RISC-V architecture post-quantum encryption vector processor

Abstract

The invention provides an RISC-V framework post-quantum encryption vector processor, and relates to the technical field of information security, the vector processor is divided into three stages of flow, the first stage of flow comprises a decoding module, the second stage of flow comprises a CSR register module, a Vector-register module and an execution module, and the third stage of flow comprises a load / store module. The decoding module receives the self-defined vector instruction distributed by the main processor, decodes the self-defined vector instruction and outputs a decoding result to the CSR register module and the execution module; the CSR register module configures parameters of the execution module according to the decoding result; the Vector-registers module is used for registering vector data; the execution module realizes different functions according to the decoding result; and the load / store module realizes data exchange between the processor and the first-level Cache and completes loading and storage operations of the data. By adopting the scheme, a vectorized and high-speed post-quantum encryption algorithm with software and hardware collaboration can be realized.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a RISC-V architecture post-quantum encryption vector processor. Background Art

[0002] In the 5G era, massive devices need to be securely connected to the edge of the communication network, and emerging quantum computers can easily crack traditional public key cryptography (RSA, ECC, etc.). The threat of quantum computers lies in their ability to use quantum parallelism and quantum entanglement to solve certain problems that are difficult to handle on traditional computers, one of which is to factorize the prime factors of large integers. Therefore, traditional encryption algorithms based on integer factorization problems may fail under the attack of quantum computers. In order to cope with the threat of quantum computing technology, Post-Quantum Cryptography (PQC) came into being.

[0003] Post-quantum cryptographic algorithms are also secure on classical computers. These algorithms are mainly based on other mathematical problems, such as lattice problems. Post-quantum cryptographic algorithms do not use any quantum properties. All post-quantum cryptographic algorithms can use traditional computing platforms based on standard semiconductor technology and do not require specialized quantum hardware to encrypt data.

[0004] RISC-V is a new, simple and open source reduced instruction set architecture. It does not have the historical burden of backward compatibility of instruction set architectures such as x86 and ARM. It also has the advantages of concise and regular instruction encoding and strong scalability. It also has a complete open source software tool chain support. Since its launch, it has received close attention from academia and industry. At present, due to the development of the situation, the localization of processors has become an increasingly important topic. The RISC-V instruction set architecture designs independent, secure and controllable domestic processors, which is conducive to strengthening the information security of processors.

[0005] Compared with traditional encryption algorithms, lattice-based cryptography usually involves polynomial rings and polynomial equations. The complexity of polynomial fields makes lattice-based cryptography highly secure under attacks from traditional computers and potential quantum computers, but at the same time, it is more computationally complex and consumes more resources than traditional encryption algorithms. Traditional scalar processors mainly operate with scalars (single data elements) as basic units. This means that for parallel computing algorithms, each computing step can only process one data element and cannot process multiple data elements at the same time. For general-purpose vector processors, they are usually designed to flexibly adapt to various computing tasks, which may make it impossible to highly optimize a specific single post-quantum algorithm. When designing a private encoding and decoding scheme, the implementation of the post-quantum encryption algorithm should be able to flexibly adapt to different application scenarios and security requirements, and have a certain degree of customizability, so that the system configuration and algorithm can be adjusted according to actual needs.

[0006] In short, modern post-quantum cryptography is a supercomputing problem that combines complex computational problems in polynomial domains, nonlinear decoding problems of fault-tolerant learning, and privatized encoding and decoding customization problems. Therefore, its encryption and decryption cannot be achieved through a deterministic platform. This processor realizes software-based post-quantum encryption and decryption problems based on the coupling of RISC-V and core computing. Summary of the invention

[0007] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0008] To this end, the purpose of this application is to propose a RISC-V architecture post-quantum encryption vector processor, which solves the problems of insufficient throughput, insufficient parallelism, and low configurability in the implementation of post-quantum encryption algorithms, and can realize software-hardware collaborative, vectorized, and high-speed post-quantum encryption algorithms, solving the complex calculation problems in the polynomial domain of post-quantum encryption, the nonlinear decoding problems of post-quantum encryption, and the mode customization problems of cryptographic systems.

[0009] To achieve the above purpose, the embodiment of the present application proposes a RISC-V architecture post-quantum encryption vector processor, which is divided into three levels of pipelines. The first level pipeline includes a decoding module, the second level pipeline includes a CSR register module, a Vector-registers module, and an execution module, and the third level pipeline includes a load / store module, wherein:

[0010] A decoding module, used for receiving the custom vector instruction distributed by the main processor, decoding it, and outputting the decoding result to the CSR register module and the execution module;

[0011] CSR register module, used to configure the parameters of the execution module according to the decoding results;

[0012] Vector-registers module, used to store vector data;

[0013] An execution module, used to implement different functions according to the decoding results;

[0014] The load / store module is used to implement data exchange between the processor and the first-level cache, and complete data loading and storage operations.

[0015] Optionally, in one embodiment of the present application, the parameters of the execution module include: the modulus q in the finite field, the pre-calculated value μ in the Barrett reduction, the bit width of the modulus q, the boundary value in the rejection sampling and the parameter k in the binomial sampling.

[0016] Optionally, in one embodiment of the present application, the execution module includes a SHA-3 module, a Sample module, and an NTT module.

[0017] Optionally, in one embodiment of the present application, the SHA-3 module includes a padding module, an iterative operation module, a control module and an interception module.

[0018] Optionally, in one embodiment of the present application, the Sample module includes a rejection sampler and a binomial sampler, wherein:

[0019] Rejection sampler, used to achieve uniform sampling;

[0020] Binomial sampler for error distribution sampling.

[0021] Optionally, in one embodiment of the present application, the rejection sampler includes a comparator and a Barrett modular reduction module, and the rejection sampler is specifically used to: discard the sampling data that exceeds the limit, and when the boundary is the modulus q, discard the sampling data that is not evenly distributed on Rq, set the boundary to a multiple of the modulus q, and perform Barrett reduction again.

[0022] Optionally, in one embodiment of the present application, the binomial sampler includes a Hamming weight calculation module and a modular reduction module, and the Hamming weight calculation module is used to calculate the Hamming weights of two input data through a configurable addition tree.

[0023] Optionally, in one embodiment of the present application, an NTT module is used to accelerate polynomial multiplication, and the NTT module includes 32 parallel butterfly operation units, an input permutation network, and an output permutation network. The NTT module processes 64 16-bit data per clock cycle.

[0024] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0026] Figure 1 A schematic diagram of the structure of a RISC-V architecture post-quantum encryption vector processor provided in Example 1 of the present application;

[0027] Figure 2 This is a schematic diagram of the structure of the SHA-3 module of an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the structure of a vector SAMPLE module according to an embodiment of the present application;

[0029] Figure 4 This is a schematic diagram of the structure of the vector NTT module of an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of the NTT arrangement network of an embodiment of the present application;

[0031] Figure 6 A schematic diagram of the structure of a butterfly operation module according to an embodiment of the present application;

[0032] Figure 7 A schematic diagram of the structure of a Barrett modular multiplier according to an embodiment of the present application; DETAILED DESCRIPTION

[0033] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0034] The following describes a RISC-V architecture post-quantum encryption vector processor according to an embodiment of the present application with reference to the accompanying drawings.

[0035] Figure 1 A schematic diagram of the structure of a RISC-V architecture post-quantum encryption vector processor provided in Example 1 of the present application.

[0036] like Figure 1As shown, the RISC-V architecture post-quantum encryption vector processor is divided into three levels of pipelines. The first level pipeline includes a decoding module, the second level pipeline includes a CSR register module, a Vector-registers module, and an execution module, and the third level pipeline includes a load / store module, where:

[0037] A decoding module, used for receiving the custom vector instruction distributed by the main processor, decoding it, and outputting the decoding result to the CSR register module and the execution module;

[0038] CSR register module, used to configure the parameters of the execution module according to the decoding results;

[0039] Vector-registers module, used to store vector data (polynomial coefficients and temporary calculation results);

[0040] An execution module, used to implement different functions according to the decoding results;

[0041] The load / store module is used to implement data exchange between the processor and the first-level cache and complete data loading and storage operations.

[0042] The RISC-V architecture post-quantum encryption vector processor of the embodiment of the present application solves the problems of insufficient throughput, insufficient parallelization, and low configurability in the implementation of post-quantum encryption algorithms, and can implement a software-hardware collaborative, vectorized, high-speed post-quantum encryption algorithm, solving the complex calculation problems in the polynomial domain of post-quantum encryption, the nonlinear decoding problems of post-quantum encryption, and the mode customization problems of the cryptographic system.

[0043] Optionally, in one embodiment of the present application, the parameters of the execution module include:

[0044] csrModulusq: modulus q in a finite field;

[0045] csrBarrettu: precomputed value μ in Barrett reduction;

[0046] csrModulusLen: bit width of modulus q;

[0047] csrBound: Boundary value in rejection sampling;

[0048] csrBinomialk: Parameter k in binomial sampling.

[0049] Optionally, in one embodiment of the present application, the execution module includes a SHA-3 module, a Sample module, and an NTT module.

[0050] Optionally, in one embodiment of the present application, a hash function is also called a hash function, which can convert a message input of any length into a fixed-length summary output and is an irreversible one-way cryptographic system. SHA-3 is the latest generation of hash functions, which can construct hash functions and generate random number bit streams. The configurable SHA-3 modules include a padding module (Padding), an iterative operation module (Transformation Round), a control module (control) and (Truncating).

[0051] Specifically, Figure 2 As shown in the figure, after SHA-3 is started, the random number seed first enters the padding module through the register. The padding module fills the random number seed. The padding rule is "pad10*1". After the padding is completed, 0 will be added to the end of the data to make the data length 1600 bits. Next, the data enters the iterative operation module through the multiplexer (mux). The iterative operation module performs iterative operations on the data. The iterative operation includes five steps: θ, ρ, π, χ, and τ. After the five steps are completed, the data enters the dmux through the register. The data output from the dmux will enter the iterative operation module through the mux for iterative operation. This process needs to be repeated 24 rounds. After 24 rounds of iterative operations are completed, the data enters the interception module through the mux. The interception module intercepts the output of a specific length and outputs it.

[0052] Optionally, in one embodiment of the present application, the vector Sample module includes a vector rejection sampler and a vector binomial sampler, wherein:

[0053] Rejection sampler, used to achieve uniform sampling;

[0054] Binomial sampler for error distribution sampling.

[0055] Optionally, in one embodiment of the present application, the rejection sampler includes a comparator and a Barrett module reduction module, and uniform sampling can be achieved by the rejection sampler. When the sampled data exceeds the limit, it must be discarded. When the boundary is the module q, the sampled data is either evenly distributed on Rq or discarded. In order to reduce the rejection rate to an acceptable level, the boundary is set to a multiple of the module q, and then Barrett reduction is performed again.

[0056] Optionally, in one embodiment of the present application, in addition to rejection sampling, another sampling process in the lattice cipher is error distribution sampling, which can be implemented by a discrete Gaussian sampler. The binomial sampler includes a Hamming weight calculation module and a modular reduction module. The Hamming weight calculation module calculates the Hamming weights of two input data through a configurable addition tree. The parameter k can be configured to 1, 2, 4, 8 and 16 to meet different application requirements.

[0057] Specifically, after the random number is generated by the SHA-3 module, it enters the vector sample module for sampling operation. Figure 3 As shown in the figure, the rejection sampling process is as follows: (1) 32 groups of 32-bit random data enter the vector rejection sampling module; (2) The input data enters the comparator, which compares the input data with the preset boundary value to determine whether the data is valid; (3) The data enters the barrett reduction module to reduce the computational complexity of the data modulus operation and output a 16-bit processing result; (4) The valid data is marked as valid through the mux output;

[0058] The process of binomial sampling is as follows: (1) Input 32 groups of 16-bit random data vectors Data a and Data b; (2) Data a and Data b pass through the Hamming weight calculation module to calculate the Hamming weights of vectors a and b; (3) Perform a modulo operation on the Hamming weight difference to obtain the sampling data; (4) Output 32 groups of 16-bit sampling data.

[0059] Optionally, in one embodiment of the present application, a vector NTT module is used to accelerate polynomial multiplication, including 32 parallel butterfly operation units (modular multiplication, modular subtraction, modular addition), an input permutation network, and an output permutation network, processing 64 16-bit data per clock cycle.

[0060] Specifically, the vector NTT module is as follows Figure 4 As shown, it includes a permutation network and 32 parallel butterfly units. The permutation network is used to sort the input and output of the butterfly unit, and the 32 parallel butterfly units perform NTT operations, so that two 512-bit vectors can be processed in parallel.

[0061] (1) Permutation network: The permutation problem can be solved by software implementation of position permutation, but each permutation requires hundreds of cycles, so a parallel hardware implementation of the permutation network is adopted. Figure 5 As shown, in order to achieve 100% hardware resource utilization, a configurable permutation network is designed inside the NTT core. The permutation network proposed in this embodiment is mainly composed of 5 independent permutation networks, and the PermConfig signal is used to select a certain output and initial input of these 5 networks. The above-mentioned permutation network is placed in front of the butterfly unit, and an inverse structure permutation network is also required behind the butterfly unit to restore the natural order of the data.

[0062] (2) Butterfly unit, such as Figure 7 As shown in the figure, the Barrett method is implemented, which supports the configurability of the modulus q. The bit width of the pre-calculated values ​​μ and q required by the Barrett algorithm can be set. Figure 6In the figure, they are represented as csrBarrettU and csrModulusLen respectively. Since the general Barrett method is used, any modulus within 16 bits is fully supported. The butterfly unit workflow is as follows:

[0063] Bit reversal is too resource-intensive for hardware implementation, especially when the dimension n is large. The design is a DIT / DIF hybrid butterfly structure. Since INTT calculation is always performed after NTT calculation in polynomial multiplication, bit reversal can be avoided by applying the following process.

[0064] (a) Set ctrl=1, the butterfly unit is in DIF mode.

[0065] (b) Perform NTT calculation and output data in reverse bit order.

[0066] (c) Perform vector arithmetic calculations.

[0067] (d) Set ctrl=0, then the butterfly unit is in DIT mode.

[0068] (e) Perform INTT calculation directly, because after NTT calculation, the input data is already in reverse order and the output data is in natural order.

[0069] For NTT calculation, 64 16-bit data are processed per clock cycle.

[0070] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0071] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0072] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0073] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0074] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0075] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0076] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0077] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A RISC-V architecture post-quantum encryption vector processor, characterized in that: The vector processor is divided into three stages of pipelines, the first stage pipeline includes a decoding module, the second stage pipeline includes a CSR register module, a Vector-registers module, and an execution module, and the third stage pipeline includes a load / store module, wherein: The decoding module is used to receive the custom vector instruction distributed by the main processor, decode it, and output the decoding result to the CSR register module and the execution module; The CSR register module is used to configure the parameters of the execution module according to the decoding result; The Vector-registers module is used to store vector data; The execution module is used to implement different functions according to the decoding result; The load / store module is used to implement data exchange between the processor and the first-level cache, and complete data loading and storage operations.

2. The post-quantum encryption vector processor according to claim 1, wherein: The parameters of the execution module include: a modulus q in a finite field, a pre-calculated value μ in Barrett reduction, a bit width of the modulus q, a boundary value in rejection sampling, and a parameter k in binomial sampling.

3. The post-quantum encryption vector processor of claim 1, wherein: The execution module includes a SHA-3 module, a Sample module, and an NTT module.

4. The post-quantum encryption vector processor of claim 3, wherein: The SHA-3 module includes a filling module, an iterative operation module, a control module and an interception module.

5. The post-quantum encryption vector processor of claim 3, wherein: The Sample module includes a rejection sampler and a binomial sampler, wherein: The rejection sampler is used to achieve uniform sampling; The binomial sampler is used to implement error distribution sampling.

6. The post-quantum encryption vector processor of claim 5, wherein: The rejection sampler includes a comparator and a Barrett modular reduction module. The rejection sampler is specifically used to discard sampling data that exceeds the limit, and when the boundary is the modulus q, discard sampling data that is not uniformly distributed on Rq, set the boundary to a multiple of the modulus q, and perform Barrett reduction again.

7. The post-quantum encryption vector processor of claim 5, wherein: The binomial sampler comprises a Hamming weight calculation module and a modular reduction module, wherein the Hamming weight calculation module is used to calculate the Hamming weights of two input data through a configurable addition tree.

8. The post-quantum encryption vector processor of claim 3, wherein: The NTT module is used to accelerate polynomial multiplication. The NTT module includes 32 parallel butterfly operation units, an input permutation network and an output permutation network. The NTT module processes 64 16-bit data per clock cycle.

Images