Arithmetic device for performing conversion operation

Abstract

An arithmetic device is used for executing a transformation operation, and the transformation operation comprises a plurality of stage operations which comprise a plurality of odd-numbered stage operations and a plurality of even-numbered stage operations. The arithmetic device comprises a stage arithmetic circuit, a sequencing circuit, a first memory and a second memory. The stage operation circuit is reused to perform a plurality of butterfly operations of each stage operation. The stage operation circuit includes a plurality of butterfly operation circuits to perform a butterfly operation according to a plurality of weight coefficients and input data to generate a stage operation result. The sorting circuit is reused to sort the input data of each level operation or the level operation result to generate a sorting result. The first memory is used for storing input data of a first-level operation and a level operation result of each even-level operation or a sorting result of each even-level operation. The second memory is used for storing a level operation result of each odd level operation or a sorting result of each odd level operation.

Description

Technical Field

[0001] The present invention relates to a computing device, and more particularly to a computing device for performing transformation operations. The computing device sorts the level operation results of the transformation operations, and stores the level operation results and the sorting results in an alternating manner using a ping-pong memory mechanism. Background Art

[0002] With the development of big data analysis technology and artificial intelligence technology, various forms of information are widely exchanged around the world and at all levels of society, which has caused concerns about information leakage; in order to meet the needs of information security, information encryption mechanism is a necessary means. However, the encryption of information may be cracked by malicious third parties through quantum technology (called "quantum decryption"); in order to resist quantum decryption, research units have developed post-quantum cryptography systems based on "post-quantum cryptography (PQC)". Among the many implementation methods of post-quantum cryptography systems, lattice cryptography systems have better overall performance evaluations and are therefore widely used. Lattice cryptography systems include, for example, the "CRYSTALS-Kyber" system and the "Dilithium" system, etc.

[0003] The operation mechanism of the lattice cryptographic system uses a large number of polynomial multiplication operations; and polynomial multiplication operations are usually implemented by number theoretic transform operations (NTT, number theoretic transform) and inverse number theoretic transform operations (INTT, inverse number theoretic transform). However, number theoretic transform operations and inverse number theoretic transform operations have high complexity and consume a lot of computing time, which greatly reduces the overall computing efficiency of the lattice cryptographic system of post-quantum cryptography. For example, number theoretic transform operations and inverse number theoretic transform operations must have complex control logic to control multiple loop nesting operations in order to implement polynomial multiplication operations. The access and scheduling of polynomial coefficients in polynomial multiplication operations are more complicated, which leads to a larger amount of transmitted data and thus consumes more communication bandwidth.

[0004] Moreover, in the prior art, the basic operation architecture of the polynomial multiplication operation of the number theory transformation operation and the inverse number theory transformation operation is the "butterfly operation". However, the existing butterfly operation architecture includes butterfly operations of different cross-types, so a plurality of different butterfly operation circuits must be provided to implement the entire butterfly operation architecture. In other words, in the prior art, it is impossible to implement the entire butterfly operation architecture based on the same butterfly operation circuit of a single cross-type, and a large number of different butterfly operation circuits must be provided. Therefore, the hardware cost of the lattice cryptographic system is greatly increased.

[0005] In view of the above issues, there is a need for an improved lattice cryptographic computing device that can implement number theoretic transformation operations and inverse number theoretic transformation operations based on a simplified butterfly computing architecture to reduce the number of butterfly computing circuits. Furthermore, the computing results of the butterfly computing can be accessed based on an improved memory access mechanism to achieve higher access efficiency and data accuracy. Summary of the invention

[0006] According to one embodiment of the present disclosure, a computing device is provided for performing a transformation operation, wherein the transformation operation includes a first number of level operations, wherein the level operations include a plurality of odd-numbered level operations and a plurality of even-numbered level operations, wherein the odd-numbered level operations include a first level operation. The computing device includes a level operation circuit, a sorting circuit, a first memory, and a second memory. The level operation circuit is reused to perform each level of operation, wherein each level of operation includes a second number of butterfly operations, and each level of operation has a third number of input data. The level operation circuit includes a second number of butterfly operation circuits, which are used to perform butterfly operations according to a plurality of weight coefficients and input data of each level of operation to generate level operation results of each level of operation. The sorting circuit is reused to sort the input data or level operation results of each level of operation to generate sorting results. The first memory is used to store the input data of the first level operation and the level operation results of each even-numbered level operation or the sorting results of each even-numbered level operation. The second memory is used to store the level operation results of each odd-numbered level operation or the sorting results of each odd-numbered level operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 FIG. 1 is a block diagram of a computing device 1000 according to an embodiment of the present disclosure.

[0008] Figure 2 FIG. 4 is a schematic diagram of a butterfly operation architecture for number-theoretic transformation operations according to an embodiment of the present disclosure.

[0009] Figure 3 FIG. 4 is a schematic diagram of a butterfly operation architecture for an inverse number theoretic transform operation according to an embodiment of the present disclosure.

[0010] Figure 4A FIG. 4 is a schematic diagram of a ping-pong memory mechanism for number theoretic transformation operations according to an embodiment of the present disclosure.

[0011] Figure 4B Department Figure 4A Detailed diagram of the ping-pong memory mechanism for number-theoretic transform operations.

[0012] Figure 5A FIG. 4 is a schematic diagram of a ping-pong memory mechanism for an inverse number theoretic transform operation according to an embodiment of the present disclosure.

[0013] Figure 5B Department Figure 5ADetailed diagram of the ping-pong memory mechanism for the inverse number theoretic transform operation.

[0014] Figure 6 The present invention is a method flow chart of a ping-pong memory mechanism for number theoretic transformation operations and inverse number theoretic transformation operations.

[0015] Fig. 7A FIG. 1 is a block diagram of a computing device 1001 according to another embodiment of the present disclosure.

[0016] Figure 7B Department Fig. 7A A block diagram of another example of a computing device 1001.

[0017] Fig. 8A FIG. 1 is a block diagram of a computing device 1002 according to another embodiment of the present disclosure.

[0018] Figure 8B Department Fig. 8A A block diagram of another example of a computing device 1002.

[0019] Fig.9A It is a schematic diagram of the "CPAPK.KeyGen" module of the computing device 1000 applied to the lattice cryptographic system 2000.

[0020] Fig. 9B It is a schematic diagram of the "CPAPK.Enc" module of the computing device 1000 applied to the lattice cryptographic system 2000.

[0021] Fig. 9C It is a schematic diagram of the "CPAPK.Dec" module of the computing device 1000 applied to the lattice cryptographic system 2000. DETAILED DESCRIPTION

[0022] The computing device 1000 disclosed herein is used to perform a transformation operation. The transformation operation is, for example, a number theoretic transform (NTT) operation or an inverse number theoretic transform (INTT) operation. Figure 1 , which is a block diagram of a computing device 1000 according to an embodiment of the present disclosure. The computing device 1000 includes a stage computing circuit 100, a sorting circuit 200, an internal memory 300, a first memory 400, a second memory 500, and a control circuit 600. In this embodiment, the internal memory 300 may be disposed in the stage computing circuit 100.

[0023] The following is an example of a number-theoretic transformation operation. The number-theoretic transformation operation includes M-level operations to process N-point input data a[0] to a[N-1], which is an N-point and M-level number-theoretic transformation operation. N and M are both positive integers, and the relationship between N and M is shown in formula (1):

[0024] M=log2(N) (1)

[0025] The stage operation circuit 100 and the sorting circuit 200 can be used repeatedly to perform the stage operations of all M stages. For example, the stage operation circuit 100 performs the stage operation of the first stage to generate the stage operation result SR(1) of the first stage. Then, the sorting circuit 200 sorts the stage operation result SR(1) to generate the sorting result PSR(1). Next, the stage operation circuit 100 performs the stage operation of the second stage according to the sorting result PSR(1) to generate the stage operation result SR(2) of the second stage. Then, the sorting circuit 200 sorts the stage operation result SR(2) to generate the sorting result PSR(2). In this way, the stage operation circuit 100 and the sorting circuit 200 are used repeatedly to perform the stage operation and sorting of each stage until the stage operation result SR(M) and the sorting result PSR(M) of the Mth stage (the last stage) are generated. The sorting result PSR(M) of the Mth stage is used as the final result of the number theory transformation operation.

[0026] Each level of the level operation includes a plurality of butterfly operations, each butterfly operation includes at least one multiplication operation, one addition operation and one subtraction operation. The internal memory 300 is used to perform in-memory computing (IMC) to perform the multiplication operation of each level of the level operation. For example, the internal memory 300 can pre-store N / 2 weight coefficients. These weight coefficients It is called the "Omega coefficient". The input data of N points a[0]~a[N-1] is calculated according to the weight coefficient The multiplication operation is performed iteratively. In addition, the input data of each stage operation and the corresponding sorting result are interleaved and stored in the first memory 400 and the second memory 500 in a ping-pong memory mechanism.

[0027] On the other hand, when the computing device 1000 performs the inverse number theoretic transformation operation, the sorting is first performed by the sorting circuit 200, and then the level operation circuit 100 performs the level operation. For example, the sorting circuit 200 sorts the input data a[0] to a[N-1] to generate a sorting result PISR(1), and then the level operation circuit 100 performs the level operation of the first level according to the sorting result PISR(1) to generate the level operation result ISR(1). Then, the level operation result ISR(1) is provided to the sorting circuit 200 for sorting to generate a sorting result PISR(2), and then the level operation circuit 100 performs the level operation of the second level according to the sorting result PISR(2) to generate the level operation result ISR(2). In this way, the sorting circuit 200 and the level operation circuit 100 are repeatedly used to perform sorting and level operation of each level until the level operation result ISR(M) of the Mth level (the last level) is generated as the final result of the number theoretic transformation operation.

[0028] The input data of the stage operation of the stage operation circuit 100 and the sorting results PSR(1)-PSR(M) generated by the sorting circuit 200 are interleaved and stored in the first memory 400 and the second memory 500 according to the mechanism of the ping-pong memory. The control circuit 600 can generate a clock signal or execute a state machine to control the timing operation of the stage operation circuit 100, the sorting circuit 200, the first memory 400 and the second memory 500. The following will further explain that the stage operation circuit 100 and the sorting circuit 200 are reused to perform the number theoretic transformation operation or the inverse number theoretic transformation operation, and further explain that the input data of the stage operation of each stage and the sorting results are interleaved and stored in the first memory 400 and the second memory 500 according to the mechanism of the ping-pong memory.

[0029] See also Figure 2 , which is a schematic diagram of a butterfly operation architecture for number theory transformation operations according to an embodiment of the present disclosure. Figure 2 In the embodiment of , N=8 and M=3, there are 3-stage stage operations to process 8-point input data a[0]~a[7]. The stage operation circuit 100 includes 4 butterfly operation circuits 11, 12, 13 and 14. Each of the butterfly operation circuits 11~14 performs a butterfly operation, and each butterfly operation includes a multiplication operation, an addition operation and a subtraction operation. The above multiplication, addition and subtraction operations are all modular operations. For example, the butterfly operation circuit 11 is used to process the input data a[0] and the input data a[4]. The butterfly operation circuit 11 first performs the input data a[4] and the weight coefficient The multiplication operation is performed to obtain the multiplication result. The result of the above multiplication operation is Add the input data a[0] to obtain the addition result b0. Multiplication result The subtraction operation is performed on the input data a[0] to obtain the subtraction result b1. Similarly, the next butterfly operation circuit 12 first performs the subtraction operation on the input data a[6] and the weight coefficient The multiplication operation is performed to obtain the multiplication result. The result of the above multiplication operation is Add the input data a[2] to obtain the addition result b2. The subtraction operation is performed on the input data a[2] to obtain the subtraction result b3. Similarly, the next butterfly operation circuit 13 first performs the subtraction operation on the input data a[5] and the weight coefficient The multiplication operation is performed to obtain the multiplication result. The input data a[1] is added to obtain the addition result b4, and the input data a[1] is subtracted to obtain the subtraction result b5. Another butterfly operation circuit 14 performs the operation of adding the input data a[7] and the weight coefficient The multiplication operation is performed, and then the multiplication result and the input data a[3] are added and subtracted to obtain the addition result b6 and the subtraction result b7. The above operations of the butterfly operation circuits 11 to 14 are collectively referred to as the first-stage stage operation s1 in the number theory transformation operation performed by the stage operation circuit 100. In summary, the input data of the first-stage stage operation s1 is the 8-point input data a[0] to a[7], and the output data generated by the first-stage stage operation s1 is the 8-point operation results b0 to b7, including 4 addition results b0, b2, b4 and b6, and 4 subtraction results b1, b3, b5 and b7. The stage operation result SR(1) of the first-stage stage operation s1 is the 8-point output data (i.e., the operation results b0 to b7). The first-stage stage operation s1 only needs 1 frequency cycle to be completed.

[0030] Then, the sorting circuit 200 sorts the first-stage operation result SR(1) to obtain the first-stage sorting result PSR(1). In the present embodiment, the sorting operation performed by the sorting circuit 200 is: sorting the results b0, b2, b4 and b6 corresponding to the even-numbered points as the first 4 points, which are used as the first 4 points of the first-stage sorting result PSR(1); and sorting the results b1, b3, b5 and b7 corresponding to the odd-numbered points as the last 4 points, which are used as the last 4 points of the first-stage sorting result PSR(1). Therefore, the first-stage sorting result PSR(1) includes b0, b2, b4, b6, b1, b3, b5 and b7 in sequence, which are used in sequence as the 8 input data of the second-stage operation s2. In other words, the first-stage operation s1 is called the "current-stage operation", and the second-stage operation s2 is called the "latter-stage operation". The sorting circuit 200 sorts the even points b0, b2, b4 and b6 of the stage operation result SR(1) of the current stage operation as the first half of the input data of the next stage operation (i.e., the first 4 points of the input data), and sorts the odd points b1, b3, b5 and b7 of the stage operation result SR(1) of the current stage operation as the second half of the input data of the next stage operation (i.e., the second 4 points of the input data).

[0031] The butterfly operation circuits 11 to 14 are repeatedly used to perform the second stage operation s2, including: the butterfly operation circuit 11 performs the sorting result b2 and the weight coefficient The butterfly operation circuit 12 performs a multiplication operation on the sorted result b6 and the weight coefficient b0, and then performs an addition operation and a subtraction operation on the multiplication result and the sorted result b0 to obtain an addition operation result c0 and a subtraction operation result c1. The multiplication operation is performed, and then the multiplication result and the sorted result b4 are added and subtracted to obtain the addition result c2 and the subtraction result c3. Similarly, the butterfly operation circuit 13 performs operation processing on the sorted result b3 and the sorted result b1 to obtain the addition result c4 and the subtraction result c5. The butterfly operation circuit 14 performs operation processing on the sorted result b7 and the sorted result b5 to obtain the addition result c6 and the subtraction result c7. In summary, the input data of the second-stage stage operation s2 is the 8-point input data b0~b7. The output data generated by the second-stage stage operation s2 is the 8-point operation results c0~c7, including 4 addition results c0, c2, c4 and c6, and 4 subtraction results c1, c3, c5 and c7. The stage operation result SR(2) of the second-stage stage operation s2 is the 8-point output data (i.e., the operation results c0~c7). The second-stage operation s2 only requires one frequency cycle to complete.

[0032] Then, the sorting circuit 200 is repeatedly used to sort the second stage operation result SR(2) to obtain the second stage sorting result PSR(2). The sorting operation is the same as the first stage sorting, that is, the results c0, c2, c4 and c6 corresponding to the even points are sorted as the first 4 points, and the results c1, c3, c5 and c7 corresponding to the odd points are sorted as the last 4 points. Therefore, the second stage sorting result PSR(2) includes c0, c2, c4, c6, c1, c3, c5 and c7 in sequence, which are sequentially used as the 8 input data of the third stage operation s3.

[0033] Next, the butterfly operation circuits 11-14 are reused to perform the third stage stage operation s3, including: the butterfly operation circuit 11 performs operation processing on the sorted results c0 and c2 to obtain operation results d0 and d1, the butterfly operation circuit 12 performs operation processing on the sorted results c4 and c6 to obtain operation results d2 and d3, the butterfly operation circuit 13 performs operation processing on the sorted results c1 and c3 to obtain operation results d4 and d5, and the butterfly operation circuit 14 performs operation processing on the sorted results c5 and c7 to obtain operation results d6 and d7. The stage operation result SR(3) of the third stage stage operation s3 includes d1-d7 in sequence. Then, the sorting circuit 200 is reused to sort the third stage stage operation result SR(3) to obtain the third stage sorting result PSR(3), which includes d0, d2, d4, d6, d1, d3, d5 and d7 in sequence. Finally, the sorting result PSR(3) is output as the final result of the number theory transformation operation. The third level operation s3 only needs one frequency cycle to complete. In other words, each level operation of the number theory transformation operation only needs one frequency cycle to complete.

[0034] Next, see Figure 3 , which is a schematic diagram of the butterfly operation architecture of the inverse arithmetic transformation operation of an embodiment of the present disclosure. This embodiment also reuses the four butterfly operation circuits 21-24 of the stage operation circuit 100 and the sorting circuit 200 to perform the inverse arithmetic transformation operation of the 8-point input data a[0]-a[7] and the 3-stage stage operation. However, different from Figure 2The number theoretic transformation operation of the embodiment of the present invention is that the inverse number theoretic transformation operation of the embodiment is first performed by the sorting circuit 200 and then performed by the level operation circuit 100. The input data a[0] to a[7] are immediately input to the sorting circuit 200 for sorting (before sorting, the level operation is1 of the first level is not performed). The input data a[0], a[1], a[2] and a[3] corresponding to the first 4 points are sorted as odd points, and the input data a[4], a[5], a[6] and a[7] corresponding to the last 4 points are sorted as even points, thereby obtaining the first level sorting result PISR(1). The first level sorting result PISR(1) is: a[0], a[4], a[1], a[5], a[2], a[6], a[3] and a[7]. And, the first level sorting result PISR(1) is used as the input of the level operation is1 of the first level.

[0035] The stage operation circuit 100 performs the stage operation is1 of the first stage according to the first stage sorting result PISR(1). The butterfly operation circuit 21 first performs an addition operation on the input data a[0] and the input data a[4] to obtain the operation result e0. Then, a subtraction operation is performed on the input data a[0] and the input data a[4], and the subtraction result is added to the weight coefficient. The next butterfly operation circuit 22 first performs an addition operation on the input data a[1] and the input data a[5] to obtain an operation result e2. Then, a subtraction operation is performed on the input data a[1] and the input data a[5], and the subtraction result is added to the weight coefficient. , and obtains the operation result e3. Similarly, the butterfly operation circuit 23 performs addition, subtraction and multiplication operations according to the input data a[2] and the input data a[6] to obtain the operation results e4 and e5. Another butterfly operation circuit 24 performs addition, subtraction and multiplication operations according to the input data a[3] and the input data a[7] to obtain the operation results e6 and e7. In summary, the butterfly operation circuits 21-24 of the stage operation circuit 100 perform the stage operation is1 of the first stage to obtain the stage operation result ISR(1) of the first stage. The stage operation result ISR(1) includes e0-e7 in sequence. In the inverse number theory transformation operation, the total operation of the first stage includes: the sorting operation of the first stage and the stage operation is1 of the first stage. First, the first stage sorting result PISR(1) is generated, and then the first stage stage operation result ISR(1) is generated according to the first stage sorting result PISR(1).

[0036] Then, the sorting circuit 200 sorts the first-stage operation result ISR(1), sorts the operation results e0-e3 corresponding to the first four points as odd points, and sorts the input data e4-e7 corresponding to the last four points as even points, thereby obtaining the second-stage sorting result PISR(2). The second-stage sorting result PISR(2) is: e[0], a[4], e[1], e[5], e[2], e[6], e[3] and e[7]. And, the second-stage sorting result PISR(2) is used as the input of the second-stage operation is2.

[0037] In other words, the stage operation is1 of the first stage is called "this stage operation", and the stage operation is2 of the second stage is called "the next stage operation". The sorting circuit 200 sorts the first half e0 to e3 of the stage operation result ISR(1) of the current stage operation (i.e., the first 4 points of the stage operation result ISR(1)) as the even points of the input data of the next stage operation, and sorts the second half e4 to e7 of the stage operation result ISR(1) of the current stage operation (i.e., the last 4 points of the stage operation result ISR(1)) as the odd points of the input data of the next stage operation.

[0038] Next, the stage operation circuit 100 uses the sorting result PISR(2) as input to perform the second stage stage operation is2. The butterfly operation circuit 21 performs addition, subtraction and multiplication operations based on the operation results e0 and e4 to obtain operation results f0 and f1. The butterfly operation circuit 22 performs addition, subtraction and multiplication operations based on the operation results e1 and e5 to obtain operation results f2 and f3. The butterfly operation circuit 23 performs addition, subtraction and multiplication operations based on the operation results e2 and e6 to obtain operation results f4 and f5. The butterfly operation circuit 24 performs addition, subtraction and multiplication operations based on the operation results e3 and e7 to obtain operation results f6 and f7. In summary, the butterfly operation circuits 21-24 of the stage operation circuit 100 perform the second stage stage operation is2 to obtain the second stage stage operation result ISR(2). The stage operation result ISR(2) includes f0-f7 in sequence. In summary, in the inverse number theory transformation operation, the second-level total operation includes: the second-level sorting operation and the second-level level operation is2. First, the second-level sorting result PISR(2) is generated, and then the second-level level operation result ISR(2) is generated according to the second-level sorting result PISR(2).

[0039] Similar to the stage operation and sorting operation of the first and second stages, the sorting circuit 200 sorts the stage operation result ISR(2) of the second stage, and the operation results f0-f3 corresponding to the first four points are sorted as odd points, and the input data f4-f7 corresponding to the last four points are sorted as even points, so as to generate the sorting result PISR(3) of the third stage. The sorting result PISR(3) is: f0, f4, f1, f5, f2, f6, f3 and f7 in sequence. In addition, in the stage operation is3 of the third stage, the butterfly operation circuits 21-24 of the stage operation circuit 100 perform addition operation, subtraction operation and multiplication operation according to the sorting result PISR(3) to obtain the stage operation result ISR(3) of the third stage, which includes the operation results g0-g7 in sequence. The overall operation of the third stage includes: the sorting operation of the third stage and the stage operation is3 of the third stage. First, the third-level sorting result PISR(3) is generated, and then the third-level operation result ISR(3) is generated according to the third-level sorting result PISR(3). Moreover, the third-level operation result ISR(3) is output as the final result of the inverse arithmetic transformation operation. Each of the inverse arithmetic transformation operation level operations is1 to is3 can be completed in only one frequency cycle.

[0040] exist Figure 2 In the number theory transformation operation, the first-stage operation result SR(1) is sorted by the sorting circuit 200, and the sorting result PSR(1) is provided to the stage operation circuit 100 to perform the second-stage operation s2, instead of directly providing the first-stage operation result SR(1) to the stage operation circuit 100 to perform the second-stage operation s2. Therefore, the butterfly operation architecture of the second-stage operation s2 is the same as the first-stage operation s1, and the same four butterfly operation circuits 11 to 14 can be reused to perform the second-stage operation s2. Similarly, the same four butterfly operation circuits 11 to 14 can also be reused to perform the third-stage operation s3. Accordingly, the number of butterfly operation circuits can be saved, and the hardware architecture of the computing device 1000 can be greatly simplified.

[0041] Similarly, in Figure 3 In the inverse arithmetic transformation operation, the first-stage stage operation result ISR(1) is sorted by the sorting circuit 200 and the sorting result PISR(2) is provided to the stage operation circuit 100 to perform the second-stage stage operation is2, instead of directly providing the first-stage stage operation result ISR(1) to the stage operation circuit 100 to perform the second-stage stage operation is2. Therefore, the butterfly operation architecture of the second-stage stage operation is2 is the same as the first-stage stage operation s1 (similarly, the butterfly operation architecture of the third-stage stage operation is3 is also the same as the first-stage stage operation s1). Therefore, the same four butterfly operation circuits 21-24 can be reused to perform the first-stage to third-stage stage operations is1-is3 of the inverse arithmetic transformation operation.

[0042] Next, see Figure 4A , which is a schematic diagram of a ping-pong memory mechanism for number theoretic transformation operations according to an embodiment of the present disclosure. The M-level operations can be divided into odd-level operations and even-level operations. The odd-level operations include the 1st level, the 3rd level, the 5th level, ..., and so on, and the even-level operations include the 2nd level, the 4th level, the 6th level, ..., and so on. According to the mechanism of the ping-pong memory, the input data and the sorting results corresponding to the odd-level operations and the even-level operations are accessed in the first memory 400 or the second memory 500 in an interleaved manner. More specifically, the input data a[0] to a[N-1] are first written into the first memory 400, and then, according to the interleaving rule of the odd-level operations / even-level operations, the input data and the sorting results of the level operations of each level are interleaved and accessed in the first memory 400 or the second memory 500. The interleaving rule is as follows: the level operation circuit 100 reads the input data of the odd-level operation from the first memory 400 (wherein the input data of the level operation of the first level is the input data a[0] to a[N-1]), and the level operation circuit 100 performs the odd-level operation according to the read input data to generate the level operation result SR(j) of the odd-level operation (wherein the independent variable j is an odd number, indicating an odd level, j=1, 3, 5, ..., M). Then, the sorting circuit 200 sorts the level operation result SR(j) of the odd-level operation to generate the sorting result PSR(j) of the odd-level operation. And, the sorting circuit 200 writes the sorting result PSR(j) of the odd-level operation into the second memory 500.

[0043] Next, the level operation circuit 100 reads the sorting result PSR(j) of the odd-level operation from the second memory 500 as the input data of the even-level operation, and the level operation circuit 100 performs the even-level operation according to the read input data to generate the level operation result SR(k) of the even-level operation (wherein the independent variable k is an even number, indicating an even-level, k=2, 4, 6, ..., (M-1)). Then, the sorting circuit 200 performs sorting on the level operation result SR(k) of the even-level operation to generate the sorting result PSR(k) of the even-level operation. And, the sorting circuit 200 writes the sorting result PSR(k) of the even-level operation into the first memory 400.

[0044] Next, the previous cycle is repeated: the stage operation circuit 100 reads the sorting result PSR(k) of the even-numbered stage operation from the first memory 400 as the input data of the odd-numbered stage operation, and the stage operation circuit 100 performs the odd-numbered stage operation according to the read input data to generate the stage operation result SR(j) of the odd-numbered stage operation. Then, the sorting circuit 200 performs sorting on the stage operation result SR(j) of the odd-numbered stage operation to generate the sorting result PSR(j) of the odd-numbered stage operation. And, the sorting circuit 200 writes the sorting result PSR(j) of the odd-numbered stage operation into the second memory 500. Then, the stage operation circuit 100 reads the sorting result PSR(j) of the odd-numbered stage operation from the second memory 500 as the input data to perform the even-numbered stage operation and generate the stage operation result SR(k) of the even-numbered stage operation. Then, the sorting circuit 200 performs sorting on the stage operation result SR(k) of the even-numbered stage operation to generate the sorting result PSR(k) and writes it into the first memory 400.

[0045] According to the above-mentioned interleaving rule, the sorting result PSR(M) obtained after the last level (Mth level, which is an odd-numbered level) level operation result SR(M) is sorted is written into the second memory 500. The sorting result PSR(M) of the level operation of the Mth level is read out from the second memory 500 and output as the final result of the number theory transformation operation.

[0046] Next, see Figure 4B , which is Figure 4A First, the internal memory 300 in the level operation circuit 100 is initialized to set the internal parameters of the level operation of the transformation operation. The internal parameters are the weight coefficients of the multiplication operation of each level operation. Then, in Figure 4B In the execution action marked with a thin solid line circle "1", the input data a[0] to a[N-1] are written into the first memory 400. Then, the input data a[0] to a[N-1] are read from the first memory 400. Then, Figure 4B In the execution action marked with a thin solid line frame "2", the first-stage operation s1 is executed according to the read input data a[0] to a[N-1] to generate the first-stage operation result SR(1). In the butterfly operation of the stage operation s1, the weight coefficient The corresponding multiplication operation is performed with the input data a[0] to a[N-1], and the multiplication operation is implemented by the internal memory 300 in the stage operation circuit 100 using the in-memory operation mechanism. Figure 4B In the execution action marked as the thin solid line frame "3", the sorting circuit 200 performs sorting on the first stage operation result SR(1) to generate the first stage sorting result PSR(1). Figure 4B In the execution action marked with a thin solid line frame “4”, the sorting result PSR(1) of the first level is written into the second memory 500.

[0047] Next, the sort result PSR(1) of the first level is read from the second memory 500. Figure 4B In the execution action marked with a thick solid circle "2", the second-level operation s2 is executed to generate the second-level operation result SR(2). Then, Figure 4B In the execution action marked as the thick solid circle "3", the sorting circuit 200 performs sorting on the second stage operation result SR(2) to generate the second stage sorting result PSR(2). Figure 4B In the execution action marked with a thick solid line frame “4”, the second-level sorting result PSR(2) is written into the first memory 400.

[0048] Next, the sort result PSR(2) of the second level is read from the first memory 400. Figure 4B In the execution action marked with a thin dotted circle "2", the third-level operation s3 is executed to generate the third-level operation result SR(3). Then, Figure 4B In the execution action marked with a thin dotted circle "3", the sorting circuit 200 performs sorting on the third-stage operation result SR(3) to generate the third-stage sorting result PSR(3). Figure 4B In the execution action marked with a thin dotted circle “4”, the third-level sorting result PSR(3) is written into the second memory 500.

[0049] By analogy, the above execution actions are repeated to implement the subsequent level operations and sorting of the 4th to Mth levels. The sorting result PSR(M) of the Mth level (the last level) is written into the first memory 400 or the second memory 500 (depending on whether M is an odd number or an even number). In addition, the sorting result PSR(M) of the Mth level is read out from the first memory 400 or the second memory 500 and output as the final result of the number theory transformation operation.

[0050] Above and in conjunction Figure 4A and Figure 4B The first memory 400 and the second memory 500 are accessed when performing the number theory transformation operation; Figure 5A and Figure 5B The figure is used to explain the access of the first memory 400 and the second memory 500 when performing the inverse number theoretic transformation operation. When performing the inverse number theoretic transformation operation, the input data is first sorted to generate a sorted result, and then the sorted result is subjected to a level operation to generate a level operation result.

[0051] Next, see Figure 5A , which is a schematic diagram of a ping-pong memory mechanism for an inverse number theory transform operation according to an embodiment of the present disclosure. The input data a[0]~a[N-1] are first written into the first memory 400. The sorting circuit 200 reads the input data a[0]~a[N-1] or the level operation result ISR(k) of the even-numbered level operation of the inverse number theory transform operation from the first memory 400 to perform sorting, and generates the sorting result PISR(k+1) of the even-numbered level operation (wherein the independent variable k is an even number, k=2, 4, 6, ..., etc.). Then, the level operation circuit 100 performs level operation according to PISR(k+1) to generate the level operation result ISR(j) of the odd-numbered level operation (wherein the independent variable j is an odd number, j=1, 3, 5, ..., etc.). Furthermore, the level operation circuit 100 writes the level operation result ISR(j) of the odd-numbered level operation into the second memory 500.

[0052] Next, the sorting circuit 200 reads the stage operation result ISR(j) of the odd-numbered stage operation from the second memory 500 and sorts it to generate the sorting result PISR(j+1) of the odd-numbered stage operation and provides it to the stage operation circuit 100 as the input data of the even-numbered stage operation. The stage operation circuit 100 performs the even-numbered stage operation according to the sorting result PISR(j+1) of the odd-numbered stage operation to generate the stage operation result ISR(k). And, the stage operation circuit 100 writes the stage operation result ISR(k) of the even-numbered stage operation into the first memory 400.

[0053] Then, the previous cycle is repeated until the last level (Mth level, which is an odd level, for example) level operation result ISR(M) is generated and written into the second memory 500. The Mth level operation sorting result ISR(M) is read out from the second memory 500 and output as the final result.

[0054] Next, see Figure 5B , which is Figure 5A First, the internal memory 300 in the stage operation circuit 100 is initialized to set the internal parameters of the stage operation of the inverse arithmetic transformation operation (i.e., the weight coefficient of the multiplication operation). ). Then, in Figure 5B In the execution action marked with a thick solid circle "1", the input data a[0] to a[N-1] are written into the first memory 400. Then, the input data a[0] to a[N-1] are read from the first memory 400. Figure 5B In the execution action marked with a thick solid circle "2", the sorting circuit 200 sorts the read input data a[0] to a[N-1] to generate the first-level sorting result PISR(1). Figure 5BIn the execution action marked with a thick solid circle "3", the first-level level operation is1 of the inverse number theory transformation operation is performed according to the first-level sorting result PISR(1) to generate the first-level level operation result ISR(1). Among them, the multiplication operation of the level operation is1 is implemented by the internal memory 300 in the level operation circuit 100 to perform the memory operation. Then, in Figure 5B In the execution action indicated by the thick solid line frame “4”, the first stage operation result ISR(1) is written into the second memory 500.

[0055] Next, the first stage operation result ISR(1) is read from the second memory 500. Figure 5B In the execution action marked with a thin solid line frame "2", the sorting circuit 200 performs sorting on the first-stage operation result ISR(1) to generate the second-stage sorting result PISR(2). Figure 5B In the execution action marked with a thin solid line frame "3", the second-level level operation is2 of the inverse number theory transformation operation is performed according to the second-level sorting result PISR(2) to generate the second-level level operation result ISR(2). Then, Figure 5B In the execution action marked with a thin solid line frame “4”, the second stage operation result ISR(2) is written into the first memory 400.

[0056] Next, the second stage operation result ISR(2) is read from the first memory 400. Figure 5B In the execution action marked with a thin dotted circle "2", the sorting circuit 200 sorts the second-stage operation result ISR(2) to generate the third-stage sorting result PISR(3). Figure 5B In the execution action marked with a thin dotted circle "3", the third-level level operation is3 of the inverse number theory transformation operation is performed according to the third-level sorting result PISR(3) to generate the third-level level operation result ISR(3). Then, Figure 5B In the execution action indicated by the thin dotted circle “4”, the third-stage operation result ISR(3) is written into the second memory 500 .

[0057] By analogy, the above execution actions are repeated to implement the subsequent sorting and level operations of the 4th to Mth levels. The level operation result ISR(M) of the Mth level (the last level) is written into the first memory 400 or the second memory 500 (depending on whether M is an odd number or an even number). In addition, the level operation result ISR(M) of the Mth level is read out from the first memory 400 or the second memory 500 and output as the final result.

[0058] Next, see Figure 6, which is a method flow chart of the ping-pong memory mechanism of number theoretic transformation operation and inverse number theoretic transformation operation. First, step S600 is executed: initializing the data related to the operation in the internal memory 300 of the stage operation circuit 100, including: the weight coefficients stored in the internal memory 300 for the input data a[0]~a[N-1] Perform initialization settings.

[0059] Then, step S602 is executed: accessing the first memory 400 or the second memory 500. First, input data a[0]-a[N-1] are written into the first memory 400, and the stage operation circuit 100 reads input data a[0]-a[N-1] from the first memory 400.

[0060] Then, step S604 is executed: performing a number theoretic transformation operation according to the input data a[0]~a[N-1]. Step S604 includes sub-steps S6041 and S6042. In sub-step S6041, the level operation circuit 100 performs the level operation of the first level of the number theoretic transformation operation on the input data a[0]~a[N-1] to generate a level operation result SR(1). Then, in sub-step S6042, the sorting circuit 200 sorts the level operation result SR(1) of the first level to generate a sorting result PSR(1). Then, step S608 is executed: writing the sorting result PSR(1) of the first level into the first memory 400 or the second memory 500. This execution is to write the sorting result PSR(1) into the second memory 500.

[0061] Then, step S602 is executed again: the first memory 400 or the second memory 500 is accessed. This execution is to read the first-level sorting result PSR(1) from the second memory 500. Then, step S6041 is executed again: the level operation circuit 100 performs the second-level level operation on the first-level sorting result PSR(1) to generate the level operation result SR(2). Then, sub-step S6042 is executed again: the sorting circuit 200 sorts the second-level level operation result SR(2) to generate the sorting result PSR(2). Then, step S608 is executed: the second-level sorting result PSR(2) is written into the first memory 400 or the second memory 500. This execution is to write the sorting result PSR(2) into the first memory 400.

[0062] Then, steps S602, S604 and S608 are executed again to perform the level operation and sorting of the third level to generate the level operation result SR(3) of the third level and the sorting result PSR(3) of the third level, and the sorting result PSR(3) is written into the second memory 500. Similarly, steps S602, S604 and S608 are repeatedly executed to perform the level operation and sorting of the subsequent 4th to Mth levels (the last level). Finally, in step S608 of the Mth level, the sorting result PSR(M) of the Mth level is output as the final result.

[0063] On the other hand, if the inverse number theoretic transformation operation is to be performed, step S606 is performed after step S602: the inverse number theoretic transformation operation is performed according to the input data a[0] to a[N-1], including sub-steps S6061 and S6062. In sub-step S6061, the sorting circuit 200 performs sorting on the input data a[0] to a[N-1] to generate the first-level sorting result PISR(1). Then, in sub-step S6062, the level operation circuit 100 performs the first-level level operation of the inverse number theoretic transformation operation on the sorting result PISR(1) to generate the level operation result ISR(1). Then, step S608 is performed: the first-level level operation result ISR(1) is written into the first memory 400 or the second memory 500. This execution is to write the level operation result ISR(1) into the second memory 500. Then, step S602 is executed again: the level operation result ISR(1) of the first level of the inverse number theory transformation operation is read from the second memory 500. Then, step S6061 is executed: the sorting circuit 200 sorts the level operation result ISR(1) to generate the sorting result PISR(2) of the second level. Then, step S6062 is executed: the level operation of the second level of the inverse number theory transformation operation is performed on the sorting result PISR(2) to generate the level operation result ISR(2). Then, step S608 is executed: the level operation result ISR(2) of the second level is written into the first memory 400. Similarly, steps S602, S606 and step S608 are repeatedly executed to perform subsequent sorting and level operations from the third level to the Mth level (the last level). Finally, in step S608 of the Mth level, the level operation result ISR(M) of the Mth level is output as the final result.

[0064] Next, see Fig. 7A , which is a block diagram of a computing device 1001 according to another embodiment of the present disclosure. The circuit architecture of the computing device 1001 according to this embodiment is substantially the same as Figure 1 The circuit architecture of the computing device 1000 is Fig. 7A The internal circuit of the stage operation circuit 100 of the operation device 1001 is also shown, including: an internal memory 300, an analog-to-digital processing circuit 102 and an addition-subtraction circuit 103.

[0065] The operation device 1001 is used to perform number theory transformation operations on 256-point (N=256) input data. The modulus processing circuit 102 includes 128 sub-units, and the addition and subtraction circuit 103 also includes 128 sub-units. The number of the sub-units is equal to half the number of points of the input data (i.e., N / 2). One of the sub-units of the modulus processing circuit 102 is the modulus processing unit 102(0). One of the sub-units of the addition and subtraction circuit 103 is the addition and subtraction unit 103(0), which also includes an addition unit 103a(0) and a subtraction unit 103b(0). The addition unit 103a(0) is used to perform modulus addition, and the subtraction unit 103b(0) is used to perform modulus subtraction.

[0066] 256 points of input data are read from the first memory 400. The 256 points of input data are divided into even points and odd points. The even points include 128 points of input data In_X[0]~In_X

[127] , and the odd points include 128 points of input data In_Y[0]~In_Y

[127] . In addition, the internal memory 300 pre-stores 128 weight coefficients W[0]~W

[127] . Each level of number theory transformation operation includes 128 butterfly operations, and each butterfly operation includes 1 multiplication operation, 1 addition operation and 1 subtraction operation. The above-mentioned multiplication, addition and subtraction operations are all modular operations. The multiplication operation is performed in the internal memory 300 using the in-memory operation mechanism.

[0067] The odd-numbered input data In_Y[0]-In_Y

[127] are input to the internal memory 300, and the internal memory 300 performs a multiplication operation of the input data In_Y[0]-In_Y

[127] and the weight coefficients W[0]-W

[127] by an in-memory operation. Furthermore, the modulus processing unit 102(0) performs a modulus processing of the Barrett Reduction algorithm on the multiplication result to generate a 128-point operation result In_Y_m[127:0] (which includes In_Y_m[0]-In_Y_m

[127] ).

[0068] The addition and subtraction circuit 103 performs a modulo addition operation and a modulo subtraction operation on the operation result In_Y_m[127:0] and the input data In_X[0] to In_X

[127] . For example, the addition unit 103a(0) of the addition and subtraction circuit 103 performs a modulo addition operation on the input data In_X[0] and the operation result In_Y_m[0], and the subtraction unit 103b(0) performs a modulo subtraction operation on the input data In_X[0] and the operation result In_Y_m[0]. Similarly, another addition unit and subtraction unit respectively perform a modulo addition operation and a modulo subtraction operation on the input data In_X

[127] and the operation result In_Y_m

[127] . Accordingly, the addition and subtraction circuit 103 generates a total of 256 points of operation results NTT_OUT[i] (the independent variable i includes odd numbers and even numbers, i=0, 1, 2, 3, ..., 255). The operation result NTT_OUT[i] is transmitted to the sorting circuit 200 for sorting, and the sorting result is written into the second memory 500. The stage operation circuit 100 is repeatedly used to perform the above-mentioned stage operations, including the stage operations of the 1st to the 7th stage, and the total operation time is 8 clock cycles.

[0069] Next, see Figure 7B , which is Fig. 7A A block diagram of another example of a computing device 1001. Figure 7B Not shown Fig. 7A The internal memory 300 and the control circuit 600. Figure 7B The 256-point input data WL[0]~WL

[255] include Fig. 7A 128 points of input data In_X[0]~In_X

[127] and 128 points of input data In_Y[0]~In_Y

[127] ). More specifically, Figure 7B Among the 256-point input data WL[0]~WL

[255] , the even-numbered input data WL[0], WL[2], ..., WL

[252] , WL

[254] represent the even-numbered input data In_X[0], In_X[1], ..., In_X

[126] , In_X

[127] ; the odd-numbered input data WL[1], WL[3], ..., WL

[253] , WL

[255] represent the odd-numbered input data In_Y[0], In_Y[1], ..., In_Y

[126] , In_Y

[127] .

[0070] In operation, the input data WL[0]-WL

[255] are first stored in the first memory 400 and read by the stage operation circuit 100 to perform the stage operation. The stage operation circuit 100 includes 128 butterfly operation circuits BF(0)-BF(127). For example, the butterfly operation circuit BF(0) performs a butterfly operation (including multiplication, addition and subtraction) according to the input data WL[0] at the first point, the input data WL[1] at the second point and the weight coefficient W[0]. In addition, the results of the butterfly operation are subjected to the modulus processing of the "Barrett Reduction" algorithm by the modulus processing unit 102(0) to generate the operation results NTT_OUT[0] and NTT_OUT[1]. Among them, the addition operation result of the butterfly operation circuit BF(0) is subjected to the modulus processing to obtain the operation result NTT_OUT[0], and the subtraction operation result of the butterfly operation circuit BF(0) is subjected to the modulus processing to obtain the operation result NTT_OUT[1].

[0071] Similarly, the next butterfly operation circuit BF(1) performs a butterfly operation based on the input data WL[2] at the second point, the input data WL[3] at the third point, and the weight coefficient W[1], and performs modulus processing through the modulus processing unit 102(1) to generate operation results NTT_OUT[2] and NTT_OUT[3]. Similarly, the butterfly operation circuits BF(0) to BF(127) perform their respective butterfly operations based on the corresponding input data WL[0] to WL

[255] and the weight coefficients W[0] to W

[127] , and perform modulus processing through the corresponding modulus processing units 102(0) to 102(127) to obtain operation results NTT_OUT[0] to NTT_OUT

[255] .

[0072] Then, the sorting circuit 200 sorts the operation results NTT_OUT[0]-NTT_OUT

[255] to generate sorting results NTT_IN[0]-NTT_IN

[255] . The operation result NTT_OUT[k] (wherein the independent variable k is an even number) is sorted as the first 127 points of sorting results NTT_IN[0]-NTT_IN

[127] , and the operation result NTT_OUT[j] (wherein the independent variable j is an odd number) is sorted as the last 127 points of sorting results NTT_IN

[128] -NTT_IN

[255] . Then, the sorting results NTT_IN[0]-NTT_IN

[255] are stored in the second memory 500.

[0073] Next, see Fig. 8A , which is a block diagram of a computing device 1002 of another embodiment of the present disclosure. The circuit architecture of the computing device 1002 of this embodiment is similar to Fig. 7AThe circuit architecture of the computing device 1001 is different from that of the embodiment, but the computing device 1002 of this embodiment is used to perform the inverse arithmetic transformation operation of 256-point input data. The internal circuit of the stage computing circuit 100' of the computing device 1002 includes: an internal memory 300, a modulus processing circuit 102 and an addition and subtraction circuit 103, and the stage computing circuit 100' cooperates with two division modules 104a and 104b.

[0074] The sorting circuit 200 sorts the 256-point input data and divides them into even points and odd points. The sorted even points include input data In_X[0]-In_X

[127] , and the odd points include input data In_Y[0]-In_Y

[127] . The input data In_X[0]-In_X

[127] and the input data In_Y[0]-In_Y

[127] perform a modulus addition operation corresponding to the input data In_X[0]-In_X

[127] , and the result of the modulus addition operation is processed by the division module 104a to generate an operation result INTT_OUT[k]. On the other hand, the input data In_X[0]-In_X

[127] and the input data In_Y[0]-In_Y

[127] perform a modulus subtraction operation corresponding to the input data In_X[0]-In_X

[127] to generate a 128-point operation result MOD_SUB_OUT[127:0] (which includes MOD_SUB_OUT[0]-MOD_SUB_OUT

[127] ).

[0075] The operation results MOD_SUB_OUT[0]-MOD_SUB_OUT

[127] are each multiplied with the weight coefficients W[0]-W

[127] stored in the internal memory 300 using the in-memory operation mechanism, and are subjected to modulus processing by the modulus processing circuit 102 to obtain a modulus multiplication operation result. Then, the operation result INTT_OUT[j] is processed by the division module 104b to generate the operation result INTT_OUT[j]. The operation result INTT_OUT[j] is integrated with the operation result INTT_OUT[k] generated by the aforementioned division module 104a as the stage operation result of the current stage, and is transmitted to the sorting circuit 200 for sorting. Similarly, all butterfly operation circuits BF(0)-BF(127) perform butterfly operations on all even-numbered input data In_X[0]-In_X

[127] , odd-numbered input data In_Y[0]-In_Y

[127] and weight coefficients W[0]-W

[127] , and perform modulus processing via corresponding modulus processing units 102(0)-102(127) to obtain the stage operation results of the inverse arithmetic transformation operation. The stage operation results are stored in the second memory 500.

[0076] Next, see Figure 8B , which is Fig. 8A A block diagram of another example of a computing device 1002. Figure 8B Not shown Fig. 8A The internal memory 300 and the control circuit 600 are the same as Figure 7B The input data WL[0] to WL

[255] of the computing device 1002 of this embodiment includes 256 points of input data WL[0] to WL

[255] : Fig. 8A The input data In_X[0]~In_X

[127] of the 128 even points and the input data In_Y[0]~In_Y

[127] of the 128 odd points.

[0077] In operation, the input data WL[0]-WL

[255] are first stored in the first memory 400; then, the input data WL[0]-WL

[255] are read by the sorting circuit 200 to perform sorting. The sorted input data are transmitted to the stage operation circuit 100' for stage operation. The stage operation circuit 100' includes 128 butterfly operation circuits BF(0)-BF(127) and 128 analog-to-digital processing units 102(0)-102(127). Among them, the butterfly operation circuit BF(0) performs butterfly operation on the sorted input data WL[0], input data WL

[128] and weight coefficient W[0], and performs analog-to-digital processing through the analog-to-digital processing unit 102(0). Similarly, the butterfly operation circuit BF(1) performs a butterfly operation on the sorted input data WL[1], input data WL

[129] and weight coefficient W[1], and performs modulus processing via the modulus processing unit 102(1). Then, the stage operation result generated by the stage operation circuit 100' is stored in the second memory 500.

[0078] Next, see 9A to 9C , which is a schematic diagram of different functional modules of the computing device 1000 disclosed herein applied to the lattice cryptography system 2000 of post-quantum cryptography. 9A to 9C The lattice cryptographic system 2000 is, for example, the "CRYSTALS-Kyber" system, and the lattice cryptographic system 2000 includes three functional modules: a "CPAPK.KeyGen" module 2001, a "CPAPK.Enc" module 2002, and a "CPAPK.Dec" module 2003. The three functional modules all utilize the computing device 1000 to perform number-theoretic transformation operations or inverse number-theoretic transformation operations on 256-point input data (N=256), and the data width of each input data is 12 bits.

[0079] Please see first Fig.9AThe computing device 1000 is used to illustrate the "CPAPK.KeyGen" module 2001 of the lattice cryptographic system 2000. The computing device 1000 calculates k number theory transformation operations for each of the matrices e and s. The number theory transformation operation has 256 points, and the data width of each input data is 12 bits. The computing circuit 800 of the "CPAPK.KeyGen" module 2001 receives a random number seed η and generates a random matrix Matrix e and matrix s. Furthermore, the operation device 1000 performs a number theory transformation operation to transform the matrix e and the matrix s into matrices With the matrix Then, the PWM operation circuit 810 calculates the matrix With the matrix Get the result of the operation And summed up in the matrix To get the total result Then, the encoding circuit 820 calculates the sum of the results. Encode with a random number seed to generate a public key pk and a private key sk.

[0080] Next, see Fig. 9B The computing device 1000 is used in the "CPAPK.Enc" module 2002 of the lattice cryptographic system 2000. The computing circuit 802 receives the random number seed η, the information m and the public key pk, and generates a random matrix The computing device 1000 then calculates k number-theoretic transformation operations on the matrix r to generate the matrix The number theory transformation operation has 256 points, and the data width of each input data is 12 bits. In addition, the PWM operation circuit 812 calculates the matrix With the matrix Furthermore, the computing device 1000 performs the matrix k inverse arithmetic transformation operations are performed, the inverse arithmetic transformation operations have 256 points, and the data width of each input data is 12 bits. And, the operation device 1000 performs k inverse arithmetic transformation operations on the matrix Perform 1 inverse arithmetic transformation operation (the inverse arithmetic transformation operation has 256 points and the data width of each input data is 12 bits), thereby generating a matrix A T r and matrix t T Then, the error matrix e1 and the error matrix e2 are obtained according to the operation circuit 802, and the summation result A is generated. T r+e1 and the sum t T r+e2+m. And, the compression encoding circuit 822 generates encrypted information c.

[0081] Next, see Fig. 9C The computing device 1000 is used in the "CPAPK.Dec" module 2003 of the lattice cryptographic system 2000. The decoding circuit 830 receives the encrypted information c and the private key sk, and then decodes and restores the vector u, the vector v and the matrix through the decompression circuit 840. Then, the computing device 1000 calculates k number-theoretic transformation operations on the matrix u to generate the matrix The number theory transformation operation has 256 points, and the data width of each input data is 12 bits. In addition, the PWM operation circuit 814 is based on the matrix With the matrix Generate operation results Then the computing device 1000 calculates the result of the computation. k inverse arithmetic transformation operations are calculated (the inverse arithmetic transformation operation has 256 points and the data width of each input data is 12 bits) to generate a matrix s T u. Then, perform a subtraction operation to get the result vs T u. Then the compression encoding circuit 824 generates the decrypted information m.

[0082]

Explanation of symbols

[0083] 1000, 1001, 1002: computing device

[0084] 100,100': Level operation circuit

[0085] 200: Sorting Circuit

[0086] 300: Internal memory

[0087] 400: First memory

[0088] 500: Second memory

[0089] 600: Control circuit

[0090] a[0]~a[7],a[N-1]:input data

[0091] WL[0]~WL

[255] :input data

[0092] SR(1),SR(2),SR(3),SR(M),SR(j),SR(k): results of level operations

[0093] PSR(1),PSR(2),PSR(3),PSR(M),PSR(j),PSR(k): sorting results

[0094] ISR(1),ISR(2),ISR(3),ISR(M),ISR(j),ISR(k): Level operation results

[0095] PISR(1),PISR(2),PISR(3),PISR(M): sorting results

[0096] PISR(j),PISR(k),PISR(j+1),PISR(k+1): sorting results

[0097] i,j,k: independent variables

[0098] Weight coefficient

[0099] 11,12,13,14,21,22,23,24: Butterfly operation circuit

[0100] s1,s2,s3,is1,is2,is3: level operation

[0101] b0~b7,c0~c7,d0~d7,e0~e7,f0~f7,g0~g7: operation result

[0102] S600, S602, S604, S606, S608, S6041, S6042, S6061, S6062: Steps

[0103] 102: Analog-to-digital processing circuit

[0104] 102(0)~102(127): A / D processing unit

[0105] 103: Addition and subtraction circuits

[0106] 103(0): Addition and subtraction unit

[0107] 103a(0): Addition unit

[0108] 103b(0): Subtraction unit

[0109] 104a, 104b: Division module

[0110] In_X[0]~In_X

[127] ,In_Y[0]~In_Y

[127] :input data

[0111] MOD_SUB_OUT[127:0]: operation result

[0112] MOD_SUB_OUT[0]~MOD_SUB_OUT

[127] :Calculation result

[0113] W[0]~W

[127] :weight coefficient

[0114] BF(0)~BF(127): Butterfly operation circuit

[0115] In_Y_m[127:0], In_Y_m[0]~In_Y_m

[127] : operation result

[0116] NTT_OUT[i], NTT_OUT[0]~NTT_OUT

[127] :Calculation result

[0117] NTT_IN[0]~NTT_IN

[127] :sort result

[0118] INTT_OUT[j], INTT_OUT[k]: operation results

[0119] 2000: Lattice Cryptography System

[0120] 2001: CPAPK.KeyGen module

[0121] 2002: The “CPAPK.Enc” module

[0122] 2003: Module "CPAPK.Dec"

[0123] 800: Operational Circuit

[0124] 810: PWM operation circuit

[0125] 820: Encoding circuit

[0126] 802: Operational Circuit

[0127] 812: PWM operation circuit

[0128] 822: Compression coding circuit

[0129] 830: Decoding circuit

[0130] 840: Decompression circuit

[0131] 814: PWM operation circuit

[0132] 824: Compression coding circuit

[0133] r,e,s, u, matrix

[0134] e1,e2: error matrix

[0135] η: random number seed

[0136] A T r+e1,tT r+e2+m: sum of the results

[0137] vs T u: operation result

[0138] m: decrypted information

[0139] c: Encrypted information

[0140] pk: public key

[0141] sk: private key

[0142] [Brief explanation of the symbols in the representative diagram]

[0143] 1000: Computing device

[0144] 100: Level operation circuit

[0145] 200: Sorting Circuit

[0146] 300: Internal memory

[0147] 400: First memory

[0148] 500: Second memory

[0149] 600: Control circuit

[0150] a[0]~a[N-1]:input data

[0151] SR(1)~SR(M): Level operation results

[0152] PSR(1)~PSR(M): Sorting results

[0153] ISR(1)~ISR(M): Level operation results

[0154] PISR(1)~PISR(M): Sorting results

[0155] Weight coefficient

Claims

1. A computing device for performing a transformation operation, wherein the transformation operation includes a first number of level operations, wherein the level operations include a plurality of odd-numbered level operations and a plurality of even-numbered level operations, wherein the odd-numbered level operations include a first level operation, wherein the computing device includes: The stage operation circuit is repeatedly used to perform each of the stage operations, each of the stage operations includes a second number of butterfly operations, and each of the stage operations has a third number of input data, the stage operation circuit comprising: The second number of butterfly operation circuits are used to perform the butterfly operation according to a plurality of weight coefficients and the input data of each stage operation to generate a stage operation result of each stage operation; the sorting circuit is repeatedly used to sort the input data of each stage operation or the stage operation result to generate a sorting result; a first memory, for storing the input data of the first-level operation and the level operation results of each of the even-numbered level operations or the sorting results of each of the even-numbered level operations; and The second memory is used to store the level operation results of each of the odd-numbered level operations or the sorting results of each of the odd-numbered level operations.

2. A computing device as claimed in claim 1, wherein the first number of the stage operations is equal to M, the third number of the input data of each stage operation is equal to N, and the second number of the butterfly operations is equal to N / 2, wherein M and N are both positive integers, and M and N have a first relationship: M=log2(N).

3. The computing device of claim 1, wherein the stage computing circuit further comprises: an internal memory for storing the weight coefficients and performing the multiplication operation of each butterfly operation according to an operation mechanism in the memory, The multiplication operation is used to generate a product of one of the weight coefficients and a corresponding one of the input data of each stage operation.

4. The computing device of claim 3, wherein the internal memory is initialized to set the weight coefficient.

5. The computing device of claim 3, wherein each of the butterfly operations further comprises an addition operation and a subtraction operation, and the multiplication operation, the addition operation and the subtraction operation are performed based on modular processing.

6. The computing device of claim 5, wherein the stage computing circuit further comprises: an analog-to-digital processing circuit, configured to perform the analog-to-digital processing, The modulus processing is based on a Barrett Reduction algorithm.

7. The computing device of claim 1, wherein the transformation operation is a number-theoretic transformation operation or an inverse number-theoretic transformation operation.

8. The computing device of claim 7, wherein when the transformation operation is the number-theoretic transformation operation, the sorting circuit sorts the stage operation results of each of the stage operations to generate the sorted result.

9. A computing device as claimed in claim 8, wherein the stage operation includes a current stage operation and a subsequent post-stage operation, the sorting circuit generates the sorting result of the current stage operation, and the sorting result is provided to the stage operation circuit as the input data of the post-stage operation.

10. The computing device of claim 9, wherein the sorting circuit sorts the stage operation results to sort multiple even points of the stage operation results into the first half of the sorting results, and sorts multiple odd points of the stage operation results into the second half of the sorting results.

11. The computing device of claim 7, wherein when the transformation operation is the inverse number theoretic transformation operation, the sorting circuit sorts the input data of each of the stage operations to generate the sorting result. 12 . The computing device of claim 11 , wherein the sorting circuit transmits the sorting result to the stage computing circuit, and the stage computing circuit performs the stage operation according to the sorting result to generate the stage operation result.

13. The computing device of claim 12, wherein the sorting circuit sorts the input data to sort the first half of the input data into a plurality of even points of the sorting result, and sorts the second half of the input data into a plurality of odd points of the sorting result.

14. The computing device of claim 7, wherein when the transformation operation is the number-theoretic transformation operation, the stage operation circuit reads the input data of the first stage operation from the first memory.

15. The computing device of claim 7, wherein when the transformation operation is the number theory transformation operation, the sorting circuit stores the sorting result of the odd-level operation in the second memory.

16. The computing device of claim 15, wherein the stage operation circuit reads the sorted results of the odd-numbered stage operations from the second memory as the input data of subsequent even-numbered stage operations, and generates the stage operation results of the even-numbered stage operations accordingly.

17. The computing device of claim 16, wherein the sorting circuit sorts the stage operation results of the even-numbered stage operations to generate the sorted results of the even-numbered stage operations, and stores the sorted results of the even-numbered stage operations in the first memory.

18. The computing device of claim 7, wherein when the transformation operation is the inverse number theoretic transformation operation, the sorting circuit reads the input data of the first stage operation from the first memory.

19. The computing device of claim 7, wherein when the transformation operation is the inverse number-theoretic transformation operation, the stage operation circuit stores the stage operation result of the odd-numbered stage operation into the second memory.

20. The computing device of claim 19, wherein the sorting circuit reads the stage operation results of the odd-numbered stage operations from the second memory and sorts them to generate the sorted results of subsequent even-numbered stage operations.

21. The computing device of claim 20, wherein the stage computing circuit uses the sorting results of the even-numbered stage computing as the input data to generate the stage computing results of the even-numbered stage computing correspondingly, and stores the stage computing results of the even-numbered stage computing into the first memory.

22. The computing device of claim 7, wherein the number theoretic transformation operation or the inverse number theoretic transformation operation is applied to a lattice cryptographic system to perform a matrix-vector transformation.

Images