Cryptographic algorithm BIKE-oriented binary polynomial multiplier and encryption method

Abstract

The invention provides a binary polynomial multiplier for a cryptographic algorithm BIKE and an encryption method, which start from data characteristics and calculation characteristics of polynomial sparsity in the cryptographic algorithm BIKE, convert binary polynomial multiplication into vector matrix multiplication, and split vector and matrix blocks to perform block-by-block calculation, so that the cryptographic algorithm BIKE is obtained. In the calculation process, the inter-block sparsity and the intra-block sparsity are combined, and the calculation amount is greatly reduced.

Description

Technical Field

[0001] The present invention relates to hardware implementation of a post-quantum cryptographic algorithm, and in particular to a binary polynomial multiplier and an encryption method for a cryptographic algorithm BIKE. Background Art

[0002] With the rapid development and practical application of quantum computing technology, traditional encryption algorithms based on mathematical problems, such as RSA and ECC, are facing potential security threats of being cracked by quantum computing. According to conservative estimates, around 2035, the public key cryptography system that ensures data and network security will face cracking by large-scale quantum computers, which poses a huge challenge to information security such as public communications, financial transactions, and personal privacy. Considering that the time cycle for upgrading cryptographic infrastructure usually takes nearly 10 years, and the long-term nature of my country's core data confidentiality needs (up to decades), it is imperative to conduct research on efficient hardware implementation of post-quantum cryptography (PQC) algorithms. Post-quantum cryptographic chips will provide long-term security for information technology systems, and can maintain the strength of encryption without being cracked even after quantum computers mature. Post-quantum cryptography technology can promote the transition of existing systems to more secure encryption technology, including updating communication protocols, storage systems, and other key infrastructure.

[0003] As a key encapsulation scheme based on error-correcting codes, BIKE not only has high security, but also has advantages in computational efficiency and implementation complexity, making it particularly suitable for resource-constrained environments. Its design combines modern coding theory and cryptography, enabling it to provide strong security guarantees in quantum environments, promoting the research and application of post-quantum cryptography, and becoming an important development direction in the field of cryptography. Different from lattice-based cryptographic algorithms, coding-based cryptographic algorithms enrich the field of post-quantum cryptographic algorithms and provide a wider range of choices for security applications. As the core operator of the BIKE cryptographic algorithm, the computational performance of binary polynomial multiplication directly determines the encryption speed of the BIKE cryptographic algorithm.

[0004] For binary polynomial multiplication, some scholars have proposed two methods to calculate binary polynomial multiplication: a divide-and-conquer strategy based on textbook multiplication and a method to rotate the polynomial with i-bit index. Furthermore, the researchers converted the polynomial multiplication into vector-matrix multiplication and calculated the columns block by block according to the design concept of parallel processing of b bits. This method is easy to integrate with other hardware structures and greatly reduces the use of storage resources. In addition, the researchers took into account the sparsity of the polynomial and optimized the design of sparse polynomial multiplication by reading the non-zero index of the sparse polynomial, then rotating it to the left according to these indexes, and accumulating the results of the rotation into the product, thereby greatly improving efficiency and reducing latency.

[0005] However, existing binary polynomial multiplication algorithms and hardware still have the following problems:

[0006] 1. Some existing binary polynomial multiplication algorithms do not utilize the sparsity of polynomials to reduce operations at all, while some existing binary polynomial multiplication algorithms only consider inter-block sparsity but ignore intra-block sparsity to further eliminate invalid calculations.

[0007] 2. Some existing binary polynomial multiplication algorithms combine sparsity and mainly process single non-zero elements in a pipeline manner. They cannot process multiple non-zero elements at the same time and cannot fully utilize sparsity and efficiently implement pipelines at the same time.

[0008] Therefore, how to calculate binary polynomial multiplication more efficiently has become one of the core issues in the efficient hardware implementation of the current BIKE cryptographic algorithm. Summary of the invention

[0009] In order to solve the above problems of the prior art, the present invention provides a binary polynomial multiplier and encryption method for the cryptographic algorithm BIKE, which combines inter-block sparsity and intra-block sparsity to greatly reduce the amount of calculation.

[0010] The present invention is achieved through the following technical solutions:

[0011] A binary polynomial multiplier for a cryptographic algorithm BIKE, comprising: a preprocessing module, a storage module A, a storage module B, a storage module C, a PE array, and a vector-matrix conversion module;

[0012] The preprocessing module is used to divide the vector A corresponding to the binary polynomial a(x) into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and divide the non-zero vector blocks into d / 8 data units, where d represents the size of the vector block; if there is a data unit with more than 4 non-zero elements in the d / 8 data units, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial a(x) is a sparse polynomial;

[0013] The storage module A is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; when the overflow flag of the non-zero vector block is 0, only 4-bit elements in each data unit are stored; when the overflow flag of the non-zero vector block is 1, 8-bit elements in each data unit are stored;

[0014] The storage module B is used to store the binary polynomial b(x);

[0015] The storage module C is used to store a binary polynomial c(x), c(x)=a(x)×b(x); the vector corresponding to c(x) is vector C;

[0016] The PE array is used to multiply the non-zero vector blocks stored in the storage module A with the corresponding rows in the matrix CB, and accumulate them with the vector C, and write the output into the storage module C for updating;

[0017] The vector-matrix conversion module is used to cyclically arrange the coefficients of the binary polynomial b(x) by rows to obtain a circulant matrix B, and delete the redundant blocks in the circulant matrix B corresponding to the zero vector blocks in the n vector blocks to obtain a matrix CB.

[0018] Preferably, the storage module A is a multi-BANK structure, including A_BANK1, A_BANK2 and A_BANK3; A_BANK1, A_BANK2 and A_BANK3 all have a d-bit width and a w-bit depth, where w represents the sparsity of the binary polynomial a(x); the A_BANK1 is used to store the block number and overflow flag corresponding to the non-zero vector block; each non-zero vector block is divided into two parts, which are stored in A_BANK2 and A_BANK3 respectively.

[0019] Furthermore, for A_BANK2 and A_BANK3, if the overflow flag of the non-zero vector block is 0, each part of the non-zero vector block is stored in a corresponding address space; if the overflow flag of the non-zero vector block is 1, each part is divided and stored in two address spaces.

[0020] Furthermore, the PE array includes two processing unit arrays, namely PEA1 and PEA2, and PEA1 and PEA2 correspond to A_BANK2 and A_BANK3 respectively.

[0021] Furthermore, the outputs of the last row of processing units in PEA1 are connected to the inputs of the first row in PEA2.

[0022] Furthermore, each processing unit array is composed of a plurality of processing units, each processing unit includes 16 computing units; each computing unit includes four AND gates and four XOR gates.

[0023] Furthermore, the number of processing units in each processing unit array is P num satisfy:

[0024]

[0025] Preferably, the register stack in the vector-matrix conversion module is initialized to the d-bit coefficients of the binary polynomial b(x), and each subsequent read of the additional d-bit coefficients forms a matrix CB of size d×d.

[0026] An encryption method, comprising: generating a key by using the binary polynomial multiplication method described below; performing BIKE cryptographic calculation on plain text by using the key and the binary polynomial multiplication method described below to generate cipher text;

[0027] The binary polynomial multiplication is:

[0028] Divide the vector A corresponding to the binary polynomial a(x) into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and divide the non-zero vector blocks into d / 8 data units, where d represents the size of the vector block; among the d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial a(x) is a sparse polynomial;

[0029] The coefficients of the binary polynomial b(x) are circulantly arranged row by row to obtain a circulant matrix B, and the redundant blocks in the circulant matrix B corresponding to the zero vector blocks in the n vector blocks are deleted to obtain a matrix CB;

[0030] Multiply the non-zero vector block with the corresponding row in the matrix CB, and then accumulate it with the vector C; if the overflow flag of the non-zero vector block is 0, the calculation step is performed once, and if the overflow flag of the non-zero vector block is 1, the calculation step is performed twice; wherein, vector C is the vector corresponding to the binary polynomial c(x), c(x) = a(x) × b(x).

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention starts from the data characteristics and computational properties of polynomial sparsity in the cryptographic algorithm BIKE, converts binary polynomial multiplication into vector-matrix multiplication, splits vector and matrix blocks for block-by-block calculation, and combines inter-block sparsity and intra-block sparsity in the calculation process, thereby greatly reducing the amount of calculation.

[0033] Furthermore, the present invention designs an expandable pipeline structure for block-by-block calculation to effectively process vector blocks, thereby improving the throughput of calculated data. Through the expandable hardware architecture proposed by the present invention, the hardware structure can be flexibly expanded according to different storage bandwidths, so that it is easy to match the application requirements of different storage bandwidths. In order to match the pipeline structure, multi-BANK RAM is used to store sparse polynomials to achieve concurrent access to data, and the data required for calculation can be read in a single cycle. The hardware pipeline structure and multi-BANK storage structure designed by the present invention can efficiently process data blocks, reduce delays and improve throughput. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 The present invention is a block calculation algorithm based on sparse characteristics;

[0036] Figure 2 This is an example of the calculation stage of the present invention;

[0037] Figure 3 is the sparse format of the vector A of the present invention;

[0038] Figure 4 This is a scalable and efficient pipeline structure of the present invention. DETAILED DESCRIPTION

[0039] The following describes the embodiments of the present invention through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0040] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0041] It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. Moreover, unless otherwise specified, the numbering of each method step is only a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the present invention. Changes or adjustments in their relative relationships should also be regarded as the scope of the present invention without substantially changing the technical content.

[0042] The present invention provides a binary polynomial multiplier for a cryptographic algorithm BIKE, comprising: a preprocessing module, a storage module A, a storage module B, a storage module C, a PE array, and a vector-matrix conversion module;

[0043] The preprocessing module is used to divide the vector A corresponding to the binary polynomial a(x) into n vector blocks, detect non-zero vector blocks in the n vector blocks, and divide the non-zero vector blocks into d / 8 data units, where d represents the size of the vector block; if there is a data unit with more than 4 non-zero elements in the d / 8 data units, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0;

[0044] The storage module A is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; when the overflow flag of the non-zero vector block is 0, only 4-bit elements in each data unit are stored; when the overflow flag of the non-zero vector block is 1, 8-bit elements in each data unit are stored;

[0045] The storage module B is used to store the binary polynomial b(x);

[0046] The storage module C is used to store a binary polynomial c(x), c(x)=a(x)×b(x); the vector corresponding to c(x) is vector C;

[0047] The PE array is used to multiply the non-zero vector blocks stored in the storage module A with the corresponding rows in the matrix CB, and accumulate them with the vector C, and output and write them into the storage module C;

[0048] The vector-matrix conversion module is used to cyclically arrange the coefficients of the polynomial b(x) by rows to obtain a circulant matrix B, and delete the redundant blocks in the circulant matrix B corresponding to the zero vector blocks in the n vector blocks to obtain a matrix CB.

[0049] The present invention proposes a block calculation algorithm based on sparse characteristics, such as Algorithm 1.

[0050] Algorithm 1 describes the proposed block calculation algorithm based on sparse characteristics for binary polynomial multiplication, which is divided into two stages: preprocessing stage and calculation stage. The vector A and circulant matrix B corresponding to the binary polynomials a(x) and b(x) are divided into n blocks, where d represents the block size, which represents the number of bits in the vector block A[i], and is usually set to 16, 32, 64, or 128 according to the storage bandwidth. i = 1, 2, ..., n; r is the order of the polynomial, r is 12323 for security level 1, 24659 for security level 3, and 40973 for security level 5.

[0051] In the preprocessing stage, the main task is to detect the sparsity between blocks and identify non-zero vector blocks. Each time a non-zero vector block is detected, the counter m is incremented by 1, as shown in line 5 of Algorithm 1. Then, the non-zero vector block is split into d / 8 data units, each containing 8 bits of data. These data units are denoted as unit[k], where k is the number of data units. For a data unit, the number of non-zero elements is denoted as f_num. Whether there is a non-zero vector block overflow is determined by f_num(unit[k]). If there is at least one data unit with f_num exceeding 4 in the non-zero vector block, the overflow flag overflow[m] of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0. Considering the intra-block sparsity, overflow rarely occurs. Based on this feature, an algorithm is designed to use half of the resources for non-zero vector block calculations. Detecting overflow is crucial because if a non-zero vector block overflows, the non-zero vector block will be split and calculated twice.

[0052] In the calculation phase, according to Figure 1 As shown in line 11, m non-zero vector blocks (i.e. Figure 2 A0, A1, …, A m-1 ) are processed in sequence. Figure 1 In line 12, p is initialized to a 1-bit number with a value of 0, indicating the number of times the current non-zero vector block has been processed. For the calculation of the current non-zero vector block, all n matrix blocks of a row of the matrix CB are required, which corresponds to the "for loop" described in line 13. Here, the matrix CB is generated by the circulant matrix B, and the redundant blocks (i.e., the blocks corresponding to the zero vector blocks of vector A) are deleted, containing m×n blocks. Each calculation involves row multiplication and column summation, such as Figure 1 As shown in line 14 of Algorithm 1 in . Lines 16 to 19 introduce how to handle data overflow. In line 14, due to the intra-block sparsity of the vector block A[j], only half of the elements in the matrix CB[j,h] participate in the calculation. On the contrary, if overflow occurs, the steps in line 14 must be repeated to complete the calculation of the entire non-zero vector block. In other words, if overflow[j] and p are both equal to 1, it will jump directly to line 13 and restart the calculation process.

[0053] An example of the calculation phase process of the algorithm proposed in the present invention is as follows: Figure 2 shown.

[0054] Vector block A1 is sequentially connected with {CB 1,0 ,CB 1,1 ,…,CB 1,n-1} and multiply them with {C 0,0 ,C 0,1 ,…,C 0,n-1} are added. The result is output as {C 1,0 ,C 1,1 ,…,C 1,n-1}.

[0055] The present invention realizes encryption of plain text based on the above algorithm, including: using the above binary polynomial multiplication to generate a key; using the key and the above binary polynomial multiplication to perform BIKE password calculation on the plain text to generate cipher text.

[0056] The sparse format designed by the present invention for vector A is as follows: Figure 3 shown.

[0057] The sparse format consists of three key components: block number, overflow flag, and block data. The block number specifies the exact location of the non-zero vector block in vector A, which determines the location of the vector block required for calculation in vector C. Its representation usually requires The overflow flag indicates whether the current non-zero vector block overflows. If there is at least one data unit in the non-zero vector block with more than four non-zero elements, the overflow flag of the current non-zero vector block is set to 1 (i.e., valid overflow), and vice versa. The block data contains k (k = d / 8) data units, each of which corresponds to an 8-bit element in the non-zero vector block. In the case of no data overflow, only 4-bit elements need to be stored, such as Figure 3 The four 3-bit indexes serve as pointers for data references, indicating the location of valid data in the data unit, and the four 1-bit valid data ensure that only data related to the index is used during the calculation process. Figure 3 The lower right corner of shows the data overflow. Since all the data in the current non-zero vector block needs to be calculated, the data of each data unit is stored using 8 3-bit indexes and 8 1-bit data.

[0058] The scalable and efficient pipeline structure designed by the present invention is as follows: Figure 4 shown.

[0059] The structure consists of three stages, corresponding to the three stages of the pipeline: reading block information, reading arithmetic data, and performing calculations. Based on the sparse format of vector A, the data size exceeds the storage bandwidth, which makes it infeasible to read all data from the global memory in the same clock cycle. In order to solve this problem, the present invention designs a multi-BANK structure to match the pipeline structure. The memory of storage module A is divided into three BANKs, each of which has a d-bit width and a w-bit depth (where w represents the sparsity of the binary polynomial a(x)). A_BANK1 is used to store block information, including block number and overflow flag, while A_BANK2 and A_BANK3 store block data. These two BANKs correspond one-to-one to two processing element arrays (PEA), namely PEA1 and PEA2.

[0060] Phase 1: The main purpose is to obtain block information from A_BANK1 to determine the storage address of storage module B and storage module C. When processing a new non-zero vector block, the controller can determine the starting position of the calculation-related matrix block in the memory of storage module B and storage module C based on the block information. Using the counter value h, the controller generates the address details of storage module B and storage module C to access the calculation-related matrix block in the next cycle. The access address of A_BANK1 is determined by two key factors. First, it depends on whether the current non-zero vector block and the current row in the corresponding entire matrix CB have been calculated. Second, it depends on the validity of the overflow flag. If the calculation is completed and the overflow flag is invalid, the address is +1; otherwise, it remains unchanged.

[0061] Phase 2: The main task is to read the computation-related data from different storage modules. In this phase, storage modules B and C store data in the form of polynomial coefficients, each with a width of d bits and Depth. This design allows each address space to store one matrix block. A_BANK2 and A_BANK3 store data in a sparse form, where each non-zero vector block is divided into two parts, stored in A_BANK2 and A_BANK3 respectively. If an invalid overflow flag appears, each part is stored in the corresponding address space. However, if a valid overflow flag appears, one address space is not enough to store a part of the data. Therefore, each data unit needs to be split and stored in two address spaces.

[0062] Phase 3: This phase focuses on computing d-bit non-zero vector blocks and d×d-sized matrix blocks. In this phase, two main factors need to be considered: computation and data flow. For the computation structure, the two processing unit arrays (PEA1 and PEA2) play a key role in the pipeline structure, which provide scalability based on the hardware structure based on the memory bandwidth. Each PEA consists of multiple processing elements (PEs), each of which contains 16 computational units. Each computational unit contains 4 AND gates and 4 XOR gates. This design enables each PE to process 4 rows and 16 columns of data. Therefore, for the computation of d-bit non-zero vector blocks and d×d-sized matrix blocks, the number of PEs in each PEA is expressed by P. num It can be expressed as follows:

[0063]

[0064] Where: d / 8 represents the number of data units in a d-bit non-zero vector block, and d / 16 represents the processing capability of each computing unit to process 16 columns of data. The division by 2 is because there are a total of 2 processing unit arrays. Figure 4In the , the processing units are arranged in a matrix and numbered from (1,1) to (z,z).

[0065] The data flow consists of three parts: the non-zero vector block in storage module A, the matrix block in storage module B, and the vector block in storage module C. Initially, a d-bit non-zero vector block in vector A is divided into two halves and mapped to A_BANK2 and A_BANK3 respectively. Each half requires one address space when there is no overflow, and two address spaces when the overflow flag is valid. Within one address space, the 4-bit data in each data unit is processed as a tile, and the entire block data is divided into d / 16 (i.e. z) tiles. These tiles from A_BANK2 and A_BANK3 are labeled A2_tiles and A3_tiles, respectively. Since each processing unit can calculate 16 columns of data, each tile is assigned to a row of processing units in the processing unit array, such as Figure 4 As shown by the green line in . In the case of a valid overflow flag, each data unit is regarded as 8-bit valid data and needs to be divided into two address spaces for storage. This process extends the completion time to two cycles.

[0066] During operation, the data conversion process of converting polynomial coefficients into matrix blocks is indispensable and is performed in the vector-matrix conversion module (VMT). The circulant matrix B is obtained by cyclically arranging the coefficients of the polynomial b(x) in rows. Due to the characteristics of the circulant matrix, this matrix block belongs to the category of Toeplitz matrices. In this matrix block, the elements on the main diagonal are equal, and the elements on the rows parallel to the main diagonal are also equal. Therefore, a d×d-sized matrix block requires 2d-bit coefficients, and the d-bit coefficients of these 2d-bit coefficients can be reused for the calculation of the next matrix block. In order to facilitate pipeline processing, the register stack in the VMT is initialized to d-bit coefficients in the preprocessing stage. Subsequently, it reads the remaining d-bit coefficients and updates the vector b in the register stack for the next matrix block calculation. At the same time, a matrix block of size d×d is constructed by reading the vector b_r in the register stack and the vector b in the storage module B. This d×d-sized matrix block can be divided into z 2 Each slice is 16×16 in size. Considering the internal sparsity of the vector block in the matrix block, only the rows related to the index in the matrix block need to be involved. Therefore, through VMT, the size of each slice is reduced from 16×16 to 8×16. In this way, z 2 The tiles are composed of B_tiles and are numbered sequentially from (1,1) to (z,z). During the calculation process, the adjusted matrix blocks are then split, such as Figure 4As shown by the blue line in , the upper part is given to processing unit array 1 (PEA1) and the lower part is given to processing unit array 2 (PEA2) for processing. For the polynomial c(x), Figure 4 As shown by the red lines in , the data flow starts from the vector block of memory module C, which is divided into z blocks of size 16 bits, which are denoted as C_tiles, and then fed into the first row of PEA 1. The 16-bit data of each tile is connected to the input of the processing element (PE), which is labeled c_i. The output of each row of PEs, labeled c_o, is then connected to the input of the next row. The output of the last row of PEs in PEA1, labeled partial_c, is connected to the input c_i of the first row of PEA2. The PEs in PEA2 are connected to each other in the same way as in PEA1. The output of the last row of PEs in PEA2, labeled imm_c, is then written to the memory module C. In order to achieve concurrency of read and write operations in the same cycle, the memory module C is instantiated as a dual-port RAM.

[0067] Examples

[0068] The performance of the present invention is compared with the existing designs 1-4, as shown in Table 1.

[0069] Design 1 reference: J.Hu et al., “Optimized Polynomial Multiplier OverCommutative Rings on FPGAs: A Case Study on BIKE,” in 2019InternationalConference on Field-Programmable Technology(ICFPT),Tianjin,China,2019,pp.231-234.

[0070] Design 2 reference: J.Richter-Brockmann et al., “Folding BIKE: Scalable Hardware Implementation for Reconfigurable Devices,” IEEE Trans Comput., vol.71, no.5, pp.1204-1215, May 2022.

[0071] Design 3 reference: Jan Richter-Brockmann et al., “Racing BIKE: improved polynomial multiplication and inversion in hardware,” IACR Trans. Cryptogr. Hardw. Embed. Syst., 2022(1): 557-588, 2022.

[0072] Design 4 reference: Y.Tu et al., “LEAP:Lightweight and EfficientAccelerator for Sparse Polynomial Multiplication of HQC,” IEEE Trans.VeryLarge Scale Integr.,vol.31,no.6,pp.892-896,June 2023.

[0073] Table 1

[0074]

[0075]

[0076] a LUT: lookup table in FPGA; FF: register in FPGA; BRAM: memory in FPGA.

[0077] b Slice: A logic unit in an FPGA.

[0078] c ECS=Slices+BRAM×70×0.8.

[0079] d Delay = (1 / frequency) × period.

[0080] e ATP=area (number of ECSs)×delay (μs).

[0081] Compared with Design 1, the present invention achieves higher performance and efficiency while using fewer slices, and the present invention is obtained at a larger polynomial order. According to the performance indicators, the present invention achieves a performance improvement of 4.5 times to 35.1 times when d=16, a performance improvement of 4.9 times to 69.7 times when d=32, a performance improvement of 5.3 times to 112.5 times when d=64, and a performance improvement of 5.9 times to 164.2 times when d=128. Due to the dual advantages in area and delay optimization, ATP is significantly reduced, achieving an improvement of 2.8 times to 24.2 times when d=16, a 5.4 times to 76.7 times improvement when d=32, a 3.8 times to 85.2 times improvement when d=64, and a 3.6 times to 109.9 times improvement when d=128.

[0082] Compared with Design 2, except for BRAM resource utilization, all indicators in the present invention have been substantially improved. In terms of performance, when d=32, the present invention shows an increase of 5.6 to 78.8 times, when d=64, the increase is 2.5 to 62.4 times, and when d=128, it shows an increase of 0.5 to 34.4 times. Due to the significant reduction in slice utilization, under different storage bandwidth parameter settings, the enhancement of ATP is as high as 9.4 to 124.7 times, 7.5 to 152.0 times, and 5.4 to 151.7 times.

[0083] Compared with Design 3, the upper boundary of the delay of the present invention is equivalent or slightly lower. As for the lower boundary, the present invention achieves a maximum performance improvement of 11.6 times when d=32, a maximum performance improvement of 16.3 times when d=64, and a maximum performance improvement of 25.0 times when d=128. In addition, although the BRAM is slightly increased, the utilization of slice resources is reduced by 59.85%, 24.87%, and 22.49%, respectively. This decrease corresponds to an increase of ATP by 13.7 times, 16.0 times, and 25.2 times, respectively.

[0084] Compared with Design 4, the present invention achieves similar performance and efficiency indicators in the worst case. However, in terms of peak performance and efficiency indicators, the present invention is 21.5 times and 22.7 times higher than Design 4, respectively.

Claims

1. A binary polynomial multiplier for a cryptographic algorithm BIKE, characterized in that: include: Preprocessing module, storage module A, storage module B, storage module C, PE array, vector-matrix conversion module; The preprocessing module is used to divide the vector A corresponding to the binary polynomial a(x) into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and divide the non-zero vector blocks into d / 8 data units, where d represents the size of the vector block; if there is a data unit with more than 4 non-zero elements in the d / 8 data units, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial a(x) is a sparse polynomial; The storage module A is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; when the overflow flag of the non-zero vector block is 0, only 4-bit elements in each data unit are stored; When the overflow flag of the non-zero vector block is 1, the 8-bit elements in each data unit are stored; The storage module B is used to store the binary polynomial b(x); The storage module C is used to store a binary polynomial c(x), c(x)=a(x)×b(x); the vector corresponding to c(x) is vector C; The PE array is used to multiply the non-zero vector blocks stored in the storage module A with the corresponding rows in the matrix CB, and accumulate them with the vector C, and write the output into the storage module C for updating; The vector-matrix conversion module is used to cyclically arrange the coefficients of the binary polynomial b(x) by rows to obtain a circulant matrix B, and delete the redundant blocks in the circulant matrix B corresponding to the zero vector blocks in the n vector blocks to obtain a matrix CB.

2. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 1, characterized in that: The storage module A is a multi-BANK structure, including A_BANK1, A_BANK2 and A_BANK3; A_BANK1, A_BANK2 and A_BANK3 all have a d-bit width and a w-bit depth, where w represents the sparsity of the binary polynomial a(x); the A_BANK1 is used to store the block number and overflow flag corresponding to the non-zero vector block; each non-zero vector block is divided into two parts, which are stored in A BANK2 and ABANK3 respectively.

3. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 2, characterized in that: For A_BANK2 and A_BANK3, if the overflow flag of the non-zero vector block is 0, each part of the non-zero vector block is stored in a corresponding address space; If the overflow flag of a non-zero vector block is 1, each part is split and stored in two address spaces.

4. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 2, characterized in that: The PE array includes two processing unit arrays, namely PEA1 and PEA2, and PEA1 and PEA2 correspond to A_BANK2 and A_BANK3 respectively.

5. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: The outputs of the last row of processing elements in PEA1 are connected to the inputs of the first row in PEA2.

6. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: Each processing unit array is composed of multiple processing units, each processing unit contains 16 computing units; each computing unit contains four AND gates and four XOR gates.

7. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: The number of processing units in each processing unit array is P num satisfy:

8. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 1, characterized in that: The register stack in the vector-matrix conversion module is initialized to the d-bit coefficients of the binary polynomial b(x), and each subsequent read of the additional d-bit coefficients forms a matrix CB of size d×d.

9. An encryption method, characterized in that: include: The key is generated using binary polynomial multiplication as described below; Perform BIKE cryptographic calculation on the plaintext using the key and the binary polynomial multiplication described below to generate ciphertext; The binary polynomial multiplication is: Divide the vector A corresponding to the binary polynomial a(x) into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and divide the non-zero vector blocks into d / 8 data units, where d represents the size of the vector block; among the d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial a(x) is a sparse polynomial; The coefficients of the binary polynomial b(x) are circulantly arranged row by row to obtain a circulant matrix B, and the redundant blocks in the circulant matrix B corresponding to the zero vector blocks in the n vector blocks are deleted to obtain a matrix CB; Multiply the non-zero vector block with the corresponding row in the matrix CB, and then accumulate it with the vector C; if the overflow flag of the non-zero vector block is 0, the calculation step is performed once, and if the overflow flag of the non-zero vector block is 1, the calculation step is performed twice; wherein, vector C is the vector corresponding to the binary polynomial c(x), c(x) = a(x) × b(x).

Images