High-performance vectorization sampler

Abstract

The invention discloses a high-performance vectorization sampler which is composed of a vectorization binomial sampler with the vector length of 16 and a vectorization rejection sampler with the vector length of 4. The vectorization binomial sampler is composed of two Hamming weight calculation units, a subtracter and a modular reduction unit, the Hamming weight calculation units achieve bit-by-bit addition operation through configurable addition trees, and two addition trees with different depths are achieved through a data selector and two adders; the rejection sampler based on data recombination is composed of two 12-bit data comparators, a 4-bit data comparator and a data selector. And when the output of the reject sampler is valid, the sampling value is temporarily stored in the output cache, and the sampling value is written into the storage module whenever four valid values exist in the output cache.

Description

Technical Field

[0001] The invention belongs to the technical field of cryptographic algorithm circuits, and relates to a polynomial coefficient generation technology, and in particular to a high-performance vectorized sampler. Background Art

[0002] In 2022, the National Institute of Standards and Technology of the United States announced that the final four algorithms entered the draft standardization of post-quantum cryptographic algorithms, namely CRYSTALS-KYBER (hereinafter referred to as KYBER), CRYSTALS-DILITHIUM, FALCON, and SPHINCS+. Among them, there are three lattice-based cryptographic algorithms, and the KYBER cryptographic algorithm is currently the only public key cryptographic algorithm that has entered the draft standardization of post-quantum cryptographic algorithms. It has received widespread attention from academia and industry and has high research value.

[0003] The KYBER cryptographic algorithm hardware accelerator is mainly composed of a polynomial coefficient generation module and a polynomial multiplication module. These two core modules are also the bottlenecks that directly affect the performance of the KYBER cryptographic algorithm hardware accelerator. The polynomial coefficient generation module consists of a pseudo-random number generator (PRNG) and a sampler, where the sampler consists of a rejection sampler and a binomial sampler. The working effect of the sampler will greatly affect the performance of the overall hardware structure. How to improve the performance of the sampler is a problem that many scientific researchers are studying.

[0004] Existing research has proposed a vectorized rejection sampler design, which further increases the group bit width of the sampling source data to 32 bits to reduce the rejection rate. The rejection rate of rejection sampling is reduced to 0.000255%. The vectorized rejection sampler uses 32 optimized rejection samplers to reject sampling of 32 groups of sampling source data at the same time, and the probability of at least one rejection sampler rejecting is reduced to 0.00816%. At the same time, the article also proposes a configurable vectorized binomial sampler design, which consists of 32 binomial samplers with configurable addition trees. Each clock cycle can generate 32 16-bit sampling data, and the configurable addition tree can be configured to different depths according to the specific requirements of the cryptographic algorithm to calculate the Hamming weights of data with different bit widths. The execution time of vectorized binomial sampling is 1.37μs. At the same time, the vectorized rejection sampler requires 32 32-bit Barrett modular reduction units, which results in a large area of ​​the sampling module, with 325 k Logic gates account for 34.5% of the overall design. Existing research proposes a scheme to reduce the rejection rate. The scheme sets the input data bit width to 8 bits and checks whether the upper 4 bits and lower 4 bits of the data are both less than 1101. 2If the conditions are met, the high 4 bits and low 4 bits of the data are concatenated with the two subsequent 8-bit random numbers to form two 12-bit valid data; otherwise, the data is rejected. This scheme reduces the rejection rate from 18.7% to 11.33%. Since this scheme focuses on reducing resource consumption, it takes 11.86μs to complete the rejection sampling.

[0005] In summary, the academic research on the sampler part of the high-performance KYBER cryptographic hardware accelerator mainly focuses on reducing the rejection rate by increasing the threshold of the rejection sampler or hardware redundancy, thereby improving the sampling efficiency of the KYBER cryptographic hardware accelerator and reducing the sampling cycle. Although the current research reduces the rejection rate, the rejection sampler requires a modular reduction unit or hardware redundancy, which leads to a long critical path and large area resource consumption of the rejection sampler. The increase in the bit width of the sampling source data of the rejection sampler causes the pseudo-random number generator to generate more rounds of pseudo-random numbers, consuming more cycles.

[0006] Based on the above background, there is still much room for improvement in the research of high-performance samplers, and conducting research on optimizing the sampler structure is of great significance and value. Summary of the invention

[0007] The present invention proposes a high-performance vectorized sampler, which greatly improves the performance and optimizes the binomial sampler. The designed binomial sampler based on a configurable addition tree supports two standard deviations and meets the KYBER cryptographic protocol to solve the technical problems of conventional rejection samplers, such as long critical paths, large area resource consumption, and large number of consumed cycles, which affect the overall efficiency.

[0008] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows: A high-performance vectorized sampler, consisting of a vectorized binomial sampler with a vector length of 16 and a vectorized rejection sampler with a vector length of 4; The vectorized binomial sampler based on the configurable addition tree realizes the function of generating polynomial coefficients of two standard deviations. The vectorized binomial sampler consists of two Hamming weight calculation units, a subtractor and a modular reduction unit. The two Hamming weight calculation units are used to calculate the Hamming weight of the input data. After the calculation is completed, the two Hamming weight values ​​are sent to the subtractor for difference to obtain the sampling value. The modular reduction module then reduces the sampling value to the polynomial ring; the vectorized binomial sampler instantiates 16 basic binomial samplers in total, samples at least 64-bit random numbers per cycle, and generates 16 error polynomial coefficients at the same time. The binomial sampling of pseudo-random numbers is completed once in at most 17 sampling cycles; The vectorized rejection sampler based on data reorganization instantiates 4 rejection samplers with low rejection rate, samples 64-bit random numbers per cycle, generates up to 4 polynomial coefficients at the same time, completes the rejection sampling of pseudo-random numbers once in 21 cycles, and sets the input data width to 16 bits. It consists of two 12-bit data comparators, one 4-bit data comparator and a data selector. The pseudo-random number is first decomposed into two sampling source data R and T , respectively, are sent to two 12-bit comparators and compared with the modulus q Compare; sample source data R The high 4 bits are sent to the 4-bit data comparator and compared with the modulus q When the valid signal of the rejection sampler is high, the output buffer accepts the sampling value of the rejection sampler; otherwise, it waits for the sampling value of the next round of rejection sampler; whenever there are 4 valid values ​​in the output buffer, the sampling value is written to the storage module.

[0009] The vectorized rejection sampler also includes an output cache module. When the output of the rejection sampler is valid, the sampling value is temporarily stored in the output cache module. Whenever there are 4 valid values ​​in the output cache module, the output result is unified; 16 error polynomial coefficients or at most 4 matrix polynomial coefficients are generated per cycle.

[0010] Furthermore, the Hamming weight calculation unit calculates the 2 or bit sampling data, respectively calculate the high or bit and low or The Hamming weight of the bit; since the sampled data has only two values, "0" and "1", the input or The bit data is added bit by bit; the bit by bit addition is implemented by a configurable addition tree; two addition trees of different depths are implemented using a data selector and two adders. or = 3, the depth of the addition tree is 2, and the sum of three input data is calculated. The three input data are A, B, and C respectively; when or = 2, the depth of the addition tree is 1, and only the sum of two input data is calculated. The two input data are A and B respectively, and HM is the Hamming weight. The specific calculation formula is as follows: .

[0011] Furthermore, the modular reduction unit reduces the sampled value obtained by the subtractor to a polynomial ring. The function of the modular reduction unit is as follows: when the sampled value sub is a negative number, the sampled value sub and the modulus q Add up to get the output out; otherwise, the sample value remains unchanged, and the output out is the sample value sub itself; .

[0012] The rejection sampler based on data reorganization compares the effects of different sampling source data bit widths on the rejection sampler and selects the appropriate sampling source data bit width. The input data bit width is set to 16 bits. The module is mainly composed of two 12-bit data comparators, a 4-bit data comparator and a data selector. The rejection rate is reduced by the rejection sampling algorithm based on data reorganization. At the same time, the designed rejection sampler only needs the pseudo-random number generator to generate 14 pseudo-random number sequences. The polynomial coefficient generation module generates a 2×2 public matrix with fewer cycles, no hardware redundancy, and small hardware resource occupancy.

[0013] Furthermore, the rejection sampling method based on data reorganization first transforms the input n The bit pseudo-random number is divided into two 12-bit sampling source data R and T , and then the two sampled source data are respectively compared with the analog q Compare, if the sampling source data R Less than modulus q , then keep the sampled data R , and set the output valid signal to "1"; if the sampling source data T Less than modulus q And sample source data R of high k bit greater than modulus q of high k bit, the sampled data is retained T , and set the output valid signal to "1"; if the above conditions are not met, reject the pseudo-random number and set the output valid signal to "0".

[0014] A high-performance vectorized sampler of the present invention has the following advantages: The circuit of the high-performance vectorized sampler designed by the present invention can reach a main frequency of 600MHz under the 28nm process. Due to the use of a rejection sampling algorithm based on data reorganization, the rejection rate of the rejection sampler is reduced. The rejection sampler designed by the present invention only needs PRNG to generate 14 pseudo-random number sequences, and the number of cycles consumed by rejection sampling is 358. The present invention designs a binomial sampling module based on a configurable addition tree, and the number of cycles consumed by binomial sampling is 256. The total time of a single sampling is 1.03μs. Among them, the two indicators of main frequency and calculation time are the best in the work of similar calculation units applied to KYBER cryptographic hardware accelerators in the past five years. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a structural diagram of a vectorized binomial sampling module based on a configurable addition tree; Figure 2The structure diagram of the vectorized rejection sampler based on data reorganization; Figure 3 It is a schematic diagram of the curve of rejection rate changing with the bit width of the sampling source data; Figure 4 It is a schematic diagram of the curve of the number of random number generation times changing with the bit width of the sampling source data; Figure 5 Schematic diagram of the overall architecture of the high-performance sampler. DETAILED DESCRIPTION

[0016] In order to better understand the purpose, structure and function of the present invention, a high-performance vector sampler of the present invention is further described in detail below with reference to the accompanying drawings.

[0017] A high performance vector sampler design of the present invention comprises the following steps: 1. Binomial Sampler Design Binomial sampling is usually implemented by calculating the difference between the Hamming weights of two random numbers that satisfy a uniform distribution. or , or ] can be used to select two adjacent random numbers from a uniformly distributed random number sequence. or The random number of bits is calculated respectively for their Hamming weights. Subtracting two Hamming weights can get the sampling value that satisfies the central binomial distribution. Repeating the above process many times can get a random number sequence that obeys the central binomial distribution. In the KYBER cryptographic algorithm, or The value of is 2 or 3. The binomial sampler needs to generate polynomial coefficients that satisfy the range of [-2,2] or [-3,3]. Therefore, generating a polynomial coefficient requires a 4-bit or 6-bit random number.

[0018] When n = 2, the possible values ​​of the Hamming weight of each sub-bit string are {0, 1, 2}, and the probabilities corresponding to the possible values ​​of the Hamming weight are {1 / 4, 1 / 2, 1 / 4}. Therefore, the possible values ​​of the binomial sampling sample value are {-2, -1, 0, 1, 2}, and the probabilities corresponding to the binomial sampling sample values ​​are: .

[0019] when or = 2, the theoretical probability of binomial sampling is shown in Table 1.

[0020] Table 1 Theoretical probability of binomial sampling ( or = 2)

[0021] when or= 3, the possible values ​​of the Hamming weight of each sub-bit string are {0, 1, 2, 3}, and the probabilities corresponding to the possible values ​​of the Hamming weight are {1 / 8, 3 / 8, 3 / 8, 1 / 8}. Therefore, the possible values ​​of the binomial sampling value are {-3, -2, -1, 0, 1, 2, 3}, and the probabilities corresponding to the binomial sampling values ​​are: .

[0022] when or = 3, the theoretical probability of binomial sampling is shown in Table 2.

[0023] Table 2 Theoretical probability of binomial sampling ( or = 3)

[0024] The binomial sampler designed by the present invention realizes the function of generating polynomial coefficients of two standard deviations, and is mainly composed of two Hamming weight calculation units, a subtractor and a modular reduction unit. The core operation unit of the binomial sampler is the Hamming weight calculation unit. or bit sampling data, respectively calculate the high or bit and low or Since the sampled data has only two values, "0" and "1", the input or The bit data is added bit by bit. The bit by bit addition is implemented by a configurable addition tree. The present invention uses a data selector and two adders to implement two addition trees of different depths. or = 3, the depth of the addition tree is 2, and the sum of the three input data is calculated; when or = 2, the depth of the addition tree is 1, and only the sum of the two input data is calculated. The specific calculation formula is as follows: .

[0025] After the Hamming weight calculation is completed, the two Hamming weight values ​​are sent to the subtractor to obtain the sampling value. Since the KYBER cryptographic algorithm works on a polynomial ring, the modular reduction module reduces the sampling value to the polynomial ring. The function of the modular reduction module is as follows. When the sampling value is negative, the sampling value and the modulus are q Add; otherwise, the sample value remains unchanged, as follows: .

[0026] 2. Rejection Sampler Design The rejection sampling algorithm based on data reorganization designed by the present invention is shown in Algorithm 1. First, the input n The bit pseudo-random number is divided into two 12-bit sampling source data R and T, and then the two sampled source data are respectively compared with the analog q Compare, if the sampled source data R Less than modulus q , then keep the sampled data R And set the output valid signal to "1"; if the sampling source data T Less than modulus q And sample source data R of high k bit greater than modulus q of high k bit, the sampled data is retained T , and set the output valid signal to "1"; if the above conditions are not met, reject the pseudo-random number and set the output valid signal to "0". Algorithm 1 is as follows: .

[0027] The program will enter n The bit pseudo-random number is divided into A , B , C Three parts, among which, A and C for k Bit, B for m bits, and the following conditions are met: .

[0028] The above three parts can form two 12-bit sampling source data R and T , sampling source data R and T It can be expressed as: .

[0029] Sampling source data R and T With modulus q For comparison, the possible situations and output results are shown in Table 3.

[0030] Table 3 Possible situations and results of rejection sampling

[0031] It is not difficult to find that when R ≥ q && A ≤ (q>>m) && T R ≥ q && T ≥ q and R ≥ q In these two cases, the sampling value of the rejection sampler is invalid. The rejection rate calculation formula of this scheme is analyzed below.

[0032] The constraints in case 4 are: .

[0033] Due to the prerequisite q >>m ,so A The constraints can be further narrowed. A The value of can only be q < <k , the minimum value of the pseudo-random number that does not meet the acceptance condition is R ≥ q ,therefore T The value range of is:

[0034] Therefore, in the fourth case, the number of sample values ​​that do not meet the acceptance condition m 0 for:

[0035] The constraints in case 5 are: .

[0036] because A = q >>m ,and Figure 1 Belongs to the fourth case, so it satisfies the constraints in the fifth case A The value range of is: .

[0037] because T and A are independent of each other, so they satisfy the constraints in case 5 T The value range of is: .

[0038] Therefore, in the fifth case, the number of sample values ​​that do not meet the acceptance condition is m 1 for: .

[0039] In summary, the number of sample values ​​that do not meet the acceptance conditions in this scheme is m 1 + m 0 , so the rejection rate of the rejection sampler is calculated as: .

[0040] 3. High-performance sampler design In order to shorten the sampling time, the present invention adopts a parallelized method to sample the pseudo-random numbers generated by the pseudo-random number generator (PRNG). The relationship between the number of sampling cycles and the degree of parallelism for completing one sampling of pseudo-random numbers by binomial sampling and rejection sampling is shown in Table 4. Since PRNG needs 24 cycles to generate a pseudo-random number sequence, when the sampling cycle is less than 24, PRNG can continuously output the pseudo-random number sequence, and PRNG and the sampler can work simultaneously. In order to balance performance and area, the binomial sampler instantiates 16 basic binomial samplers, which can sample at least 64 bits of random numbers per cycle, and can generate 16 ring polynomial coefficients at the same time. The binomial sampling of pseudo-random numbers can be completed once in 17 sampling cycles at most; for rejection sampling, the rejection sampler instantiates 4 rejection samplers with low rejection rates, which can sample 64 bits of random numbers per cycle, and can generate at most 4 polynomial coefficients at the same time. The rejection sampling of pseudo-random numbers can be completed once in 21 cycles. Since the 4 rejection samplers cannot be valid at the same time, the present invention designs an output cache module for the vectorized rejection sampler. When the valid signal of the rejection sampler is high, the output cache accepts the sampling value of the rejection sampler; otherwise, it waits for the sampling value of the next round of rejection samplers. Whenever there are 4 valid values ​​in the output cache, the sampling value is written into the storage module.

[0041] Table 4 Relationship between the number of sampling cycles and parallelism for binomial sampling and rejection sampling

[0042] like or As shown, the structure diagram of the binomial sampling module based on the configurable addition tree: The binomial sampler realizes the function of generating polynomial coefficients of two standard deviations. It is mainly composed of two Hamming weight calculation units, a subtractor and a modular reduction unit. The core operation unit of the binomial sampler is the Hamming weight calculation unit. or bit sampling data, respectively calculate the high or bit and low or Since the sampled data has only two values, "0" and "1", the input n=3 The bit data is added bit by bit. The bit-by-bit addition is implemented by a configurable addition tree. This paper uses a data selector and two adders to implement two addition trees of different depths. n=2 When , the depth of the addition tree is 2, and the sum of the three input data is calculated; when Figure 2 When , the depth of the addition tree is 1, and only the sum of the two input data is calculated. The specific calculation formula is as follows: .

[0043] After the Hamming weight calculation is completed, the two Hamming weight values ​​are sent to the subtractor to obtain the sampling value. Since the KYBER cryptographic algorithm works on a polynomial ring, the modular reduction module reduces the sampling value to the polynomial ring. When the sampling value is negative, the sampling value and the modulus are q Added; otherwise, the sampled values ​​remain unchanged: .

[0044] like Figure 3 As shown, the structure diagram of the rejection sampler based on data reorganization: The rejection sampler based on data reorganization designed by the present invention mainly consists of two 12-bit data comparators, one 4-bit data comparator and a data selector. The pseudo-random number is first decomposed into two sampling source data R and T , respectively, are sent to two 12-bit comparators and compared with the modulus q Compare; sample source data R The high 4 bits are sent to the 4-bit data comparator and compared with the modulus q If the source data is sampled R Less than modulus q , then the sample data is output R , and set the output valid signal to "1"; if the sampling source data T Less than modulus q And sample source data R The upper 4 bits are greater than the modulus q The high 4 bits of the output sampling data T , and set the output valid signal to "1"; if the above conditions are not met, reject the pseudo-random number and set the output valid signal to "0".

[0045] like Figure 4 and Figure 3 As shown, the schematic diagram of the curve of rejection rate changing with the bit width of sampling source data and the curve of random number generation times changing with the bit width of sampling source data is as follows: Figure 4 The curve shows that as the bit width of the sampling source data increases, the rejection rate shows a trend of being constant at first and then decreasing. When the bit width of the sampling source data is 15 bits, the rejection rate changes greatly, from 0.187 to 0.086, which means that on average, only 9 sampling values ​​will be rejected for every 100 sampling values; when the bit width of the sampling source data is greater than 16 bits, the rejection rate slowly decreases from 0.086 to 0.035, which means that on average, only 4 sampling values ​​will be rejected for every 100 sampling values. In order to reduce the rejection rate of the rejection sampler, the bit width of the input pseudo-random number of the rejection sampler is at least 15 bits.

[0046] Since the pseudo-random number generator used in the present invention can generate a 1344-bit random number sequence each time, and a 2×2 public matrix needs to generate 1024 valid sampling values, the pseudo-random number generator needs to generate pseudo-random number sequences multiple times for the rejection sampler to perform sampling. On average, the relationship between the number of times the pseudo-random number generator generates the pseudo-random number sequence and the input data bit width of the rejection sampling algorithm is: .

[0047] in, w is the sampling source data bit width, P is the rejection rate of the rejection sampling algorithm. The curve of the number of times the pseudo-random number generator generates a pseudo-random number sequence changes with the bit width of the sampling source data is as follows: Figure 5 As shown. It can be found that the curve shows a trend of first increasing, then decreasing, and then continuously increasing. The extreme point of the curve is when the sampling source data bit width is 15 bits. On average, when the sampling source data bit width is 15 bits, the PRNG only needs to generate 13 pseudo-random number sequences to support the rejection sampler to complete the rejection sampling task; when the sampling source data bit width is greater than 15 bits, the number of PRNG operations increases from 14 to 19 times, and the number of cycles of the rejection sampling task continues to increase. Since the rejection sampler cannot complete all 1344-bit sampling when the sampling source data bit width is 15 bits, it is necessary to increase the data cache unit to save the unsampled data. In order not to increase the hardware resource usage and ensure that the number of PRNG operations is at a low level, this article sets the rejection sampler input data bit width to 16 bits.

[0048] like ​ As shown, the overall architecture diagram of the high-performance sampler: The high-performance sampler designed by the present invention is composed of a vectorized binomial sampler with a vector length of 16 and a vectorized rejection sampler with a vector length of 4, and can generate 16 error polynomial coefficients or at most 4 matrix polynomial coefficients per cycle. When the output of the rejection sampler is valid, the sampled value is temporarily stored in the output buffer, and when there are 4 data in the output buffer, the sampled value is written into the storage module.

[0049] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A high performance vectorized sampler, characterized in that: The vectorized sampler is composed of a vectorized binomial sampler with a vector length of 16 and a vectorized rejection sampler with a vector length of 4; The vectorized binomial sampler based on the configurable addition tree realizes the function of generating polynomial coefficients of two standard deviations. The vectorized binomial sampler consists of two Hamming weight calculation units, a subtractor and a modular reduction unit. The two Hamming weight calculation units are used to calculate the Hamming weight of the input data. After the calculation is completed, the two Hamming weight values ​​are sent to the subtractor for difference to obtain the sampling value. The modular reduction module then reduces the sampling value to the polynomial ring; the vectorized binomial sampler instantiates 16 basic binomial samplers in total, samples at least 64-bit random numbers per cycle, and generates 16 error polynomial coefficients at the same time. The binomial sampling of pseudo-random numbers is completed once in at most 17 sampling cycles; The vectorized rejection sampler based on data reorganization instantiates 4 rejection samplers with low rejection rate, samples 64-bit random numbers per cycle, generates up to 4 polynomial coefficients at the same time, completes the rejection sampling of pseudo-random numbers once in 21 cycles, and sets the input data width to 16 bits. It consists of two 12-bit data comparators, one 4-bit data comparator and a data selector. The pseudo-random number is first decomposed into two sampling source data R and T , respectively, are sent to two 12-bit comparators and compared with the modulus q Compare; sample source data R The high 4 bits are sent to the 4-bit data comparator and compared with the modulus q When the valid signal of the rejected sampler is high, the output buffer accepts the sampled value of the rejected sampler; Otherwise, wait for the next round of rejected sampler sample values; whenever there are 4 valid values ​​in the output buffer, write the sample values ​​into the storage module; The vectorized rejection sampler also includes an output cache module. When the output of the rejection sampler is valid, the sampling value is temporarily stored in the output cache module. Whenever there are 4 valid values ​​in the output cache module, the output result is unified; 16 error polynomial coefficients or at most 4 matrix polynomial coefficients are generated per cycle.

2. A high performance vector sampler according to claim 1, characterized in that: The Hamming weight calculation unit calculates the 2 η bit sampling data, respectively calculate the high η bit and low η The Hamming weight of the bit; since the sampled data has only two values, "0" and "1", the input η The bit data is added bit by bit; the bit by bit addition is implemented by a configurable addition tree; two addition trees of different depths are implemented using a data selector and two adders. η = 3, the depth of the addition tree is 2, and the sum of three input data is calculated. The three input data are A, B, and C respectively; when η = 2, the depth of the addition tree is 1, and only the sum of two input data is calculated. The two input data are A and B respectively, and HM is the Hamming weight. The specific calculation formula is as follows: .

3. A high performance vector sampler according to claim 2, characterized in that: The modular reduction unit reduces the sampled value obtained by the subtractor to a polynomial ring. The function of the modular reduction unit is as follows: when the sampled value sub is a negative number, the sampled value sub and the modulus q Add up to get the output out; otherwise, the sample value remains unchanged, and the output out is the sample value sub itself; 。 4. A high performance vector sampler according to claim 3, characterized in that: The input n The bit pseudo-random number is divided into two 12-bit sampling source data R and T , and then the two sampled source data are respectively compared with the analog q The more specific steps include: If the sampling source data R Less than modulus q , then keep the sampled data R , and set the output valid signal to "1"; if the sampling source data T Less than modulus q And sample source data R of high k bit greater than modulus q of high k bit, the sampled data is retained T , and set the output valid signal to "1"; if the above conditions are not met, reject the pseudo-random number and set the output valid signal to "0".

Images