A Base-4 NTT Hardware Architecture Based on Constant Geometry and Its Memory Access Method

Abstract

This invention relates to a radix-4 NTT hardware architecture and its memory access method based on a constant geometry structure, belonging to the field of lattice cryptography. To improve the computation speed of the NTT operation unit in lattice cryptography, the invention includes a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit. The control unit is connected to the address generator, which is connected to both the rotation factor memory and the coefficient memory. The rotation factor memory is connected to the PE operation unit, and the coefficient memory is connected to the PE operation unit via a multiplexer. The coefficient memory contains a storage block. The PE operation unit contains a radix-4 butterfly operation unit. This invention designs an efficient storage scheme, enabling the reading of 8 coefficients within one cycle, thus improving the computation speed of the NTT operation unit in lattice cryptography.

Description

Technical Field

[0001] This invention belongs to the field of lattice cryptography, specifically relating to a radix-4NTT hardware architecture based on a constant geometric structure and its memory access method. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptography algorithms face the risk of being cracked by Shor's quantum algorithm. In 2022, the National Institute of Standards and Technology (NIST) identified four post-quantum cryptography algorithms, three of which are based on mathematically difficult problems on lattices. In lattice cryptography based on the Module Learning With Errors (MLWE) problem, the NTT (Network Tolerance) operation unit consumes significant computational resources.

[0003] NTT is a method for rapidly computing the Discrete Fourier Transform (DFT) using a divide-and-conquer strategy. Its core idea is to select... The unit original root in the model Evaluate under the integer ring to convert the polynomial coefficient representation into a point-value representation. Point NTT is defined as:

[0004] ,

[0005] The vector in the above formula For polynomial coefficients, The result of the NTT transformation. The rotation factor is NTT in the polynomial annular domain. Up operation, Indicates the coefficient in the modulus All polynomials in the ring of integers, modular polynomials in lattice ciphers based on MLWE for Negative-Wrapped Convolution (NWC) can be used to avoid zero-padding, but for prime numbers... Need to meet This method requires preprocessing the input vector before performing the NTT transform. The preprocessing formula is as follows:

[0006]

[0007] In the formula This is the square root of the rotation factor. This method increases the amount of modular multiplication. To reduce computational complexity, the preprocessing operations can be merged into the NTT, as shown in the following formula:

[0008] ,

[0009] The radix-2 NTT method groups the above formulas according to the parity of the input vector indices, and then simplifies them using the reducibility, symmetry, and periodicity of the rotation factor. The base-2 NTT of the point needs Each stage requires a total of [number] steps. Modular multiplication, modular addition, and modular subtraction operations are performed. The radix-2 NTT is characterized by its simple structure and flexible configuration, but parallel operation of multiple radix-2 butterfly units requires high memory bandwidth. The base-4 NTT of the point needs Each stage requires a total of [number] steps. The radix-4 NTT algorithm introduces constant coefficient multiplication, which can be implemented using shift and addition operations, thus reducing hardware resource overhead. Radix-4 NTT is characterized by high computational speed, but its control logic and data flow are complex.

[0010] There are two main types of data flow structures for NTT. NTTs based on in-situ computation do not require additional storage space in hardware implementation and have the same input / output addresses, but the coefficient reading pattern differs in each stage. NTTs based on constant geometry have a consistent data flow within and between stages, simplifying the coefficient reading pattern, but typically require twice the storage space. Summary of the Invention

[0011] The problem this invention aims to solve is to improve the computation speed of NTT operation units in lattice cryptography, and proposes a radix-4 NTT hardware architecture based on a constant geometry and its memory access method.

[0012] To achieve the above objectives, the present invention provides the following technical solution:

[0013] A radix-4NTT hardware architecture based on constant geometry includes a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit;

[0014] The control unit is connected to an address generator, which is connected to a rotation factor memory and a coefficient memory. The rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit via a multiplexer. The coefficient memory contains a storage unit. The PE operation unit contains a radix-4 butterfly operation unit.

[0015] Furthermore, the control unit generates the number of stages in the NTT calculation process. Steps The storage addresses for the number of groups G, the number of rounds T, and the twitch factor are as follows: , , , N is the total number of unit primitive roots, and the control unit also generates enable signals for the coefficient memory and the rotation factor memory.

[0016] Furthermore, the coefficient memory is used to store polynomial coefficients. The coefficient memory includes four memory banks: Bank0 (zeroth bank), Bank1 (first bank), Bank2 (second bank), and Bank3 (third bank), implemented using a dual-port Block RAM in an FPGA device. The number of memory addresses for each bank is... Furthermore, one address stores two coefficients; each stage reads from the memory. The data is processed step by step. In each step, two coefficients are read from one address of each of the four memory banks. These eight data are then processed by the radix-4 butterfly arithmetic unit and written back to the corresponding address of each memory bank.

[0017] Furthermore, the address generator is used to generate the original address of the memory bank, the new address of the memory bank, and the memory bank enable signal.

[0018] Furthermore, the rotation factor memory is used to store the rotation factor pre-calculated during the NTT operation.

[0019] Furthermore, the multiplexer consists of two sets of multiplexers. The first set of four multiplexers controls the reading of polynomial coefficients from the corresponding memory bank, while the second set of four multiplexers controls the writing of the corresponding reassembled data back to memory bank.

[0020] Furthermore, the PE operation unit is equipped with two parallel radix-4 butterfly operation units for performing NTT calculations;

[0021] Each radix-4 butterfly arithmetic unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, employing... -RED algorithm improves modular multiplication operation The first step of the -RED algorithm is to multiply the two input operands, and then process the product... Perform two K-RED operations;

[0022] Setting the modulus in K-RED calculation , It is an odd number, and Assuming the high and low digits of the product are respectively and ,So , The final output result The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the verifier performs verification based on the combination of the values ​​of sign1 and sign2. The verification value is added to the numerical bits of the output result of the second K-RED operation to obtain the final modular multiplication result.

[0023] Furthermore, the radix-4 NTT method based on constant geometry set in each radix-4 butterfly arithmetic unit includes the following steps:

[0024] S1. Set the input parameters to polynomial coefficients. The square root of the rotation factor The total number of unit primitive roots Modulus ;

[0025] S2. Set the first variable Second variable Third variable and the fourth variable The first variable The value ranges from 0 to , The second variable The value ranges from 0 to The fourth variable The value ranges from 0 to Through variables , , and To control the polynomial coefficients input to each butterfly unit;

[0026] S3. Settings The four twitch factors included in a radix-4 butterfly arithmetic unit are first used to generate the basic twitch factor. The expression is:

[0027]

[0028] Then the expression for calculating the twiddle factor in asynchronous operations is:

[0029]

[0030]

[0031]

[0032] The coefficient is constant.

[0033] S4. Set the radix-4 butterfly arithmetic unit to two levels of operation. The expression for the first level of operation is:

[0034]

[0035]

[0036]

[0037]

[0038] The expression for the second-level operation is:

[0039]

[0040]

[0041]

[0042] ;

[0043] S5. Generation per stage of the basal-4NTT method based on constant geometry. The indexing process involves generating four coefficient indices at each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is 0. Meanwhile, the difference between indices in each step is The difference between the four positions after data processing is 1, and the difference between the different starting positions is 4. The final output result is stored in a different position than the coefficient reading.

[0044] A memory access method based on a radix-4NTT hardware architecture with constant geometry, implemented using the aforementioned radix-4NTT hardware architecture with constant geometry, includes the following steps:

[0045] Step 1. The prerequisite for setting the conflict-free address access mode is: Greater than 16 and a power of 4;

[0046] Step 2. The address reading pattern in the conflict-free address access mode is as follows: Each step reads the same address from four memory banks. The memory bank addresses are read sequentially between steps. After the last address of a memory bank is read, the next step reads the first address of the memory bank. The number of steps... The addresses read from each memory bank are represented as follows:

[0047]

[0048] Step 3. Set the write address rule for the conflict-free address access mode as follows: if in each stage... The steps are divided into 4 groups, each group has In a round, the address offset between rounds within a group is 4. When the address space is insufficient, the offset continues to the starting address for subsequent offsets. Each group is written back to memory. If the addresses are the same, and the addresses of the same round of data written back to the same memory bank from different groups are different, then the address of the first... The data of the number of groups G in the phase and the number of rounds T are written back to the first... The new address of each memory bank is:

[0049] .

[0050] The beneficial effects of this invention are:

[0051] The present invention discloses a radix-4 NTT hardware architecture based on a constant geometry structure, which reduces the clock cycle of the NTT operation unit in lattice cipher by merging preprocessing operations and eliminating reordering operations.

[0052] The present invention discloses a radix-4 NTT hardware architecture based on a constant geometry structure, and designs an efficient storage scheme to enable the reading of 8 coefficients in one cycle, thereby improving the calculation speed of the NTT operation unit in lattice cipher.

[0053] This invention discloses a radix-4 NTT hardware architecture based on a constant geometry structure, which designs an efficient conflict-free address access mode. Compared with the traditional ping-pong storage method, the storage space is reduced from... Reduced to This reduced memory usage by 12.5% ​​and decreased hardware resource consumption. Attached Figure Description

[0054] Figure 1 This is a schematic diagram of a base-4NTT hardware architecture based on a constant geometry, as described in this invention.

[0055] Figure 2 This is a schematic diagram of the basic-4 butterfly unit structure of the present invention;

[0056] Figure 3 This is a schematic diagram of the 1024-point radix-4 NTT memory access method based on constant geometry structure of the present invention. In the figure, (a) is the first memory bank, (b) is the second memory bank, (c) is the third memory bank, and (d) is the fourth memory bank.

[0057] Figure 4 The module of this invention A schematic diagram of the modular multiplication unit;

[0058] Figure 5 This is a schematic diagram of the verifier of the present invention;

[0059] Figure 6 This is the pseudocode for the radix-4NTT algorithm based on constant geometry. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention; that is, the described specific embodiments are merely a part of the embodiments of the invention, and not all of them. The components of the specific embodiments of the invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations, and the invention may also have other embodiments.

[0061] Therefore, the following detailed description of specific embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected specific embodiments of the invention. All other specific embodiments obtained by those skilled in the art based on these specific embodiments without inventive effort are within the scope of protection of this invention.

[0062] To further understand the invention's content, features, and effects, the following specific embodiments are provided, along with accompanying drawings. Figure 1 -Appendix Figure 6 Detailed explanation is as follows:

[0063] Example 1:

[0064] A radix-4NTT hardware architecture based on constant geometry includes a control unit, an address generator, a rotation factor memory, a coefficient memory, a multiplexer, and a PE operation unit;

[0065] The control unit is connected to an address generator, which is connected to a rotation factor memory and a coefficient memory. The rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit via a multiplexer. The coefficient memory contains a storage unit. The PE operation unit contains a radix-4 butterfly operation unit.

[0066] Furthermore, the control unit generates the number of stages in the NTT calculation process. Steps The storage addresses for the number of groups G, the number of rounds T, and the twitch factor are as follows: , , , N is the total number of unit primitive roots, and the control unit also generates enable signals for the coefficient memory and the rotation factor memory.

[0067] Furthermore, the coefficient memory is used to store polynomial coefficients. The coefficient memory includes four memory banks: Bank0 (zeroth bank), Bank1 (first bank), Bank2 (second bank), and Bank3 (third bank), implemented using a dual-port Block RAM in an FPGA device. The number of memory addresses for each bank is... Furthermore, one address stores two coefficients; each stage reads from the memory. The data is processed step by step. In each step, two coefficients are read from one address of each of the four memory banks. These eight data are then processed by the radix-4 butterfly arithmetic unit and written back to the corresponding address of each memory bank.

[0068] Furthermore, the total storage capacity of the coefficient memory is ;

[0069] Furthermore, the address generator is used to generate the original address of the memory bank, the new address of the memory bank, and the memory bank enable signal.

[0070] Furthermore, the original address of the memory bank is the address that needs to be read from the memory bank, and the new address of the memory bank is the address that is written back to the memory bank after the operation from the butterfly unit;

[0071] Furthermore, the rotation factor memory is used to store the rotation factor pre-calculated during the NTT operation.

[0072] Furthermore, the multiplexer consists of two sets of multiplexers. The first set of four multiplexers controls the reading of polynomial coefficients from the corresponding memory bank, while the second set of four multiplexers controls the writing of the corresponding reassembled data back to memory bank.

[0073] Furthermore, Figure 1 The left-hand MUXs contain four multiplexers used to control the reading of polynomial coefficients from their respective memory banks. Then, the output data of each multiplexer is decomposed and sent to the corresponding inputs of the two butterfly arithmetic units. Specifically, the high-order data from the output of the Lth multiplexer is sent to the Lth input of the first butterfly unit, while the low-order data is sent to the Lth input of the second butterfly unit (L=1, 2, 3, 4). The control signals for the first group of four multiplexers are as follows: , , and , Starting from 0, read each step of data. Add 1. After the data at the output of the butterfly unit is reassembled, Figure 1The four multiplexers on the right side of the MUXs are used to control the corresponding reassembled data being written back to memory. Specifically, the reassembly process involves concatenating the data from the first and third outputs of the first butterfly unit, concatenating the data from the second and fourth outputs of the first butterfly unit, concatenating the data from the first and third outputs of the second butterfly unit, and concatenating the data from the second and fourth outputs of the second butterfly unit. The control signals for the second group of four multiplexers are as follows: , , and , Starting from 0, after writing each... Step data Decrease by 1. Write the output data of the first selector back. The output data of the second selector is written back. The output data of the third selector is written back. The output data of the fourth selector is written back. .

[0074] Furthermore, the PE operation unit is equipped with two parallel radix-4 butterfly operation units for performing NTT calculations;

[0075] Furthermore, the radix-4NTT algorithm is derived as follows:

[0076] Based on the input index, the original sequence is divided into four parts, as shown in the following formula:

[0077]

[0078] Based on the properties of the rotation factor, the formula can be simplified to obtain:

[0079]

[0080] In the formula , , , Following the above method, the formula is decomposed and recombined, thus breaking down the matrix multiplication process into two layers of operations. The first layer of operations includes... , , and The second layer of operations includes , , and The base-4 butterfly unit, such as Figure 2 As shown, Point base -4NTT requires One radix-4 butterfly operation unit;

[0081] Each radix-4 butterfly arithmetic unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, employing... -RED algorithm improves modular multiplication operation The first step of the -RED algorithm is to multiply the two input operands, and then process the product... Perform two K-RED operations;

[0082] Setting the modulus in K-RED calculation , It is an odd number, and Assuming the high and low digits of the product are respectively and ,So , The final output result The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the verifier performs verification based on the combination of the values ​​of sign1 and sign2. The verification value is added to the numerical bits of the output result of the second K-RED operation to obtain the final modular multiplication result.

[0083] Furthermore, the output after performing K-RED twice consecutively is not a modular multiplication result. , but Therefore, to ensure the correct modular multiplication result is output, the pre-calculated twitch factor needs to be multiplied by . ;

[0084] To further reduce clock cycles, the NTT operation order was adjusted to avoid reordering the input data, thus achieving an NTT algorithm with reversed output order. To simplify the coefficient memory access method, a radix-4 NTT algorithm based on a constant geometry was adopted.

[0085] Furthermore, the radix-4 NTT method based on constant geometry set in each radix-4 butterfly arithmetic unit includes the following steps:

[0086] S1. Set the input parameters to polynomial coefficients. The square root of the rotation factor The number of points involved in NTT calculation Modulus ;

[0087] S2. Set the first variable Second variable Third variable and the fourth variable The first variable The value ranges from 0 to , The second variable The value ranges from 0 to The fourth variable The value ranges from 0 to Through variables , , and To control the polynomial coefficients input to each butterfly unit;

[0088] S3. Settings The four twitch factors included in a radix-4 butterfly arithmetic unit are first used to generate the basic twitch factor. The expression is:

[0089]

[0090] Then the expression for calculating the twiddle factor in asynchronous operations is:

[0091]

[0092]

[0093]

[0094] =Constant coefficient;

[0095] S4. Set the radix-4 butterfly arithmetic unit to two levels of operation. The expression for the first level of operation is:

[0096]

[0097]

[0098]

[0099]

[0100] The expression for the second-level operation is:

[0101]

[0102]

[0103]

[0104] ;

[0105] S5. Generation per stage of the basal-4NTT method based on constant geometry. The indexing process involves generating four coefficient indices at each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is 0. Meanwhile, the difference between indices in each step is The difference between the four positions after data processing is 1, and the difference between the different starting positions is 4. The final output result is stored in a different position than the coefficient reading.

[0106] The following is an example illustrating specific lattice cipher parameters, using a modulus. , Parameters:

[0107] 1) The control unit generates the number of stages in the NTT operation process. Steps ( ), number of groups ( ), number of rounds The addresses for the rotation factor memory and the rotation factor memory are determined, and enable signals are generated for the coefficient memory and the rotation factor memory.

[0108] 2) The coefficient memory contains four memory banks, each with 224 storage addresses, and two coefficients are stored at each address, so the total storage capacity is 6272 bits.

[0109] 3) Completing a 1024-point basal-4NTT based on a constant geometry requires 5 stages, each stage requires 128 steps, and each step reads 8 data points from 4 storage banks.

[0110] 4) The rotation factor memory is used to store the rotation factors pre-calculated during the NTT operation. The rotation factor values ​​can be obtained from Table 1. To ensure the correct modular multiplication result is output, the pre-calculated rotation factors need to be multiplied by [the specified value]. .

[0111] 5) Completing the 1024-point radix-4 NTT algorithm based on constant geometry requires 5 stages, each stage requiring 256 radix-4 butterfly unit operations. Taking the first step of the first stage as an example, the first layer of operations of the first radix-4 butterfly unit includes:

[0112]

[0113]

[0114]

[0115] ;

[0116] The second-level operations of the first radix-4 butterfly arithmetic unit include:

[0117]

[0118]

[0119]

[0120] ;

[0121] The first level of operations of the second radix-4 butterfly arithmetic unit includes:

[0122]

[0123]

[0124]

[0125] ;

[0126] The second layer of operations in the second radix-4 butterfly arithmetic unit includes:

[0127]

[0128]

[0129]

[0130] .

[0131] Modular multiplication in the butterfly unit is performed by -RED algorithm completes as follows Figure 4 and Figure 5 As shown. Because the modulus satisfies Therefore, it is possible to choose The K-RED algorithm requires two K-RED operations. First, the two 14-bit input operands are multiplied to obtain a 28-bit product. The high 16 bits and low 12 bits of the product are denoted as Ch and Cl, respectively. Then, 3Cl-Ch is calculated to obtain a 17-bit signed number (the first sign bit is denoted as sign1). Next, a second K-RED operation is performed. The 16-bit value of the first K-RED output is divided into high 4 bits and low 12 bits, denoted as Ch' and Cl', respectively. Then, 3Cl'-Ch' is calculated to obtain a 15-bit signed number (the first sign bit is denoted as sign2). Finally, the combination of sign1 and sign2 is used for verification in a checker. The resulting check value is added to the low 14 bits of the second K-RED output to obtain the final modular multiplication result.

[0132] 6) Two sets of multiplexers are needed in total. The first set of four multiplexers is used to control the reading of polynomial coefficients from the corresponding memory banks, and then the data at the output of each multiplexer is decomposed and sent to the corresponding inputs of the two butterfly arithmetic units. The control signals for the four multiplexers in the first set are as follows: , , and , Starting from 0, increment by 1 each time, up to 639. After the data at the butterfly unit output is reassembled, the second group of four multiplexers is used to control the corresponding reassembled data to be written back to memory. The control signals for the second group of four multiplexers are as follows: , , and , Starting from 0, write data in 32 steps. Decrease by 1. Write the output data of the first selector back. The output data of the second selector is written back. The output data of the third selector is written back. The output data of the fourth selector is written back. .

[0133] Example 2:

[0134] A memory access method based on a radix-4NTT hardware architecture with constant geometry, implemented using the radix-4NTT hardware architecture with constant geometry described in Example 1, includes the following steps:

[0135] Step 1. The prerequisite for setting the conflict-free address access mode is: Greater than 16 and a power of 4;

[0136] Step 2. The address reading pattern in the conflict-free address access mode is as follows: Each step reads the same address from four memory banks. The memory bank addresses are read sequentially between steps. After the last address of a memory bank is read, the next step reads the first address of the memory bank. The number of steps... The addresses read from each memory bank are represented as follows:

[0137]

[0138] Step 3. Set the write address rule for the conflict-free address access mode as follows: if in each stage... The steps are divided into 4 groups, each group has In a round, the address offset between rounds within a group is 4. When the address space is insufficient, the offset continues to the starting address for subsequent offsets. Each group is written back to memory. If the addresses are the same, and the addresses of the same round of data written back to the same memory bank from different groups are different, then the address of the first... The data of the number of groups G in the phase and the number of rounds T are written back to the first... The new address of each memory bank is:

[0139] .

[0140] Further examples are as follows:

[0141] Since the data flow structure is consistent at each stage, radix-4 only discusses the conflict-free memory access mode of the first stage, such as... Figure 3 As shown. For ease of description, the 128 steps in the first phase are divided into 4 groups, each with 32 rounds. In step 0 of the first phase, the steps are performed in parallel from... , , , Extracting polynomial coefficients from address 0 and , and , and , and After these 8 coefficients are processed by the butterfly unit, the new data... and Written back The 128 address, and Written back The 129 address, and Written back address 130 and Written back Address 131. Until step 31 of the first phase (i.e., round 31 of group 0), proceed in parallel from... , , , Extract the polynomial coefficients from address 31 and , and , and , and After these 8 coefficients are processed by the butterfly unit, the new data... and Written back Address 28 and Written back Address 29, and Written back Address 30, and Written back Address 31. In subsequent steps of the first phase, following the storage rules described above, the addresses read from the memory bank in each step are read sequentially and consecutively, and each group is written back to the same address. However, the addresses of the same rounds of data from different groups written back to the same memory bank are different. For example, in step 127 of the first phase (i.e., round 31 of group 3), data is read in parallel from memory bank 31. , , , Extract the polynomial coefficients from address 127 and , and , and , and After these 8 coefficients are processed by the butterfly unit, the new data... and Written back Address 29, and Written back Address 30, and Written back address 31, and Written back Address 28. At this point, the first stage of the operation is complete. The remaining four stages follow the same read / write memory access rules as the first stage.

[0142] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0143] Although this application has been described above with reference to specific embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of this application. In particular, as long as there is no structural conflict, the features in the specific embodiments disclosed in this application can be combined with each other in any way. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, this application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A radix-4 NTT hardware system based on a constant geometry, characterized in that, Includes a control unit, address generator, rotation factor memory, coefficient memory, multiplexer, and PE arithmetic unit; The control unit is connected to an address generator, which is connected to a rotation factor memory and a coefficient memory. The rotation factor memory is connected to a PE operation unit, and the coefficient memory is connected to the PE operation unit via a multiplexer. The coefficient memory contains a storage unit. The PE operation unit contains a radix-4 butterfly operation unit. The PE operation unit is equipped with two parallel radix-4 butterfly operation units for performing NTT calculations; Each radix-4 butterfly arithmetic unit performs 4 modular multiplication operations, 4 modular addition operations, and 4 modular subtraction operations, employing... The -RED algorithm performs modular multiplication. The first step of the -RED algorithm is to multiply the two input operands, and then process the product... Perform two K-RED operations; Setting the modulus in RED operations , It is an odd number, and Assuming the high and low digits of the product are respectively and ,So , The final output result The first sign bit of the output result of the first K-RED operation is recorded as sign1, and the first sign bit of the output result of the second K-RED operation is recorded as sign2. Finally, the verifier performs verification based on the combination of sign1 and sign2. The verification value is added to the numerical bits of the output result of the second K-RED operation to obtain the final modular multiplication result. The radix-4 NTT method based on constant geometry, set in each radix-4 butterfly operation unit, includes the following steps: S1. Set the input parameters to polynomial coefficients. The square root of the rotation factor The number of points involved in NTT calculation Modulus ; S2. Set the first variable Second variable Third variable and the fourth variable The first variable The value ranges from 0 to , The second variable The value ranges from 0 to The fourth variable The value ranges from 0 to Through variables , , and To control the polynomial coefficients input to each butterfly unit; S3. Settings The four twitch factors included in a radix-4 butterfly arithmetic unit are first used to generate the basic twitch factor. The expression is: ； Then the expression for calculating the twiddle factor in asynchronous operations is: ； ； ； The coefficient is constant. S4. Set the radix-4 butterfly arithmetic unit to two levels of operation. The expression for the first level of operation is: ； ； ； ； The expression for the second-level operation is: ； ； ； ； S5. Generation per stage of the basal-4NTT method based on constant geometry. The indexing process involves generating four coefficient indices at each step. The first coefficient index in the first step is 0, the first coefficient index in the second step is 1, and so on, until the first coefficient index in the last step is 0. Meanwhile, the difference between indices in each step is The difference between the four positions after data processing is 1, and the difference between the different starting positions is 4. The final output result is stored in a different position than the coefficient reading.

2. The radix-4NTT hardware system based on a constant geometry structure according to claim 1, characterized in that, The control unit generates the number of stages in the NTT calculation process. Steps The storage addresses for the number of groups G, the number of rounds T, and the twitch factor are as follows: , , , N is the number of points participating in the NTT operation, and the control unit also generates enable signals for the coefficient memory and the rotation factor memory.

3. A radix-4 NTT hardware system based on a constant geometry structure according to claim 1 or 2, characterized in that, The coefficient memory is used to store polynomial coefficients. The coefficient memory comprises four memory banks: Bank0 (zeroth bank), Bank1 (first bank), Bank2 (second bank), and Bank3 (third bank), implemented using a dual-port Block RAM in an FPGA device. The number of memory addresses in each bank is... Furthermore, one address stores two coefficients; each stage reads from the memory. The data is processed step by step. In each step, two coefficients are read from one address of each of the four memory banks. These eight data are then processed by the radix-4 butterfly arithmetic unit and written back to the corresponding address of each memory bank.

4. The radix-4NTT hardware system based on a constant geometry structure according to claim 3, characterized in that, The address generator is used to generate the original address of the memory bank, the new address of the memory bank, and the memory bank enable signal.

5. A radix-4 NTT hardware system based on a constant geometry according to claim 4, characterized in that, The rotation factor storage is used to store the rotation factor pre-calculated during the NTT operation.

6. A radix-4 NTT hardware system based on a constant geometry structure according to claim 5, characterized in that, The multiplexer consists of two sets of multiplexers. The first set of four multiplexers controls the reading of polynomial coefficients from the corresponding memory bank, while the second set of four multiplexers controls the writing of the corresponding recombined data back to memory bank.

7. A memory access method for a radix-4 NTT hardware system based on a constant geometry, implemented using the radix-4 NTT hardware system based on a constant geometry as described in any one of claims 1-6, characterized in that, Includes the following steps: Step 1. The prerequisite for setting the conflict-free address memory access mode is: Greater than 16 and a power of 4; Step 2. The address reading pattern in the conflict-free address access mode is as follows: Each step reads the same address from four memory banks. The memory bank addresses are read sequentially between steps. After the last address of a memory bank is read, the next step reads the first address of the memory bank. The number of steps... The addresses read from each memory bank are represented as follows: ； Step 3. Set the write address rule for the conflict-free address access mode as follows: if in each stage... The steps are divided into 4 groups, each group has In a round, the address offset between rounds within a group is 4. When the address space is insufficient, the offset continues to the starting address for subsequent offsets. Each group is written back to memory. If the addresses are the same, and the addresses of the same round of data written back to the same memory bank from different groups are different, then the address of the first... The data of the number of groups G and the number of rounds T in the phase are written back to the first... The new address of each memory bank is: 。

Images