NTT polynomial multiplier capable of realizing in-situ storage, constant geometric structure and no memory access conflict

Abstract

The invention provides an NTT polynomial multiplier capable of realizing in-situ storage, a constant geometric structure and no memory access conflict, a dislocation storage mode of a traditional constant geometric structure type NTT is converted into an in-situ storage mode, and the memory access conflict and the in-situ storage are realized by adopting an odd Bank storage structure. Therefore, conflict-free storage mapping irrelevant to the polynomial length N and the NTT / INTT calculation stage is realized, and a storage structure and a data loading mode are unified. The structure provides conditions for dynamically supporting polynomial multiplication with different lengths. Besides, along with the increase of the maximum polynomial length N supported by the RAEPM, the structure of the buffer area does not need to be modified, and only the depth of the Bank needs to be increased, so that polynomial multiplication of different times can be executed under the condition of not recompiling.

Description

Technical Field

[0001] The present invention relates to a polynomial multiplier and a lattice cryptographic hardware accelerator, and in particular to an NTT polynomial multiplier and an algorithm for realizing in-situ storage, a constant geometric structure and no memory access conflict. Background Art

[0002] Lattice-based cryptography (LBC) occupies a core position in the recently popular field of Fully Homomorphic Encryption (FHE) and Post-Quantum Cryptography (PQC). Currently, most FHE and PQC schemes are built on Ring Learning With Errors (RLWE) or Module Learning With Errors (MLWE), which requires operations on high-order polynomial rings. However, performing high-order polynomial multiplications consumes a lot of time and memory, and thus becomes the main bottleneck for the application of most FHE and PQC schemes.

[0003] In order to speed up the multiplication of polynomials, methods based on number theoretic transform (NTT) are widely used. There are two main types of NTT algorithms: iterative NTT with in-situ storage and constant geometry NTT with staggered storage. In the iterative NTT with in-situ storage, the access order of polynomial coefficients changes in different NTT calculation stages, so it often has a complex memory access pattern. This makes the data transmission and address logic very complex, which is not conducive to flexible and lightweight implementation. In contrast, the constant geometry NTT with staggered storage usually has a simple and uniform memory access pattern, because the access order of polynomial data remains unchanged in different NTT calculation stages, which makes it increasingly used for efficient hardware implementation of NTT.

[0004] However, the existing constant geometry structure NTT polynomial multiplier still has the following problems:

[0005] 1. Although the memory access pattern of the iterative NTT with in-situ storage is complex, its data reading and writing can be completed in the same storage area. Although the constant geometry structure NTT with staggered storage has a unified memory access pattern, it usually needs to use a ping-pong structure memory to prevent read-write conflicts, which results in its memory usage being twice as much as that of the NTT with in-situ storage.

[0006] 2. Existing memory access conflict-free read and write solutions for NTT are often directly related to the polynomial length N. Therefore, when the polynomial length N changes, the NTT polynomial multiplier needs to be recompiled on the FPGA and dynamic reconstruction cannot be achieved. Summary of the invention

[0007] In order to solve the problems of the above-mentioned prior art, the present invention provides an NTT polynomial multiplier that realizes in-situ storage, constant geometry structure, and no memory access conflict, which can greatly reduce the memory overhead of the constant geometry structure type NTT, and at the same time can flexibly meet the multiplication requirements of polynomials of different lengths without re-compiling the FPGA.

[0008] The present invention is achieved through the following technical solutions:

[0009] An NTT polynomial multiplier that realizes in-situ storage, constant geometry, and no memory access conflict, characterized by comprising: a PE array, a polynomial cache module, a rotation factor cache module, an address generator, and a Bank index generator;

[0010] The PE array is used to perform an NTT butterfly operation of an in-situ storage constant geometry structure type with a cardinality of t on the polynomial, and the operation results of each stage of the NTT butterfly operation are stored in a polynomial cache module in a storage structure with a bank number of t+1; wherein t is a number greater than 0 and a power of 2;

[0011] The polynomial cache module is used to store the polynomial and the calculation results of each stage of the NTT butterfly calculation;

[0012] The twiddle factor cache module is used to store the twiddle factors used by the NTT butterfly operation;

[0013] The address generator and the bank index generator are used to generate data reading and writing addresses of the polynomial cache module using a storage structure with a bank number of t+1.

[0014] Preferably, the PE array includes PE units, and the number of the PE units is log2t*t / 2.

[0015] Furthermore, the PE array is a reconfigurable PE array, including two operation modes, NTT and INTT; in the NTT operation mode, the PE array is used to perform an NTT butterfly operation with a base number of t and an in-situ storage constant geometric structure on the polynomial; in the INTT operation mode, the PE array is used to perform an INTT butterfly operation with a base number of t and an in-situ storage constant geometric structure on the polynomial, and the operation results of each stage of the INTT butterfly operation are stored in a polynomial cache module in a storage structure with a bank number of t+1; the rotation factor cache module is also used to store the rotation factors used by the INTT butterfly operation.

[0016] Furthermore, the PE unit is a reconfigurable PE unit, including two operation modes: NTT and INTT; in the NTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type NTT butterfly operation; in the INTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type INTT butterfly operation.

[0017] Furthermore, the PE array also includes an EWM operation mode; in the EWM operation mode, the PE array is used to perform vector corresponding point modular multiplication operations.

[0018] Furthermore, the PE unit is a reconfigurable PE unit, including NTT, INTT and EWM operation modes; in the NTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type NTT butterfly operation; in the INTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type INTT butterfly operation; in the EWM operation mode, the PE unit is used to perform vector corresponding point modular multiplication operation.

[0019] Preferably, t is 4.

[0020] Preferably, the polynomial cache module includes a polynomial cache module A and a polynomial cache module B;

[0021] The PE array is used to perform a first NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t on polynomial A, and the operation results of each stage of the first NTT butterfly operation are stored in a polynomial cache module A in a storage structure with a bank number of t+1; perform a second NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t on polynomial B, and the operation results of each stage of the second NTT butterfly operation are stored in a polynomial cache module B in a storage structure with a bank number of t+1;

[0022] The polynomial cache module A is used to store the polynomial A and the operation results of each stage of the first NTT butterfly operation;

[0023] The polynomial cache module B is used to store the polynomial B and the calculation results of each stage of the second NTT butterfly calculation.

[0024] The present invention provides an NTT butterfly operation method with in-situ storage, constant geometric structure and no memory access conflict. The cardinality of the NTT butterfly operation is 4, and the input is a polynomial on a ring with a length of N. The coefficient modulus q, the primitive root ψ of the modulus q; the output is the NTT vector A=(A0,…A N-1 );

[0025] 1) Initialize variables m=0, k=0, j=0;

[0026] 2) Calculate the initial index value: Index0′=4 m ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4;

[0027] 3) Determine whether m is equal to 0:

[0028] If m is equal to 0, calculate the index value: Index0 = Index0′, Index1 = Index1′, Index2 = Index2′, Index3 = Index3′;

[0029] If m is not equal to 0, initialize variable i = 0; calculate index values: Index0 = Index0′ / 4 + (Index0′mod 4)×N / 4, Index1 = Index1′ / 4 + (Index1′mod 4)×N / 4, Index2 = Index2′ / 4 + (Index2′mod 4)×N / 4, Index3 = Index3′ / 4 + (Index3′mod 4)×N / 4; set variable i = i+1 and repeat the above operation until i≥m;

[0030] 4) Calculate the rotation factor:

[0031] 5) Calculate the intermediate results T0 = (a[Index0] + a[Index2] × ω0) modq, T1 = (a[Index1] + a[Index3] × ω1) modq, T2 = (a[Index0] - a[Index2] × ω0) modq, T3 = (a[Index1] - a[Index3] × ω1) modq;

[0032] 6) Calculate the NTT output of the current stage A[Index0] = (T0 + T1 × ω2) modq, A[Index1] = (T0 + T1 × ω2) modq, A[Index2] = (T2 + T3 × ω3) modq, A[Index3] = (T2 + T3 × ω3) modq;

[0033] 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m ;

[0034] 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 ;

[0035] 9) Set variable m=m+1 and repeat steps 2) to 8) until m≥log4N;

[0036] 10) Return the NTT vector A = (A0,…A N-1 ).

[0037] The present invention provides an INTT butterfly operation method with in-situ storage, constant geometric structure and no memory access conflict. The cardinality of the INTT butterfly operation is 4, and the input is an NTT vector A=(A0,…A N-1 ), coefficient modulus q, primitive root ψ of modulus q; the output is the INTT result of NTT vector A

[0038] 1) Initialize variables m=log4N-1, k=0, j=0;

[0039] 2) Calculate the initial index value: Index0′=4 m ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4;

[0040] 3) Determine whether m is equal to 0:

[0041] If m is equal to 0, calculate the index value: Index0 = Index0′, Index1 = Index1′, Index2 = Index2′, Index3 = Index3′;

[0042] If m is not equal to 0, initialize variable i = 0; calculate index values: Index0 = Index0′ / 4 + (Index0′mod 4)×N / 4, Index1 = Index1′ / 4 + (Index1′mod 4)×N / 4, Index2 = Index2′ / 4 + (Index2′mod 4)×N / 4, Index3 = Index3′ / 4 + (Index3′mod 4)×N / 4; set variable i = i+1 and repeat the above operation until i≥m;

[0043] 4) Calculate the rotation factor:

[0044] 5) Calculate the intermediate results T0 = (A[Index0] + A[Index1]) / 2modq, T1 = (A[Index0] - A[Index1]) × ω0 / 2modq, T2 = (A[Index2] + A[Index3]) / 2modq, T3 = (A[Index2] - A[Index3]) × ω1 / 2modq;

[0045] 6) Calculate the INTT output of the current stage: a[Index0] = (T0 + T2) modq, a[Index1] = (T1 + T3) modq, a[Index2] = (T0 - T2) × ω2 / 2 modq, a[Index3] = (T1 - T3) × ω3 / 2 modq;

[0046] 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m ;

[0047] 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 ;

[0048] 9) Set variable m=m-1 and repeat steps 2) to 8) until m<0;

[0049] 10) Return INTT result

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] The present invention proposes an NTT polynomial multiplier RAEPM that realizes in-situ storage, constant geometry, and no memory access conflict. The staggered storage mode of the traditional constant geometry structure type NTT is converted into an in-situ storage mode. Compared with the traditional staggered storage constant geometry structure type NTT, the in-situ storage constant geometry structure type NTT proposed by the present invention does not require a ping-pong structure memory, thereby reducing the memory capacity requirement from 2N to N (N is the polynomial length). The present invention proposes an odd-numbered Bank cache structure, which adopts an odd-numbered Bank storage structure to achieve no memory access conflict and in-situ storage. Thereby, a conflict-free storage mapping that is independent of the polynomial length N and the NTT / INTT calculation stage is realized, and a unified storage structure and data loading mode are unified. This structure provides conditions for dynamically supporting polynomial multiplications of different lengths. In addition, as the maximum polynomial length N supported by RAEPM increases, the structure of the proposed buffer does not need to be modified, and only the depth of the Bank needs to be increased. Therefore, polynomial multiplications of different times can be executed without recompiling.

[0052] Furthermore, the present invention adopts a dynamically reconfigurable PE to execute NTT, INTT and vector corresponding point modular multiplication (Element-Wise Multiplication, EWM) on a unified hardware PE, thereby improving hardware utilization.

[0053] The present invention proposes a novel in-situ storage constant geometry type NTT and INTT (NTT inverse transform, Inverse NTT) algorithm. By cascading multiple simple interconnections, the staggered storage method of the traditional constant geometry type NTT is converted into an in-situ storage method. Compared with the traditional staggered storage constant geometry type NTT, the in-situ storage constant geometry type NTT proposed by the present invention does not require a ping-pong structure memory, thereby reducing the memory capacity requirement from 2N to N (N is the polynomial length). Compared with the in-situ storage iterative NTT, the in-situ storage constant geometry type NTT proposed by the present invention has a unified scheduling mode in each calculation stage, avoiding the additional scheduling overhead caused by the sharp increase in the degree of the polynomial. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 The schematic diagram of the NTT polynomial multiplier RAEPM proposed in the embodiment of the present invention;

[0056] Figure 2 It is the PE structure in NTT polynomial multiplier RAEPM;

[0057] Figure 3 This is a polynomial cache structure without memory access conflicts in the NTT polynomial multiplier RAEPM. DETAILED DESCRIPTION

[0058] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0059] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0060] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0061] Taking the base number 4 as an example, the in-situ storage constant geometry type NTT proposed by the present invention is as follows.

[0062] The input is a polynomial on a ring of length N. The coefficient modulus q, the primitive root ψ of modulus q. The output is the NTT result A=(A0,…A N-1 ).

[0063] 1) Initialize variables m=0, k=0, j=0.

[0064] 2) Calculate the initial index value: Index0′=4 m ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4.

[0065] 3) Determine whether m is equal to 0:

[0066] If m is equal to 0, calculate the index values: Index0=Index0′, Index1=Index1′, Index2=Index2′, Index3=Index3′.

[0067] If m is not equal to 0, initialize the variable i = 0. Calculate the index value: Index0 = Index0' / 4 + (Index0'mod 4) × N / 4, Index1 = Index1' / 4 + (Index1'mod 4) × N / 4, Index2 = Index2' / 4 + (Index2'mod 4) × N / 4, Index3 = Index3' / 4 + (Index3'mod 4) × N / 4. Set the variable i = i+1 and repeat the above operation until i≥m.

[0068] 4) Calculate the rotation factor:

[0069] 5) Calculate the intermediate results T0 = (a[Index0] + a[Index2] × ω0) modq, T1 = (a[Index1] + a[Index3] × ω1) modq, T2 = (a[Index0] - a[Index2] × ω0) modq, T3 = (a[Index1] - a[Index3] × ω1) modq.

[0070] 6) Calculate the NTT output of the current stage: A[Index0] = (T0 + T1 × ω2) modq, A[Index1] = (T0 + T1 × ω2) modq, A[Index2] = (T2 + T3 × ω3) modq, A[Index3] = (T2 + T3 × ω3) modq.

[0071] 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m .

[0072] 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 .

[0073] 9) Let variable m=m+1 and repeat steps 2) to 8) until m≥log4N.

[0074] 10) Return NTT result A=(A0,…A N-1 ).

[0075] Taking the base number of 4 as an example, the in-situ storage constant geometry structure type INTT proposed by the present invention is as follows.

[0076] The input is a NTT vector A=(A0,…A N-1 ), coefficient modulus q, primitive root ψ of modulus q. The output is the INTT result of NTT vector A

[0077] 1) Initialize variables m=log4N-1, k=0, j=0.

[0078] 2) Calculate the initial index value: Index0′=4 M ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4.

[0079] 3) Determine whether m is equal to 0:

[0080] If m is equal to 0, calculate the index values: Index0=Index0′, Index1=Index1′, Index2=Index2′, Index3=Index3′.

[0081] If m is not equal to 0, initialize the variable i = 0. Calculate the index value: Index0 = Index0' / 4 + (Index0'mod 4) × N / 4, Index1 = Index1' / 4 + (Index1'mod 4) × N / 4, Index2 = Index2' / 4 + (Index2'mod 4) × N / 4, Index3 = Index3' / 4 + (Index3'mod 4) × N / 4. Set the variable i = i+1 and repeat the above operation until i≥m.

[0082] 4) Calculate the rotation factor:

[0083] 5) Calculate the intermediate results T0 = (A[Index0] + A[Index1]) / 2modq, T1 = (A[Index0] - A[Index1]) × ω0 / 2modq, T2 = (A[Index2] + A[Index3]) / 2modq, T3 = (A[Index2] - A[Index3]) × ω1 / 2modq.

[0084] 6) Calculate the INTT output of the current stage: a[Index0] = (T0 + T2) modq, a[Index1] = (T1 + T3) modq, a[Index2] = (T0 - T2) × ω2 / 2 modq, a[Index3] = (a1 - T3) × ω3 / 2 modq.

[0085] 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m .

[0086] 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 .

[0087] 9) Let variable m=m-1 and repeat steps 2) to 8) until m<0.

[0088] 10) Return INTT result

[0089] The present invention realizes an NTT polynomial multiplier with in-situ storage and constant geometric structure, comprising: a PE array, a polynomial cache module, a rotation factor cache module, an address generator and a Bank index generator;

[0090] The PE array is used to perform an NTT butterfly operation of an in-situ storage constant geometry structure type with a cardinality of t on a polynomial, and the operation results of each stage of the NTT butterfly operation are stored in a polynomial cache module in a storage structure with a bank number of t+1; wherein t is a number greater than 0 and a power of 2; the PE array includes PE units, and the number of the PE units is log2t*t / 2;

[0091] The polynomial cache module is used to store the polynomial and the calculation results of each stage of the NTT butterfly calculation;

[0092] The twiddle factor cache module is used to store the twiddle factors used by the NTT butterfly operation;

[0093] The address generator and the bank index generator are used to generate data reading and writing addresses of the polynomial cache module using a storage structure with a bank number of t+1.

[0094] The embodiment of the present invention adopts a dynamically reconfigurable PE to execute NTT, INTT and EWM on a unified hardware PE, thereby improving hardware utilization. The present invention adopts an odd number of Bank storage structure to achieve no memory access conflict and in-situ storage.

[0095] The embodiment of the present invention implements the proposed in-situ storage constant geometry type NTT and INTT algorithms in hardware and implements a flexible polynomial multiplier. The hardware architecture of the NTT polynomial multiplier RAEPM adopted in the embodiment of the present invention uses a 2×2 reconfigurable PE array to construct a radix 4 butterfly unit. Figure 1 .

[0096] The top-level architecture of the polynomial multiplier implemented in the embodiment of the present invention is as follows: Figure 1 As shown, it mainly consists of 6 parts:

[0097] 1. Reconfigurable PE array: It consists of 4 reconfigurable PE units. The PE array has three operation modes: NTT, INTT and EWM. In the NTT operation mode, the function of the PE array is to perform NTT butterfly operation with a base of 4 on the polynomial. In the INTT operation mode, the function of the PE array is to perform INTT butterfly operation with a base of 4 on the polynomial. In the EWM operation mode, the function of the PE array is to implement vector corresponding point modular multiplication operation.

[0098] The specific working process is as follows: a first NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t is performed on polynomial A, and the operation results of each stage of the first NTT butterfly operation are stored in a polynomial cache module A in a storage structure with a bank number of t+1; a second NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t is performed on polynomial B, and the operation results of each stage of the second NTT butterfly operation are stored in a polynomial cache module B in a storage structure with a bank number of t+1; an EWM operation is performed on the final operation result of the first NTT butterfly operation and the final operation result of the second NTT butterfly operation, and an INTT butterfly operation is performed on the EWM operation result to obtain the final polynomial multiplication result.

[0099] 2. Polynomial cache module A and polynomial cache module B:

[0100] The polynomial cache module A is used to store the polynomial A and the operation results of each stage of the first NTT butterfly operation;

[0101] The polynomial cache module B is used to store the polynomial B and the calculation results of each stage of the second NTT butterfly calculation.

[0102] 3. Twist factor cache module: used to store pre-calculated NTT / INTT twist factors.

[0103] 4. Address generator and bank index generator: used to generate data reading and writing addresses of polynomial cache module A and polynomial cache module B.

[0104] 5. Controller: The main functions include data path selection, task scheduling and pre-calculation of some fixed values.

[0105] 6. Configuration information register: used to store some configuration parameters and constant values.

[0106] The embodiment of the present invention implements the structure of the reconfigurable PE unit in the NTT polynomial multiplier RAEPM, such as Figure 2 .

[0107] The reconfigurable PE unit also has three operation modes: NTT, INTT and EWM. The function of the PE unit in the NTT operation mode is a basic NTT butterfly operation. The function of the PE unit in the INTT operation mode is a basic INTT butterfly operation. The function of the PE unit in the EWM operation mode is modular multiplication. The reconfigurable PE unit is mainly composed of a multiplexer and three operation units: Barrett modular multiplier (BMMB) based on Booth coding, modular adder (MA), modular subtractor (MS) and modular division 2 unit.

[0108] The present invention implements an odd-numbered bank storage structure with no memory access conflict and in-situ storage, such as Figure 3 .

[0109] Since traditional constant geometry NTTs are all stored in staggered locations, polynomial data caches always use a ping-pong structure to avoid access conflicts. The improved constant geometry NTT proposed in the present invention is stored in-situ and the NTT cardinality is preferably 4. Although it avoids the problem of doubling the memory overhead caused by the ping-pong structure, it will produce significant memory access conflicts, so specific memory mapping is required to avoid conflicts.

[0110] In order to achieve memory mapping without memory access conflicts that is independent of the polynomial length N and the NTT / INTT stage, and to unify the data storage structure, data loading mode and data access mode under different N and stages, the present invention proposes a polynomial cache structure with an odd number of banks. The PE array of the embodiment of the present invention requires four input coefficient data each time, and theoretically only four banks are needed. However, it is difficult to achieve memory mapping without memory access conflicts in the case of four banks, and the traditional method requires more banks to achieve memory access conflicts. In order to ensure that the number of banks is minimized under the premise of achieving memory mapping without memory access conflicts, the present invention proposes a polynomial cache structure with an odd number of banks, such as Figure 3As shown. The polynomial cache structure of odd-numbered banks in the embodiment of the present invention only needs 5 banks. The horizontal and vertical step sizes of the base-4 in-situ storage constant geometry structure type NTT read-write index in the embodiment of the present invention are both powers of 4, and the horizontal and vertical step sizes of the polynomial cache structure of odd-numbered banks adopted in the embodiment of the present invention are 1 and 5 respectively, which can effectively avoid memory access conflicts.

[0111] The present invention is implemented on Xilinx Virtex-7 VC709 FPGA, the upper limit of the supported polynomial length is 16384, the coefficient modulus is set to 32 bits, and the operating frequency of the present invention is 294MHz. The total number of resources and the number of resources of each module of the present invention are shown in Table 1. The operating performance is shown in Table 2.

[0112] Table 1 Implementation results of the present invention on VC709 FPGA

[0113] project Lookup Table trigger Block RAM quantity DSP Total number of FPGA available resources 433200 866400 1470 3600 Total number of uses of the present invention 14211 14540 65 0 Percentage of use 3.28％ 1.68％ 4.42％ 0％

[0114] Table 2 Performance of the present invention running at 294 MHz

[0115] Test items Number of cycles Total time consumed (μs) 1024 points NTT 1331 4.53 4096 NTT points 6195 21.06 16384 NTT points 28723 97.64 Polynomial multiplication on a 1024-point ring 4273 14.53 Polynomial multiplication on a 4096-point ring 19633 66.75 16384-point polynomial multiplication 90289 306.98

[0116] It can be seen from Table 1 that, thanks to the reconfigurable design and algorithm optimization, the present invention consumes very small logic resources and RAM, and does not consume any DSP.

[0117] As can be seen from Table 2, the present invention has excellent performance in calculating the multiplication of polynomials on the ring. A 16384-point polynomial multiplication on the ring can be completed every 306.98 μs. This has a great performance improvement for lattice cryptography whose performance bottleneck is the multiplication of polynomials on the ring. In addition, the performance of the present invention is linearly related to the length (number of points) of the polynomial.

Claims

1. An NTT polynomial multiplier that realizes in-situ storage, constant geometry, and no memory access conflict, characterized in that: include: PE array, polynomial cache module, rotation factor cache module, address generator and bank index generator; The PE array is used to perform an NTT butterfly operation of an in-situ storage constant geometry structure type with a cardinality of t on the polynomial, and the operation results of each stage of the NTT butterfly operation are stored in a polynomial cache module in a storage structure with a bank number of t+1; wherein t is a number greater than 0 and a power of 2; The polynomial cache module is used to store the polynomial and the calculation results of each stage of the NTT butterfly calculation; The twiddle factor cache module is used to store the twiddle factors used by the NTT butterfly operation; The address generator and the bank index generator are used to generate data reading and writing addresses of the polynomial cache module using a storage structure with a bank number of t+1.

2. The NTT polynomial multiplier with in-situ storage, constant geometry and no memory access conflict according to claim 1, characterized in that: The PE array includes PE units, and the number of the PE units is log2t*t / 2.

3. The NTT polynomial multiplier realizing in-situ storage, constant geometry and no memory access conflict according to claim 2, characterized in that: The PE array is a reconfigurable PE array, including two operation modes, NTT and INTT; in the NTT operation mode, the PE array is used to perform an NTT butterfly operation with a cardinality of t on the polynomial, which is an in-situ storage constant geometric structure; in the INTT operation mode, the PE array is used to perform an INTT butterfly operation with a cardinality of t on the polynomial, which is an in-situ storage constant geometric structure, and the operation results of each stage of the INTT butterfly operation are stored in a polynomial cache module in a storage structure with a bank number of t+1; the rotation factor cache module is also used to store the rotation factors used by the INTT butterfly operation.

4. The NTT polynomial multiplier realizing in-situ storage, constant geometry and no memory access conflict according to claim 3, characterized in that: The PE unit is a reconfigurable PE unit, including two operation modes, NTT and INTT; in the NTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type NTT butterfly operation; in the INTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type INTT butterfly operation.

5. The NTT polynomial multiplier realizing in-situ storage, constant geometry and no memory access conflict according to claim 3, characterized in that: The PE array also includes an EWM operation mode; in the EWM operation mode, the PE array is used to perform vector corresponding point modular multiplication operations.

6. The NTT polynomial multiplier realizing in-situ storage, constant geometry, and no memory access conflict according to claim 5, characterized in that: The PE unit is a reconfigurable PE unit, including NTT, INTT and EWM operation modes; in the NTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type NTT butterfly operation; in the INTT operation mode, the PE unit is used to perform a basic in-situ storage constant geometry type INTT butterfly operation; in the EWM operation mode, the PE unit is used to perform vector corresponding point modular multiplication operation.

7. The NTT polynomial multiplier with in-situ storage, constant geometry and no memory access conflict according to claim 1, characterized in that: t is 4.

8. The NTT polynomial multiplier with in-situ storage, constant geometry and no memory access conflict according to claim 1, characterized in that: The polynomial cache module includes a polynomial cache module A and a polynomial cache module B; The PE array is used to perform a first NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t on polynomial A, and the operation results of each stage of the first NTT butterfly operation are stored in a polynomial cache module A in a storage structure with a bank number of t+1; perform a second NTT butterfly operation of an in-situ storage constant geometric structure type with a cardinality of t on polynomial B, and the operation results of each stage of the second NTT butterfly operation are stored in a polynomial cache module B in a storage structure with a bank number of t+1; The polynomial cache module A is used to store the polynomial A and the operation results of each stage of the first NTT butterfly operation; The polynomial cache module B is used to store the polynomial B and the calculation results of each stage of the second NTT butterfly calculation.

9. An NTT butterfly operation method with in-situ storage, constant geometry, and no memory access conflict, characterized in that: The base of the NTT butterfly operation is 4, and the input is a polynomial on a ring of length N. The coefficient modulus q, the primitive root ψ of the modulus q; the output is the NTT vector A=(A0,…A N-1 ); 1) Initialize variables m=0, k=0, j=0; 2) Calculate the initial index value: Index0′=4 m ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4; 3) Determine whether m is equal to 0: If m is equal to 0, calculate the index value: Index0 = Index0′, Index1 = Index1′, Index2 = Index2′, Index3 = Index3′; If m is not equal to 0, initialize the variable i = 0; Calculate the index value: Index0=Index′0 / 4+(Index′0mod 4)×N / 4, Index1=Index′1 / 4+(Index′1mod 4)×N / 4, Index2=Index′2 / 4+(Index′2mod 4)×N / 4, Index3=Index′3 / 4+(Index′3mod 4)×N / 4; Let variable i=i+1 and repeat the above operation until i≥m; 4) Calculate the rotation factor: 5) Calculate the intermediate results T0 = (a[Inidex0] + a[Inidex2] × ω0) mod q, T1 = (a[Index1] + a[Index3] × ω1) mod q, T2 = (a[Index0] - a[Index2] × ω0) mod q, T3 = (a[Index1] - a[Index3] × ω1) mod q; 6) Calculate the NTT output of the current stage: A[Index0] = (T0 + T1 × ω2) mod q, A[Index1] = (T0 + T1 × ω2) mod q, A[Index2] = (T2 + T3 × ω3) mod q, A[Index3] = (T2 + T3 × ω3) mod q; 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m ; 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 ; 9) Set variable m=m+1 and repeat steps 2) to 8) until m≥log4N; 10) Return the NTT vector A = (A0,…A N-1 ).

10. An INTT butterfly operation method with in-situ storage, constant geometry, and no memory access conflict, characterized in that: The cardinality of the INTT butterfly operation is 4, and the input is an NTT vector A=(A0,…A N-1 ), coefficient modulus q, primitive root ψ of modulus q; The output is the INTT result of the NTT vector A. 1) Initialize variables m=log4N-1, k=0, j=0; 2) Calculate the initial index value: Index0′=4 m ×k+j+0×N / 4, Index1′=4 m ×k+j+1×N / 4, Index2′=4 m ×k+j+2×N / 4, Index3′=4 m ×k+j+3×N / 4; 3) Determine whether m is equal to 0: If m is equal to 0, calculate the index value: Index0 = Index0′, Index1 = Index1′, Index2 = Index2′, Index3 = Index3′; If m is not equal to 0, initialize the variable i = 0; Calculate the index value: Index0=Index′0 / 4+(Index′0mod 4)×N / 4, Index1=Index′1 / 4+(Indexv1mod 4)×N / 4, Index2=Index′2 / 4+(Index′2mod 4)×N / 4, Index3=Index′3 / 4+(Index′3mod 4)×N / 4; Let variable i=i+1 and repeat the above operation until i≥m; 4) Calculate the rotation factor: 5) Calculate the intermediate results T0 = (A[Index0] + A[Index1]) / 2 mod q, T1 = (A[Index0] - A[Index1]) × ω0 / 2 mod q, T2 = (A[Index2] + A[Index3]) / 2 mod q, T3 = (A[Index2] - A[Index3]) × ω1 / 2 mod q; 6) Calculate the INTT output of the current stage: a[Index0] = (T0 + T2) mod q, q[Index1] = (T1 + T3) mod q, a[Index2] = (T0 - T2) × ω2 / 2 mod q, a[Index3] = (T1 - T3) × ω3 / 2 mod q; 7) Set variable j = j + 1 and repeat steps 2) to 6) until j ≥ 4 m ; 8) Let variable k = k + 1 and repeat steps 2) to 7) until k ≥ N / 4 m+1 ; 9) Set variable m=m-1 and repeat steps 2) to 8) until m<0; 10) Return INTT result

Images