Number-theory transformation processing device based on post-quantum encryption algorithm

Abstract

The embodiment of the invention provides a number-theory transformation processing device based on a post-quantum encryption algorithm. The device comprises a control unit, a ping-pong storage unit, a butterfly unit and a nonvolatile storage unit, the control unit is used for receiving the polynomial of the post-quantum encryption algorithm, splitting the polynomial into coefficients and writing the coefficients into the ping-pong storage unit; writing a preset twiddle factor into the nonvolatile storage unit; and calling the ping-pong storage unit and the nonvolatile storage unit to read and write data according to a preset processing flow of the post-quantum encryption algorithm, and calling the butterfly unit to calculate. According to the embodiment of the invention, the polynomial is split into coefficients through the control unit, the ping-pong storage unit and the nonvolatile storage unit are called to read and write data according to the preset processing flow of the post-quantum encryption algorithm, and the butterfly unit is called to calculate, so that the running speed of the algorithm on hardware is optimized; and meanwhile, the performance of the post-quantum encryption algorithm can be greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of post-quantum cryptography applications, and in particular to a number theory transformation processing device based on a post-quantum encryption algorithm. Background Art

[0002] With the rapid development of quantum computing technology, traditional cryptographic algorithms based on mathematical problems are at risk of being cracked by quantum computers. CRYSTALS-Kyber is a post-quantum cryptographic system designed to provide a secure key encapsulation mechanism (KEM). This cryptographic system is built on a lattice, so it is resistant to quantum computer attacks. In July 2022, the National Institute of Standards and Technology (NIST) announced CRYSTALS-Kyber as part of the post-quantum encryption standard. This means that it will be widely adopted in the future to protect data from potential threats in the era of quantum computing.

[0003] Although the CRYSTALS-Kyber algorithm has shown excellent security performance in theory, it has encountered significant challenges in the actual hardware implementation process. These challenges are mainly reflected in how to optimize the algorithm's running speed on hardware to ensure that while ensuring security, it can also meet the strict requirements of computing speed and energy consumption in practical applications. Therefore, it is urgent to explore more efficient hardware implementation solutions to overcome these technical bottlenecks. Summary of the invention

[0004] In view of the above problems, an embodiment of the present invention is proposed to provide a number theory transformation processing device based on a post-quantum encryption algorithm that overcomes the above problems or at least partially solves the above problems.

[0005] According to a first aspect of an embodiment of the present invention, a number theory transformation processing device based on a post-quantum encryption algorithm is provided, the device comprising:

[0006] A control unit, a ping-pong storage unit, a butterfly unit, and a non-volatile storage unit;

[0007] The control unit is used to receive at least two polynomials of the post-quantum encryption algorithm, split the polynomials into coefficients, and write the coefficients into a ping-pong storage unit; write a preset rotation factor into a non-volatile storage unit; according to a preset processing flow of the post-quantum encryption algorithm, call the ping-pong storage unit and the non-volatile storage unit to read and write data, and call the butterfly unit to perform calculations;

[0008] The butterfly unit is used to read coefficients from the ping-pong storage unit and read rotation factors from the non-volatile storage unit, perform calculations according to the read input coefficients and rotation factors according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit;

[0009] The ping-pong storage unit is used to store the coefficients of the polynomial and the calculation results output by the butterfly unit;

[0010] The non-volatile storage unit is used to store the preset rotation factor.

[0011] Optionally, the preset processing flow of the post-quantum encryption algorithm includes: performing number theory transformation processing on each of the polynomials to obtain a first processing result; performing coefficient point multiplication processing on the first processing result corresponding to each of the polynomials to obtain a second processing result; performing inverse number theory transformation processing on the second processing result to obtain a third processing result; the number theory transformation processing and the inverse number theory transformation processing each include 4 stages, and each stage calls the butterfly unit to perform 64 calculations;

[0012] The butterfly unit includes 4 input terminals and 4 output terminals, and is used to read 4 input coefficients from the ping-pong storage unit and 5 rotation factors from the non-volatile storage unit in each calculation, perform calculations according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit.

[0013] Optionally, the butterfly unit calculates four input coefficients a, b, c, d, and five rotation factors ω1, ω2, ω3, ω4, ω5, respectively, and the calculation results are a1, b1, c1, d1;

[0014] The preset number theory transformation operation rule is: bω3, bω4, cω1, dω2, dω5 are obtained through the first parallel calculation; a+cω1, bω3+dω5, a-cω1, bω4-dω2 are obtained through the second parallel calculation; (a+cω1)+(bω3+dω5), (a+cω1)-(bω3+dω5), (a-cω1)+(bω4-dω2), (a-cω1)-(bω4-dω2) are obtained through the third parallel calculation; the four output coefficients are a1=(a+cω1)+(bω3+dω5), b1=(a+cω1)-(bω3+dω5), c1=(a-cω1)+(bω4-dω2), d1=(a-cω1)-(bω4-dω2);

[0015] The preset inverse number theory transformation operation rule is: a+c, b+d, ac, bd are obtained through the first parallel calculation; (a+c)+(b+d), (a+c)-(b+d) are obtained through the first calculation and (ac)ω1, (ac)ω5, (bd)ω2, (bd)ω4 are obtained through the second parallel calculation; ((a+c)-(b+d))ω3, (ac)ω1+(bd)ω2, (ac)ω5-(bd)ω4 are obtained through the third parallel calculation; the four output coefficients are a1=(a+c)+(b+d), b1=((a+c)-(b+d))ω3, c1=(ac)ω1+(bd)ω2, d1=(ac)ω5-(bd)ω4.

[0016] Optionally, the ping-pong storage unit includes a first storage unit, a second storage unit, a third storage unit, and a fourth storage unit;

[0017] The control unit is used to split each of the polynomials into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

[0018] Optionally, the butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; based on the 4 input coefficients and 5 rotation factors, parallel calculation is performed according to preset number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

[0019] Optionally, the butterfly unit is used for the i-th calculation in the first stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, and reading the i+192-th coefficient from the fourth storage unit;

[0020] The butterfly unit is used for the i-th calculation in the second stage, when i is less than 16, reading the i-th, i+16-th, i+32-th and i+48-th coefficients from the first storage unit, when i is greater than or equal to 16 and less than 32, reading the i+48-th, i+64-th, i+80-th and i+96-th coefficients from the second storage unit, when i is greater than or equal to 32 and less than 48, reading the i+96-th, i+112-th, i+128-th and i+144-th coefficients from the third storage unit, and when i is greater than or equal to 48 and less than 64, reading the i+144-th, i+160-th, i+176-th and i+192-th coefficients from the fourth storage unit;

[0021] The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit;

[0022] The butterfly unit is used for the i-th calculation in the fourth stage. When i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the first storage unit; when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the second storage unit; when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the third storage unit; when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the fourth storage unit.

[0023] Optionally, the control unit is used to split the polynomial of the second processing result into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

[0024] Optionally, the butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; based on the 4 input coefficients and 5 rotation factors, parallel calculation is performed according to preset inverse number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

[0025] Optionally, the butterfly unit is used for the i-th calculation in the first stage, when i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the first storage unit, when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the second storage unit, when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the fourth storage unit;

[0026] The butterfly unit is used for the i-th calculation in the second stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit;

[0027] The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i-th, i+16-th, i+32-th and i+48-th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+48-th, i+64-th, i+80-th and i+96-th coefficients are read from the second storage unit. When i is greater than or equal to 32 and less than 48, the i+96-th, i+112-th, i+128-th and i+144-th coefficients are read from the third storage unit. When i is greater than or equal to 48 and less than 64, the i+144-th, i+160-th, i+176-th and i+192-th coefficients are read from the fourth storage unit.

[0028] The butterfly unit is used for the i-th calculation in the fourth stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, reading the i+192-th coefficient from the fourth storage unit; and reading 5 rotation factors from the non-volatile storage unit.

[0029] Optionally, the non-volatile storage unit includes: a first non-volatile storage unit, a second non-volatile storage unit, a third non-volatile storage unit, a fourth non-volatile storage unit, and a fifth non-volatile storage unit; the first non-volatile storage unit is used to write the first rotation factor, the second non-volatile storage unit is used to write the second rotation factor, the third non-volatile storage unit is used to write the third rotation factor, the fourth non-volatile storage unit is used to write the fourth rotation factor, and the fifth non-volatile storage unit is used to write the fifth rotation factor.

[0030] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0031] The embodiment of the present invention provides a number theory transformation processing device based on a post-quantum encryption algorithm, the device including a control unit, a ping-pong storage unit, a butterfly unit and a non-volatile storage unit; the control unit is used to receive a polynomial of the post-quantum encryption algorithm, split the polynomial into coefficients, and write the coefficients into the ping-pong storage unit; write a preset rotation factor into the non-volatile storage unit; according to the preset processing flow of the post-quantum encryption algorithm, call the ping-pong storage unit and the non-volatile storage unit to read and write data, and call the butterfly unit to perform calculations. The embodiment of the present invention splits the polynomial into coefficients by the control unit, calls the ping-pong storage unit and the non-volatile storage unit to read and write data, and calls the butterfly unit to perform calculations according to the preset processing flow of the post-quantum encryption algorithm, thereby optimizing the running speed of the algorithm on hardware and greatly improving the performance of the post-quantum encryption algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a structural block diagram of a number theory transformation processing device based on a post-quantum encryption algorithm provided by an embodiment of the present invention;

[0033] Figure 2 It is a structural block diagram of another number theory transformation processing device based on a post-quantum encryption algorithm provided by an embodiment of the present invention;

[0034] Figure 3 is a preset processing flow chart of a post-quantum encryption algorithm provided by an embodiment of the present invention;

[0035] Figure 4 is a structural block diagram of a number theory transformation operation rule provided by an embodiment of the present invention;

[0036] Figure 5 It is a structural block diagram of the inverse number theory transformation operation rule provided by an embodiment of the present invention;

[0037] Figure 6 It is a flow chart of four stages of a ping-pong storage unit provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] One of the core concepts of the embodiments of the present invention is that with the rapid development of quantum computing technology, traditional cryptographic algorithms based on mathematical problems are at risk of being cracked by quantum computers. CRYSTALS-Kyber is a post-quantum cryptographic system designed to provide a secure key encapsulation mechanism (KEM). This cryptographic system is built on a lattice, so it is resistant to quantum computer attacks. In July 2022, the National Institute of Standards and Technology (NIST) announced CRYSTALS-Kyber as part of the post-quantum encryption standard. This means that it will be widely adopted in the future to protect data from potential threats in the era of quantum computing.

[0040] Although the CRYSTALS-Kyber algorithm has shown excellent security performance in theory, it has encountered significant challenges in the actual hardware implementation process. These challenges are mainly reflected in how to optimize the algorithm's running speed on hardware to ensure that while ensuring security, it can also meet the strict requirements of computing speed and energy consumption in practical applications. Therefore, it is urgent to explore more efficient hardware implementation solutions to overcome these technical bottlenecks.

[0041] The embodiment of the present invention splits the polynomial into coefficients through a control unit, calls the ping-pong storage unit and the non-volatile storage unit to read and write data according to the preset processing flow of the post-quantum encryption algorithm, and calls the butterfly unit to perform calculations, thereby optimizing the running speed of the algorithm on hardware and greatly improving the performance of the post-quantum encryption algorithm.

[0042] Reference Figure 1 , shows a flowchart of a number theory transformation processing device based on a post-quantum encryption algorithm provided by an embodiment of the present invention, and the method may specifically include the following steps:

[0043] The control unit 101 is used to receive at least two polynomials of the post-quantum encryption algorithm, split the polynomials into coefficients, write the coefficients into a ping-pong storage unit, and write a preset rotation factor into a non-volatile storage unit; according to a preset processing flow of the post-quantum encryption algorithm, call the ping-pong storage unit and the non-volatile storage unit to read and write data, and call the butterfly unit to perform calculations;

[0044] The control unit is responsible for coordinating and scheduling each step in the algorithm execution process, and through precise timing control, ensures that the data flow passes through each module of the algorithm correctly according to the established logical path. The post-quantum encryption algorithm is also the CRYSTALS-Kyber encryption algorithm. The optimization of the hardware implementation of CRYSTALS-Kyber is based on the optimization of polynomial multipliers based on number theory transformations. Because polynomial multiplication is the most complex and time-consuming operation in Kyber's key generation, encryption and decryption, the optimization of polynomial multiplication can greatly affect Kyber's overall performance.

[0045] The number theory transform in this application is a number theory transform based on Radix-4 (radix 4), which is a variant of the fast Fourier transform (FFT) and is used to accelerate the calculation of polynomial multiplication. Number theory transform is also NTT, which includes number theory transform NTT and inverse number theory transform INTT. Number theory transform NTT usually refers to the forward number theory transform, and number theory transform NTT usually refers to the inverse number theory transform. Compared with the traditional Radix-2FFT, Radix-4 NTT reduces the number of multiplications required by decomposing the polynomial into four smaller parts, thereby improving the calculation efficiency. Ping-pong storage reduces the time of external storage access by alternating multiple storage blocks, thereby improving the calculation efficiency. The role of the butterfly unit in the algorithm is to perform efficient data processing to accelerate the calculation of polynomial multiplication.

[0046] Coefficients refer to the constant multiples of each term in a polynomial, and they represent the basic structure of the polynomial. Twiddle factors, which usually refer to the power of the root of a complex unit, play a role in rotation or phase adjustment in polynomial decomposition, helping to convert polynomials from the time domain to the frequency domain, or perform efficient calculations in the frequency domain. This split helps simplify the calculation process and increase processing speed.

[0047] Reference Figure 2 , shows a structural block diagram of another number theory transformation processing device based on a post-quantum encryption algorithm provided by an embodiment of the present invention.

[0048] The control selector 101 also includes an address generator 1101 and a mode selector 1102. The address generator 1101 is used to arrange addresses for coefficients of the polynomial, rotation factors and calculation results of the butterfly unit, and reads and writes addresses after the address generator outputs and confirms that the address is the correct address, and controls the position of data in the ping-pong storage unit and the non-volatile storage unit through the control unit. The mode selector is used to receive the mode type, confirm the mode type required to be operated in each step and run the mode according to the preset processing flow of the post-quantum encryption algorithm, and control the processing method of number theory transformation or inverse number theory transformation through different mode control signals.

[0049] The butterfly unit 103 is used to read coefficients from the ping-pong storage unit and read rotation factors from the non-volatile storage unit, perform calculations according to the read input coefficients and rotation factors according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit;

[0050] The butterfly unit is a basic operation unit commonly used in digital signal processing and numerical calculation. In the present application, the butterfly unit 103 includes CT (continuous transmission mode) and GS (protection signal mode). When performing the NTT operation, the butterfly unit is in CT mode, and when performing the inverse NTT operation, the butterfly unit is in GS mode. Different modes are selected in the same circuit by selecting signals, and calculations are performed according to different modes through preset number theory transformation operation rules or preset inverse number theory transformation operation rules.

[0051] When performing NTT operations, data usually needs to be processed in a high-speed and continuous manner, because NTT operations involve a large number of data points and need to be calculated quickly and continuously. CT mode is suitable for this scenario because it allows the device to continuously send and process signals, thereby improving the speed and efficiency of data processing. In addition, NTT operations usually have high requirements for real-time performance, and CT mode can ensure the continuity of data flow and reduce processing delays. When performing INTT operations, higher signal quality and stronger anti-interference capabilities are required, because INTT operations restore transformed data to original data, and this process requires high signal accuracy. GS mode improves signal reliability and accuracy by sending additional protection signals to prevent interference between different signals. In INTT operations, ensuring accurate data recovery is more important than simply pursuing processing speed.

[0052] By using CT mode and GS mode, the butterfly unit can adopt the most suitable calculation strategy in NTT and INTT operations respectively. CT mode reduces latency by simplifying calculations, while GS mode ensures accuracy during the inverse transformation process. Combined with the advantages of the Radix-4 NTT hardware structure, this design can significantly reduce the latency of the butterfly unit, thereby improving the efficiency of the entire NTT / INTT calculation.

[0053] The ping-pong storage unit 102 is used to store the coefficients of the polynomial and the calculation results output by the butterfly unit;

[0054] The ping-pong storage unit is a memory management technology commonly used in digital signal processing and computer architecture. In the present application, the ping-pong storage 102 includes 4 storage units, namely RAM, and the RAM type is BRAM. In the Number Theoretic Transform (NTT) mode based on Radix-4, the ping-pong storage unit can efficiently alternately store input data and intermediate calculation results to ensure fast reading and writing of data, thereby improving computing efficiency and effective use of storage resources.

[0055] The non-volatile storage unit 104 is used to store the preset rotation factor.

[0056] The non-volatile storage unit is also known as ROM. The rotation factors are frequently used in the calculation process, and the non-volatile storage unit can keep the data from being lost even after power failure, ensuring the safe storage of the rotation factors, thereby ensuring the continuity and accuracy of the calculation.

[0057] In one embodiment, the preset processing flow of the post-quantum encryption algorithm includes: performing number theory transformation processing on each of the polynomials to obtain a first processing result; performing coefficient point multiplication processing on the first processing result corresponding to each of the polynomials to obtain a second processing result; performing inverse number theory transformation processing on the second processing result to obtain a third processing result; the number theory transformation processing and the inverse number theory transformation processing each include 4 stages, and each stage calls the butterfly unit to perform 64 calculations;

[0058] Reference Figure 3 , showing a preset processing flow chart of the post-quantum encryption algorithm provided by an embodiment of the present invention.

[0059] For example, two polynomials are input, namely polynomial A and polynomial B, the length of the two polynomials is 256 and the bit width is 12 bits. The control unit controls the butterfly unit and the ping-pong storage to perform number theory transformation (NTT) processing, and the two polynomials are transformed by NTT in turn to obtain the first processing results NTT (A) and NTT (B).

[0060] The transformed polynomial is subjected to coefficient dot multiplication operation, namely PWM dot multiplication calculation, PWM (Pulse Width Modulation. A technology for digital control of analog signals), to obtain a second processing result NTT(A)·NTT(B).

[0061] The result after the PWM dot multiplication calculation is processed by inverse number theory transformation (INTT) to obtain a third processing result INTT (NTT (A) · NTT (B)). The result is output, wherein the length of the polynomial result is 256 and the bit width of each coefficient is still 12 bits.

[0062] The butterfly unit includes 4 input terminals and 4 output terminals, and is used to read 4 input coefficients from the ping-pong storage unit and 5 rotation factors from the non-volatile storage unit in each calculation, perform calculations according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit.

[0063] In the Radix-4-based number theory transformation mode, each calculation needs to process a set of 4 input coefficients and apply 5 rotation factors to perform the calculation. The design of the butterfly unit enables these calculations to be performed efficiently, ensuring fast reading and writing of data, thereby improving computing efficiency and effective use of storage resources.

[0064] In one embodiment, the butterfly unit calculates four input coefficients a, b, c, and d at one time, and five rotation factors ω1, ω2, ω3, ω4, and ω5, respectively, and the calculation results are a1, b1, c1, and d1;

[0065] Reference Figure 4 , shows a structural block diagram of the number theory transformation operation rules provided by an embodiment of the present invention.

[0066] The preset number theory transformation operation rule is: bω3, bω4, cω1, dω2, dω5 are obtained through the first parallel calculation; a+cω1, bω3+dω5, a-cω1, bω4-dω2 are obtained through the second parallel calculation; (a+cω1)+(bω3+dω5), (a+cω1)-(bω3+dω5), (a-cω1)+(bω4-dω2), (a-cω1)-(bω4-dω2) are obtained through the third parallel calculation; the four output coefficients are a1=(a+cω1)+(bω3+dω5), b1=(a+cω1)-(bω3+dω5), c1=(a-cω1)+(bω4-dω2), d1=(a-cω1)-(bω4-dω2);

[0067] Reference Figure 5 , showing a structural block diagram of the inverse number theory transformation operation rules provided by an embodiment of the present invention.

[0068] The preset inverse number theory transformation operation rule is: a+c, b+d, ac, bd are obtained through the first parallel calculation; (a+c)+(b+d), (a+c)-(b+d) are obtained through the first calculation and (ac)ω1, (ac)ω5, (bd)ω2, (bd)ω4 are obtained through the second parallel calculation; ((a+c)-(b+d))ω3, (ac)ω1+(bd)ω2, (ac)ω5-(bd)ω4 are obtained through the third parallel calculation; the four output coefficients are a1=(a+c)+(b+d), b1=((a+c)-(b+d))ω3, c1=(ac)ω1+(bd)ω2, d1=(ac)ω5-(bd)ω4.

[0069] Regardless of the preset inverse number theory transformation operation rule or the preset inverse number theory transformation operation rule, the time consumed by the butterfly unit is the delay of one modular multiplication plus two modular additions. Compared with the traditional butterfly unit, this new butterfly unit saves the delay of one modular multiplication calculation, because the modular multiplication calculation occupies most of the delay of the entire butterfly unit. Reducing the number of modular multiplication calculations by half can significantly reduce the overall delay of the butterfly unit.

[0070] Reference Figure 6 , showing a flowchart of four stages of a ping-pong storage unit provided in an embodiment of the present invention.

[0071] In one embodiment, the ping-pong storage unit includes a first storage unit RAM0, a second storage unit RAM1, a third storage unit RAM2, and a fourth storage unit RAM3;

[0072] The control unit is used to split each of the polynomials into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

[0073] The ping-pong storage unit includes four storage units because this configuration can efficiently support data processing based on Radix-4 number-theoretic transformations. By evenly distributing the coefficients to different storage units, the ping-pong storage strategy can be fully utilized to ensure that the calculations at each stage can read and write data efficiently, and these storage units are used alternately at different stages of the calculation, thereby reducing data access latency and improving the parallelism of the calculation. This storage allocation method helps to optimize the data flow, so that the number-theoretic transformation or inverse number-theoretic transformation process can be performed efficiently.

[0074] In one embodiment, the butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; based on the 4 input coefficients and 5 rotation factors, parallel calculation is performed according to preset number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

[0075] In one embodiment, the butterfly unit is used for the i-th calculation in the first stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, and reading the i+192-th coefficient from the fourth storage unit;

[0076] The butterfly unit is used for the i-th calculation in the second stage, when i is less than 16, reading the i-th, i+16-th, i+32-th and i+48-th coefficients from the first storage unit, when i is greater than or equal to 16 and less than 32, reading the i+48-th, i+64-th, i+80-th and i+96-th coefficients from the second storage unit, when i is greater than or equal to 32 and less than 48, reading the i+96-th, i+112-th, i+128-th and i+144-th coefficients from the third storage unit, and when i is greater than or equal to 48 and less than 64, reading the i+144-th, i+160-th, i+176-th and i+192-th coefficients from the fourth storage unit;

[0077] The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit;

[0078] Here, i>>2 means shifting the binary representation of the integer i two bits to the right. This means that the value of i is divided by 4 (i.e., i / 4), because shifting right by two bits is equivalent to dividing by 2 raised to the power of 2 (2 raised to the power of 4), and *12 means multiplying the result of the right shift operation by 12. This means that the calculation result is (i / 4)*12. In ping-pong storage, the expression (i>>2)*12 is used to calculate the address in RAM. The effect of this expression is to divide the value of i by 4 and then multiply it by 12, which is equivalent to i*3. This calculation method is used to determine the specific location of data in RAM so that the data can be read or written correctly.

[0079] The butterfly unit is used for the i-th calculation in the fourth stage. When i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the first storage unit; when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the second storage unit; when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the third storage unit; when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the fourth storage unit.

[0080] In the second, third and fourth stages of the above four stages, after the calculation task of the coefficients in the current RAM is completed, it interacts with the read and write tasks of the next RAM to avoid memory conflicts. Under the inverse number theory transformation processing, the storage implementation process of ping-pong storage is the reverse implementation of the number theory transformation processing process.

[0081] In one embodiment, the control unit is used to split the polynomial of the second processing result into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

[0082] In one embodiment, the butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; based on the 4 input coefficients and 5 rotation factors, parallel calculation is performed according to preset inverse number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

[0083] In one embodiment, the butterfly unit is used for the i-th calculation in the first stage, when i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the first storage unit, when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the second storage unit, when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the fourth storage unit;

[0084] The butterfly unit is used for the i-th calculation in the second stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit;

[0085] The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i-th, i+16-th, i+32-th and i+48-th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+48-th, i+64-th, i+80-th and i+96-th coefficients are read from the second storage unit. When i is greater than or equal to 32 and less than 48, the i+96-th, i+112-th, i+128-th and i+144-th coefficients are read from the third storage unit. When i is greater than or equal to 48 and less than 64, the i+144-th, i+160-th, i+176-th and i+192-th coefficients are read from the fourth storage unit.

[0086] The butterfly unit is used for the i-th calculation in the fourth stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, reading the i+192-th coefficient from the fourth storage unit; and reading 5 rotation factors from the non-volatile storage unit.

[0087] In one embodiment, the non-volatile storage unit 104 includes: a first non-volatile storage unit, a second non-volatile storage unit, a third non-volatile storage unit, a fourth non-volatile storage unit, and a fifth non-volatile storage unit; the first non-volatile storage unit is used to write the first rotation factor, the second non-volatile storage unit is used to write the second rotation factor, the third non-volatile storage unit is used to write the third rotation factor, the fourth non-volatile storage unit is used to write the fourth rotation factor, and the fifth non-volatile storage unit is used to write the fifth rotation factor.

[0088] The embodiment of the present invention provides a number theory transformation processing device based on a post-quantum encryption algorithm, the device including a control unit, a ping-pong storage unit, a butterfly unit and a non-volatile storage unit; the control unit is used to receive a polynomial of the post-quantum encryption algorithm, split the polynomial into coefficients, and write the coefficients into the ping-pong storage unit; write a preset rotation factor into the non-volatile storage unit; according to the preset processing flow of the post-quantum encryption algorithm, call the ping-pong storage unit and the non-volatile storage unit to read and write data, and call the butterfly unit to perform calculations. The embodiment of the present invention splits the polynomial into coefficients by the control unit, calls the ping-pong storage unit and the non-volatile storage unit to read and write data, and calls the butterfly unit to perform calculations according to the preset processing flow of the post-quantum encryption algorithm, thereby optimizing the running speed of the algorithm on hardware and greatly improving the performance of the post-quantum encryption algorithm.

[0089] It should be noted that, for the sake of simplicity, the device embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the described action sequence, because according to the embodiments of the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0090] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0091] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the apparatus and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, and the instructions executed generate instructions for implementing the process in the flowchart. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0093] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0094] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0095] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0096] The above is a detailed introduction to a number theory transformation processing device based on a post-quantum encryption algorithm provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the device of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A number theory transformation processing device based on a post-quantum encryption algorithm, characterized in that: include: A control unit, a ping-pong storage unit, a butterfly unit, and a non-volatile storage unit; The control unit is used to receive at least two polynomials of a post-quantum encryption algorithm, split the polynomials into coefficients, and write the coefficients into a ping-pong storage unit; Writing the preset rotation factor into the non-volatile storage unit; According to a preset processing flow of the post-quantum encryption algorithm, the ping-pong storage unit and the non-volatile storage unit are called to read and write data, and the butterfly unit is called to perform calculation; The butterfly unit is used to read coefficients from the ping-pong storage unit and read rotation factors from the non-volatile storage unit, perform calculations according to the read input coefficients and rotation factors according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit; The ping-pong storage unit is used to store the coefficients of the polynomial and the calculation results output by the butterfly unit; The non-volatile storage unit is used to store the preset rotation factor.

2. The device according to claim 1, characterized in that The preset processing flow of the post-quantum encryption algorithm includes: performing number theory transformation processing on each of the polynomials to obtain a first processing result; performing coefficient point multiplication processing on the first processing result corresponding to each of the polynomials to obtain a second processing result; performing inverse number theory transformation processing on the second processing result to obtain a third processing result; the number theory transformation processing and the inverse number theory transformation processing each include 4 stages, and each stage calls the butterfly unit to perform 64 calculations; The butterfly unit includes 4 input terminals and 4 output terminals, and is used to read 4 input coefficients from the ping-pong storage unit and 5 rotation factors from the non-volatile storage unit in each calculation, perform calculations according to preset number theory transformation operation rules or preset inverse number theory transformation operation rules, and store the calculation results in the ping-pong storage unit.

3. The device according to claim 2, characterized in that The butterfly unit calculates four input coefficients a, b, c, d, and five rotation factors ω1, ω2, ω3, ω4, ω5, respectively, and the calculation results are a1, b1, c1, d1; The preset number theory transformation operation rule is: bω3, bω4, cω1, dω2, dω5 are obtained through the first parallel calculation; a+cω1, bω3+dω5, a-cω1, bω4-dω2 are obtained through the second parallel calculation; (a+cω1)+(bω3+dω5), (a+cω1)-(bω3+dω5), (a-cω1)+(bω4-dω2), (a-cω1)-(bω4-dω2) are obtained through the third parallel calculation; the four output coefficients are a1=(a+cω1)+(bω3+dω5), b1=(a+cω1)-(bω3+dω5), c1=(a-cω1)+(bω4-dω2), d1=(a-cω1)-(bω4-dω2); The preset inverse number theory transformation operation rule is: a+c, b+d, ac, bd are obtained through the first parallel calculation; (a+c)+(b+d), (a+c)-(b+d) are obtained through the first calculation and (ac)ω1, (ac)ω5, (bd)ω2, (bd)ω4 are obtained through the second parallel calculation; ((a+c)-(b+d))ω3, (ac)ω1+(bd)ω2, (ac)ω5-(bd)ω4 are obtained through the third parallel calculation; the four output coefficients are a1=(a+c)+(b+d), b1=((a+c)-(b+d))ω3, c1=(ac)ω1+(bd)ω2, d1=(ac)ω5-(bd)ω4.

4. The device according to claim 2, characterized in that The ping-pong storage unit includes a first storage unit, a second storage unit, a third storage unit, and a fourth storage unit; The control unit is used to split each of the polynomials into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

5. The device according to claim 4, characterized in that The butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; according to the 4 input coefficients and the 5 rotation factors, parallel calculation is performed according to preset number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

6. The device according to claim 5, characterized in that The butterfly unit is used for the i-th calculation in the first stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, and reading the i+192-th coefficient from the fourth storage unit; The butterfly unit is used for the i-th calculation in the second stage, when i is less than 16, reading the i-th, i+16-th, i+32-th and i+48-th coefficients from the first storage unit, when i is greater than or equal to 16 and less than 32, reading the i+48-th, i+64-th, i+80-th and i+96-th coefficients from the second storage unit, when i is greater than or equal to 32 and less than 48, reading the i+96-th, i+112-th, i+128-th and i+144-th coefficients from the third storage unit, and when i is greater than or equal to 48 and less than 64, reading the i+144-th, i+160-th, i+176-th and i+192-th coefficients from the fourth storage unit; The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit; The butterfly unit is used for the i-th calculation in the fourth stage. When i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the first storage unit; when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the second storage unit; when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the third storage unit; when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read out from the fourth storage unit.

7. The device according to claim 4, characterized in that The control unit is used to split the polynomial of the second processing result into 256 coefficients, write the 0th to 63rd coefficients into the first storage unit, write the 64th to 127th coefficients into the second storage unit, write the 128th to 191st coefficients into the third storage unit, and write the 192nd to 255th coefficients into the fourth storage unit.

8. The device according to claim 7, characterized in that The butterfly unit is used to read 4 input coefficients from the corresponding storage unit and 5 rotation factors from the non-volatile storage unit for each calculation in each stage; according to the 4 input coefficients and the 5 rotation factors, parallel calculation is performed according to the preset inverse number theory transformation operation rules to obtain 4 output coefficients, and the 4 output coefficients are respectively stored in the storage units corresponding to the 4 input coefficients.

9. The device according to claim 8, characterized in that The butterfly unit is used for the i-th calculation in the first stage, when i is less than 16, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the first storage unit, when i is greater than or equal to 16 and less than 32, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the second storage unit, when i is greater than or equal to 32 and less than 48, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the third storage unit, when i is greater than or equal to 48 and less than 64, the i*4th, i*4+1th, i*4+2th and i*4+3th coefficients are read from the fourth storage unit; The butterfly unit is used for the i-th calculation in the second stage. When i is less than 16, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the second storage unit. 2+12 coefficients, when i is greater than or equal to 32 and less than 48, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the third storage unit, and when i is greater than or equal to 48 and less than 64, the i+(i>>2)*12th, i+(i>>2)*12+4th, i+(i>>2)*12+8th and i+(i>>2)*12+12th coefficients are read from the fourth storage unit; The butterfly unit is used for the i-th calculation in the third stage. When i is less than 16, the i-th, i+16-th, i+32-th and i+48-th coefficients are read from the first storage unit. When i is greater than or equal to 16 and less than 32, the i+48-th, i+64-th, i+80-th and i+96-th coefficients are read from the second storage unit. When i is greater than or equal to 32 and less than 48, the i+96-th, i+112-th, i+128-th and i+144-th coefficients are read from the third storage unit. When i is greater than or equal to 48 and less than 64, the i+144-th, i+160-th, i+176-th and i+192-th coefficients are read from the fourth storage unit. The butterfly unit is used for the i-th calculation in the fourth stage, reading the i-th coefficient from the first storage unit, reading the i+64-th coefficient from the second storage unit, reading the i+128-th coefficient from the third storage unit, reading the i+192-th coefficient from the fourth storage unit; and reading 5 rotation factors from the non-volatile storage unit.

10. The device according to claim 2, characterized in that: The nonvolatile storage unit includes: a first nonvolatile storage unit, a second nonvolatile storage unit, a third nonvolatile storage unit, a fourth nonvolatile storage unit, and a fifth nonvolatile storage unit; the first nonvolatile storage unit is used to write the first rotation factor, the second nonvolatile storage unit is used to write the second rotation factor, the third nonvolatile storage unit is used to write the third rotation factor, the fourth nonvolatile storage unit is used to write the fourth rotation factor, and the fifth nonvolatile storage unit is used to write the fifth rotation factor.

Images