Fault injection detection circuit and operation method applied to post quantum cryptography algorithm

Abstract

The invention provides a fault injection detection circuit and operation method applied to a post quantum cryptography algorithm, and the circuit comprises an input unit which is used for inputting a state matrix; the plurality of operation units are respectively connected with the input unit, and each operation unit is used for calculating preset bit data in the state matrix to obtain a calculation result; the output unit is connected with the plurality of operation units and is used for comparing the calculation result with a pre-calculation value and determining whether fault injection exists or not; wherein the state matrix and the pre-calculation value conform to a preset relation. The fault injection detection circuit applied to the post quantum cryptography algorithm has a longer critical path, clock injection can be detected before key information leakage, the potential side channel leakage problem in algorithm hardware implementation is solved, and safety protection of a post quantum cryptography chip is achieved.

Description

Technical Field

[0001] The present application relates to the field of security algorithm technology, and in particular to a fault injection detection circuit and operation method applied to a post-quantum cryptographic algorithm. Background Art

[0002] Digital signatures play an integral role in today's increasingly digital and connected world. They not only protect sensitive financial transactions and legal contracts, but also maintain the integrity of important healthcare and government documents, becoming the cornerstone of trust and security in a variety of online activities. Digital signatures effectively prevent forgery and tampering by verifying the origin and integrity of information and ensuring that only authorized users can access and modify important data.

[0003] However, with the rapid development of quantum computers, traditional public key encryption algorithms such as Elliptic Curve Diffie-Hellman (ECDH) and RSA will face major security challenges. Quantum computers have powerful parallel processing capabilities and can crack these traditional cryptographic systems in a short time through quantum algorithms (such as Shor's algorithm), making the digital signature mechanism that relies on these algorithms vulnerable. Therefore, there is an urgent need to develop a new generation of cryptographic algorithms that can resist quantum attacks, which is the research background of post-quantum cryptographic algorithms.

[0004] Currently, four algorithms (Kyber, Dilithium, Falcon, and SPHINCS+) have been successfully selected and entered the standardization process. These algorithms have their own characteristics and are suitable for different application scenarios. Among these four algorithms, SPHINCS+ is a hash-based algorithm due to its complete security proof and relatively simple calculation operations.

[0005] However, despite the strong security demonstrated by post-quantum cryptographic algorithms, their hardware deployment in practical applications still faces many potential side-channel security issues. Side-channel attacks exploit information leaked by encryption devices during operation, such as power consumption, execution time, and electromagnetic waves. By analyzing this information, attackers can bypass the underlying mathematical problems of the algorithm and steal private information, which greatly reduces security. Therefore, in order to achieve widespread application of post-quantum cryptographic algorithms, improving their security in hardware implementation has become a challenge that needs to be solved urgently.

[0006] Application Contents

[0007] In view of the above problems, the present application provides a fault injection detection circuit and operation method applied to post-quantum cryptographic algorithms.

[0008] In a first aspect, a fault injection detection circuit applied to a post-quantum cryptographic algorithm is provided, comprising:

[0009] An input unit, used for inputting a state matrix;

[0010] A plurality of operation units are connected to the input units respectively, and each of the operation units is used to calculate the preset bit data in the state matrix to obtain a calculation result;

[0011] An output unit is connected to the plurality of the operation units and is used to compare the calculation result with the pre-calculated value to determine whether there is a fault injection; wherein the state matrix and the pre-calculated value conform to a preset relationship.

[0012] If the calculation result is different from the pre-calculated value, it is determined that fault injection occurs.

[0013] Wherein, the computing unit comprises:

[0014] The first calculation module is used to perform an XOR calculation on the preset bit data to obtain a first calculation result, which is recorded as Sum j , j∈[0,n], n is the number of columns of the state matrix minus 1;

[0015] A second calculation module, the second calculation module is used to perform an XOR calculation on each data in the preset bit data and the first calculation result, and rearrange them to obtain a second calculation result, which is recorded as E i,j ; Wherein, i∈[0,m], m is the number of rows of the state matrix minus 1; each data in the preset bit data is recorded as S i,j ;

[0016] The third calculation module is used to calculate E i,j After negation and E i,j+1 Do a logical AND operation, and then AND E i,j Perform XOR calculation, and finally perform XOR calculation with round constant c to obtain the third calculation result, recorded as P i,j ;

[0017] Extended path for P i,j and P i,j-1 XOR inversion and S i,j Perform XOR calculation to obtain the calculation result, which is recorded as P' i,j .

[0018] Wherein, the output unit comprises:

[0019] Comparison unit, used to compare P' i,j Each data in the preset bit data is recorded as S i,j Compare them one by one, if the comparison results are different, it is determined that fault injection has occurred.

[0020] Wherein, the first calculation module includes:

[0021] The first XOR calculation module receives the data S in the preset bit number path i,j , and perform XOR calculation to get Sum j .

[0022] The second calculation module includes:

[0023] The second XOR calculation module receives Sum j+1 and Sum j-1 , and perform XOR calculation;

[0024] The third XOR calculation module receives Sum j+1 and Sum j-1 The XOR calculation result and S i,j , and perform XOR calculation and rearrange to get E i,j .

[0025] Wherein, the third calculation module includes:

[0026] The first inverter is used to i,j Negate;

[0027] AND gate, used to pair E i,j After negation and E i,j+1 Do logic and calculations;

[0028] The fourth XOR calculation module is used to sum the AND gate output result and E i,j Perform XOR calculation;

[0029] The fifth XOR calculation module is used to perform XOR calculation on the output result of the fourth XOR calculation module and the round constant c to obtain P i,j .

[0030] The expansion path includes:

[0031] The sixth XOR calculation module receives P i,j and P i,j-1 , and perform XOR calculation;

[0032] A second inverter inverts the output of the sixth XOR calculation module;

[0033] The seventh XOR calculation module calculates the output of the second inverter and S i,j Do XOR calculation and get P' i,j .

[0034] In a second aspect, the present application provides a computing method, which is performed based on the fault injection detection circuit applied to the post-quantum cryptographic algorithm described in any one of the above items, and the computing method includes:

[0035] Receiving a state matrix and a pre-calculated value corresponding to the state matrix; wherein the state matrix and the pre-calculated value conform to a preset relationship;

[0036] Calculating the preset bit data in the state matrix to obtain a calculation result;

[0037] The calculation result is compared with the pre-calculated value to determine whether there is a fault injection.

[0038] The step of calculating the preset bit data in the state matrix to obtain a calculation result includes:

[0039] Receive the preset bit number of data S i,j , and perform XOR calculation to get Sum j ;

[0040] Receive Sum j+1 and Sum j-1 , and perform XOR calculation, and receive Sum j+1 and Sum j-1 The XOR calculation result and S i,j , and perform XOR calculation and rearrange to get E i,j ;

[0041] For E i,j After negation and E i,j+1 Perform a logical AND calculation and add the result to E i,j Perform XOR calculation, and then perform XOR calculation with round constant c to get P i,j ;

[0042] Receive P i,j and P i,j-1 , and then XOR it and negate it, and then add it to S i,j Perform XOR calculation and get the calculation result P' i,j .

[0043] The step of comparing the calculation result with the pre-calculated value to determine whether there is a fault injection includes:

[0044] P' i,j Each data in the preset bit data is recorded as S i,j Compare them one by one, if the comparison results are different, it is determined that fault injection has occurred.

[0045] The fault injection detection circuit applied to the post-quantum cryptographic algorithm provided in this application has a longer critical path and can detect clock injection before critical information is leaked, thereby solving the potential side channel leakage problem in the hardware implementation of the algorithm and realizing the security protection of the post-quantum cryptographic chip.

[0046] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0048] Figure 1 It is a structural schematic diagram of an embodiment of a fault injection detection circuit applied to a post-quantum cryptographic algorithm provided by the present application;

[0049] Figure 2 It is a structural schematic diagram of another embodiment of a fault injection detection circuit applied to a post-quantum cryptographic algorithm provided by the present application;

[0050] Figure 3 It is a flowchart of an embodiment of a calculation method provided by the present application. DETAILED DESCRIPTION

[0051] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to be able to fully convey the scope of the present disclosure to those skilled in the art. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0052] Various structural schematic diagrams according to embodiments of the present disclosure are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may further design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0053] KECCAK is a cryptographic hash algorithm designed and proposed by a Belgian research team. It was eventually selected by NIST as the SHA-3 standard algorithm. KECCAK is based on a design called "Sponge Construction". This structure makes KECCAK more flexible and resistant to attacks, especially in resisting attacks related to quantum computing. In the KECCAK algorithm, the data involved in the calculation is stored in a 1600-bit three-dimensional state matrix, which can be sorted into S x,y,z , where x, y∈[0,4], z∈[0,63]. Each set of 64-bit data with constant {x, y} coordinates is called a "lane". Since the bits in the same "lane" in the KECCAK algorithm do not operate on each other, the iteration can be regarded as 64 sets of parallel operations. It is precisely because of the nature of this parallel operation that we first invented a new algorithm that compresses the original 1600-bit three-dimensional state matrix of the KECCAK algorithm into a 25-bit two-dimensional state matrix. Therefore, the amount of calculation is 1 / 64 of the KECCAK algorithm, and theoretically shares the same critical path with the KECCAK algorithm.

[0054] The fault injection detection circuit and operation method applied to the post-quantum cryptographic algorithm of the present application are described below in conjunction with the accompanying drawings.

[0055] See also Figure 1 , Figure 1 It is a structural schematic diagram of an embodiment of a fault injection detection circuit applied to a post-quantum cryptographic algorithm provided by the present application, which specifically includes: an input unit 11, a plurality of operation units 12 and an output unit 13. The input unit 11 is used to input a state matrix; the plurality of operation units 12 are respectively connected to the input unit 11, and each of the operation units 12 is used to calculate the preset bit data in the state matrix to obtain a calculation result; the output unit 13 is connected to the plurality of operation units 12, and is used to compare the calculation result with the pre-calculated value to determine whether there is a fault injection; wherein the state matrix and the pre-calculated value conform to a preset relationship.

[0056] Specifically, the state matrix described above is the 25-bit two-dimensional state matrix of the present application, which is used as the input of the anti-clock injection detection circuit. The 25-bit two-dimensional state matrix is, for example, Figure 2 The 5×5 matrix represented by r is shown in the figure.

[0057] The operation process of each of the multiple operation units in the fault injection detection circuit applied to the post-quantum cryptographic algorithm is the same. This application uses one operation unit to calculate S in a 25-bit two-dimensional state matrix. 0,0 , S 0,1 , S 0,2 , S 0,3, S 0,4 This is explained using the calculation of 5 bits of data as an example.

[0058] Please combine Figure 2 The operation unit 12 includes: a first calculation module 121, a second calculation module 122, a third calculation module 123, and an extension path 124.

[0059] The first calculation module 121 is used to perform an XOR calculation on the preset bit data to obtain a first calculation result, denoted as Sum j , j∈[0,n], n is the number of columns of the state matrix minus 1. In one embodiment, the state matrix is ​​a 5×5 matrix, and n is 4. In a specific embodiment, the first calculation module includes a first XOR calculation module, and the first XOR calculation module receives the data S in the preset bit number path i,j , and perform XOR calculation to get Sum j For example, the first XOR calculation module calculates S 0,0 , S 0,1 , S 0,2 , S 0,3 , S 0,4 The 5-bit data (i.e., the preset bit data) is XORed to obtain Sum0. Similarly, in the first XOR calculation module of the first calculation module of the other operation unit, S 1,0 , S 1,1 , S 1,2 , S 1,3 , S 1,4 The result obtained by XOR calculation of these 5 bits of data is Sum1. The same is true for Sum2, Sum3, and Sum4.

[0060] The second calculation module 122 is used to perform an XOR calculation on each data in the preset bit data and the first calculation result, and rearrange them to obtain a second calculation result, which is recorded as E i,j ; Wherein, i∈[0,m], m is the number of rows of the state matrix minus 1, that is, m=4; each data in the preset bit data is recorded as S i,j .

[0061] In a specific embodiment, the second calculation module 122 includes: a second XOR calculation module and a third XOR calculation module. The second XOR calculation module receives Sum j+1 and Sum j-1 , and perform XOR calculation; the third XOR calculation module receives Sum j+1 and Sum j-1 The XOR calculation result and S i,j , and perform XOR calculation and rearrange to get E i,j .

[0062] Concrete, Ei,j YesS i,j With Sum (j-1) and Sum (j+1) The result of XOR and rearrangement.

[0063] D i,j =S i,j ^Sum (j-1) ^Sum (j+1) ; i, j∈[0,4], ^ represents XOR calculation;

[0064] Then the rearrangement is

[0065] E i,j =D j,(3i+j)

[0066] For example:

[0067] E 00 =D 00 =S 00 ^Sum1^Sum4;

[0068] E 01 =D 11 =S 11 ^Sum0^Sum2;

[0069] E 10 =D 03 =S 03 ^Sum2^Sum4;

[0070] And so on.

[0071] The third calculation module 123 is used to calculate E i,j After negation and E i,j+1 Do a logical AND operation, and then AND E i,j Perform XOR calculation, and finally perform XOR calculation with round constant c to obtain the third calculation result, recorded as P i,j .

[0072] In one embodiment, the third calculation module 123 includes: a first inverter, an AND gate, a fourth XOR calculation module, and a fifth XOR calculation module. i,j Negate; AND gate is used to negate E i,j After negation and E i,j+1 Perform logical AND calculation; the fourth XOR calculation module is used to AND the gate output result and E i,j The fifth XOR calculation module is used to perform XOR calculation on the output result of the fourth XOR calculation module and the round constant c to obtain P i,j The round constant c is the pre-stored data

[0073] Specifically, remember:

[0074] F i,j =E i,j ^(~E i,j+1 )&E i,j+2 )),i,j∈[0,4], ~ represents negation, & represents logical AND calculation.

[0075] For the inversion operation and XOR operation between E, the rearrangement method is:

[0076] P[5×i+j]=F i,j ,i,j∈[0,4]

[0077] For example:

[0078] P 01 =F 0,1 =E 0,1 ^(~E 0,2 &E 0,3 )

[0079] P 02 =F 0,2 =E 0,2 ^(~E 0,3 &E 0,4 )

[0080] And so on.

[0081] Among them, P 00 The calculation process of P 00 In the calculation process, the round constant c needs to be introduced for XOR calculation, which can be expressed as follows

[0082] P 00 =c^F 0,0 =c^E 0,0 ^(~E 0,1 &E 0,2 )

[0083] Extension path 124 is used to i,j and P i,j-1 XOR inversion and S i,j Perform XOR calculation to obtain the calculation result, which is recorded as P' i,j Specifically, the extended path 124 includes: a sixth XOR calculation module, a second inverter, and a seventh XOR calculation module. The sixth XOR calculation module receives P i,j and P i,j-1 , and perform XOR calculation; the second inverter inverts the output of the sixth XOR calculation module; the seventh XOR calculation module inverts the output of the second inverter and S i,j Do XOR calculation and get P' i,j .

[0084] The extended path is used to extend the delay of the critical path by adding two sets of XOR gates and one set of inverters. The input of the extended path is denoted as P i,j , the output of the extended path is recorded as P' i,j , then the relationship between the input and output of the expansion path can be expressed by the formula:

[0085] P' i,j =~(P i,j ^P i,j-1 ))^S i,j ,i,j∈[0,4];

[0086] For example,

[0087] P' 0,0 =~(P 0,0 ^P 0,4 )^S 0,0 ,i,j∈[0,4];

[0088] P' 0,1 =~(P 0,1 ^P 0,0 )^S 0,1 ,i,j∈[0,4];

[0089] P' 0,2 =~(P 0,2 ^P 0,1 )^S 0,2 ,i,j∈[0,4];

[0090] And so on.

[0091] The output unit 13 includes: a comparison unit 131, which is used to compare P' i,j Each data in the preset bit data is recorded as S i,j Compare one by one, if the comparison results are different, it is determined that there is a fault injection. Specifically, the comparison unit 131 can be a comparator, and the comparator part is used to calculate the result P' of the extended path. i,j , and the element S' in the precomputed value r' of the input two-dimensional random number matrix r i,j If there is a difference, a warning is issued and the warning signal is pulled high; otherwise, no warning is issued and the warning signal is kept at a low level.

[0092] We implemented the SPHINCS+ algorithm in hardware on the Artix-7 FPGA. Without adding the KECCAK-C module to detect clock injection attacks, the maximum operating frequency was about 268MHz. After adding the protection circuit, the protected overall circuit can work normally below 254MHz. As the frequency increases, the circuit occasionally warns of calculation errors until the protection circuit stably detects clock injection attacks at 260MHz.

[0093] After experiments, we obtained the comparison results of the design with internal clock protection circuit and without internal clock protection circuit. The detection unit consumes 106 / 91LUT / FF, accounting for 1.9% / 1.7%. Due to the extension of the path, the maximum operating frequency of the overall circuit is reduced from 268MHz to 254MHz. Therefore, the operation time of Keygen / Sign / Verify increased by 5.5%. Compared with conventional solutions such as instantiation redundancy to resist fault injection, our anti-clock injection protection circuit based on the KECCAK-C algorithm only consumes 5.5% of additional time, and the resource overhead is almost negligible, which has great advantages and application prospects.

[0094] The fault injection detection circuit applied to the post-quantum cryptographic algorithm provided in this application has a longer critical path and can detect clock injection before critical information is leaked, thereby solving the potential side channel leakage problem in the hardware implementation of the algorithm and realizing the security protection of the post-quantum cryptographic chip.

[0095] See also Figure 3 , Figure 3 A flowchart of an embodiment of a computing method provided in the present application specifically includes:

[0096] Step S31: receiving a state matrix and a pre-calculated value corresponding to the state matrix; wherein the state matrix and the pre-calculated value conform to a preset relationship.

[0097] The state matrix is ​​a 5×5 matrix.

[0098] Step S32: Calculate the preset bit data in the state matrix to obtain a calculation result.

[0099] Specifically, receiving the preset bit number data S i,j , and perform XOR calculation to get Sum j .

[0100] Receive Sum j+1 and Sum j-1 , and perform XOR calculation, and receive Sum j+1 and Sum j-1 The XOR calculation result and S i,j, and perform XOR calculation and rearrange to get E i,j .

[0101] For E i,j After negation and E i,j+1 Perform a logical AND calculation and add the result to E i,j Perform XOR calculation, and then perform XOR calculation with round constant c to get P i,j .

[0102] Receive P i,j and P i,j-1 , and then XOR it and negate it, and then add it to S i,j Perform XOR calculation and get the calculation result P' i,j .

[0103] The calculation steps and process here are the same as those in the fault injection detection circuit applied to the post-quantum cryptographic algorithm mentioned above. Please refer to it for details and will not be repeated here.

[0104] Step S33: Compare the calculation result with the pre-calculated value to determine whether there is a fault injection.

[0105] P' i,j Each data in the preset bit data is recorded as S i,j Compare them one by one, if the comparison results are different, it is determined that fault injection has occurred.

[0106] The operation method provided in this application has a longer critical path and can detect clock injection before critical information is leaked, thereby solving the potential side channel leakage problem in the hardware implementation of the algorithm and realizing security protection for post-quantum cryptographic chips.

[0107] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description of the specific language above is for the purpose of disclosing the best mode of implementation of the application.

[0108] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0109] Similarly, it should be understood that in order to streamline the present disclosure and assist in understanding one or more of the various aspects of the application, in the above description of exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof.

[0110] Those skilled in the art will appreciate that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiment can be combined into one module or unit or component, and in addition they can be divided into multiple submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including abstracts and drawings) and all processes or units of any method or device disclosed in this manner can be combined in any combination. Unless otherwise explicitly stated, each feature disclosed in this specification (including accompanying abstracts and drawings) can be replaced by alternative features that provide the same, equivalent or similar purposes.

[0111] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present application and to form different embodiments.

[0112] It should be noted that the above embodiments illustrate the present application rather than limit the present application. Any reference symbol between brackets should not be constructed as a limitation to the present application. The word "comprising" does not exclude the existence of components or steps not listed in the present application. The word "one" or "an" before a component does not exclude the existence of multiple such components. The present application can be implemented by means of hardware including several different components and by means of a suitably programmed computer. In the embodiments in which several devices are listed, several of these devices can be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims

1. A fault injection detection circuit applied to a post-quantum cryptographic algorithm, characterized in that: include: An input unit, used for inputting a state matrix; A plurality of operation units are connected to the input units respectively, and each of the operation units is used to calculate the preset bit data in the state matrix to obtain a calculation result; An output unit is connected to the plurality of the operation units and is used to compare the calculation result with the pre-calculated value to determine whether there is a fault injection; wherein the state matrix and the pre-calculated value conform to a preset relationship.

2. The fault injection detection circuit for post-quantum cryptographic algorithm according to claim 1, characterized in that: If the calculation result is different from the pre-calculated value, it is determined that a fault is injected.

3. The fault injection detection circuit for post-quantum cryptographic algorithm according to claim 1, characterized in that: The computing unit comprises: The first calculation module is used to perform an XOR calculation on the preset bit data to obtain a first calculation result, which is recorded as Sum j , j∈[0,n], n is the number of columns of the state matrix minus 1; A second calculation module, the second calculation module is used to perform an XOR calculation on each data in the preset bit data and the first calculation result, and rearrange them to obtain a second calculation result, which is recorded as E i，j ; Wherein, i∈[0, m], m is the number of rows of the state matrix minus 1; each data in the preset bit data is recorded as S i，j ; The third calculation module is used to calculate E i，j After negation and E i，j+1 Do a logical AND operation, and then AND E i，j Perform XOR calculation, and finally perform XOR calculation with round constant c to obtain the third calculation result, recorded as P i，j ; Extended path for P i，j and P i，j-1 XOR inversion and S i，j Perform XOR calculation to obtain the calculation result, which is recorded as P′ i，j .

4. The fault injection detection circuit applied to the post-quantum cryptographic algorithm according to claim 3, characterized in that: The output unit comprises: Comparison unit, used to compare P′ i，j Each data in the preset bit data is recorded as S i，j Compare them one by one, if the comparison results are different, it is determined that fault injection has occurred.

5. The fault injection detection circuit applied to the post-quantum cryptographic algorithm according to claim 3, characterized in that: The first calculation module includes: The first XOR calculation module receives the data S in the preset bit number path i，j , and perform XOR calculation to get Sum j . The second calculation module includes: The second XOR calculation module receives Sum j+1 and Sum j-1 , and perform XOR calculation; The third XOR calculation module receives Sum j+1 and Sum j-1 The XOR calculation result and S i，j , and perform XOR calculation and rearrange to get E i，j .

6. The fault injection detection circuit applied to the post-quantum cryptographic algorithm according to claim 3, characterized in that: The third calculation module includes: The first inverter is used to i，j Negate; AND gate, used to pair E i，j After negation and E i，j+1 Do logic and calculations; The fourth XOR calculation module is used to sum the AND gate output result and E i，j Perform XOR calculation; The fifth XOR calculation module is used to perform XOR calculation on the output result of the fourth XOR calculation module and the round constant c to obtain P i，j .

7. The fault injection detection circuit for post-quantum cryptographic algorithm according to claim 3, characterized in that: The expansion path includes: The sixth XOR calculation module receives P i，j and P i，j-1 , and perform XOR calculation; A second inverter inverts the output of the sixth XOR calculation module; The seventh XOR calculation module calculates the output of the second inverter and S i，j Do XOR calculation and get P′ i，j .

8. A calculation method, characterized in that: The operation method is performed based on the fault injection detection circuit applied to the post-quantum cryptographic algorithm according to any one of claims 1 to 7 above, and the operation method includes: Receiving a state matrix and a pre-calculated value corresponding to the state matrix; wherein the state matrix and the pre-calculated value conform to a preset relationship; Calculating the preset bit data in the state matrix to obtain a calculation result; The calculation result is compared with the pre-calculated value to determine whether there is a fault injection.

9. The calculation method according to claim 8, characterized in that: The calculating the preset bit data in the state matrix to obtain the calculation result includes: Receive the preset bit number of data S i，j , and perform XOR calculation to get Sum j ; Receive Sum j+1 and Sum j-1 , and perform XOR calculation, and receive Sum j+1 and Sum j-1 The XOR calculation result and S i，j , and perform XOR calculation and rearrange to get E i，j ; For E i，j After negation and E i，j+1 Perform a logical AND calculation and add the result to E i，j Perform XOR calculation, and then perform XOR calculation with round constant c to get P i，j ; Receive P i，j and P i，j-1 , and then XOR calculation and inversion, and then S i，j Perform XOR calculation to get the calculation result P′ i，j .

10. The calculation method according to claim 8, characterized in that: Comparing the calculation result with the pre-calculated value to determine whether there is a fault injection, including: P′ i，j Each data in the preset bit data is recorded as S i，j Compare them one by one, if the comparison results are different, it is determined that fault injection has occurred.

Images