Polynomial operation acceleration method and device, equipment and storage medium

Abstract

The invention discloses a polynomial operation acceleration method, device and equipment and a storage medium, and belongs to the technical field of cryptographs.The method comprises the steps that a first numerical value and a second numerical value of a first sub-algorithm are obtained, the first numerical value is the number of first polynomials which are generated in the operation process of the first sub-algorithm and need to be operated, and the second numerical value is the number of second polynomials which need to be operated; the second numerical value is the number of second polynomials needing to be operated with the first polynomial in the NTT domain; comparing the first numerical value with the second numerical value; under the condition that the first numerical value is greater than or equal to the second numerical value, performing number-theory transformation on the first polynomial by adopting a bit inverse number-theory transformation algorithm; performing polynomial multiplication on the first polynomial and the second polynomial after the number-theory transformation; or under the condition that the first numerical value is smaller than the second numerical value, the shuffling ordinal number theory transformation algorithm is adopted to carry out number theory transformation on the second polynomial; and performing polynomial multiplication on the first polynomial and the second polynomial after the number theory transformation. The method can realize accelerated polynomial operation.

Description

Technical Field

[0001] The present disclosure relates to the field of cryptographic technology, and in particular to a polynomial operation acceleration method, device, equipment and storage medium. Background Art

[0002] In cryptographic algorithms based on lattice difficulty problems, taking the Dilithium signature algorithm as an example, polynomial multiplication operations account for about 30% of the total signature process time, becoming the main bottleneck restricting the further migration of current cryptographic systems to post-quantum cryptographic systems. Therefore, a polynomial operation acceleration method is needed to accelerate the polynomial multiplication operations in lattice cryptographic algorithms, thereby realizing accelerated lattice cryptographic algorithms. Summary of the invention

[0003] The present disclosure provides a polynomial operation acceleration method, device, equipment and storage medium, which can realize the acceleration of polynomial operation. The technical solution at least includes the following solutions: In a first aspect, a polynomial operation acceleration method is provided, including: obtaining a first value and a second value of a first sub-algorithm, the first lattice cryptographic algorithm including multiple sub-algorithms, each sub-algorithm corresponding to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm being any one of the multiple sub-algorithms, the first value being the number of first polynomials that need to be calculated generated during the operation of the first sub-algorithm, and the second value being the number of second polynomials that need to be calculated with the first polynomial in the NTT domain; comparing the first value with the second value; when the first value is greater than or equal to the second value, performing a number-theoretic transformation on the first polynomial using a bit-reversal number-theoretic transformation algorithm; performing a polynomial multiplication operation on the first polynomial after the number-theoretic transformation and the second polynomial; or, when the first value is less than the second value, performing a number-theoretic transformation on the second polynomial using a shuffled order number-theoretic transformation algorithm; performing a polynomial multiplication operation on the first polynomial after the number-theoretic transformation and the second polynomial.

[0004] Optionally, the shuffle ordinal transformation algorithm includes a shuffle ordinal transformation algorithm based on register exchange, and the output of the shuffle ordinal transformation algorithm based on register exchange is a shuffle sequence polynomial based on register exchange, and the shuffle sequence polynomial based on register exchange is expressed by the following formula:

[0005] Among them, when the above formula is satisfied, is the shuffle sequence polynomial based on register exchange, is an integer, is a value raised to a power of 2, Express After performing a register-based shuffle operation, we get , is a polynomial in the NTT field Any of the following: The shuffling operation based on register exchange is expressed by the following formula:

[0006] in, To satisfy A non-negative integer, Express Perform a register-swap based shuffle operation, is the number of polynomial coefficients stored in the register, Indicates bit reversal operation.

[0007] Optionally, the register-swap-based shuffle ordinal transformation algorithm includes a forward fast shuffle operation, the input of the forward fast shuffle operation is a bit inversion polynomial, and the output is a register-swap-based shuffle ordinal polynomial, and the forward fast shuffle operation is implemented in the following manner: read every 8 terms in the third polynomial into a register , , the third polynomial is a bit inversion polynomial; using the vpermd instruction, according to the first index register register Replace the data in and save the replacement result to the register , , the data stored in the first index register is ; Use the vpermd instruction to register the second index register Replace the data in and save the replacement result to the register , the data stored in the second index register is ; Use vpblendd instruction to unpack the registers and the register and the register The lower 128 bits of data and the register The high 128 bits of data in are packed and stored in the register ; Use vpblendd instruction to unpack the registers and the register and the register The high 128 bits of data and the register The lower 128 bits of data in are packed and stored in the register ; Use the vpermd instruction to set the register according to the third index register The data in the third index register is replaced. The data stored in the third index register is ; The register and the register The data in the first array are stored in the first array, and the data in the first array is used to indicate the register exchange-based shuffle sequence polynomial obtained after the forward shuffle operation is performed on the third polynomial; wherein the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2 AVX2 instruction set.

[0008] Optionally, the register-switching based shuffle ordinal transformation algorithm includes a reverse fast shuffle operation, the input of the reverse fast shuffle operation is a register-switching based shuffle ordinal polynomial, and the output is a bit reverse polynomial, and the reverse fast shuffle operation is implemented in the following manner: read every 8 terms in the fourth polynomial into a register , , the fourth polynomial is a shuffle sequence polynomial based on register exchange; the vpunpckldq instruction is used to unpack and interleave registers and registers The lower 64 bits of data in every 128 bits in the , and the replacement result is saved in the register , ; Unpack and interleave the registers using the vpunpckhdq instruction and the register The high 64 bits of data in every 128 bits in the , and the replacement result is saved in the register ; Use the vperm2i128 instruction to set the register and the register The lower 128 bits of data are stored in the register ; Use the vperm2i128 instruction to set the register and the register The high 128 bits of data are stored in the register ; Set the register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the reverse shuffle operation is performed on the fourth polynomial; wherein the vpunpckldq instruction, the vpunpckhdq instruction and the vperm2i128 instruction are instructions in the AVX2 instruction set.

[0009] Optionally, in the process of performing polynomial multiplication operation on the first polynomial and the second polynomial after number theory transformation, or in the process of performing polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial, there are multiple levels of butterfly operations, each level of butterfly operations corresponds to a set of pre-calculated values, and the method further includes: obtaining multiple first pre-calculated values ​​corresponding to the butterfly operations of the first level and the second precomputed value , the first level is The first level is the Layer; construct a third array with a basic unit of 64 bits, in which each 64 bits of data are stored in sequence , and read the third array into a vector register; when the first pre-calculated value is needed In the case of, reading the lower 32 bits of data of each 64 bits of data in the vector register; when the second pre-calculated value is needed In the case of, the upper 32 bits of each 64 bits of data in the vector register are shifted right by 32 bits, and the lower 32 bits of each 64 bits of data in the vector register after the shift are read.

[0010] In the second aspect, a polynomial operation acceleration device is also provided, including: an acquisition module, used to acquire a first value and a second value of a first sub-algorithm, the first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponds to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm is any one of the multiple sub-algorithms, the first value is the number of first polynomials that need to be calculated generated during the operation of the first sub-algorithm, and the second value is the number of second polynomials that need to be calculated with the first polynomial in the NTT domain; a comparison module, used to compare the size of the first value and the second value; a number theory transformation module, used to use a bit reversal number theory transformation algorithm to perform number theory transformation on the first polynomial when the first value is greater than or equal to the second value, and to use a shuffle order number theory transformation algorithm to perform number theory transformation on the second polynomial when the first value is less than the second value; a polynomial operation module, used to perform polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial when the first value is greater than or equal to the second value, and to perform polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial when the first value is less than the second value.

[0011] Optionally, the number theory transformation module is further used to read every 8 terms in the third polynomial into a register , , the third polynomial is a bit inversion polynomial; using the vpermd instruction, according to the first index register register Replace the data in and save the replacement result to the register , , the data stored in the first index register is ; Use the vpermd instruction to register the second index register Replace the data in and save the replacement result to the register , the data stored in the second index register is ; Use vpblendd instruction to unpack the registers and the register and the register The lower 128 bits of data and the register The high 128 bits of data in are packed and stored in the register ; Use vpblendd instruction to unpack the registers and the register and the register The high 128 bits of data and the register The lower 128 bits of data in are packed and stored in the register ; Use the vpermd instruction to set the register according to the third index register The data in the third index register is replaced. The data stored in the third index register is ; Set the register and the register The data in the first array are stored in the first array, and the data in the first array is used to indicate the register exchange-based shuffle sequence polynomial obtained after the forward shuffle operation is performed on the third polynomial; wherein the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2 AVX2 instruction set.

[0012] Optionally, the number theory transformation module is further used to read every 8 terms in the fourth polynomial into a register , , the fourth polynomial is a shuffle sequence polynomial based on register exchange; the vpunpckldq instruction is used to unpack and interleave registers and registers The lower 64 bits of data in every 128 bits in the , and the replacement result is saved in the register , ; Unpack and interleave the registers using the vpunpckhdq instruction and the register The high 64 bits of data in every 128 bits in the , and the replacement result is saved in the register ; Use the vperm2i128 instruction to set the register and the register The lower 128 bits of data are stored in the register ; Use the vperm2i128 instruction to set the register and the register The high 128 bits of data are stored in the register ; Set the register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the reverse shuffle operation is performed on the fourth polynomial; wherein the vpunpckldq instruction, the vpunpckhdq instruction and the vperm2i128 instruction are instructions in the AVX2 instruction set.

[0013] Optionally, the device further comprises: a pre-calculation module, configured to obtain a plurality of first pre-calculated values ​​corresponding to the butterfly operation of the first level and the second precomputed value , the first level is The first level is the Layer; construct a third array with a basic unit of 64 bits, in which each 64 bits of data are stored in sequence , and read the third array into a vector register; when the first pre-calculated value is needed In the case of, reading the lower 32 bits of data of each 64 bits of data in the vector register; when the second pre-calculated value is needed In the case of, the upper 32 bits of each 64 bits of data in the vector register are shifted right by 32 bits, and the lower 32 bits of each 64 bits of data in the vector register after the shift are read.

[0014] In a third aspect, a computer device is also provided, comprising: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor, thereby executing the polynomial operation acceleration method described in the above embodiment.

[0015] In a fourth aspect, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor, thereby executing the polynomial operation acceleration method described in the above embodiment.

[0016] In a fifth aspect, a computer program product is provided, comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the method described in the first aspect is implemented.

[0017] The beneficial effects brought by the technical solution provided by the embodiments of the present disclosure include at least: The time spent on performing number-theoretic transformation on a first polynomial using a bit-reversal number-theoretic transformation algorithm and the time spent on performing number-theoretic transformation on a second polynomial using a shuffled number-theoretic transformation algorithm can be approximately considered equal. Let this time be T.

[0018] For the case where the first value in a sub-algorithm is greater than or equal to the second value, for example, the first value is 7 and the second value is 9, if the bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial, the total time spent on number-theoretic transformation is 7T, and if the shuffle number-theoretic transformation algorithm is used to perform number-theoretic transformation on the second polynomial, the total time spent on number-theoretic transformation is 9T. Since 7T is less than 9T, the time spent on number-theoretic transformation on the first polynomial using the bit-reversal number-theoretic transformation algorithm is less.

[0019] For the case where the first value in a certain sub-algorithm is less than the second value, for example, the first value is 9 and the second value is 7, if the bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial, the total time spent on the number-theoretic transformation is 9T, and if the shuffled order number-theoretic transformation algorithm is used to perform number-theoretic transformation on the second polynomial, the total time spent on the number-theoretic transformation is 7T. Since 7T is less than 9T, the time spent on performing number-theoretic transformation on the second polynomial using the shuffled order number-theoretic transformation algorithm is less. In summary, selecting the number-theoretic transformation algorithm based on the size of the first value and the second value in the disclosed embodiment is essentially selecting the number-theoretic transformation algorithm that takes less time.

[0020] In the related art, each sub-algorithm of the lattice cryptographic algorithm uses the same type of number theory transformation algorithm to accelerate the polynomial multiplication operation. In the embodiment of the present disclosure, the number theory transformation algorithm that takes less time is selected according to the size of the first value and the second value in each sub-algorithm, thereby effectively reducing the time required for the number theory transformation operation in the entire lattice cryptographic algorithm and accelerating the polynomial operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flowchart of a polynomial operation acceleration method provided by an exemplary embodiment of the present disclosure is shown; Figure 2 A flowchart of a polynomial operation acceleration method provided by another exemplary embodiment of the present disclosure is shown; Figure 3 It is a flowchart of the forward fast shuffle operation; Figure 4 This is a schematic diagram of instructions for a forward fast shuffle operation; Figure 5 A flowchart of a forward shuffle operation based on register exchange performed hierarchically in the related art; Figure 6 It is a flowchart of the reverse fast shuffle operation; Figure 7 This is a schematic diagram of the instructions for the reverse fast shuffle operation; Figure 8 A flowchart of a reverse shuffle operation based on register exchange performed hierarchically in the related art; Fig. 9 For the A schematic diagram of a process for optimizing the storage method of pre-computed values ​​of a layer; Fig.10 A schematic diagram of the structure of a polynomial operation acceleration device provided by an exemplary embodiment of the present disclosure is shown; Fig.11 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] Unless otherwise defined, the technical or scientific terms used herein shall have the usual meanings understood by persons of ordinary skill in the field to which the present disclosure belongs. The words "first", "second", "third" and similar words used in the patent application specification and claims of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "one" do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" and similar words mean that the elements or objects appearing before "include" or "comprises" cover the elements or objects listed after "include" or "comprises" and their equivalents, and do not exclude other elements or objects.

[0024] In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0025] In order to facilitate understanding of the embodiments of the present disclosure, the number theory transformation algorithm involved in the embodiments of the present disclosure is first briefly described below.

[0026] The Number Theoretic Transform (NTT), also known as the fast number theoretic transform, is a special form of discrete Fourier transform on a finite field. The algorithm can convert polynomials from coefficient representation to point value representation through fast Fourier transform to accelerate the computational efficiency of polynomial multiplication. The forward NTT algorithm converts polynomials from coefficient representation to point value representation, and the reverse NTT algorithm converts polynomials back to coefficient representation. According to the length of the polynomial, the NTT algorithm is divided into multiple layers for operation, and the core operation component is the butterfly operator. The butterfly operator can be divided into CT (Cooley-Tukey) and GS (Gentleman-Sande) butterfly operations according to different operations. For the parallel implementation of the NTT algorithm, in order to ensure the correctness of the butterfly operation input value, it is necessary to add shuffle operations between different layers. At the same time, the powers of the rotation factors required for butterfly operations at different levels can be pre-calculated. When needed, the pre-calculated results can be directly read from the memory instead of recalculated, thereby accelerating the implementation efficiency of the NTT algorithm.

[0027] Figure 1 A flowchart of a polynomial operation acceleration method provided by an exemplary embodiment of the present disclosure is shown. The method can be executed by a computer device. Figure 1 , the method comprising: In step 101, a first value and a second value of a first sub-algorithm are obtained.

[0028] The first grid cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponds to a different stage of the first grid cryptographic algorithm. The first sub-algorithm is any one of the multiple sub-algorithms. The first numerical value is the number of first polynomials that need to be calculated and generated during the operation of the first sub-algorithm. The second numerical value is the number of second polynomials that need to be calculated in the NTT domain.

[0029] In the embodiment of the present disclosure, taking the Dilithium signature algorithm as an example, the first-level cryptographic algorithm includes three stages: key generation, signature generation, and signature verification, and each stage is a sub-algorithm.

[0030] Typically, operations performed on the first polynomial in the NTT domain include forward NTT and inverse NTT, and the second value is the sum of the number of polynomials in the NTT domain that need to perform forward NTT operations on the first polynomial and the number of polynomials in the NTT domain that need to perform inverse NTT operations on the first polynomial.

[0031] Taking the first lattice cryptographic algorithm as the Dilithium signature algorithm and the first sub-algorithm as the signature verification step as an example, the second value is equal to the average number of required cycles multiplied by the number of forward NTT and reverse NTT called in a single cycle. This is because the lattice cryptographic algorithm also includes multiple cycles, so when calculating the second value, first calculate the number of forward NTT and reverse NTT called in a single cycle, and then use the average number of required cycles (used to indicate the number of cycles in the sub-algorithm) multiplied by this number.

[0032] In step 102, the first value is compared with the second value.

[0033] When the first value is greater than or equal to the second value, steps 103-104 are executed; when the first value is less than the second value, steps 105-106 are executed.

[0034] In step 103, a bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial.

[0035] Optionally, before explaining the bit reversal number theory transformation algorithm, the bit reversal operation and the bit reversal polynomial are briefly described first.

[0036] The bit reversal operation is expressed using formula (1).

[0037] (1) In formula (1), Express Perform bit reversal operation. A value that is a power of 2, such as 2, 4, 8, etc. In the case of base 2 The logarithm of To satisfy A non-negative integer, express The binary expansion of bits. For example, when It is 19:00, The binary expansion of is 00010011, then , … It is: 1, 1, 0, 0, 1, 0, 0, 0.

[0038] Bit inversion polynomial: Based on formula (1), the bit inversion polynomial is expressed using formula (2).

[0039] (2) When formula (2) is satisfied, is a polynomial in the NTT field The bit inversion polynomial of . Among them, , Express After bit reversal operation, we get , For polynomial Any of The meanings of other parameters in formula (2) are the same as those in formula (1), and their detailed description is omitted here.

[0040] Bit-reversal number theory transformation algorithm: The number theory transformation algorithm whose final output is a bit-reversal polynomial is called a bit-reversal number theory transformation algorithm. There are many implementation methods of the bit-reversal number theory transformation algorithm in the related art, so the detailed description is omitted here.

[0041] In step 104, a polynomial multiplication operation is performed on the first polynomial after the number theory transformation and the second polynomial.

[0042] There are many methods for implementing the polynomial multiplication operation between the first polynomial after number theory transformation and the second polynomial in the related art, and the detailed description is omitted here.

[0043] In step 105, a shuffled sequence number theory transformation algorithm is used to perform number theory transformation on the second polynomial.

[0044] Before explaining the shuffle sequence number theory transformation algorithm, we first briefly describe the shuffle sequence operation and the shuffle sequence polynomial.

[0045] Optionally, the shuffle operation is divided into a register exchange-based shuffle operation and a matrix transposition-based shuffle operation.

[0046] The shuffle operation based on register exchange is expressed using formula (3).

[0047] (3) In formula (3), Express Perform a register-swap based shuffle operation, is the number of polynomial coefficients stored in the register. The meanings of other parameters in formula (3) are the same as those in formula (1), and their detailed description is omitted here. n,l The full English name is Register Intersection-shuffle n,l , which is a shuffle operation based on register exchange.

[0048] Shuffle sequence polynomial based on register exchange: Based on formula (3), the shuffle sequence polynomial based on register exchange is expressed using formula (4).

[0049] (4) When formula (4) is satisfied, is a polynomial in the NTT field The shuffle order polynomial based on register exchange. Among them, , Express After performing a register-based shuffle operation, we get , For polynomial The meanings of other parameters in formula (4) are the same as those in formula (2), and their detailed description is omitted here.

[0050] Number theory transformation algorithm for shuffling sequence based on register exchange: The number theory transformation algorithm whose final output is a shuffling sequence polynomial based on register exchange is called the number theory transformation algorithm for shuffling sequence based on register exchange.

[0051] Similarly, the shuffling operation based on matrix transposition is expressed using formula (5).

[0052] (5) In formula (5), Express Perform a shuffle operation based on register exchange. The meanings of other parameters in formula (5) are the same as those in formula (1) and formula (3), and are omitted here. n,l The full name of Matrix Transpose-shuffle is n,l , which is a shuffle operation based on matrix transposition.

[0053] Shuffle sequence polynomial based on matrix transposition: Based on formula (5), the shuffle sequence polynomial based on register exchange is expressed using formula (6).

[0054] (6) When formula (6) is satisfied, is a polynomial in the NTT field The shuffle order polynomial based on matrix transposition. Among them, , Express After performing a shuffle operation based on matrix transposition, we get , For polynomial The meanings of other parameters in formula (6) are the same as those in formula (2), and their detailed description is omitted here.

[0055] Shuffle ordinal number theory transformation algorithm based on matrix transposition: The number theory transformation algorithm whose final output is a shuffle ordinal polynomial based on matrix transposition is called a shuffle ordinal number theory transformation algorithm based on matrix transposition. There are many implementation methods of the shuffle ordinal number theory transformation algorithm based on matrix transposition in the related art, so the detailed description is omitted here.

[0056] In summary, the shuffle ordinal number theory transformation algorithm includes a shuffle ordinal number theory transformation algorithm based on register exchange and a shuffle ordinal number theory transformation algorithm based on matrix transposition. When the shuffle ordinal number theory transformation algorithm is used for number theory transformation, any of the two algorithms can be selected according to the needs, and the embodiments of the present disclosure do not limit this.

[0057] In step 106, a polynomial multiplication operation is performed on the first polynomial and the second polynomial after number theory transformation.

[0058] There are many methods for implementing the polynomial multiplication operation of the first polynomial and the second polynomial after number theory transformation in the related art, and the detailed description is omitted here.

[0059] The purpose of performing number-theoretic transformation on polynomials is to convert all polynomials that need to be operated to the same dimension, so that subsequent polynomial multiplication operations can be performed. Here, the dimensions of multiple first polynomials and multiple second polynomials are different, so it is necessary to perform number-theoretic transformation on the first polynomial or the second polynomial. If the bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial, the first polynomial and the second polynomial can be converted to the same dimension (both are bit-reversal polynomials) before subsequent polynomial operations; if the shuffled order number-theoretic transformation algorithm is used to perform number-theoretic transformation on the second polynomial, the first polynomial and the second polynomial can also be converted to the same dimension (both are shuffled order polynomials) before subsequent polynomial operations.

[0060] Here, the time spent on performing number-theoretic transformation on a first polynomial using a bit-reversal number-theoretic transformation algorithm and the time spent on performing number-theoretic transformation on a second polynomial using a shuffled number-theoretic transformation algorithm can be approximately considered equal, and this time is assumed to be T.

[0061] For the case where the first value in a sub-algorithm is greater than or equal to the second value, for example, the first value is 7 and the second value is 9, if the bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial, the total time spent on number-theoretic transformation is 7T, and if the shuffle number-theoretic transformation algorithm is used to perform number-theoretic transformation on the second polynomial, the total time spent on number-theoretic transformation is 9T. Since 7T is less than 9T, the time spent on number-theoretic transformation on the first polynomial using the bit-reversal number-theoretic transformation algorithm is less.

[0062] For the case where the first value in a certain sub-algorithm is less than the second value, for example, the first value is 9 and the second value is 7, if the bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial, the total time spent on the number-theoretic transformation is 9T, and if the shuffled order number-theoretic transformation algorithm is used to perform number-theoretic transformation on the second polynomial, the total time spent on the number-theoretic transformation is 7T. Since 7T is less than 9T, the time spent on performing number-theoretic transformation on the second polynomial using the shuffled order number-theoretic transformation algorithm is less. In summary, selecting the number-theoretic transformation algorithm based on the size of the first value and the second value in the disclosed embodiment is essentially selecting the number-theoretic transformation algorithm that takes less time.

[0063] In the related art, each sub-algorithm of the lattice cryptographic algorithm uses the same type of number theory transformation algorithm to accelerate the polynomial multiplication operation. In the embodiment disclosed in the present invention, the number theory transformation algorithm that takes less time is selected according to the size of the first value and the second value in each sub-algorithm, thereby effectively reducing the time required for the number theory transformation operation in the entire lattice cryptographic algorithm.

[0064] Exemplarily, in the three sub-algorithms of the Dilithium signature algorithm, the first value in the key generation sub-algorithm is greater than the second value, for example, the first value is 9 and the second value is 7; the first value in the signature generation sub-algorithm is less than the second value, for example, the first value is 7 and the second value is 9; the first value in the signature verification sub-algorithm is greater than the second value, for example, the first value is 9 and the second value is 7. Since each sub-algorithm of the lattice cryptographic algorithm in the related art adopts the same number theory transformation algorithm, when the bit reversal number theory transformation algorithm is adopted in the related art, the total time spent on the number theory transformation algorithm is 9T plus 7T plus 9T, that is, 25T; when the shuffle sequence number theory transformation algorithm is adopted in the related art, the total time spent on the number theory transformation algorithm is 7T plus 9T plus 7T, that is, 23T.

[0065] When the polynomial operation acceleration method in the embodiment of the present disclosure is used, by comparing the first value and the second value in each sub-algorithm, it can be obtained that: the shuffled ordinal number theory transformation algorithm is used in the key generation sub-algorithm; the bit inversion number theory transformation algorithm is used in the signature generation sub-algorithm; the shuffled ordinal number theory transformation algorithm is used in the signature verification sub-algorithm, then the total time spent on the number theory transformation algorithm is 7T plus 7T plus 7T, that is, 21T, which is less than the time spent on the two selected number theory transformation algorithms in the related art. Therefore, the method in the embodiment of the present disclosure can effectively reduce the time spent on the number theory transformation algorithm in the polynomial operation, realize the acceleration of the polynomial operation, and then realize the acceleration of the lattice cryptographic algorithm.

[0066] Figure 2A flowchart of a polynomial operation acceleration method provided by another exemplary embodiment of the present disclosure is shown, and the method can be executed by a computer device. Figure 2 , the method comprising: In step 201, a first value and a second value of a first sub-algorithm are obtained.

[0067] The relevant contents of step 201 refer to the aforementioned step 101, and the detailed description is omitted here.

[0068] In step 202, the first value is compared with the second value.

[0069] When the first value is greater than or equal to the second value, steps 203-204 are executed; when the first value is less than the second value, steps 205-206 are executed.

[0070] In step 203, a bit-reversal number-theoretic transformation algorithm is used to perform number-theoretic transformation on the first polynomial.

[0071] In step 204, a polynomial multiplication operation is performed on the first polynomial after the number theory transformation and the second polynomial.

[0072] The relevant contents of steps 203-204 refer to the aforementioned steps 103-104, and detailed description is omitted here.

[0073] In step 205, a shuffled sequence number theory transformation algorithm is used to perform number theory transformation on the second polynomial.

[0074] Optionally, the first grid cryptographic algorithm can be implemented on a CPU (Central Processing Unit) platform. In this case, the AVX2 (Advanced Vector Extensions2) instruction set on the CPU platform can be used to accelerate the register exchange-based shuffle ordinal transformation algorithm. The register exchange-based shuffle ordinal transformation algorithm includes a forward fast shuffle operation and a reverse fast shuffle operation.

[0075] The input of the forward fast shuffle operation is a bit reversal polynomial, and the output is a register-swapping based shuffle polynomial. Figure 3 Schematic diagram of the process of the forward fast shuffle operation. Figure 3 The process of implementing a forward fast shuffle operation using the AVX2 instruction set on a CPU platform is described. The method includes the following ten steps.

[0076] The first step is to define the first index register.

[0077] The data stored in the first index register is .

[0078] The second step is to define the second index register.

[0079] The data stored in the second index register is .

[0080] The third step is to define the third index register.

[0081] The data stored in the third index register is .

[0082] Step 4: Read every 8 terms of the third polynomial into a register .

[0083] The third polynomial is a bit-reversal polynomial. In the disclosed embodiment, the third polynomial is a bit-reversal polynomial that needs to perform a forward fast shuffle operation.

[0084] Alternatively, the third polynomial can be expressed as , then read each 8 terms of the third polynomial into a register That is, the third polynomial Read register , .

[0085] The fifth step is to use the vpermd instruction to register the first index register Replace the data in and save the replacement result to the register , .

[0086] The vpermd instruction is an instruction in the AVX2 instruction set. The vpermd instruction in step 5 is used to replace the registers in the order indicated by the value in the first index register. The order of the data in the register is saved and the result of the replacement is saved in the register .

[0087] Figure 3 In the example, each register is used to store 256 bits of data, of which every 32 bits are used to store one term of the polynomial. Figure 3 Part (a) of the register For example, in order from top to bottom, 0, 1, 2, 3, 4, 5, 6, and 7 represent registers respectively. The data of the 0th to 31st bits, the data of the 32nd to 63rd bits, the data of the 64th to 95th bits, the data of the 96th to 127th bits, the data of the 128th to 159th bits, the data of the 160th to 191st bits, the data of the 192th to 223rd bits, and the data of the 224th to 255th bits.

[0088] like Figure 3 As shown in parts (a) and (b), the original register The order of the data in is 0, 1, 2, 3, 4, 5, 6, 7. After the vpermd instruction is used to permute the data in the order indicated by the value in the first index register, the register The order of the data in the first index register is changed to the order of the values ​​in the first index register, that is, 0, 2, 4, 6, 1, 3, 5, 7, and the replaced data is stored in the register middle.

[0089] Step 6: Use the vpermd instruction to set the register according to the second index register. Replace the data in and save the replacement result to the register .

[0090] The sixth step is similar to the fifth step. The vpermd instruction in the sixth step is used to replace the registers in the order indicated by the value in the second index register. The order of the data in the register is saved and the result of the replacement is saved in the register .like Figure 3 As shown in parts (a) and (b), the original register The order of the data in is 8, 9, 10, 11, 12, 13, 14, 15. After the vpermd instruction is used to permute the data in the order indicated by the value in the second index register, the register The order of the data in becomes 9, 11, 13, 15, 8, 10, 12, 14, and the replaced data is stored in register middle.

[0091] Step 7: Use the vpblendd instruction to unpack registers and registers , and register The lower 128 bits of data and registers in The high 128 bits of data in are packed and stored in registers .

[0092] The vpblendd instruction is an instruction in the AVX2 instruction set. The vpblendd instruction in step 7 is used to unpack registers. and registers , and register The lower 128 bits of data and registers in The high 128 bits of data in are packed and stored in registers Among them, the unpacking operation is used to obtain the register and registers Data stored in the register The lower 128 bits of data in the register Data of bits 0-127 in register The high 128 bits of data in the register are The 128th to 255th bits of data.

[0093] like Figure 3 As shown in parts (b) and (c), the register The lower 128 bits of data in the register are 0, 2, 4, and 6. The high 128 bits of data in are 8, 10, 12, and 14, which are packed and stored in the register. After that, register The data in is 0, 2, 4, 6, 8, 10, 12, 14.

[0094] Step 8: Use vpblendd instruction to unpack registers and registers , and register The upper 128 bits of data and registers in The lower 128 bits of data in are packed and stored in registers .

[0095] The eighth step is similar to the seventh step. The vpblendd instruction in the eighth step is used to unpack the registers. and registers , and register The upper 128 bits of data and registers in The lower 128 bits of data in are packed and stored in registers .register The high 128 bits of data in the register Data of bits 128-255 in register The lower 128 bits of data in the register The data of bits 0-127 in .

[0096] like Figure 3 As shown in parts (b) and (c), the register The high 128 bits of data in the register are 1, 3, 5, 7, The lower 128 bits of data are 9, 11, 13, and 15, which are packed and stored in the register. After that, register The data are 9, 11, 13, 15, 1, 3, 5, 7.

[0097] Here, the register and registers The data in is packed and stored in registers When the lower 128 bits of data are extracted, they are used as registers. The lower 128 bits of data in the register are used as the higher 128 bits of data extracted. The high 128 bits of data in Step 9: Use the vpermd instruction to set the register according to the third index register. Replace the data in .

[0098] The ninth step is similar to the fifth and sixth steps. The vpermd instruction in the ninth step is used to replace the registers in the order indicated by the value in the third index register. The order of the data in . Figure 3 As shown in parts (c) and (d), the original register The order of the data in is 9, 11, 13, 15, 1, 3, 5, 7. After the vpermd instruction is used to permute the data in the order indicated by the value in the third index register, the register The order of the data in becomes 1, 3, 5, 7, 9, 11, 13, 15. This completes the forward fast shuffle operation, and the tenth step needs to be performed later to save the result of the forward fast shuffle operation.

[0099] Step 10: Register and registers The data in is stored in the first array.

[0100] The data in the first array is used to indicate a register exchange-based shuffle sequence polynomial obtained after a forward shuffle operation is performed on the third polynomial.

[0101] Figure 4 Schematic diagram of instructions for a forward fast shuffle operation. In the disclosed embodiment, each of the ten steps is equivalent to an instruction in the AVX2 instruction set, that is, the forward fast shuffle operation in the disclosed embodiment requires a total of ten instructions in the AVX2 instruction set to be implemented (e.g. Figure 4). Since the AVX2 instruction set is a type of SIMD (Single Instruction Multiple Data) instruction set, the advantage of the SIMD instruction set is that a set of instructions can be used to perform parallel operations on multiple sets of data. Therefore, some of the instructions in the above ten AVX2 instruction sets in the embodiment of the present disclosure can also be executed in parallel (for example, the instructions corresponding to the first to third steps can be executed in parallel, the instructions corresponding to the fifth and sixth steps can be executed in parallel, and the instructions corresponding to the seventh and eighth steps can be executed in parallel), thereby greatly reducing the time required for instruction implementation.

[0102] Figure 5 This is a flowchart of a forward shuffle operation based on register exchange in a hierarchical manner in the related art. It can be seen that the process is relatively complex and has many instruction cycles. Compared with the flowchart of a forward shuffle operation based on register exchange in a hierarchical manner in the related art, the forward fast shuffle operation in the embodiment of the present disclosure belongs to a new algorithm flow, which is more concise and has a shorter instruction cycle.

[0103] The input of the reverse fast shuffle operation is a register-swapping based shuffle polynomial, and the output is a bit-reversal polynomial. Figure 6 Schematic diagram of the reverse fast shuffle operation. Figure 6 The process of implementing the reverse fast shuffle operation using the AVX2 instruction set is described. The method includes the following six steps.

[0104] The first step is to read every 8 terms of the fourth polynomial into a register. .

[0105] In the disclosed embodiment, the fourth polynomial is a register exchange based shuffling sequence polynomial that requires a reverse fast shuffling operation.

[0106] Alternatively, the fourth polynomial can be expressed as , then read each 8 terms of the fourth polynomial into a register That is, the fourth polynomial Read register , .

[0107] The second step is to unpack and interleave registers using the vpunpckldq instruction. and registers The lower 64 bits of data in every 128 bits in the , and the replacement result is saved in the register , .

[0108] The vpunpckldq instruction is an instruction in the AVX2 instruction set. The vpunpckldq instruction in the second step is used to unpack the register. and registers , and register and registers The lower 64 bits of data in every 128 bits are interleaved. Here, register and registers The lower 64 bits of data in every 128 bits are the register and registers The data of bits 0-63 and bits 128-191 in .

[0109] When interleaving, the register and registers The data of bits 0-63 in the register are interleaved, and the register and registers 128-191 bits of data are interleaved. and registers When interleaving the data of bits 0-63 in register The data of bits 0-63 are A and B respectively, and the register The data of bits 0-63 in are C and D respectively, then the interleaving result is A, C, B, D. Similarly, register and registers When interleaving the data of bits 128-191 in register The data of bits 128-191 are E and F respectively, and the register The data of the 128th to 191th bits in are G and H respectively, then the interleaving result is E, G, F, H.

[0110] There are many related technologies for implementing interleaving processing using the vpunpckldq instruction, and detailed description is omitted here.

[0111] like Figure 6 As shown in parts (a) and (b), the register The data of bits 0-63 in the register are 0 and 2 respectively. The data of bits 0-63 in are 1 and 3 respectively, then the result after interleaving is 0, 1, 2, 3, and the interleaved result is stored in register The lower 128 bits of the register The data of bits 128-191 in the register are 8 and 10 respectively. The data of bits 128-191 in are 9 and 11 respectively, so the result after interleaving is 8, 9, 10, 11, and the interleaved result is stored in register The high 128 bits of the .

[0112] The third step is to unpack and interleave registers using the vpunpckhdq instruction and registers The high 64 bits of data in every 128 bits in the , and the replacement result is saved in the register .

[0113] The principle of the third step is similar to that of the second step. The vpunpckhdq instruction in the third step is used to unpack the registers. and registers , and register and registers The high 64 bits of data in every 128 bits are interleaved. Here, register and registers The high 64 bits of data in every 128 bits are the register and registers The data of the 64th to 127th bits and the data of the 192th to 255th bits.

[0114] like Figure 6 As shown in parts (a) and (b), the register The data of bits 64-127 in the register are 4 and 6 respectively. The data of bits 64 to 127 in are 5 and 7 respectively, so the result of interleaving is 4, 5, 6, 7, and the interleaved result is stored in register The lower 128 bits of the register The data of bits 192-255 in the register are 12 and 14 respectively. The data of bits 192-255 in are 13 and 15 respectively, so the result after interleaving is 12, 13, 14, 15, and the interleaved result is stored in register The high 128 bits of the .

[0115] The fourth step is to use the vperm2i128 instruction to set the register and registers The lower 128 bits of data are stored in the register .

[0116] The vperm2i128 instruction is an instruction in the AVX2 instruction set. The vperm2i128 instruction in step 4 is used to set the register and registers The lower 128 bits of data are stored in the register Among them, register and registers The lower 128 bits of data in the register and registers The data of bits 0-127 in .

[0117] Figure 6 As shown in parts (b) and (c), the register The lower 128 bits of data are 0, 1, 2, and 3. The lower 128 bits of data in are 4, 5, 6, and 7. and registers The lower 128 bits of data are stored in the register When the register The lower 128 bits of data are stored in the register The lower 128 bits of the register The lower 128 bits of data are stored in the register The high 128 bits of Figure 6 Part (c) of the register The data stored in is 0, 1, 2, 3, 4, 5, 6, 7.

[0118] Step 5: Use the vperm2i128 instruction to set the register and registers The high 128 bits of data are stored in the register .

[0119] The principle of step 5 is similar to step 4. The vperm2i128 instruction in step 5 is used to set register and registers The high 128 bits of data are stored in the register Among them, register and registers The high 128 bits of data in the register and registers The 128th to 255th bits of data.

[0120] Figure 6 As shown in parts (b) and (c), the register The high 128 bits of data in the register are 8, 9, 10, and 11. The high 128 bits of data in are 12, 13, 14, and 15. and registers The high 128 bits of data are stored in the register When the register The high 128 bits of data in the register are stored The lower 128 bits of the register The high 128 bits of data are stored in the register The high 128 bits of Figure 6 Part (c) of the register The data stored in is 8, 9, 10, 11, 12, 13, 14, 15.

[0121] Step 6: Register and registers The data in is stored in the second array.

[0122] The data in the second array is used to indicate a bit reverse polynomial obtained after performing a reverse shuffle operation on the fourth polynomial.

[0123] Figure 7 Schematic diagram of the instruction of the reverse fast shuffle operation. In the embodiment of the present disclosure, each of the above six steps is equivalent to an instruction in the AVX2 instruction set, that is, the reverse fast shuffle operation in the embodiment of the present disclosure requires a total of six instructions in the AVX2 instruction set to be implemented (such as Figure 7 ). Since the AVX2 instruction set is a type of SIMD instruction set, the advantage of the SIMD instruction set is that a set of instructions can be used to perform parallel operations on multiple sets of data. Therefore, some instructions in the above six AVX2 instruction sets in the embodiment of the present disclosure can also be executed in parallel (for example, the instructions corresponding to the second step to the third step can be executed in parallel, and the instructions corresponding to the fourth step to the fifth step can be executed in parallel), thereby greatly reducing the time required for instruction implementation.

[0124] Figure 8 This is a flowchart of a reverse shuffle operation based on register exchange in a hierarchical manner in the related art. It can be seen that the process is relatively complex and has many instruction cycles. Compared with the flowchart of a reverse shuffle operation based on register exchange in a hierarchical manner in the related art, the reverse fast shuffle operation in the embodiment of the present disclosure belongs to a new algorithm flow, which is more concise and has a shorter instruction cycle.

[0125] In step 206, a polynomial multiplication operation is performed on the first polynomial and the second polynomial after the number-theoretic transformation.

[0126] Optionally, in the process of performing polynomial multiplication operation on the first polynomial and the second polynomial after number theory transformation, or in the process of performing polynomial multiplication operation on the first polynomial and the second polynomial after number theory transformation, there are multiple levels of butterfly operation, and before performing the butterfly operation of any level, it is necessary to perform AND calculation on the power of the rotation factor required for the butterfly operation of the level, and obtain and store multiple pre-calculated values ​​of the level. In this case, the method further includes: performing AND calculation on the first level Layer and The method optimizes the storage of precomputed values ​​of the layer. The method includes the following four steps: The first step is to obtain multiple first pre-calculated values ​​corresponding to the butterfly operation of the first level and the second precomputed value .

[0127] The first level is Layer, or the first level is layer.

[0128] Here, Layer and The first pre-calculated values ​​and the second pre-calculated values ​​in the layer are arranged alternately, that is, there is a second pre-calculated value between every two first pre-calculated values, and there is a first pre-calculated value between every two second pre-calculated values. The arrangement of pre-calculated values ​​at other levels does not meet the above rule.

[0129] When implementing, you can first calculate the first pre-calculated value and the second pre-calculated value of all levels, and then Layer and Precomputed values ​​for layers are handled separately.

[0130] For all levels except Layer, For layers other than the 0th layer, the method includes: for layers 0 to 1st Layer, use the broadcast function to quickly generate the corresponding vector, and every 32 bits of data in the generated vector are the same.

[0131] Since the butterfly operation from layer 0 to layer The precomputed values ​​in any layer of the layer are the same, so the corresponding vectors can be directly generated without optimizing the storage method.

[0132] For The pre-calculated value corresponding to the layer generates a corresponding vector, in which each 32 bits of data are different. The pre-calculated values ​​corresponding to the layers are different and do not satisfy the Layer and The rules of the pre-calculated values ​​of the layer are followed, so there is no need to optimize the storage method.

[0133] The second step is to construct a third array with a basic unit of 64 bits. In the third array, every 64 bits of data are stored in sequence. , and read this third array into a vector register.

[0134] The third step is to use the first pre-calculated value In this case, the lower 32 bits of data for every 64 bits of data in the vector register are read.

[0135] Step 4: Use the second pre-calculated value when needed In the case of, the upper 32 bits of each 64-bit data in the vector register are shifted right by 32 bits, and the lower 32 bits of each 64-bit data in the shifted vector register are read.

[0136] Here, the high 32 bits of each 64-bit data in the vector register are shifted 32 bits to the right, which essentially means that the following operation is performed on each 64-bit data in each vector register: Therefore, the lower 32 bits of each 64-bit data finally stored in the vector register after translation are the second pre-calculated value .

[0137] In the related art, only one pre-calculated value is stored in every 64 bits, but in the embodiment of the present disclosure, by storing , which is equivalent to storing two pre-calculated values. Therefore, the storage method of the pre-calculated values ​​is optimized so that more pre-calculated values ​​can be stored in a vector register of the same size.

[0138] Fig. 9 For the A flowchart of optimizing the storage method of pre-computed values ​​of the layer, such as Fig. 9 As shown, one data in the vector register occupies 32 bits of storage space, and the vector register is sequentially 0-31 bits, 32-63 bits, etc. from right to left. If you need to use the first pre-calculated value , then directly read the lower 32 bits of each 64-bit data in the vector register; if you need to use the second pre-calculated value , the data in the vector register is shifted in the third step, and the lower 32 bits of every 64 bits of data in the vector register after the shift are the second pre-calculated value.

[0139] The following are device embodiments of the present application. For details not described in detail in the device embodiments, reference may be made to the above method embodiments.

[0140] Fig.10 FIG. 1 shows a schematic diagram of a polynomial operation acceleration device provided by an exemplary embodiment of the present disclosure. Fig.10 The polynomial operation acceleration device 1000 includes: an acquisition module 1001, a comparison module 1002, a number theory transformation module 1003, and a polynomial operation module 1004.

[0141] The acquisition module 1001 is used to obtain the first value and the second value of the first sub-algorithm. The first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponds to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm is any one of the multiple sub-algorithms, the first value is the number of first polynomials that need to be calculated generated during the operation of the first sub-algorithm, and the second value is the number of second polynomials that need to be calculated in the NTT domain.

[0142] The comparison module 1002 is used to compare the first value and the second value.

[0143] The number theory transformation module 1003 is used to perform number theory transformation on the first polynomial using a bit-reversal number theory transformation algorithm when the first value is greater than or equal to the second value, and to perform number theory transformation on the second polynomial using a shuffled order number theory transformation algorithm when the first value is less than the second value.

[0144] The polynomial operation module 1004 is used to perform a polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial when the first value is greater than or equal to the second value, and to perform a polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial when the first value is less than the second value.

[0145] Optionally, the number theory transformation module 1003 is further configured to read every 8 terms in the third polynomial into a register , , the third polynomial is a bit-reversal polynomial; the vpermd instruction is used to register the first index register Replace the data in and save the replacement result to the register , , the data stored in the first index register is ; Use the vpermd instruction to register the second index register Replace the data in and save the replacement result to the register , the data stored in the second index register is ; Use vpblendd instruction to unpack registers and registers , and register The lower 128 bits of data and registers in The high 128 bits of data in are packed and stored in registers ; Use vpblendd instruction to unpack registers and registers , and register The upper 128 bits of data and registers in The lower 128 bits of data in are packed and stored in registers ; Use the vpermd instruction to register the third index register The data in the third index register is replaced. ; Register and registers The data in the first array are stored in the first array, and the data in the first array is used to indicate the register exchange-based shuffle sequence polynomial obtained after performing a forward shuffle operation on the third polynomial; wherein the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2 AVX2 instruction set.

[0146] Optionally, the number theory transformation module 1003 is further configured to read every 8 terms in the fourth polynomial into a register , , the fourth polynomial is a shuffle polynomial based on register exchange; the vpunpckldq instruction is used to unpack and interleave registers and registers The lower 64 bits of data in every 128 bits in the , and the replacement result is saved in the register , ; Unpack and interleave registers using vpunpckhdq instruction and registers The high 64 bits of data in every 128 bits in the , and the replacement result is saved in the register ; Use the vperm2i128 instruction to set the register and registers The lower 128 bits of data are stored in the register ; Use the vperm2i128 instruction to set the register and registers The high 128 bits of data are stored in the register ; Register and registers The data in the second array are stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the reverse shuffle operation is performed on the fourth polynomial; wherein the vpunpckldq instruction, the vpunpckhdq instruction and the vperm2i128 instruction are instructions in the AVX2 instruction set.

[0147] Optionally, the device further includes: a pre-calculation module 1005, configured to obtain a plurality of first pre-calculation values ​​corresponding to the butterfly operation of the first level and the second precomputed value , the first level is The first level or the first level is Layer; construct a third array with a basic unit of 64 bits. In the third array, each 64 bits of data are stored in sequence , and read the third array into the vector register; when the first pre-calculated value is needed In the case of , read the lower 32 bits of data for every 64 bits of data in the vector register; when the second pre-calculated value is needed In the case of, the upper 32 bits of each 64-bit data in the vector register are shifted right by 32 bits, and the lower 32 bits of each 64-bit data in the shifted vector register are read.

[0148] It should be noted that: when the polynomial operation acceleration device provided in the above embodiment performs polynomial operation acceleration, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the polynomial operation acceleration device provided in the above embodiment and the polynomial operation acceleration method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0149] The division of modules in the embodiments of the present disclosure is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present disclosure may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0150] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a terminal device (which can be a personal computer, mobile phone, or communication device, etc.) or a processor (processor) to execute all or part of the steps of the method of each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0151] Fig.11 Schematic diagram of the structure of the computer device provided by the embodiment of the present disclosure. Fig.11 As shown, the computer device 1100 includes: a processor 1101 and a memory 1102 .

[0152] The processor 1101 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1101 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1101 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU; the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1101 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1101 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0153] The memory 1102 may include one or more computer-readable storage media, which may be non-transitory. The memory 1102 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1102 is used to store at least one instruction, which is used to be executed by the processor 1101 to implement the polynomial operation acceleration method provided in the embodiments of the present disclosure.

[0154] Those skilled in the art will understand that Fig.11 The structure shown in the figure does not constitute a limitation on the computer device 1100, and the computer device 1100 may include more or less components than shown in the figure, or combine some components, or adopt a different component arrangement.

[0155] The embodiments of the present disclosure also provide a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by a processor of a computer device, the computer device is enabled to execute the polynomial operation acceleration method provided in the embodiments of the present disclosure.

[0156] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the polynomial operation acceleration method provided in the embodiments of the present disclosure.

[0157] The above description is only an optional embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A polynomial operation acceleration method, characterized in that: The method includes. Obtain a first value and a second value of a first sub-algorithm, where the first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponds to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm is any one of the multiple sub-algorithms, the first value is the number of first polynomials that need to be calculated and generated during the operation of the first sub-algorithm, and the second value is the number of second polynomials that need to be calculated with the first polynomial in the NTT domain; Comparing the first value with the second value; When the first value is greater than or equal to the second value, performing a number-theoretic transformation on the first polynomial using a bit-reversal number-theoretic transformation algorithm; Performing a polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial; or, When the first value is less than the second value, performing a number-theoretic transformation on the second polynomial using a shuffled ordinal number-theoretic transformation algorithm; A polynomial multiplication operation is performed on the first polynomial and the second polynomial after number theory transformation.

2. The method according to claim 1, characterized in that The shuffle ordinal transformation algorithm includes a shuffle ordinal transformation algorithm based on register exchange, and the output of the shuffle ordinal transformation algorithm based on register exchange is a shuffle sequence polynomial based on register exchange, and the shuffle sequence polynomial based on register exchange is expressed by the following formula: Among them, when the above formula is satisfied, is the shuffle sequence polynomial based on register exchange, is an integer, is a value raised to a power of 2, Express After performing a register-based shuffle operation, we get , is a polynomial in the NTT field Any of the following: The shuffling operation based on register exchange is expressed by the following formula: in, To satisfy A non-negative integer, Express Perform a register-swap based shuffle operation, is the number of polynomial coefficients stored in the register, Indicates bit reversal operation.

3. The method according to claim 2, characterized in that The register-exchange-based shuffling ordinal number theory transformation algorithm includes a forward fast shuffling operation, the input of the forward fast shuffling operation is a bit inversion polynomial, and the output is a register-exchange-based shuffling ordinal polynomial, and the forward fast shuffling operation is implemented in the following manner: Read every 8 terms of the third polynomial into a register , , the third polynomial is a bit inversion polynomial; Use the vpermd instruction to set the register according to the first index register Replace the data in and save the replacement result to the register , , the data stored in the first index register is ; Use the vpermd instruction to set the register according to the second index register Replace the data in and save the replacement result to the register , the data stored in the second index register is ; Unpack the registers using the vpblendd instruction and the register and the register The lower 128 bits of data and the register The high 128 bits of data in are packed and stored in the register ; Unpack the registers using the vpblendd instruction and the register and the register The high 128 bits of data and the register The lower 128 bits of data in are packed and stored in the register ; The vpermd instruction is used to set the register according to the third index register. The data in the third index register is replaced. The data stored in the third index register is ; The register and the register The data in the first array are stored in the first array, wherein the data in the first array is used to indicate a shuffle sequence polynomial based on register exchange obtained after a forward shuffle operation is performed on the third polynomial; Among them, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2 AVX2 instruction set.

4. The method according to claim 2, characterized in that: The register-switching-based shuffling ordinal number theory transformation algorithm includes a reverse fast shuffling operation, the input of the reverse fast shuffling operation is a register-switching-based shuffling ordinal polynomial, and the output is a bit reverse polynomial. The reverse fast shuffling operation is implemented in the following manner: Read every 8 terms of the fourth polynomial into a register , , the fourth polynomial is a shuffle sequence polynomial based on register exchange; Unpack and interleave registers using the vpunpckldq instruction and registers The lower 64 bits of data in every 128 bits in the , and the replacement result is saved in the register , ; Unpack and interleave the registers using the vpunpckhdq instruction and the register The high 64 bits of data in every 128 bits in the , and the replacement result is saved in the register ; Use the vperm2i128 instruction to set the register and the register The lower 128 bits of data are stored in the register ; Use the vperm2i128 instruction to set the register and the register The high 128 bits of data are stored in the register ; The register and the register The data in the second array are used to indicate a bit reverse polynomial obtained after performing a reverse shuffle operation on the fourth polynomial; Among them, the vpunpckldq instruction, the vpunpckhdq instruction and the vperm2i128 instruction are instructions in the AVX2 instruction set.

5. The method according to any one of claims 1 to 4, characterized in that: In the process of performing a polynomial multiplication operation on the first polynomial and the second polynomial after number theory transformation, or in the process of performing a polynomial multiplication operation on the first polynomial after number theory transformation and the second polynomial, there are multiple levels of butterfly operations, each level of butterfly operations corresponds to a set of pre-calculated values, The method further comprises: Get multiple first pre-calculated values ​​corresponding to the butterfly operation of the first level and the second precomputed value , the first level is The first level is the layer; Construct a third array with a basic unit of 64 bits, in which each 64 bits of data are stored in sequence and reading the third array into a vector register; When you need to use the first precomputed value In the case of , reading the lower 32 bits of data for every 64 bits of data in the vector register; The second precomputed value needs to be used In the case of, the upper 32 bits of each 64 bits of data in the vector register are shifted right by 32 bits, and the lower 32 bits of each 64 bits of data in the vector register after the shift are read.

6. A polynomial operation acceleration device, characterized in that: The device comprises: an acquisition module, configured to acquire a first value and a second value of a first sub-algorithm, wherein the first lattice cryptographic algorithm includes a plurality of sub-algorithms, each sub-algorithm corresponds to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm is any one of the plurality of sub-algorithms, the first value is the number of first polynomials that need to be calculated and generated during the operation of the first sub-algorithm, and the second value is the number of second polynomials that need to be calculated with the first polynomial in the NTT domain; A comparison module, used for comparing the first value with the second value; a number theory transformation module, configured to perform a number theory transformation on the first polynomial using a bit reversal number theory transformation algorithm when the first value is greater than or equal to the second value, and to perform a number theory transformation on the second polynomial using a shuffle order number theory transformation algorithm when the first value is less than the second value; A polynomial operation module is used to perform a polynomial multiplication operation on the first polynomial after number-theoretic transformation and the second polynomial when the first value is greater than or equal to the second value, and to perform a polynomial multiplication operation on the first polynomial after number-theoretic transformation and the second polynomial when the first value is less than the second value.

7. A computer device, characterized in that: The computer device comprises: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor to implement the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images