Concurrent constant geometry number-theory transformation structure

Abstract

The invention discloses a number-theory transformation structure of concurrency constant geometry, which uses two polynomial storage blocks to store polynomials, namely a left storage block MembL and a right storage block MembR, each of the left storage block MembL and the right storage block MembR consists of four 1024 * 24 single-port SRAMs (Static Random Access Memory), and n is an integer multiple greater than or equal to 16; and parallel computing of the two butterfly arithmetic units is realized through the four multiplexers, and position transformation of input and output data of the BFU is controlled. To be compatible with multiple algorithms, there is a need for an additional number-theoretical transform constant memory to store a pre-computed twiddle factor to provide a required twiddle factor access bandwidth. According to the method, data independence between polynomial storage blocks is utilized, a modular arithmetic unit of a two-concurrence BFU is designed, and the polynomial multiplication performance is improved by more than one time under the condition that the area increase is limited.

Description

Technical Field

[0001] The present invention belongs to the technical field of lattice cryptographic computing, and in particular relates to a concurrent constant geometry number theory transformation structure. Background Art

[0002] Since 2016, the National Institute of Standards and Technology (NIST) has been soliciting post-quantum cryptography (PQC) schemes for standardization and selection. Among them, lattice-base cryptography (LBC), as an important part of PQC, has become a hot topic in PQC research due to its advantages such as high encryption efficiency. Most LBCs are constructed based on the problem of learning with errors (LWE), that is, extracting vector s from the equation b = As + e, where the matrix A and vector b are known, and e is a random vector sampled from a small error distribution. The LWE problem is defined on a standard lattice and requires a large number of polynomial matrix multiplications and polynomial storage. Among the algorithms standardized by NIST, CRYSTALS-Kyber (Kyber for short) and CRYSTALS-Dilithium (Dilithium for short) are LBC algorithms based on Module-LWE. The former is used for asymmetric encryption, and the latter is used for digital signatures. In LBC, polynomial multiplication is the main cause of the bottleneck, which brings huge challenges to the computing and storage of devices deploying lattice cryptography, especially for resource-constrained IoT applications.

[0003] Polynomial multiplication, as the part with the highest computational complexity and the most memory-intensive access in lattice cryptography, directly affects the performance and area of ​​lattice cryptography hardware implementation. Therefore, the optimization of polynomial multiplication is crucial to improving the area efficiency. Among them, the number-theoretic transform (NTT) is the key operation of polynomial multiplication. Its hardware structure and storage scheme have an important impact on the computational efficiency of polynomial multiplication. In order to speed up heavy computing tasks, it is necessary to optimize the hardware structure of NTT. Furthermore, modular multiplication, as the most basic and widely used operation of polynomial multiplication, directly affects the performance of the butterfly unit (Butterfly Unit, BFU). And BFU, as the core component of NTT calculation, is frequently called in the NTT calculation process. Therefore, optimizing the hardware structure and modular multiplication of NTT in polynomial multiplication is of vital significance to improving the area efficiency of lattice cryptography algorithm accelerators.

[0004] There is a constant geometry NTT structure. The algorithm is shown in Algorithm 1. The coefficients of the polynomial are accessed in the same order at each stage of the NTT, which simplifies the read and write control circuit. For the constant geometry DITNTT, the input data of the BFU at each stage is a[2j] and a[2j+1], and the output data is For constant geometry DIF NTT, the index of the input and output data of each stage BFU is exactly opposite to that of constant geometry DIT NTT. The calculation of constant geometry NTT is not in-situ calculation, and two storage blocks are required to store a and The architecture uses two polynomial storage blocks to store polynomials, namely the left storage block MembankL and the right storage block MembankR. In each stage of NTT, the input and output of BFU ping-pong between MembankL and MembankR, that is, a storage block implements different functions in each NTT stage, either as a read memory or as a write memory. MembankL or MembankR consists of four 1024×24 single-port SRAMs.

[0005] In order to be compatible with multiple algorithms, additional memory is required to store the pre-computed twiddle factors.

[0006]

[0007] In each stage of NTT operation, the BFU reads data from the two single-port SRAMs in the read memory in each clock cycle, and at the same time, writes two data to the two single-port SRAMs in the write memory. Reading and writing occur in different memories, avoiding conflicts.

[0008] Based on the above background, there is still much room for improvement in the research on issues such as insufficient bandwidth utilization and long computing cycle of NTT structures. It is of great significance and value to carry out research on optimizing data flows of constant geometry architectures. Summary of the invention

[0009] Technical problem: For constant geometry NTT operations, the BFU only reads 2 data from the read memory and writes only two data to the write memory in each clock cycle, resulting in insufficient utilization of the memory bandwidth and limiting the performance improvement. The present invention proposes a concurrent constant geometry number theory transformation structure, which can read 4 data from a memory with data independence, or write 4 data to a memory with data independence, in each clock cycle.

[0010] Technical solution: To achieve the above technical problems, the specific technical solution of the present invention is as follows:

[0011] A concurrent constant geometry number-theoretic transform (NTT) structure is disclosed. For the number-theoretic transform NTT operation, two polynomial storage blocks MembL and MembR are used to ping-pong store data in the operation process. The position transformation of the input and output data of the butterfly operation unit (BFU) is controlled by four multiplexers. The multiplexers realize switching the read and write functions of the polynomial storage blocks MembR and MembL when the number-theoretic transform NTT is converted from one stage to another, that is, the two polynomial storage blocks MembR and MembL alternately serve as read storage blocks and write storage blocks. Pre-calculated rotation factors are stored in a number-theoretic transform constant memory (NTTConst.RAM) to provide the required rotation factor access bandwidth. The number-theoretic transform constant memory includes NTTConst.RAM0 and NTT Const.RAM1.

[0012] Furthermore, the polynomial storage block MembL or MembR is composed of four 1024×24 single-port SRAMs, wherein the polynomial storage block MembL is divided into single-port SRAMs Mem L0, Mem L1, Mem L2, and Mem L3, and the polynomial storage block MembR is divided into single-port SRAMs MemR0, MemR1, MemR2, and MemR3. The polynomial storage blocks MembL and MembR have a total of 8192×3 storage words for storing polynomial coefficients.

[0013] Furthermore, two butterfly operation units BFU are used to implement the number theoretic transformation NTT. The two butterfly operation units BFU are referred to as BFU0 and BFU1. Four data are read and written in each cycle, and four addresses need to be generated to read four data from the memory.

[0014] Furthermore, according to the data independence existing in the calculation process of number theory transformation NTT, each storage block divides 4 single-port SRAMs into two parts, each part contains two SRAMs, and four multiplexers control each clock cycle to read 4 data from the polynomial storage block MembL or MembR with data independence, or write 4 data, thereby avoiding the occurrence of memory access conflicts.

[0015] Furthermore, in the first stage Stage1 of the number theoretic transformation NTT operation, the polynomial storage block MembL is used as the read storage block, and the polynomial storage block MembR is used as the write storage block; at this time, BFU0 reads data from MemL0 and Mem L1, and the addresses of the read data are 0, 1, ..., n / 4-1; BFU1 reads data from Mem L2 and Mem L3, and the addresses of the read data are n / 4-1, n / 4-2, ..., 1, 0, avoiding read conflicts; for BFU writing, in the first cycle, BFU0 writes data to Mem R0 and MemR2, and BFU1 writes data to MemR1 and MemR3; in the second cycle, BFU0 writes data to MemR1 and Mem R3, and BFU1 writes data to MemR0 and MemR2; in the third and fourth cycles, the memories written by BFU0 and BFU1 are the same as those in the first and second cycles, that is, the memories written by BFU in each cycle are between MemR1 and MemR3, MemR0 and Mem The two parts composed of R2 alternate to avoid write conflicts; the addresses of BFU0 writing data are 0, n / 4-1, 1, n / 4-2, ..., n / 8-1, n / 8, and the addresses of BFU1 writing data are n / 4-0, n / 4-2, 1 ..., n / 8, n / 8-1; where n is an integer multiple greater than or equal to 16.

[0016] Furthermore, the butterfly operation unit BFU contains two modular multipliers; CRYSTALS-Dilithium and CRYSTALS-Kyber are two modular multipliers based on the polynomial quotient ring R q =Z q [x] / (x n +1), where the modulus q is an NTT-friendly prime number. For CRYSTALS-Dilithium, the polynomial dimension n=256, the modulus q=8380417, and for CRYSTALS-Kyber, the polynomial dimension n=256, the modulus q=3329. Therefore, the polynomial multiplication based on NTT is used to realize the polynomial multiplication. For the (n-1) polynomial a(x)=a0+a1x+a2x 2 +...+a n-1 x n-1 , whose coefficients are expressed as a=(a0,a1,a2,...,a n-1 ), a∈R q , after NTT transformation, it is expressed as For the (n-1) polynomial b(x) = b0+b1x+b2x 2 +...+b n-1 x n-1 , whose coefficients are expressed as b=(b0,b1,b2,...,b n-1 ), b∈R q, after NTT transformation, it is expressed as In CRYSTALS-Dilithium, for the number theory transformation NTT transformation, two polynomials are The point multiplication PWM operation requires one multiplication operation for each point multiplication, that is, Contains (2n-1) coefficients, for (x n +1) After taking the modulus, you can get the ring R q =Z q [x] / (x n +1); therefore, two BFUs are used to complete the PWM operation of two polynomial coefficients each time, and two dot multiplication results are obtained; for CRYSTALS-Kyber, a polynomial of length 256 needs to be divided into two polynomials of length 128 according to the parity of the coefficient index. even (y) and f odd (y), respectively for f even (y) and f odd (y) Perform NTT, where y = x 2 , For two polynomials f,g∈R q , polynomial point multiplication after NTT No longer and The multiplication of the same index coefficients in the polynomial ring is Multiplication of the previous quadratic polynomial; in the multiplication of the quadratic polynomial, br7(i) represents the 7-bit index reversal operation; Apply the Karatsuba algorithm to PWM calculation:

[0017]

[0018] This can be done by calling BFU0 and BFU1 twice; for Then we have:

[0019]

[0020]

[0021] For polynomials The result of PWM operation is expressed as BFU0 and BFU1 read four data from the polynomial memory block The calculation yields two results Write back the polynomial storage block; for the implementation of polynomial PWM, add another polynomial storage block MembL1, MembL and MembL1 are used to store polynomials MembR is used to store calculation results

[0022] Beneficial effect: The present invention utilizes the data independence between polynomial storage blocks and designs a modular arithmetic unit with 2 concurrent BFUs. With limited area increase, the clock cycle required for concurrent constant geometry architecture operations is half of the clock cycle required for constant geometry architecture, achieving more than 1 times improvement in polynomial multiplication performance. Taking 8-point DIF NTT as an example, it takes a total of 6 clock cycles to complete the 8-point constant geometry DIF NTT operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a diagram of the Changgeometry NTT storage architecture;

[0024] Figure 2 It is a schematic diagram of the normal geometry NTT data flow;

[0025] Figure 3 It is a schematic diagram of the 8-point constant geometry NTT operation topology and memory access;

[0026] Figure 4 This is a schematic diagram of 8-point concurrent constant geometry NTT operation memory access;

[0027] Figure 5 It is a concurrent constant geometry NTT structure diagram;

[0028] Figure 6 It is a schematic diagram of concurrent constant geometry NTT data flow;

[0029] Figure 7 This is a diagram of the concurrent constant geometry NTT storage structure PMM data flow. DETAILED DESCRIPTION

[0030] In order to better understand the purpose, structure and function of the present invention, the following is a further detailed description of a concurrent constant geometry number theory transformation structure of the present invention in conjunction with the accompanying drawings.

[0031] In hardware implementation, when there is only one BFU, two addresses corresponding to the polynomial coefficient index pairs need to be generated to read two data from the storage block. In order to make full use of the memory bandwidth, that is, to read and write 4 data per cycle, it is necessary to add a BFU so that the data reading and writing match the processing speed. At this time, 4 addresses need to be generated to read 4 data from the memory. Using two BFUs to implement NTT changes the address generation control logic, where the two BFUs are represented as BFU0 and BFU1 respectively. The concurrent constant geometry NTT algorithm is shown in Algorithm 2. The memory to which the data is written in each iteration of the loop corresponding to the third round is different. Therefore, in hardware implementation, the data output by the two BFUs needs to be transformed before it can be written to MembL or MembR.

[0032]

[0033]

[0034] For the number theory transformation NTT operation, two polynomial storage blocks MembL and MembR are still used to ping-pong store the data in the operation process. The position transformation of the input and output data of the butterfly operation unit BFU is controlled by four multiplexers. The multiplexers realize the switching of the read and write functions of MembR and MembL when the number theory transformation NTT is converted from one stage to another. That is, MembR and MembL alternately act as read storage blocks and write storage blocks. Since there are two BFUs, the read bandwidth requirement of the rotation factor is doubled when performing butterfly operations. The present invention stores the pre-calculated rotation factors through NTTConst.RAM0 and NTT Const.RAM1 to provide the required rotation factor access bandwidth.

[0035] The concurrent constant geometry NTT structure can be configured as two BFUs, including two modular multipliers. CRYSTALS-Dilithium and CRYSTALS-Kyber are two polynomial quotient rings based on R q =Z q [x] / (x n +1), where the modulus q is an NTT-friendly prime number. For CRYSTALS-Dilithium, the polynomial dimension n=256, the modulus q=8380417, and for CRYSTALS-Kyber, the polynomial dimension n=256, the modulus q=3329. Therefore, the polynomial multiplication based on NTT is used to realize the polynomial multiplication. For the (n-1) polynomial a(x)=a0+a1x+a2x 2 +...+a n-1 x n-1 , whose coefficients are expressed as a=(a0,a1,a2,...,a n-1 ), a∈R q , after NTT transformation, it is expressed as For the (n-1) polynomial b(x) = b0+b1x+b2x 2 +...+b n-1 x n-1 , whose coefficients are expressed as b=(b0,b1,b2,...,b n-1 ), b∈R q , after NTT transformation, it is expressed as In CRYSTALS-Dilithium, for the two polynomials after NTT transformation PWM operation, each point multiplication requires a multiplication operation, that is, Contains (2n-1) coefficients, for (x n +1) After taking the modulus, you can get the ring R q =Z q [x] / (x n +1). Therefore, two BFUs can complete the PWM operation of two polynomial coefficients each time and obtain two point multiplication results. For CRYSTALS-Kyber, a polynomial of length 256 needs to be divided into two polynomials of length 128 according to the parity of the coefficient index. even (y) and f odd (y), respectively for f even (y) and f odd (y) Perform NTT, where y = x 2 , For two polynomials f,g∈R q , polynomial point multiplication after NTT is a polynomial ring The multiplication of the above quadratic polynomials; in the multiplication of the quadratic polynomials, br7(i) represents the 7-bit index reversal operation. The present invention uses the Karatsuba algorithm to optimize the multiplication. For the integer multiplication of the following form:

[0036] a×b=(a0+a1×2 n )×(b0+b1×2 n )

[0037] The Karatsuba algorithm can be used to convert it into:

[0038] a×b=a0b0+((a0+a1)(b0+b1)-a0b0-a1b1)×2 n +a1b1×2 2n

[0039] The number of multiplications is reduced from 4 to 3. On this basis, the Karatsuba algorithm is applied to Kyber's PWM calculation:

[0040]

[0041] The number of multiplications required is reduced from 5 to 4, which can be accomplished by calling BFU0 and BFU1 twice. Then we have:

[0042]

[0043]

[0044] For polynomials The result of PWM operation is expressed as BFU0 and BFU1 read four data from the polynomial memory block The calculation yields two results Write back the polynomial storage block. For the implementation of polynomial PWM, add another polynomial storage block MembL1. MembL and MembL1 are used to store polynomials. MembR is used to store calculation results

[0045] like Figure 1 As shown in the figure, the common geometry NTT storage architecture diagram:

[0046] As shown in CG NTT MemoryArch, at each stage of NTT, the input and output of BFU ping-pong between MembankL and MembankR, that is, a memory block implements different functions at each NTT stage, either as a read memory or as a write memory. MembankL or MembankR is composed of four 1024×24 single-port SRAMs. The polynomial memory block MembL is divided into single-port SRAMs Mem L0, Mem L1, Mem L2, and Mem L3, and the polynomial memory block MembR is divided into single-port SRAMs Mem R0, Mem R1, Mem R2, and Mem R3. The polynomial memory blocks MembL and MembR have a total of 8192×3 storage words for storing polynomial coefficients. At each stage of NTT operation, BFU reads data from the two single-port SRAMs in the read memory per clock cycle, and writes two data to the two single-port SRAMs in the write memory at the same time. Reading and writing occur in different memories, avoiding conflicts.

[0047] The constant geometry NTT storage architecture shown in the Memory Bank Design stores the polynomial coefficients in four single-port SRAMs respectively through the lowest two bits of the polynomial parameter index or address, so that the BFU can simultaneously access the polynomial coefficients with indexes or addresses (2j, 2j+1) and (j, j+n / 2). In order to be compatible with multiple algorithms, additional number theory transformation constant memory is required to store pre-calculated rotation factors, including the NTT Const.RAM.

[0048] like Figure 2 As shown, the normal geometry NTT data flow diagram:

[0049] In the data stream of the first two cycles of NTT operation, a represents the data to be processed. Indicates the processed data. In the first cycle, Cycle#1, two data are read from Mem L0 and Mem L1, input to BFU to complete the butterfly operation, and then written back to Mem R0 and Mem R2. The same is true for Cycle#2. When NTT switches from one stage to the next, the data representation of the left and right memories is also in a and When switching between the two, the direction of data flow is also opposite.

[0050] like Figure 3 As shown, the 8-point constant geometry NTT operation topology and memory access diagram:

[0051] To further illustrate the data flow of the common geometry architecture, take the 8-point DIT NTT as an example. Figure 3 As shown in (a), the topology of the 8-point DIT NTT operation is shown, which includes three stages, namely Stage 1, Stage 2 and Stage 3; Figure 3 (b) shows the read and write accesses of Mem L0-3 and Mem R0-3 by BFU in each cycle. It takes 12 clock cycles to complete the 8-point DIT NTT.

[0052] like Figure 4 As shown, the schematic diagram of 8-point concurrent constant geometry NTT operation memory access is as follows:

[0053] Taking 8-point constant geometry DIF NTT as an example, 2 data are first stored in each SRAM of MembankL, and data is accessed in each NTT cycle. In NTT Stage1, MembankL is used as a read storage block. Each time the address of Mem L0 and Mem L1 is read, it is the same, and it is spliced ​​into RDP0; each time the address of Mem L2 and Mem L3 is read, it is the same, and it is spliced ​​into RDP1. Each time the address of MemR0 and Mem R2 is written, it is the same, and it is spliced ​​into WRP0; each time the address of Mem R1 and Mem R3 is written, it is the same, and it is spliced ​​into WRP1. In the first clock cycle, the data at address 0 in RDP0 is independent of the data at address 1 in RDP1, and after the two BFU calculations are completed, the data is written back to address 0 of WRP0 and address 1 of WRP1, and there is no conflict in writing to the memory; in the second clock cycle, the data at address 1 in RDP0 is independent of the data at address 0 in RDP1, and after the two BFU calculations are completed, the data is written back to address 1 of WRP0 and address 0 of WRP1, and there is no conflict in writing to the memory. In Stage2, MembankR is used as a read storage block and MembankL is used as a write storage block. The data access method in each cycle is the same as Stage1. Stage3 switches the read and write functions of MembankR and MembankL again until the calculation of Stage3 is completed, and the 8-point constant geometry DIF NTT operation is completed, which requires a total of 6 clock cycles.

[0054] like Figure 5 As shown, the concurrent constant geometry NTT structure diagram of the present invention is:

[0055] In the first stage of NTT operation, Stage 1, MembL is used as a read memory block and MembR is used as a write memory block. At this time, BFU0 reads data from Mem L0 and Mem L1, and the addresses of the read data are 0, 1, ..., n / 4-1; BFU1 reads data from Mem L2 and MemL3, and the addresses of the read data are n / 4-1, n / 4-2, ..., 1, 0, avoiding read conflicts. For BFU writes, in the first cycle, BFU0 writes data to Mem R0 and Mem R2, and BFU1 writes data to Mem R1 and Mem R3; in the second cycle, BFU0 writes data to Mem R1 and Mem R3, and BFU1 writes data to Mem R0 and Mem R2; in the third and fourth cycles, the memory written by BFU0 and BFU1 is the same as the first and second cycles, that is, the memory written by BFU in each cycle alternates between the two parts consisting of Mem R1 and Mem R3 and Mem R0 and Mem R2, avoiding write conflicts. The addresses for writing data to BFU0 are 0, n / 4-1, 1, n / 4-2, …, n / 8-1, n / 8, and the addresses for writing data to BFU1 are n / 4-0, n / 4-2, 1 …, n / 8, n / 8-1, where n is an integer multiple greater than or equal to 16.

[0056] Since there are two BFUs, the read bandwidth requirement of the rotation factor is doubled when the butterfly operation is performed. The present invention stores the pre-calculated rotation factors through NTT Const. RAM0 and NTT Const. RAM1 to provide the required rotation factor access bandwidth.

[0057] like Figure 6 As shown, the concurrent constant geometry NTT data flow diagram:

[0058] Taking 16-point NTT operation as an example, the data flow of the first two cycles of concurrent constant geometry NTT is shown. In the first cycle Cycle#1, 4 data are read from Mem L0-Mem L3, input to BFU to complete butterfly operation, and then written back to Mem R0-Mem R3. The same is true for Cycle#2. The data flow of INTT is opposite to that of NTT.

[0059] like Figure 7 As shown, the concurrent constant geometry NTT storage structure PMM data flow diagram:

[0060] The data flow of the first two cycles of PWM is shown, taking 16-point polynomial PWM calculation as an example. In the first cycle, BFU reads data from MembL1, MembL's Mem L0, Mem L1, and writes it to MembR's Mem R0 and Mem R1. In the second cycle, BFU reads data from MembL1, MembL's Mem L2, Mem L3, and writes the data back to MembR's Mem R2 and Mem R3. The data reading and writing methods for the third and fourth cycles are the same as the first and second cycles, and so on. BFU alternately reads data from MembL1, MembL's Mem L0, Mem L1 and Mem L2, Mem L3, and the BFU reads and writes the same address of the polynomial storage block. After completing the point multiplication of the two polynomials, INTT is used to store the NTT domain. Convert back to the field of natural numbers.

[0061] In summary, the present invention is based on the constant geometry NTT structure and expands it into a concurrent constant geometry NTT structure, and then processes the algorithm to achieve more than 1 times improvement in polynomial multiplication performance with limited area increase.

[0062] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A concurrent constant geometric number-theoretic transformation structure, characterized in that: For the number theoretic transformation NTT operation, two polynomial storage blocks MembL and MembR are used to ping-pong store the data in the operation process; the position transformation of the input and output data of the butterfly operation unit BFU is controlled by four multiplexers, and the multiplexers realize switching the read and write functions of the polynomial storage blocks MembR and MembL when the number theoretic transformation NTT is converted from one stage to another, that is, the two polynomial storage blocks MembR and MembL alternately act as read storage blocks and write storage blocks; the pre-calculated rotation factors are stored in the number theoretic transformation constant memory to provide the required rotation factor access bandwidth, and the number theoretic transformation constant memory includes NTT Const.RAM0 and NTTConst.RAM1.

2. The number-theoretic transformation structure of concurrent constant geometry according to claim 1, characterized in that: The polynomial storage block MembL or MembR is composed of four 1024×24 single-port SRAMs, where the polynomial storage block MembL is divided into single-port SRAMs MemL0, Mem L1, MemL2, and MemL3, and the polynomial storage block MembR is divided into single-port SRAMs Mem R0, MemR1, MemR2, and MemR3. The polynomial storage blocks MembL and MembR have a total of 8192×3 storage words for storing polynomial coefficients.

3. The number-theoretic transformation structure of concurrent constant geometry according to claim 2, characterized in that: Two butterfly operation units BFU are used to implement number theoretic transformation NTT. The two butterfly operation units BFU are referred to as BFU0 and BFU1. Four data are read and written in each cycle, and four addresses need to be generated to read four data from the memory.

4. The number-theoretic transformation structure of concurrent constant geometry according to claim 3, characterized in that: According to the data independence existing in the calculation process of number theory transformation NTT, each storage block divides 4 single-port SRAMs into two parts, each part contains two SRAMs, and four multiplexers control each clock cycle to read 4 data from the polynomial storage block MembL or MembR with data independence, or write 4 data, thus avoiding the occurrence of memory access conflicts.

5. The concurrent constant geometry number theory transformation structure according to claim 4, characterized in that: In the first stage of the number theory transformation NTT operation, the polynomial storage block MembL is used as the read storage block, and the polynomial storage block MembR is used as the write storage block. At this time, BFU0 reads data from MemL0 and Mem L1, and the addresses of the read data are 0, 1, ..., n / 4-1; BFU1 reads data from MemL2 and MemL3, and the addresses of the read data are n / 4-1, n / 4-2, ..., 1, 0, avoiding read conflicts. For BFU write, in the first cycle, BFU0 writes data to MemR0 and MemR2, and BFU1 writes data to MemR1 and Mem R3; in the second cycle, BFU0 writes data to MemR1 and MemR3, and BFU1 writes data to MemR0 and MemR2; in the third and fourth cycles, the memories written by BFU0 and BFU1 are the same as those in the first and second cycles, that is, the memories written by BFU in each cycle alternate between the two parts consisting of MemR1 and MemR3, and MemR0 and MemR2, avoiding write conflicts; the addresses where BFU0 writes data are 0, n / 4-1, 1, n / 4-2, …, n / 8-1, n / 8, and the addresses where BFU1 writes data are n / 4-0, n / 4-2, 1 …, n / 8, n / 8-1; where n is an integer multiple greater than or equal to 16.

6. The number-theoretic transformation structure of concurrent constant geometry according to claim 5, characterized in that: The butterfly operation unit BFU contains two modular multipliers; CRYSTALS-Dilithium and CRYSTALS-Kyber are two modular multipliers based on the polynomial quotient ring R q =Z q [x] / (x n +1), where the modulus q is an NTT-friendly prime number. For CRYSTALS-Dilithium, the polynomial dimension n=256, the modulus q=8380417, and for CRYSTALS-Kyber, the polynomial dimension n=256, the modulus q=3329. Therefore, the polynomial multiplication based on NTT is used to realize the polynomial multiplication. For the (n-1) polynomial a(x)=a0+a1x+a2x 2 +...+a n-1 x n-1 , whose coefficients are expressed as a=(a0,a1,a2,...,a n-1 ), a∈R q , after NTT transformation, it is expressed as For the (n-1) polynomial b(x) = b0+b1x+b2x 2 +...+b n-1 x n-1 , whose coefficients are expressed as b=(b0,b1,b2,...,b n-1 ), b∈R q , after NTT transformation, it is expressed as In CRYSTALS-Dilithium, for the number theory transformation NTT transformation, two polynomials are The point multiplication PWM operation requires one multiplication operation for each point multiplication, that is, Contains (2n-1) coefficients, for (x n +1) After taking the modulus, you can get the ring R q =Z q [x] / (x n +1); therefore, two BFUs are used to complete the PWM operation of two polynomial coefficients each time, and two dot multiplication results are obtained; for CRYSTALS-Kyber, a polynomial of length 256 needs to be divided into two polynomials of length 128 according to the parity of the coefficient index. even (y) and f odd (y), respectively for f even (y) and f odd (y) Perform NTT, where y = x 2 , For two polynomials f,g∈R q , polynomial point multiplication after NTT is a polynomial ring Multiplication of the previous quadratic polynomial; in the multiplication of the quadratic polynomial, br7(i) represents the 7-bit index reversal operation; Apply the Karatsuba algorithm to PWM calculation: This can be done by calling BFU0 and BFU1 twice; for Then we have: For polynomials The result of PWM operation is expressed as BFU0 and BFU1 read four data from the polynomial memory block The calculation yields two results Write back the polynomial storage block; for the implementation of polynomial PWM, add another polynomial storage block MembL1, MembL and MembL1 are used to store polynomials MembR is used to store calculation results

Images