Polynomial operation acceleration method, device, equipment and storage medium

Abstract

A polynomial operation acceleration method, device, equipment and storage medium are disclosed, and belong to the field of cryptography. The method comprises the following steps: obtaining a first value and a second value of a first sub-algorithm, the first value being the number of first polynomials that need to be operated and generated in the running process of the first sub-algorithm, and the second value being the number of second polynomials that need to be operated with the first polynomials in an NTT domain; comparing the first value with the second value; in the case that the first value is greater than or equal to the second value, performing a bit inverse order number theory transformation algorithm on the first polynomials; performing polynomial multiplication operation on the first polynomials after the number theory transformation and the second polynomials; or in the case that the first value is less than the second value, performing a shuffling order number theory transformation algorithm on the second polynomials; and performing polynomial multiplication operation on the first polynomials and the second polynomials after the number theory transformation. The method can accelerate polynomial operation.

Description

Technical Field

[0001] This disclosure relates to the field of cryptography, and in particular to a method, apparatus, device, and storage medium for accelerating polynomial operations. Background Technology

[0002] In lattice-hard cryptographic algorithms, taking the Dilithium signature algorithm as an example, polynomial multiplication operations account for approximately 30% of the total signing time, becoming a major bottleneck restricting the further migration of current cryptographic systems to post-quantum cryptosystems. Therefore, a polynomial operation acceleration method is needed to speed up polynomial multiplication operations in lattice cryptographic algorithms, thereby accelerating lattice cryptography. Summary of the Invention

[0003] This disclosure provides a method, apparatus, device, and storage medium for accelerating polynomial operations, enabling accelerated polynomial calculations. The technical solution includes at least the following: In a first aspect, a method for accelerating polynomial operations is provided, comprising: obtaining a first value and a second value of a first sub-algorithm, wherein the first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponding to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm being any one of the multiple sub-algorithms, the first value being the number of first polynomials to be operated on generated during the operation of the first sub-algorithm, and the second value being the number of second polynomials in the NTT field to be operated on with the first polynomials; comparing the size of the first value and the second value; if the first value is greater than or equal to the second value, performing a number-theoretical transformation on the first polynomial using a bit-reversal number-theoretical transformation algorithm; performing polynomial multiplication on the number-theoretical transformed first polynomial and the second polynomial; or, if the first value is less than the second value, performing a number-theoretical transformation on the second polynomial using a shuffle ordinal number-theoretical transformation algorithm; and performing polynomial multiplication on the first polynomial and the number-theoretical transformed second polynomial.

[0004] Optionally, the shuffle ordinal theory transformation algorithm includes a register-switching-based shuffle ordinal theory transformation algorithm, the output of which is a register-switching-based shuffle ordinal polynomial, which is expressed by the following formula:

[0005] Wherein, under the condition that the above formula is satisfied, This is a register-swapping shuffle order polynomial. It is an integer. The value is a power of 2. Indicates to After performing a register-swapping operation, the result is... , For polynomials in the NTT field Any one of them; The register-swapping-based shuffle operation is represented by the following formula:

[0006] in, To meet non-negative integers, Indicates to Perform a register-swapping shuffle operation. The number of polynomial coefficients stored in the register. This indicates a bit reversal operation.

[0007] Optionally, the register-swapping ordinal theory transformation algorithm includes a forward fast shuffle operation. The input of the forward fast shuffle operation is a bit inversion polynomial, and the output is a register-swapping ordinal polynomial. The forward fast shuffle operation is implemented as follows: every 8 terms of the third polynomial are read into a register. , The third polynomial is a bit-reversed polynomial; the vpermd instruction is used to adjust the register according to the first index register. The data in the register is replaced, and the replacement result is saved to the register. , The data stored in the first index register is The vpermd instruction is used to modify the registers based on the second index register. The data in the register is replaced, and the replacement result is saved to the register. The data stored in the second index register is The registers are unpacked using the vpblendd instruction. and the register and the register The lower 128 bits of data and the register The high 128 bits of data are packaged and stored in the register. The registers are unpacked using the vpblendd instruction. and the register and the register The high 128 bits of data and the register The lower 128 bits of data are packaged and stored in the register. The vpermd instruction is used to modify the register according to the third index register. The data in the middle is replaced, and the data stored in the third index register is ; to the register and the register The data in the first array is stored in the first array, and the data in the first array is used to indicate the register-exchange-based shuffled polynomial obtained after performing a forward shuffle operation on the third polynomial; wherein, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2AVX2 instruction set.

[0008] Optionally, the register-switching-based shuffle ordinal theory transformation algorithm includes a reverse fast shuffle operation. The input of the reverse fast shuffle operation is a register-switching-based shuffle order polynomial, and the output is a bit-inverse polynomial. The reverse fast shuffle operation is implemented as follows: every 8 terms of the fourth polynomial are read into a register. , The fourth polynomial is a shuffled polynomial based on register swapping; the vpunpckldq instruction is used to unpack and interleave the registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , The registers are unpacked and interleaved using the vpunpckhdq instruction. and the register The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. The register is accessed using the vperm2i128 instruction. and the register The lower 128 bits of data are stored in the register. The register is accessed using the vperm2i128 instruction. and the register The high 128 bits of data are stored in the register. ; to the register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the fourth polynomial is reversed; wherein, the vpunpckldq instruction, vpunpckhdq instruction and vperm2i128 instruction are instructions in the AVX2 instruction set.

[0009] Optionally, during the polynomial multiplication operation between the first polynomial and the number-theory-transformed second polynomial, or during the polynomial multiplication operation between the number-theory-transformed first polynomial and the second polynomial, there are multiple levels of butterfly operations, each level of butterfly operation corresponding to a set of pre-calculated values. The method further includes: obtaining multiple first pre-calculated values ​​corresponding to the first level of butterfly operations. Second pre-calculated value The first level is the The first level or the first level is the Layer; Construct a third array with a basic unit of 64 bits, in which each 64-bit data is stored sequentially. The third array is read into the vector register; when the first pre-calculated value is needed... In the case of reading the lower 32 bits of data from each 64-bit data set in the vector register, the second pre-calculated value is used when necessary. In this case, the high 32 bits of each 64-bit data in the vector register are shifted 32 bits to the right, and the low 32 bits of each 64-bit data in the shifted vector register are read.

[0010] Secondly, a polynomial operation acceleration device is also provided, comprising: an acquisition module for acquiring a first value and a second value of a first sub-algorithm, wherein the first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponding to a different stage of the first lattice cryptographic algorithm, the first sub-algorithm being any one of the multiple sub-algorithms, the first value being the number of first polynomials to be operated on during the operation of the first sub-algorithm, and the second value being the number of second polynomials in the NTT field to be operated on with the first polynomials; a comparison module for comparing the size of the first value and the second value; a number theory transformation module for performing a number theory transformation on the first polynomial using a bit-reversal number theory transformation algorithm when the first value is greater than or equal to the second value, and performing a number theory transformation on the second polynomial using a shuffle order number theory transformation algorithm when the first value is less than the second value; and a polynomial operation module for performing a polynomial multiplication operation on the number-theoretically transformed first polynomial and the second polynomial when the first value is greater than or equal to the second value, and performing a polynomial multiplication operation on the first polynomial and the number-theoretically transformed second polynomial when the first value is less than the second value.

[0011] Optionally, the number theory transformation module is further configured to read every 8 terms of the third polynomial into a register. , The third polynomial is a bit-reversed polynomial; the vpermd instruction is used to adjust the register according to the first index register. The data in the register is replaced, and the replacement result is saved to the register. , The data stored in the first index register is The vpermd instruction is used to modify the registers based on the second index register. The data in the register is replaced, and the replacement result is saved to the register. The data stored in the second index register is The registers are unpacked using the vpblendd instruction. and the register and the register The lower 128 bits of data and the register The high 128 bits of data are packaged and stored in the register. The registers are unpacked using the vpblendd instruction. and the register and the register The high 128 bits of data and the register The lower 128 bits of data are packaged and stored in the register. The vpermd instruction is used to modify the register according to the third index register. The data in the middle is replaced, and the data stored in the third index register is ; to the register and the register The data in the first array is stored in the first array, and the data in the first array is used to indicate the register-exchange-based shuffled polynomial obtained after performing a forward shuffle operation on the third polynomial; wherein, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2AVX2 instruction set.

[0012] Optionally, the number theory transformation module is further configured to read every 8 terms of the fourth polynomial into a register. , The fourth polynomial is a shuffled polynomial based on register swapping; the vpunpckldq instruction is used to unpack and interleave the registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , The registers are unpacked and interleaved using the vpunpckhdq instruction. and the register The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. The register is accessed using the vperm2i128 instruction. and the register The lower 128 bits of data are stored in the register. The register is accessed using the vperm2i128 instruction. and the register The high 128 bits of data are stored in the register. ; to the register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the fourth polynomial is reversed; wherein, the vpunpckldq instruction, vpunpckhdq instruction and vperm2i128 instruction are instructions in the AVX2 instruction set.

[0013] Optionally, the device further includes: a pre-computation module, used to obtain multiple first pre-computation values ​​corresponding to the first-level butterfly operation. Second pre-calculated value The first level is the The first level or the first level is the Layer; Construct a third array with a basic unit of 64 bits, in which each 64-bit data is stored sequentially. The third array is read into the vector register; when the first pre-calculated value is needed... In the case of reading the lower 32 bits of data from each 64-bit data set in the vector register, the second pre-calculated value is used when necessary. In this case, the high 32 bits of each 64-bit data in the vector register are shifted 32 bits to the right, and the low 32 bits of each 64-bit data in the shifted vector register are read.

[0014] Thirdly, a computer device is also provided, comprising: a memory and a processor, wherein the memory stores at least one computer program, the at least one computer program being loaded and executed by the processor to perform the polynomial operation acceleration method described in the above embodiments.

[0015] Fourthly, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, the at least one computer program being loaded and executed by a processor to perform the polynomial operation acceleration method described in the above embodiments.

[0016] Fifthly, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the method described in the first aspect.

[0017] The beneficial effects of the technical solutions provided in this disclosure include at least the following: The time taken to perform a number theory transformation on a first polynomial using the bit inversion number theory transformation algorithm can be approximated as the time taken to perform a number theory transformation on a second polynomial using the shuffle order number theory transformation algorithm. Let this time be T.

[0018] In a sub-algorithm where the first value is greater than or equal to the second value (e.g., the first value is 7 and the second value is 9), if the bit-reversal number theory transformation algorithm is used to transform the first polynomial, the total time spent on the number theory transformation is 7T. However, if the shuffle order number theory transformation algorithm is used to transform the second polynomial, the total time spent on the number theory transformation is 9T. Since 7T is less than 9T, the bit-reversal number theory transformation algorithm takes less time to transform the first polynomial in this case.

[0019] In a sub-algorithm where the first value is less than the second value (e.g., the first value is 9 and the second value is 7), if the bit-reversal number theory transformation algorithm is used to transform the first polynomial, the total time spent on the number theory transformation is 9T. However, if the shuffle order number theory transformation algorithm is used to transform the second polynomial, the total time spent on the number theory transformation is 7T. Since 7T is less than 9T, the shuffle order number theory transformation algorithm takes less time to transform the second polynomial. In summary, in this embodiment, choosing the number theory transformation algorithm based on the magnitude of the first and second values ​​essentially means choosing the number theory transformation algorithm with shorter time consumption.

[0020] In related technologies, each sub-algorithm of the lattice cryptography algorithm uses the same type of number theory transformation algorithm to accelerate polynomial multiplication operations. However, in this embodiment, the number theory transformation algorithm with shorter time is selected based on the magnitude of the first and second values ​​in each sub-algorithm, thereby effectively reducing the time required for number theory transformation operations in the entire lattice cryptography algorithm and accelerating polynomial operations. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 A flowchart illustrating a polynomial operation acceleration method provided in an exemplary embodiment of this disclosure is shown. Figure 2 A flowchart of a method for accelerating polynomial operations provided in another exemplary embodiment of this disclosure is shown; Figure 3 A flowchart illustrating the forward rapid shuffling process; Figure 4 This is a diagram illustrating the instructions for a forward rapid shuffle operation. Figure 5 This is a flowchart illustrating a register-swapping-based forward shuffling operation executed in a hierarchical manner in related technologies. Figure 6 A flowchart illustrating the reverse rapid shuffling operation; Figure 7 This is a schematic diagram of the instructions for a reverse rapid shuffle operation; Figure 8 This is a flowchart illustrating the layered execution of a register-swapping-based reverse shuffling operation in related technologies. Figure 9 For the first A flowchart illustrating the optimization of the storage method for pre-computed values ​​in layers; Figure 10 This illustration shows a schematic diagram of the structure of a polynomial operation acceleration device provided in an exemplary embodiment of the present disclosure; Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. Detailed Implementation

[0023] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, but do not exclude other elements or objects.

[0024] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0025] To facilitate understanding of the embodiments of this disclosure, the number theory transformation algorithms involved in the embodiments of this disclosure will be briefly described below.

[0026] Number Theoretic Transform (NTT), also known as Fast Number Theoretic Transform, is a special form of Discrete Fourier Transform over finite fields. This algorithm uses Fast Fourier Transform to convert a polynomial from coefficient representation to point-value representation, thus accelerating polynomial multiplication. The forward NTT algorithm converts the polynomial from coefficient representation to point-value representation, while the reverse NTT algorithm converts it back to coefficient representation. Depending on the polynomial length, the NTT algorithm operates in multiple layers, with the core computational component being the butterfly arithmetic unit. The butterfly arithmetic unit can be categorized into CT (Cooley-Tukey) and GS (Gentleman-Sande) butterfly operations. For parallel implementation of the NTT algorithm, to ensure the correctness of the butterfly operation input values, shuffling operations are added between different layers. Furthermore, the powers of the rotation factors required for butterfly operations at different layers can be pre-calculated, and the pre-calculated results can be directly read from memory when needed instead of recalculating, thereby accelerating the implementation efficiency of the NTT algorithm.

[0027] Figure 1 A flowchart illustrating an exemplary embodiment of this disclosure provides a method for accelerating polynomial operations, which can be executed by a computer device. See also... Figure 1 The method includes: In step 101, the first and second values ​​of the first sub-algorithm are obtained.

[0028] The first-level cryptographic algorithm includes multiple sub-algorithms, each corresponding to a different stage of the first-level cryptographic algorithm. The first sub-algorithm is any one of the multiple sub-algorithms. The first value is the number of first polynomials that need to be operated on during the operation of the first sub-algorithm. The second value is the number of second polynomials in the NTT field that need to be operated on with the first polynomials.

[0029] In this embodiment of the disclosure, the first cryptographic algorithm is the Dilithium signature algorithm, which includes three stages: key generation, signature generation, and signature verification. Each stage is a sub-algorithm.

[0030] Typically, operations performed with the first polynomial in the NTT field include forward NTT and inverse NTT. The second value is the sum of the number of polynomials in the NTT field that need to be operated on with the first polynomial in the forward NTT operation and the number of polynomials in the NTT field that need to be operated on with the first polynomial in the inverse NTT operation.

[0031] Taking the Dilithium signature algorithm as the first lattice cryptography algorithm and the signature verification step as the first sub-algorithm, the second value is equal to the average number of required loops multiplied by the number of forward and backward NTTs called in a single loop. This is because the lattice cryptography algorithm includes multiple loops, so when calculating the second value, the number of forward and backward NTTs called in a single loop is first calculated, and then the average number of required loops (used to indicate the number of loops in the sub-algorithm) is multiplied by that number.

[0032] In step 102, the first value and the second value are compared.

[0033] If the first value is greater than or equal to the second value, proceed to steps 103-104; if the first value is less than the second value, proceed to steps 105-106.

[0034] In step 103, the first polynomial is transformed using a bit-reversed number-theory transformation algorithm.

[0035] Optionally, before explaining the number-theoretic transformation algorithm for bit reversal, a brief description of bit reversal operations and bit reversal polynomials is given first.

[0036] The bit reversal operation is represented by formula (1).

[0037] (1) In formula (1), Indicates to Perform bit reversal operation. Values ​​that are powers of 2, such as 2, 4, 8, etc. This means that when the base is 2 The logarithm of ; To meet non-negative integers, express The first binary expansion 1 bit. For example, when It was 7 PM. The binary expansion of is 00010011, then , ... The sequence is: 1, 1, 0, 0, 1, 0, 0, 0.

[0038] Bit inversion polynomial: Based on formula (1), the bit inversion polynomial is expressed by formula (2).

[0039] (2) Under the condition that formula (2) is satisfied, For polynomials in the NTT field The bit-reversed polynomial. , Indicates to After performing bit reversal operation, we get , For polynomials Any one of them, The values ​​are integers. The meanings of the other parameters in formula (2) are the same as those in formula (1), and will not be detailed here.

[0040] Number-theoretic transformation algorithm for bit inversion: A number-theoretic transformation algorithm whose final output is a bit inversion polynomial is called a number-theoretic transformation algorithm for bit inversion. There are many implementation methods for this algorithm in related technologies, which will not be detailed here.

[0041] In step 104, the first polynomial after number theory transformation and the second polynomial are multiplied by polynomial.

[0042] There are many methods for implementing polynomial multiplication between the first and second polynomials after number theory transformation, which will not be detailed here.

[0043] In step 105, the second polynomial is transformed using the shuffle ordinal number theory transformation algorithm.

[0044] Before explaining the shuffle ordinal theory transformation algorithm, we will first briefly describe the shuffle order operation and the shuffle order polynomial.

[0045] Optionally, the shuffling operation can be divided into register-swapping operation and matrix transpose-based shuffling operation.

[0046] The shuffling operation based on register exchange is represented by formula (3).

[0047] (3) In formula (3), Indicates to Perform a register-swapping shuffle operation. This represents the number of polynomial coefficients stored in the register. The meanings of the other parameters in formula (3) are the same as in formula (1), and will not be detailed here. Wherein, RI_shuf n,l The full English name is Register Intersection-shuffle n,l This is a shuffling operation based on register swapping.

[0048] Shuffle order polynomial based on register exchange: Based on formula (3), the shuffle order polynomial based on register exchange is expressed by formula (4).

[0049] (4) Under the condition that formula (4) is satisfied, For polynomials in the NTT field The register-swapping shuffle order polynomial. , Indicates to After performing a register-swapping operation, the result is... , For polynomials Any one of the terms in formula (4). The meanings of the other parameters in formula (4) are the same as those in formula (2), and will not be detailed here.

[0050] Number theory transformation algorithm for shuffling based on register exchange: A number theory transformation algorithm whose final output is a shuffling order polynomial based on register exchange is called a number theory transformation algorithm for shuffling based on register exchange.

[0051] Similarly, the shuffling operation based on matrix transpose is represented by formula (5).

[0052] (5) In formula (5), Indicates to Perform a register-swapping operation. The meanings of the other parameters in formula (5) are the same as in formulas (1) and (3), and are omitted here in detail. Among them, MT_shuf n,l The full English name is Matrix Transpose-shuffle. n,l This is a shuffling operation based on matrix transpose.

[0053] Shuffle order polynomial based on matrix transpose: Based on formula (5), the shuffle order polynomial based on register exchange is expressed by formula (6).

[0054] (6) Under the condition that formula (6) is satisfied, For polynomials in the NTT field The shuffle order polynomial based on matrix transpose. , Indicates to After performing a shuffle operation based on matrix transpose, we obtain... , For polynomials Any one of the terms in formula (6). The meanings of the other parameters in formula (6) are the same as those in formula (2), and will not be detailed here.

[0055] Number theory transformation algorithm for shuffling based on matrix transpose: A number theory transformation algorithm whose final output is a shuffling ordinal polynomial based on matrix transpose is called a number theory transformation algorithm for shuffling based on matrix transpose. There are many implementation methods for this algorithm in related technologies, which will not be detailed here.

[0056] In summary, the shuffling ordinal transformation algorithms include register-swapping ordinal transformation algorithms and matrix transpose-based shuffling ordinal transformation algorithms. When using shuffling ordinal transformation algorithms for number theory transformations, either of these two algorithms can be selected according to requirements, and this disclosure does not limit this choice.

[0057] In step 106, the first polynomial is multiplied by the second polynomial after number theory transformation.

[0058] There are many implementation methods for performing polynomial multiplication between the first polynomial and the number-theoretic transformed second polynomial, which will not be detailed here.

[0059] Number theory transformations of polynomials are performed to convert all polynomials to the same dimension, enabling subsequent polynomial multiplication. Here, the multiple first polynomials and multiple second polynomials have different dimensions, thus requiring number theory transformations of either the first or second polynomials. If a bit-reversal number theory transformation algorithm is used to transform the first and second polynomials to the same dimension (both bit-reversal polynomials), subsequent polynomial operations can be performed. Similarly, if a shuffle order number theory transformation algorithm is used to transform the second polynomials, both the first and second polynomials can be converted to the same dimension (both shuffle order polynomials) before subsequent polynomial operations.

[0060] Here, the time spent using the bit-reversal number theory transformation algorithm to perform a number theory transformation on a certain first polynomial can be approximately considered to be equal to the time spent using the shuffle order number theory transformation algorithm to perform a number theory transformation on a certain second polynomial. Let this time be T.

[0061] In a sub-algorithm where the first value is greater than or equal to the second value (e.g., the first value is 7 and the second value is 9), if the bit-reversal number theory transformation algorithm is used to transform the first polynomial, the total time spent on the number theory transformation is 7T. However, if the shuffle order number theory transformation algorithm is used to transform the second polynomial, the total time spent on the number theory transformation is 9T. Since 7T is less than 9T, the bit-reversal number theory transformation algorithm takes less time to transform the first polynomial in this case.

[0062] In a sub-algorithm where the first value is less than the second value (e.g., the first value is 9 and the second value is 7), if the bit-reversal number theory transformation algorithm is used to transform the first polynomial, the total time spent on the number theory transformation is 9T. However, if the shuffle order number theory transformation algorithm is used to transform the second polynomial, the total time spent on the number theory transformation is 7T. Since 7T is less than 9T, the shuffle order number theory transformation algorithm takes less time to transform the second polynomial. In summary, in this embodiment, choosing the number theory transformation algorithm based on the magnitude of the first and second values ​​essentially means choosing the number theory transformation algorithm with shorter time consumption.

[0063] In related technologies, each sub-algorithm of the lattice cryptography algorithm uses the same type of number theory transformation algorithm to accelerate polynomial multiplication operations. However, in this embodiment, the number theory transformation algorithm with shorter time consumption is selected based on the magnitude of the first and second values ​​in each sub-algorithm, thereby effectively reducing the time required for number theory transformation operations in the entire lattice cryptography algorithm.

[0064] For example, in the three sub-algorithms of the Dilithium signature algorithm, the first value in the key generation sub-algorithm is greater than the second value, for example, the first value is 9 and the second value is 7; the first value in the signature generation sub-algorithm is less than the second value, for example, the first value is 7 and the second value is 9; and the first value in the signature verification sub-algorithm is greater than the second value, for example, the first value is 9 and the second value is 7. Since each sub-algorithm in the related technologies uses the same number theory transformation algorithm, when the related technologies all use the bit-reversal number theory transformation algorithm, the total time spent on the number theory transformation algorithm is 9T + 7T + 9T, which is 25T; when the related technologies all use the shuffle order number theory transformation algorithm, the total time spent on the number theory transformation algorithm is 7T + 9T + 7T, which is 23T.

[0065] When using the polynomial operation acceleration method in this embodiment, by comparing the magnitudes of the first and second values ​​in each sub-algorithm, it can be seen that: the key generation sub-algorithm uses a shuffle ordinal number theory transformation algorithm; the signature generation sub-algorithm uses a bit inversion number theory transformation algorithm; and the signature verification sub-algorithm uses a shuffle ordinal number theory transformation algorithm. Therefore, the total time spent by the number theory transformation algorithms is 7T + 7T + 7T, which is 21T, less than the time spent by the two chosen number theory transformation algorithms in related technologies. Thus, the method in this embodiment can effectively reduce the time required for number theory transformation algorithms in polynomial operations, thereby accelerating polynomial operations and ultimately accelerating lattice cryptography algorithms.

[0066] Figure 2A flowchart illustrating a method for accelerating polynomial operations according to another exemplary embodiment of this disclosure is shown, which can be executed by a computer device. See also Figure 2 The method includes: In step 201, the first and second values ​​of the first sub-algorithm are obtained.

[0067] The details of step 201 are the same as those of step 101 above, and will not be described in detail here.

[0068] In step 202, the first value is compared with the second value.

[0069] If the first value is greater than or equal to the second value, proceed to steps 203-204; if the first value is less than the second value, proceed to steps 205-206.

[0070] In step 203, the first polynomial is transformed using a bit-reversed number-theory transformation algorithm.

[0071] In step 204, the first polynomial after number theory transformation and the second polynomial are multiplied by polynomial.

[0072] For details regarding steps 203-204, please refer to steps 103-104 above, which will be omitted here.

[0073] In step 205, the second polynomial is transformed using a shuffle ordinal number theory transformation algorithm.

[0074] Optionally, the first-level cryptographic algorithm can be implemented on a CPU (Central Processing Unit) platform. In this case, the AVX2 (Advanced Vector Extensions 2) instruction set on the CPU platform can be used to accelerate the register-switching-based ordinal-theory transformation algorithm. The register-switching-based ordinal-theory transformation algorithm includes forward fast shuffling and reverse fast shuffling operations.

[0075] The input to the forward fast shuffle operation is a bit inversion polynomial, and the output is a shuffle order polynomial based on register swapping. Figure 3 This is a flowchart illustrating a forward rapid shuffling operation. Optionally, the following section will combine... Figure 3 The process of implementing a forward fast shuffle operation using the AVX2 instruction set on a CPU platform is described, and the method includes the following ten steps.

[0076] The first step is to define the first index register.

[0077] The data stored in the first index register is .

[0078] The second step is to define the second index register.

[0079] The data stored in the second index register is .

[0080] The third step is to define the third index register.

[0081] The data stored in the third index register is .

[0082] The fourth step is to read every 8 terms of the third polynomial into a register. .

[0083] The third polynomial is a bit-reversal polynomial. In this embodiment, the third polynomial is a bit-reversal polynomial that requires a forward fast shuffle operation.

[0084] Alternatively, the third polynomial can be expressed as Then, every 8 terms of the third polynomial will be read into a register. That is, the third polynomial in Read into register , .

[0085] Fifth step, use the vpermd instruction to adjust the register according to the first index register. The data in the register is replaced, and the replacement result is saved to the register. , .

[0086] The vpermd instruction is an instruction in the AVX2 instruction set. The vpermd instruction in step five is used to replace registers in the order indicated by the values ​​in the first index register. The data in the register is ordered, and the result of the replacement is saved to the register. .

[0087] Figure 3 In this configuration, each register stores 256 bits of data, with 32 bits used to store one term of the polynomial. Figure 3 Registers in part (a) For example, in top-to-bottom order, 0, 1, 2, 3, 4, 5, 6, and 7 represent registers respectively. The data in the sequence are bits 0-31, bits 32-63, bits 64-95, bits 96-127, bits 128-159, bits 160-191, bits 192-223, and bits 224-255.

[0088] like Figure 3 As shown in parts (a) and (b), the original register The data in the register is in the order 0, 1, 2, 3, 4, 5, 6, 7. After the vpermd instruction is used to replace the data according to the order indicated by the value in the first index register, the register... The order of the data in the register is changed to the order of the values ​​in the first index register, which is 0, 2, 4, 6, 1, 3, 5, 7, and the replaced data is stored in the register. middle.

[0089] Step 6: Use the vpermd instruction to adjust the registers according to the second index register. The data in the register is replaced, and the replacement result is saved to the register. .

[0090] Step six is ​​similar in principle to step five. In step six, the vpermd instruction is used to replace registers in the order indicated by the value in the second index register. The data in the register is ordered, and the result of the replacement is saved to the register. .like Figure 3 As shown in parts (a) and (b), the original register The data in the register is in the order of 8, 9, 10, 11, 12, 13, 14, 15. After the vpermd instruction is used to replace the data according to the order indicated by the value in the second index register, the register... The data in the register is ordered as 9, 11, 13, 15, 8, 10, 12, 14, and the replaced data is stored in the register. middle.

[0091] Step 7: Use the vpblendd instruction to unpack the register. and registers and register The lower 128 bits of data and registers The high 128 bits of data are packed and stored in a register. .

[0092] The vpblendd instruction is an instruction in the AVX2 instruction set. The vpblendd instruction in step seven is used to unpack the register. and registers and register The lower 128 bits of data and registers The high 128 bits of data are packed and stored in a register. The unpacking operation is used to obtain the registers. and registers The data stored in the register. The lower 128 bits of data in the register are also known as the register. Data bits 0-127 in the register The high 128 bits of data in the register are also called the high 128 bits of data. The data in bits 128-255.

[0093] like Figure 3 As shown in parts (b) and (c), the register The lower 128 bits of data are 0, 2, 4, and 6 in the register. The high 128 bits of data are 8, 10, 12, and 14. These two data are then packaged and stored in a register. After that, register The data in the table are 0, 2, 4, 6, 8, 10, 12, and 14.

[0094] Step 8: Use the vpblendd instruction to unpack the register. and registers and register The high 128 bits of data and registers The lower 128 bits of data are packed and stored in a register. .

[0095] Step 8 is similar in principle to step 7. The vpblendd instruction in step 8 is used to unpack the register. and registers and register The high 128 bits of data and registers The lower 128 bits of data are packed and stored in a register. .register The high 128 bits of data in the register are also called the high 128 bits of data. Data bits 128-255; register The lower 128 bits of data in the register are also known as the register. The data in bits 0-127.

[0096] like Figure 3 As shown in parts (b) and (c), the register The high 128 bits of data in the register are 1, 3, 5, and 7. The lower 128 bits of data are 9, 11, 13, and 15. These two data points are then packaged and stored in a register. After that, register The data in the table are 9, 11, 13, 15, 1, 3, 5, 7.

[0097] Here, the register and registers The data in the data is packaged and stored in the register. During this process, the extracted lower 128 bits of data are used as a register. The lower 128 bits of data are extracted, and the higher 128 bits are used as a register. The high 128 bits of data, Step 9: Use the vpermd instruction to adjust the registers according to the third index register. The data in the middle is replaced.

[0098] Step nine is similar in principle to steps five and six. The vpermd instruction in step nine is used to replace registers in the order indicated by the value in the third index register. The order of the data in the file. For example... Figure 3 As shown in parts (c) and (d), the original register The data in the register is in the order of 9, 11, 13, 15, 1, 3, 5, 7. After the vpermd instruction is used to replace the data according to the order indicated by the value in the third index register, the register... The order of the data becomes 1, 3, 5, 7, 9, 11, 13, 15. This completes the forward fast shuffle operation. The tenth step is then required to save the result of the forward fast shuffle operation.

[0099] Step 10, transfer the register and registers The data is stored in the first array.

[0100] The data in the first array is used to indicate the register-swapping shuffled polynomial obtained after performing a forward shuffle on the third polynomial.

[0101] Figure 4 This is a schematic diagram of the instructions for a forward fast shuffle operation. In this embodiment, each of the ten steps is equivalent to one instruction in the AVX2 instruction set, meaning that the forward fast shuffle operation in this embodiment requires only ten instructions in the AVX2 instruction set to be implemented (e.g., ...). Figure 4Since the AVX2 instruction set belongs to the SIMD (Single Instruction Multiple Data) instruction set, the advantage of the SIMD instruction set is that a set of instructions can be used to perform parallel operations on multiple sets of data. Therefore, some instructions in the above ten AVX2 instruction sets in this embodiment can also be executed in parallel (for example, the instructions corresponding to the first to third steps can be executed in parallel, the instructions corresponding to the fifth and sixth steps can be executed in parallel, and the instructions corresponding to the seventh and eighth steps can be executed in parallel), thereby greatly reducing the time required for instruction implementation.

[0102] Figure 5 This is a flowchart illustrating a layered, register-swapping-based forward shuffle operation in related technologies. It can be seen that this process is relatively complex and has many instruction cycles. Compared to the flowchart of a layered, register-swapping-based forward shuffle operation in related technologies, the forward fast shuffle operation in this embodiment represents a novel algorithm that is simpler and has a shorter instruction cycle.

[0103] The input to the reverse fast shuffle operation is a register-swapping shuffle order polynomial, and the output is a bit-inverse polynomial. Figure 6 This is a flowchart illustrating the reverse rapid shuffling operation. Optionally, the following is combined with... Figure 6 The process of implementing reverse fast shuffling using the AVX2 instruction set is described, and the method includes the following six steps.

[0104] The first step is to read every 8 terms of the fourth polynomial into a register. .

[0105] In this embodiment of the disclosure, the fourth polynomial is a register-swapping shuffle order polynomial that requires a reverse fast shuffle operation.

[0106] Alternatively, the fourth polynomial can be expressed as Then, every 8 terms of the fourth polynomial will be read into a register. That is, the fourth polynomial in Read into register , .

[0107] The second step is to use the vpunpckldq instruction to unpack and interleave the registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , .

[0108] The `vpunpckldq` instruction is an instruction in the AVX2 instruction set. In the second step, the `vpunpckldq` instruction is used to unpack the register. and registers and register and registers The lower 64 bits of data in each 128-bit register are interleaved. and registers The lower 64 bits of data in each 128-bit array are also known as registers. and registers The data in bits 0-63 and bits 128-191.

[0109] During interleaving, it is a register. and registers Interleaving the data from bits 0 to 63 in the register, and and registers The data in bits 128-191 of the register is interleaved. For example, the register... and registers When interleaving the data in bits 0-63 of the register, assuming the register The data in bits 0-63 are A and B respectively, while the register If bits 0-63 of the register are C and D respectively, then the interleaving result is A, C, B, D. Similarly, the register... and registers When interleaving bits 128-191 of the data in the register, assuming the register Bits 128-191 are E and F respectively, while the register If the data in bits 128-191 are G and H respectively, then the interleaving result is E, G, F, H.

[0110] There are many implementations of interleaving using the vpunpckldq instruction, so they will not be detailed here.

[0111] like Figure 6 As shown in parts (a) and (b), the register The data in bits 0-63 of the register are 0, 2, and 2 respectively. If bits 0-63 of the array are 1 and 3 respectively, then the result after interleaving the bits is 0, 1, 2, 3, and the interleaved result is stored in a register. In the lower 128 bits. Register The data in bits 128-191 of the register are 8 and 10 respectively. If bits 128-191 of the data are 9 and 11 respectively, then the result after interleaving them is 8, 9, 10, 11, and the interleaved result is stored in a register. In the high 128 bits.

[0112] The third step is to use the vpunpckhdq instruction to unpack and interleave the registers. and registers The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. .

[0113] The principle of the third step is similar to that of the second step. The vpunpckhdq instruction in the third step is used to unpack the register. and registers and register and registers The high 64 bits of data in each 128-bit register are interleaved. and registers The high 64 bits of data in each 128 bits are the registers. and registers The data in bits 64-127 and bits 192-255.

[0114] like Figure 6 As shown in parts (a) and (b), the register The data in bits 64-127 of the register are 4 and 6 respectively. If bits 64-127 of the array contain 5 and 7 respectively, then the result after interleaving the bits is 4, 5, 6, and 7, and the interleaved result is stored in a register. In the lower 128 bits. Register The data in bits 192-255 of the register are 12 and 14 respectively. If bits 192-255 of the data are 13 and 15 respectively, then the result after interleaving them is 12, 13, 14, 15, and the interleaved result is stored in a register. In the high 128 bits.

[0115] The fourth step is to use the vperm2i128 instruction to change the register. and registers The lower 128 bits of data are stored in the register. .

[0116] The `vperm2i128` instruction is a function in the AVX2 instruction set. The `vperm2i128` instruction in step four is used to transfer data from the register... and registers The lower 128 bits of data are stored in the register. Among them, registers and registers The lower 128 bits of data in the register are also known as the register. and registers The data in bits 0-127.

[0117] Figure 6 As shown in parts (b) and (c), the register The lower 128 bits of the data are 0, 1, 2, and 3, respectively. (Register) The lower 128 bits of data in the register are 4, 5, 6, and 7, respectively. and registers The lower 128 bits of data are stored in the register. At that time, register The lower 128 bits of data are stored in a register. In the lower 128 bits, the register The lower 128 bits of data are stored in a register. In the high 128 bits. Therefore Figure 6 Registers in part (c) The data stored in it is 0, 1, 2, 3, 4, 5, 6, 7.

[0118] Fifth step, use the vperm2i128 instruction to change the register. and registers The high 128 bits of data are stored in the register. .

[0119] The principle of step five is similar to that of step four. The vperm2i128 instruction in step five is used to change the register... and registers The high 128 bits of data are stored in the register. Among them, registers and registers The high 128 bits of data in the register are also called the high 128 bits of data. and registers The data in bits 128-255.

[0120] Figure 6 As shown in parts (b) and (c), the register The high 128 bits of data in the register are 8, 9, 10, and 11 respectively. The high 128 bits of data in the register are 12, 13, 14, and 15, respectively. and registers The high 128 bits of data are stored in the register. At that time, register The high 128 bits of data are stored in a register. In the lower 128 bits, the register The high 128 bits of data are stored in a register. In the high 128 bits. Therefore Figure 6 Registers in part (c) The data stored in it are 8, 9, 10, 11, 12, 13, 14, 15.

[0121] Step 6, transfer the register and registers The data is stored in the second array.

[0122] The data in the second array is used to indicate the bit-inverted polynomial obtained after reversing the fourth polynomial.

[0123] Figure 7 This is a schematic diagram of the instructions for a reverse fast shuffle operation. In this embodiment, each of the six steps is equivalent to one instruction in the AVX2 instruction set, meaning that the reverse fast shuffle operation in this embodiment requires a total of six instructions in the AVX2 instruction set (e.g., ...). Figure 7 Since the AVX2 instruction set is a type of SIMD instruction set, the advantage of the SIMD instruction set is that a set of instructions can be used to perform parallel operations on multiple sets of data. Therefore, some of the instructions in the above six AVX2 instruction sets in this embodiment can also be executed in parallel (for example, the instructions corresponding to the second and third steps can be executed in parallel, and the instructions corresponding to the fourth and fifth steps can be executed in parallel), thereby greatly reducing the time required for instruction implementation.

[0124] Figure 8 This is a flowchart illustrating a layered, register-swapping-based reverse shuffling operation in related technologies. It can be seen that this process is relatively complex and has many instruction cycles. Compared to the flowchart of a layered, register-swapping-based reverse shuffling operation in related technologies, the reverse fast shuffling operation in this embodiment represents a novel algorithm that is simpler and has a shorter instruction cycle.

[0125] In step 206, the first polynomial is multiplied by the second polynomial after number theory transformation.

[0126] Optionally, during the polynomial multiplication operation between the first polynomial and the number-theory-transformed second polynomial, or during the polynomial multiplication operation between the number-theory-transformed first polynomial and the second polynomial, there are multiple levels of butterfly operations. Before performing any level of butterfly operation, it is necessary to perform a bitwise AND operation on the powers of the twiddle factors required for that level of butterfly operation to obtain multiple pre-calculated values ​​for that level and store them. In this case, the method further includes: for the first polynomial... Layer and first The storage method for pre-computed values ​​of the layer is optimized. This method includes the following four steps: The first step is to obtain multiple first pre-calculated values ​​corresponding to the first-level butterfly operation. Second pre-calculated value .

[0127] The first level is the Layer, or, the first layer is the th layer.

[0128] Here, the first Layer and first The first and second pre-computed values ​​in the layer are arranged alternately, that is, there is a second pre-computed value between every two first pre-computed values, and a first pre-computed value between every two second pre-computed values. However, the arrangement of pre-computed values ​​in other layers does not follow the above pattern.

[0129] In implementation, the first and second pre-calculated values ​​for all levels can be calculated first, and then the values ​​for the third level can be calculated later. Layer and first The pre-calculated values ​​for each layer are processed separately.

[0130] For all levels except the first Layer, First For levels other than layer 0, the method includes: for layers 0 to 10... The layer utilizes broadcasting to quickly generate the corresponding vector, with each 32 bits of data in the generated vector being identical.

[0131] Due to the butterfly operation from level 0 to level 1 The pre-computed values ​​in any layer are the same, so the corresponding vectors can be generated directly without the need for storage optimization.

[0132] For the The pre-computed values ​​corresponding to each layer generate a corresponding vector, where each 32 bits of data is different. This is because the butterfly operation... The pre-calculated values ​​corresponding to each layer are different, and do not satisfy the first... Layer and first The pre-calculated values ​​of the layers follow a pattern, therefore no storage optimization is needed.

[0133] The second step is to construct a third array with a basic unit of 64 bits, in which data in 64-bit units is stored sequentially. And read the third array into the vector register.

[0134] The third step is to use the first pre-calculated value. In this case, read the lower 32 bits of data from each 64-bit data in the vector register.

[0135] The fourth step is to use the second pre-calculated value. In this case, shift the high 32 bits of each 64-bit data in the vector register 32 bits to the right, and then read the low 32 bits of each 64-bit data in the shifted vector register.

[0136] Here, shifting the high 32 bits of each 64-bit data in the vector register to the right by 32 bits is essentially performing the following operation on each 64-bit data in each vector register: Therefore, the lower 32 bits of each 64-bit data ultimately stored in the shifted vector register are the second pre-calculated value. .

[0137] In related technologies, only one pre-calculated value is stored in every 64 bits, while in this embodiment of the disclosure, by storing... This is equivalent to storing two pre-calculated values, thus optimizing the storage method of pre-calculated values, allowing more pre-calculated values ​​to be stored in a vector register of the same size.

[0138] Figure 9 For the first A flowchart illustrating the optimization of the storage method for pre-computed values ​​in layers, as shown below. Figure 9 As shown, each data value in this vector register occupies 32 bits of storage space. The bits in the vector register, from right to left, are bits 0-31, bits 32-63, and so on. If the first pre-calculated value is needed... If so, simply read the lower 32 bits of data from every 64 bits of data in the vector register; if a second pre-calculated value is needed... Then, the data in the vector register is shifted in the third step. After the shift, the lower 32 bits of each 64-bit data in the vector register are the second pre-calculated value.

[0139] The following are device embodiments of this application. For details not described in detail in the device embodiments, please refer to the above method embodiments.

[0140] Figure 10 A schematic diagram of a polynomial operation acceleration device provided in an exemplary embodiment of this disclosure is shown below. See also: Figure 10 The polynomial operation acceleration device 1000 includes: an acquisition module 1001, a comparison module 1002, a number theory transformation module 1003, and a polynomial operation module 1004.

[0141] The acquisition module 1001 is used to acquire the first value and the second value of the first sub-algorithm. The first cipher algorithm includes multiple sub-algorithms, each of which corresponds to a different stage of the first cipher algorithm. The first sub-algorithm is any one of the multiple sub-algorithms. The first value is the number of first polynomials that need to be operated on during the operation of the first sub-algorithm. The second value is the number of second polynomials in the NTT field that need to be operated on with the first polynomials.

[0142] The comparison module 1002 is used to compare the size of the first value and the second value.

[0143] The number theory transformation module 1003 is used to perform a number theory transformation on the first polynomial using a bit-reverse number theory transformation algorithm when the first value is greater than or equal to the second value, and to perform a number theory transformation on the second polynomial using a shuffle order number theory transformation algorithm when the first value is less than the second value.

[0144] The polynomial operation module 1004 is used to perform polynomial multiplication on the first polynomial after number theory transformation and the second polynomial when the first value is greater than or equal to the second value, and to perform polynomial multiplication on the first polynomial and the second polynomial after number theory transformation when the first value is less than the second value.

[0145] Optionally, the number theory transformation module 1003 is also used to read every 8 terms of the third polynomial into a register. , The third polynomial is a bit-inverse polynomial; the vpermd instruction is used to adjust the register according to the first index register. The data in the register is replaced, and the replacement result is saved to the register. , The data stored in the first index register is The vpermd instruction is used to modify the registers based on the second index register. The data in the register is replaced, and the replacement result is saved to the register. The data stored in the second index register is Use the vpblendd instruction to unpack the register. and registers and register The lower 128 bits of data and registers The high 128 bits of data are packed and stored in a register. Use the vpblendd instruction to unpack the register. and registers and register The high 128 bits of data and registers The lower 128 bits of data are packed and stored in a register. The vpermd instruction is used to modify the registers based on the third index register. The data in the middle is replaced, and the data stored in the third index register is ; to register and registers The data in the first array is stored in the first array. The data in the first array is used to indicate the register-exchange-based shuffled polynomial obtained after performing a forward shuffle operation on the third polynomial. Among them, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2AVX2 instruction set.

[0146] Optionally, the number theory transformation module 1003 is also used to read every 8 terms of the fourth polynomial into a register. , The fourth polynomial is a shuffled polynomial based on register swapping; the vpunpckldq instruction is used to unpack and interleave the registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , The vpunpckhdq instruction is used to unpack and interleave the registers. and registers The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. Use the vperm2i128 instruction to change the register. and registers The lower 128 bits of data are stored in the register. Use the vperm2i128 instruction to change the register. and registers The high 128 bits of data are stored in the register. ; to register and registers The data in the second array is used to indicate the bit-inverted polynomial obtained after reversing the fourth polynomial; among them, the vpunpckldq instruction, vpunpckhdq instruction, and vperm2i128 instruction are instructions in the AVX2 instruction set.

[0147] Optionally, the device further includes a pre-calculation module 1005, used to obtain multiple first pre-calculated values ​​corresponding to the first-level butterfly operation. Second pre-calculated value The first level is the The first level or the first level is the Layer; Construct a third array with a basic unit of 64 bits, in which data in 64-bit units is stored sequentially. And read the third array into the vector register; when the first pre-calculated value is needed... In the case of reading the lower 32 bits of data from each 64-bit data set in the vector register, when a second pre-calculated value is required... In this case, shift the high 32 bits of each 64-bit data in the vector register 32 bits to the right, and then read the low 32 bits of each 64-bit data in the shifted vector register.

[0148] It should be noted that the polynomial operation acceleration device provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the polynomial operation acceleration device and the polynomial operation acceleration method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0149] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in the various embodiments of this disclosure can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0150] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device (which may be a personal computer, mobile phone, or communication device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] Figure 11 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. For example... Figure 11 As shown, the computer device 1100 includes a processor 1101 and a memory 1102.

[0152] Processor 1101 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1101 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1101 may also include a main processor and a coprocessor. The main processor, also known as the CPU, is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1101 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1101 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0153] The memory 1102 may include one or more computer-readable storage media, which may be non-transitory. The memory 1102 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1102 are used to store at least one instruction, which is executed by the processor 1101 to implement the polynomial operation acceleration method provided in the embodiments of this disclosure.

[0154] Those skilled in the art will understand that Figure 11 The structure shown does not constitute a limitation on the computer device 1100 and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0155] This disclosure also provides a non-transitory computer-readable storage medium that, when the instructions in the storage medium are executed by the processor of a computer device, enables the computer device to execute the polynomial operation acceleration method provided in this disclosure.

[0156] This disclosure also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the polynomial operation acceleration method provided in this disclosure.

[0157] The above description is merely an optional embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A method for accelerating polynomial operations, characterized in that, The method includes: Obtain the first and second values ​​of the first sub-algorithm. The first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponding to a different stage of the first lattice cryptographic algorithm. The first sub-algorithm is any one of the multiple sub-algorithms. The first value is the number of first polynomials that need to be operated on during the operation of the first sub-algorithm. The second value is the sum of the number of polynomials in the NTT field that need to be operated on in the forward NTT with the first polynomial and the number of polynomials in the NTT field that need to be operated on in the reverse NTT with the first polynomial. When the first lattice cryptographic algorithm is the Dilithium signature algorithm and the first sub-algorithm is the signature verification step, the second value is equal to the average number of required loops multiplied by the number of forward NTTs and reverse NTTs called in a single loop. Comparing the first value with the second value, when the first sub-algorithm is a key generation sub-algorithm, the first value is 9 and the second value is 7; when the first sub-algorithm is a signature generation sub-algorithm, the first value is 7 and the second value is 9; when the first sub-algorithm is a signature verification sub-algorithm, the first value is 9 and the second value is 7. If the first value is greater than or equal to the second value, the first polynomial is transformed using the bit inversion number theory transformation algorithm. Perform polynomial multiplication on the first polynomial and the second polynomial after number theory transformation; If the first value is less than the second value, the second polynomial is transformed using the shuffle ordinal number theory transformation algorithm. Perform polynomial multiplication on the first polynomial and the second polynomial after number theory transformation; The shuffling ordinal theory transformation algorithm includes a register-switching-based shuffling ordinal theory transformation algorithm. The output of the register-switching-based shuffling ordinal theory transformation algorithm is a register-switching-based shuffling ordinal theory polynomial. The register-switching-based shuffling ordinal theory transformation algorithm includes a forward fast shuffling operation. The input of the forward fast shuffling operation is a bit inversion polynomial, and the output is a register-switching-based shuffling ordinal polynomial. The forward fast shuffling operation is implemented in the following way: Read every 8 terms of the third polynomial into a register. , The third polynomial is a bit-inverse polynomial; Using the vpermd instruction, the register is accessed based on the first index register. The data in the register is replaced, and the replacement result is saved to the register. , The data stored in the first index register is ; The vpermd instruction is used to access the registers based on the second index register. The data in the register is replaced, and the replacement result is saved to the register. The data stored in the second index register is ; The register is unpacked using the vpblendd instruction. and the register and the register The lower 128 bits of data and the register The high 128 bits of data are packaged and stored in the register. ; The register is unpacked using the vpblendd instruction. and the register and the register The high 128 bits of data and the register The lower 128 bits of data are packaged and stored in the register. ; The vpermd instruction is used to modify the register according to the third index register. The data in the middle is replaced, and the data stored in the third index register is ; The register and the register The data in the first array is stored in the first array, and the data in the first array is used to indicate the register-swapping order polynomial obtained after performing a forward shuffle operation on the third polynomial. Among them, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2AVX2 instruction set; The register-switching-based shuffle order polynomial is expressed by the following formula: Wherein, under the condition that the above formula is satisfied, This is a register-swapping shuffle order polynomial. It is an integer. The value is a power of 2. Indicates to After performing a register-swapping operation, the result is... , For polynomials in the NTT field Any one of them; The register-swapping-based shuffle operation is represented by the following formula: in, To meet non-negative integers, Indicates to Perform a register-swapping shuffle operation. The number of polynomial coefficients stored in the register. This indicates a bit reversal operation; The register-switching-based ordinal-theory shuffling transformation algorithm includes a reverse fast shuffling operation. The input of the reverse fast shuffling operation is a register-switching-based shuffling order polynomial, and the output is a bit-inverse polynomial. The reverse fast shuffling operation is implemented in the following way: Read every 8 terms of the fourth polynomial into a register. , The fourth polynomial is a shuffle order polynomial based on register swapping; Use the vpunpckldq instruction to unpack and interleave registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , ; The registers are unpacked and interleaved using the vpunpckhdq instruction. and the register The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. ; Use the vperm2i128 instruction to change the register and the register The lower 128 bits of data are stored in the register. ; Use the vperm2i128 instruction to change the register and the register The high 128 bits of data are stored in the register. ; The register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the fourth polynomial is reversed and shuffled. Among them, the vpunpckldq instruction, vpunpckhdq instruction, and vperm2i128 instruction are instructions in the AVX2 instruction set; In the process of performing polynomial multiplication between the first polynomial and the number-theory-transformed second polynomial, or in the process of performing polynomial multiplication between the number-theory-transformed first polynomial and the second polynomial, there are multiple levels of butterfly operations, each level of butterfly operation corresponding to a set of pre-calculated values. The method further includes: Obtain multiple first pre-computed values ​​corresponding to the first-level butterfly operation. Second pre-calculated value The first level is the The first level or the first level is the layer; A third array is constructed with a basic unit of 64 bits, in which data of every 64 bits is stored sequentially. And read the third array into the vector register; When the first pre-calculated value needs to be used In this case, read the lower 32 bits of data from each 64-bit data in the vector register; When the second pre-calculated value is needed In this case, the high 32 bits of each 64-bit data in the vector register are shifted 32 bits to the right, and the low 32 bits of each 64-bit data in the shifted vector register are read.

2. A polynomial operation acceleration device, characterized in that, The device includes: The acquisition module is used to acquire the first value and the second value of the first sub-algorithm. The first lattice cryptographic algorithm includes multiple sub-algorithms, each sub-algorithm corresponding to a different stage of the first lattice cryptographic algorithm. The first sub-algorithm is any one of the multiple sub-algorithms. The first value is the number of first polynomials that need to be operated on during the operation of the first sub-algorithm. The second value is the sum of the number of polynomials in the NTT field that need to be operated on in the forward NTT with the first polynomial and the number of polynomials in the NTT field that need to be operated on in the reverse NTT with the first polynomial. When the first lattice cryptographic algorithm is the Dilithium signature algorithm and the first sub-algorithm is the signature verification step, the second value is equal to the average number of required loops multiplied by the number of forward NTTs and reverse NTTs called in a single loop. The comparison module is used to compare the size of the first value and the second value. When the first sub-algorithm is a key generation sub-algorithm, the first value is 9 and the second value is 7. When the first sub-algorithm is a signature generation sub-algorithm, the first value is 7 and the second value is 9. When the first sub-algorithm is a signature verification sub-algorithm, the first value is 9 and the second value is 7. The number theory transformation module is used to perform a number theory transformation on the first polynomial using a bit-reverse number theory transformation algorithm when the first value is greater than or equal to the second value, and to perform a number theory transformation on the second polynomial using a shuffle order number theory transformation algorithm when the first value is less than the second value. The polynomial operation module is used to perform polynomial multiplication on the first polynomial after number theory transformation and the second polynomial when the first value is greater than or equal to the second value, and to perform polynomial multiplication on the first polynomial and the second polynomial after number theory transformation when the first value is less than the second value. In the number theory transformation module, the shuffle ordinal number theory transformation algorithm includes a register-switching-based shuffle ordinal number theory transformation algorithm. The output of the register-switching-based shuffle ordinal number theory transformation algorithm is a register-switching-based shuffle ordinal polynomial. The register-switching-based shuffle ordinal number theory transformation algorithm includes a forward fast shuffle operation. The input of the forward fast shuffle operation is a bit inversion polynomial, and the output is a register-switching-based shuffle ordinal polynomial. The forward fast shuffle operation is implemented in the following way: Read every 8 terms of the third polynomial into a register. , The third polynomial is a bit-inverse polynomial; Using the vpermd instruction, the register is accessed based on the first index register. The data in the register is replaced, and the replacement result is saved to the register. , The data stored in the first index register is ; The vpermd instruction is used to access the registers based on the second index register. The data in the register is replaced, and the replacement result is saved to the register. The data stored in the second index register is ; The register is unpacked using the vpblendd instruction. and the register and the register The lower 128 bits of data and the register The high 128 bits of data are packaged and stored in the register. ; The register is unpacked using the vpblendd instruction. and the register and the register The high 128 bits of data and the register The lower 128 bits of data are packaged and stored in the register. ; The vpermd instruction is used to modify the register according to the third index register. The data in the middle is replaced, and the data stored in the third index register is ; The register and the register The data in the first array is stored in the first array, and the data in the first array is used to indicate the register-swapping order polynomial obtained after performing a forward shuffle operation on the third polynomial. Among them, the vpblendd instruction and the vpermd instruction are instructions in the Advanced Vector Extension 2AVX2 instruction set; The register-switching-based shuffle order polynomial is expressed by the following formula: Wherein, under the condition that the above formula is satisfied, This is a register-swapping shuffle order polynomial. It is an integer. The value is a power of 2. Indicates to After performing a register-swapping operation, the result is... , For polynomials in the NTT field Any one of them; The register-swapping-based shuffle operation is represented by the following formula: in, To meet non-negative integers, Indicates to Perform a register-swapping shuffle operation. The number of polynomial coefficients stored in the register. This indicates a bit reversal operation; The register-switching-based ordinal-theory shuffling transformation algorithm includes a reverse fast shuffling operation. The input of the reverse fast shuffling operation is a register-switching-based shuffling order polynomial, and the output is a bit-inverse polynomial. The reverse fast shuffling operation is implemented in the following way: Read every 8 terms of the fourth polynomial into a register. , The fourth polynomial is a shuffle order polynomial based on register swapping; Use the vpunpckldq instruction to unpack and interleave registers. and registers The lower 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. , ; The registers are unpacked and interleaved using the vpunpckhdq instruction. and the register The high 64 bits of data from each 128 bits are used to perform the permutation and save the result to a register. ; Use the vperm2i128 instruction to change the register and the register The lower 128 bits of data are stored in the register. ; Use the vperm2i128 instruction to change the register and the register The high 128 bits of data are stored in the register. ; The register and the register The data in the second array is stored in the second array, and the data in the second array is used to indicate the bit inversion polynomial obtained after the fourth polynomial is reversed and shuffled. Among them, the vpunpckldq instruction, vpunpckhdq instruction, and vperm2i128 instruction are instructions in the AVX2 instruction set; In the process of performing polynomial multiplication between the first polynomial and the number-theory-transformed second polynomial, or in the process of performing polynomial multiplication between the number-theory-transformed first polynomial and the second polynomial, there are multiple levels of butterfly operations, each level of butterfly operation corresponding to a set of pre-calculated values. The device further includes a pre-calculation module for obtaining multiple first pre-calculated values ​​corresponding to the first-level butterfly operation. Second pre-calculated value The first level is the The first level or the first level is the layer; A third array is constructed with a basic unit of 64 bits, in which data of every 64 bits is stored sequentially. And read the third array into the vector register; When the first pre-calculated value needs to be used In this case, read the lower 32 bits of data from each 64-bit data in the vector register; When the second pre-calculated value is needed In this case, the high 32 bits of each 64-bit data in the vector register are shifted 32 bits to the right, and the low 32 bits of each 64-bit data in the shifted vector register are read.

3. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the method of claim 1.

4. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the method of claim 1.

5. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method of claim 1.

Images