtraction of modular multiplication, modular addition and subtraction of butterfly operation, and modular division by 2 operation of INTT;

[0021] Sixth-level pipeline operation: executes two write operations in a single cycle.

[0022] Furthermore, the polynomial coefficient storage unit uses a first single-port static random access memory and a second single-port static random access memory to cooperate and cache data in the form of a ping-pong buffer.

[0023] The beneficial effects of the present invention are:

[0024] (1) The present invention designs a universal pipelined circuit for the NTT algorithm, which combines the characteristics of the butterfly operation and modular multiplication operation of the NTT algorithm. Based on the modular multiplication algorithm, it supports the configurable design of domain parameters and can realize modular multiplication operations of different bit widths, which can effectively meet the requirements of different parameters and security strength of post-quantum algorithms.

[0025] (2) In the circuit design of the present invention, the forward NTT and reverse NTT algorithms share a set of hardware logic, combined with the forward and reverse parameter matching of the dynamic or static storage type rotation factor module, and the structural adjustment of the forward bit sequence data input and the bit reverse bit sequence output, which not only saves hardware resources, but also has the flexibility of the operation and use of both.

[0026] (3) The present invention is based on the butterfly address remapping method and uses a single-port SRAM to store polynomial coefficients, which has the significant advantages of small circuit area and high performance. In terms of performance, a single butterfly unit full pipeline is used, and the number of cycles of NTT / INTT operations is approximately equal to (n / 2)·logn. When n=256, it is about 1000 cycles, and when n=8192, it is about 53,000 cycles. In terms of resource consumption, compared with other high-performance solutions (such as multi-cycle parallelization), the design method has obvious resource consumption advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flow chart of the circuit structure of the NTT algorithm according to the embodiment of the present invention;

[0028] Figure 2 It is a flow chart of the pipelined design circuit design process of the NTT algorithm according to the embodiment of the present invention;

[0029] Figure 3 is a schematic diagram of pipelined butterfly unit optimization according to an embodiment of the present invention, wherein: Figure 3 (a) is the schematic diagram of the original butterfly unit operation. Figure 3 (b) is a schematic diagram of the optimized pipeline butterfly unit operation;

[0030] Figure 4 is a schematic diagram of a Ping-Pong RAM according to an embodiment of the present invention;

[0031] Figure 5 1. It is a schematic diagram of the address access sequence of the pipelined butterfly unit according to an embodiment of the present invention;

[0032] Figure 6 1. It is a schematic diagram of address adjustment of pipelined butterfly unit according to an embodiment of the present invention;

[0033] Figure 7 1 is a schematic diagram comparing the butterfly adjustment address and the actual address according to an embodiment of the present invention;

[0034] Figure 8It is a schematic diagram of pipeline matching for dynamic calculation of rotation factors according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0036] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.

[0037] In fully homomorphic cryptographic algorithms, the degree of the polynomial can reach tens of thousands, and the modulus can reach hundreds of bits. In the hardware implementation of the entire architecture, the polynomial multiplication part is the most time-consuming and resource-consuming module.

[0038] In order to solve the above technical problems, the following embodiments of a pipelined design circuit of an NTT algorithm of the present invention are proposed.

[0039] Reference Figure 1 ,like Figure 1 FIG. 1 is a flow chart of the pipeline design circuit structure of the NTT algorithm of this embodiment, and the circuit specifically includes the following structures:

[0040] ntt_pipe: overall pipeline control of the ntt algorithm, pipeline access control of the butterfly_pipe module, and read and write access control of the twiddle / SPRAM storage module.

[0041] butterfly_pipe: 4-stage pipeline operation of butterfly unit. It can support 6-stage pipeline butterfly operation, 4-stage pipeline modular multiplication operation, and single-cycle modular addition and modular subtraction operation. The madd_alg submodule performs the last step of modular multiplication operation, butterfly modular addition, butterfly modular subtraction, and modular division by 2. After the butterfly_pipe module operation, the butterfly operation result dout_even / dou_odd and the modular multiplication result dout_modmul_mont are generated and stored in the SPRAM module.

[0042] addr_reflect: butterfly address remapping, adjustment of the actual bit order of each layer of operation. The bit_rev submodule, address reversal module, adjusts the data of the last layer of butterfly operation to support the bit order of INTT operation and the normal order output of the result. The butterfly_pipe module outputs the storage access address addr, and after the address is remapped by the addr_reflect module, it generates the address signal addr_ref for accessing the SPRAM module.

[0043] SPRAM: data memory, storing polynomial coefficients and butterfly operation input and output, polynomial coefficients include SPRAM0 and SPRAM1. Specifically, the butterfly operation input and output stored in the data memory include butterfly_pipe module butterfly operation input parameters bu_odd / bu_even, butterfly_pipe module butterfly operation output results dout_even / dou_odd and modular multiplication operation result dout_modmul_mont.

[0044] twiddle: Twiddle factor module, which can use dynamic synchronous calculation and static pre-calculation to store twiddle factors. mtwd module, generates or stores forward NTT twiddle factors; minvtwd module, generates or stores reverse INTT twiddle factors. Stores or generates twiddle_factor, which is used as the input parameter of butterfly operation in butterfly_pipe module.

[0045] Reference Figure 2 ,like Figure 2 The figure is a flow chart of the pipeline design circuit design process of the NTT algorithm of this embodiment, which specifically includes the following steps:

[0046] Step 1: NTT algorithm process optimization

[0047] The typical NTT algorithm process is as follows:

[0048] Algorithm 1: DIT NTT with CT Butterfly

[0049] Input: a'∈R q , (φ 0 ,φ 1 ,·,φ n-1 ), φ is a primitive root of order 2n

[0050] Output: A←NTT(a')∈R q

[0051] A=NTT(a')

[0052] 1Bit_Reverse_Copy(a',A)

[0053] 2n=A.length / / n is a power of 2

[0054] 3for s=1to lgn

[0055] 4m=2 s

[0056] 5for k=0to n-1by m

[0057] 6for j=0to m / 2-1

[0058] 7twd=j<<(1+lgn-s)

[0059] 8t=φ (twd) ...A[k+j+m / 2]

[0060] 9u=A[k+j]

[0061] 10A[k+j]=u+t

[0062] 11A[k+j+m / 2]=ut

[0063] 12return A

[0064] (1) Avoid Bit_Reverse_Copy Operation

[0065] To avoid the Bit_Reverse_Copy(a',A) operation in the process of Algorithm 1, that is, the bit-reverse copy operation of the data, the storage address is directly accessed in the butterfly operation unit in bit-reverse order.

[0066] (2)INTT Optimization

[0067] Inverse NTT (INTT) In the NTT algorithm flow, the last step is to perform a modular inverse n operation on all polynomial ring coefficient parameters. Since n is a power of 2, we can add a modulo division by 2 operation to the butterfly operation of each layer, and omit the modulo inverse n operation at the end of INTT to improve performance. The modulo division by 2 operation can be optimized as follows: Simplifies the modulo division of x by 2 by shifting right, adding, and performing a logical AND.

[0068] (3) NTT / INTT multiplexing

[0069] For NTT operations, the input is in the positive order and the output is in the reverse order. For INTT operations, the input is in the reverse order and the output is in the positive order.

[0070] By adopting the above processing method, the NTT / INTT modules are reused to reduce the use of hardware resources. There is no need to perform bit reverse operation on the data. Only the corresponding rotation factors need to be changed, and the butterfly unit operation of the INTT needs to have one more modulo division by 2 operation.

[0071] Step 2: Modular multiplication algorithm

[0072] The butterfly unit operation involves a large integer modular multiplication operation. In order to support modular multiplication operations with large bit widths and to make the modulus q flexible, the classic Montgomery algorithm is used. The algorithm is described as follows:

[0073] Algorithm 2: Montgomery modular multiplication algorithm

[0074] Input: modulus M, gcd(M,2)=1, R=2 n , M'=-M -1 modR, AB <MR;

[0075] Output: TR -1 modM

[0076] 1. T = AB;

[0077] 2. U = TM'modR;

[0078] 3. A=T+UM;

[0079] 4. A = A / R;

[0080] 5. if A≥M, A=AM;

[0081] 6. return A

[0082] From the above, we can see that step 1 to step 3 are three multiplications. If a single-cycle multiplier is used, each takes one cycle. Steps 4 to 6 take one cycle in total. Then a complete modular multiplication operation requires four cycles to complete.

[0083] Step 3: Pipeline division

[0084] Reference Figure 3 ,like Figure 3 FIG. 1 is a schematic diagram of the optimization of the pipelined butterfly unit in this embodiment, wherein: Figure 3 (a) is the schematic diagram of the original butterfly unit operation. Figure 3 (b) is a schematic diagram of the optimized pipelined butterfly unit operation.

[0085] The essence of the NTT algorithm is (n / 2)·logn butterfly operations. Considering the full pipeline design, the original butterfly unit operations are: read, read, multiplication, multiplication, multiplication, addition and subtraction, write, write.

[0086] To facilitate pipeline design, this embodiment combines two reads and two writes respectively to design a 6-stage pipeline, specifically: DR, M1, M2, M3, A, DW.

[0087] Among them, DR: single cycle two read operations.

[0088] M1: First level multiplication.

[0089] M2: Second level multiplication.

[0090] M3: Third level multiplication.

[0091] A: The last level of subtraction of modular multiplication, modular addition and subtraction of butterfly operation, and modular division by 2 operation of INTT.

[0092] DW: Two write operations in a single cycle.

[0093] Step 4: Storage Design

[0094] (1) To save area, single-port SRAM (static random access memory) is preferred for caching data.

[0095] (2) To resolve the read-write access conflicts between DR and DW, the idea of ​​ping-pong buffer is adopted to write the results of each layer into another RAM (random access memory). At the same time, this RAM can be reused for the complete polynomial multiplication operation. Figure 4 ,like Figure 4 Shown is a schematic diagram of the Ping-Pong RAM of this embodiment.

[0096] (3) A single data storage is divided into two banks, supporting two read and two write operations in a single cycle and facilitating butterfly operations.

[0097] (4) The rotation factors of NTT and INTT can be calculated synchronously or stored statically in advance. If the static type is considered, the rotation factor data can be stored in ROM.

[0098] Step 5: Butterfly address remapping

[0099] The butterfly address access of the full pipeline design is the most critical element of the NTT algorithm design. Figure 5 ,like Figure 5 FIG. 1 is a schematic diagram of the address access sequence of the pipelined butterfly unit in this embodiment.

[0100] (1) First, the 0-7 bit sequence data is stored at the 0-7 address of BANK0; the 8-15 bit sequence data is stored at the 0-7 address of BANK1, forming the first layer of butterfly bit reverse access.

[0101] (2) After completing a single butterfly operation, according to the normal process, such as the (0,8) sequence pair, the operation result needs to be written into the actual address 0 and address 8 accordingly. However, since the addresses 0 and 8 in the second layer are located in the same BANK, it will cause a conflict between two reads in a single cycle and fail to meet the requirements of the second layer (0,4) butterfly sequence pair. Accordingly, the following storage adjustment scheme is proposed, such as Figure 5 shown.

[0102] (2.1) Write the 0-bit result of the butterfly operation (0,8) of SRAM0 into the 0-bit of SRAM1 BANK0, and write the 8-bit result into the 4-bit of SRAM1 BANK1;

[0103] (2.2) Write the 0-bit result of the butterfly operation (1,9) of SRAM0 into the 1-bit of SRAM1 BANK0, and write the 9-bit result into the 9-bit of SRAM1 BANK1;

[0104] (2.3) Similarly, the storage distribution relationship of the second layer is formed, refer to Figure 6 ,like Figure 6 FIG. 1 is a schematic diagram of address adjustment of pipelined butterfly units in this embodiment.

[0105] (3) Adjust the read order to match the actual read sequence requirements. Figure 7 ,like Figure 7 The figure is a schematic diagram comparing the butterfly adjustment address and the actual address in this embodiment. By exchanging the read order with double brackets, the real butterfly bit reverse operation can be satisfied.

[0106] Step 6: Rotation factor design

[0107] The twiddle factor module is an important submodule in NTT, which is divided into dynamic calculation type twiddle factor circuit and static storage type twiddle factor circuit in implementation.

[0108] The resource consumption of the dynamic type is mainly on modular multiplication operations. In pipeline design, the operation of the rotation factor needs to be started in advance to match the NTT operation pipeline. At the same time, the address mapping of the butterfly needs to be adjusted to make the modular exponent of the rotation factor continuous. Taking n = 16 as an example, the dynamic operation type needs to store the unit root corresponding to each layer, a total of logn = 4 data, the first layer φ 0 , the second layer φ 8 , the third layer φ 4 , the fourth layer φ 2 , φ is a 2n-order primitive root. Each layer is dynamically matched by modular multiplier operation, and the storage of rotation factors is reduced from n / 2 to logn. Figure 8 ,like Figure 8 The figure is a schematic diagram of the dynamic calculation pipeline matching of the rotation factors in this embodiment.

[0109] The static storage type twiddle factor circuit uses RAM or ROM to store all the calculated twiddle factors and related parameters. Compared with the dynamic type, the static type only consumes storage resources, which are mainly related to the data width and the polynomial dimension n. The data depth of the twiddle factor is n / 2.

[0110] This embodiment designs a universal pipeline circuit for the NTT algorithm, supports operations with variable parameters on different domains, and supports reusable designs of forward NTT and reverse NTT algorithms. A pipeline method is adopted, and a butterfly address remapping method is proposed based on a single-port SRAM to store polynomial coefficients. The method solves the read and write access conflict problem of butterfly operations under the pipeline design, and has the significant advantages of small circuit area and high performance.

[0111] This embodiment combines the characteristics of the butterfly operation and modular multiplication operation of the NTT algorithm, is based on the Montgomery modular multiplication algorithm, supports the configurable design of domain parameters, can realize modular multiplication operations of different bit widths, and can effectively meet the requirements of different parameters and security strength of post-quantum algorithms.

[0112] In the circuit design of this embodiment, the forward NTT and reverse NTT algorithms share a set of hardware logic, combined with the forward and reverse parameter matching of the dynamic or static storage type rotation factor module, and the structural adjustment of the forward bit sequence data input and the bit reverse bit sequence output, which not only saves hardware resources, but also has the flexibility of the operation and use of both.

[0113] The pipeline design circuit of the number theoretic transformation NTT algorithm in this embodiment is based on the butterfly address remapping method and uses a single-port SRAM to store polynomial coefficients, and has the significant advantages of small circuit area and high performance.

[0114] In terms of performance, a single butterfly unit full pipeline is used, and the number of cycles of NTT / INTT operation is approximately equal to (n / 2)·logn. When n=256, it is about 1000 cycles, and when n=8192, it is about 53,000 cycles.

[0115] In terms of resources, compared with other high-performance solutions (such as multi-cycle parallelization) design methods, taking the performance of (n / 2)·logn cycles as an equivalent reference, the resource consumption evaluation is shown in Table 1 below:

[0116] Table 1 Comparison of scheme evaluation results

[0117]

[0118] It can be seen that the pipeline design circuit based on single-port SRAM storage in this embodiment has obvious resource advantages.

[0119] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A pipeline design circuit for the NTT algorithm, characterized in that: The circuit comprises: A rotation factor module, wherein the rotation factor module generates and stores the rotation factors and sends the rotation factors to the pipelined butterfly unit as input parameters of the operation, wherein the rotation factors include a forward NTT rotation factor and a reverse INTT rotation factor; A pipelined butterfly unit, which performs multi-stage pipeline operations and pipeline modular multiplication operations, and stores input parameters and operation results in a data storage module; A data storage module, wherein the data storage module stores polynomial coefficients of the NTT algorithm, and input parameters and operation results output by the pipelined butterfly unit; A butterfly address remapping module adjusts the actual bit sequence of each layer of operation in the pipeline operation, and adjusts the data of the last layer of pipeline operation, and remaps the storage access address output by the pipelined butterfly unit to generate an address signal for accessing the data storage module.

2. The pipeline design circuit of the NTT algorithm as claimed in claim 1, characterized in that: The pipelined butterfly unit directly performs bit-reverse access to the storage address by avoiding the bit-reverse copy operation of the data.

3. The pipeline design circuit of the NTT algorithm as claimed in claim 1, characterized in that: When the pipelined butterfly unit performs the pipelined modular multiplication operation, the modular inverse n operation of all polynomial ring coefficient parameters at the end of INTT is omitted by adding a modular division by 2 operation to the butterfly operation of each layer.

4. The pipeline design circuit of the NTT algorithm as claimed in claim 1, characterized in that: The pipelined butterfly unit uses forward bit sequence data input and reverse bit sequence data output for NTT operation, and uses reverse bit sequence data input and forward bit sequence data output for INTT operation.

5. The pipeline design circuit of the NTT algorithm as claimed in claim 1, characterized in that: The performing of multi-stage pipeline operation specifically includes: Perform 6-level pipeline operations, specifically: First-level pipeline operation: execute two read operations in a single cycle; Second-level pipeline operation: perform first-level multiplication; The third-level pipeline operation: performs the second-level multiplication; Fourth-level pipeline operation: perform third-level multiplication; The fifth stage of pipeline operation: performs the last subtraction of modular multiplication, modular addition and subtraction of butterfly operation, and modular division by 2 operation of INTT; Sixth-level pipeline operation: executes two write operations in a single cycle.

6. The pipeline design circuit of the NTT algorithm as claimed in claim 5, characterized in that: The polynomial coefficient storage unit uses a first single-port static random access memory and a second single-port static random access memory to cooperate and cache data in the form of a ping-pong buffer.

Images