A Binary Polynomial Multiplier and Encryption Method for BIKE Cryptographic Algorithm

Abstract

The present invention provides a binary polynomial multiplier and encryption method for the BIKE cryptographic algorithm. Taking into account the data characteristics and computational properties of polynomial sparsity in the BIKE cryptographic algorithm, the present invention converts binary polynomial multiplication into vector-matrix multiplication, splits vector and matrix blocks for block-by-block computation, and combines inter-block sparsity and intra-block sparsity in the computation process, thereby significantly reducing the amount of computation.

Description

Technical Field

[0001] The present invention relates to hardware implementation of a post-quantum cryptographic algorithm, and in particular to a binary polynomial multiplier and encryption method for the BIKE cryptographic algorithm. Background Art

[0002] With the rapid development and practical application of quantum computing technology, traditional cryptographic algorithms based on mathematically challenging problems, such as RSA and ECC, are facing the potential security threat of being cracked by quantum computing. Conservative estimates suggest that around 2035, the public key cryptography systems that ensure data and network security will be vulnerable to cracking by large-scale quantum computers, posing a significant challenge to the security of public communications, financial transactions, personal privacy, and other information. Given that cryptographic infrastructure upgrades typically take nearly 10 years, and the long-term nature of my country's core data confidentiality needs (up to several decades), research on efficient hardware implementations of post-quantum cryptography (PQC) algorithms is imperative. Post-quantum cryptographic chips will provide long-term security for information technology systems, maintaining encryption strength even after quantum computers mature. Post-quantum cryptography technology can facilitate the transition of existing systems to more secure cryptographic technologies, including upgrades to communication protocols, storage systems, and other critical infrastructure.

[0003] BIKE, a key encapsulation scheme based on error-correcting codes, not only offers high security but also boasts advantages in computational efficiency and implementation complexity, making it particularly suitable for resource-constrained environments. Its design integrates modern coding theory and cryptography, enabling strong security guarantees in quantum environments. This has advanced the research and application of post-quantum cryptography, becoming a key development direction in the field. Unlike lattice-based cryptographic algorithms, code-based cryptographic algorithms enrich the field of post-quantum cryptographic algorithms and offer a wider range of options for security applications. Binary polynomial multiplication, the core operator of the BIKE cryptographic algorithm, directly determines its encryption speed due to its computational performance.

[0004] For binary polynomial multiplication, some scholars have proposed a divide-and-conquer strategy based on textbook multiplication and a i The researchers used two methods to calculate binary polynomial multiplication: bit index derotation polynomial. Furthermore, they converted polynomial multiplication into vector matrix multiplication and used parallel processing. b The bitwise design concept computes columns block by block. This approach is easy to integrate with other hardware structures and significantly reduces storage resource usage. Furthermore, the researchers took the sparsity of polynomials into account and optimized the design of sparse polynomial multiplication. This method significantly improves efficiency and reduces latency by reading the non-zero indices of the sparse polynomial, performing left rotations based on these indices, and accumulating the rotation results into the product.

[0005] However, existing binary polynomial multiplication algorithms and hardware still have the following problems:

[0006] 1. Some existing binary polynomial multiplication algorithms do not fully utilize the sparsity of polynomials to reduce operations, while some existing binary polynomial multiplication algorithms only consider inter-block sparsity but ignore intra-block sparsity to further eliminate invalid calculations.

[0007] 2. Some existing binary polynomial multiplication algorithms, combined with sparsity, mainly process single non-zero elements in a pipeline manner and cannot process multiple non-zero elements at the same time. They cannot fully utilize sparsity and efficiently implement pipelines at the same time.

[0008] Therefore, how to calculate binary polynomial multiplication more efficiently has become one of the core issues in the efficient hardware implementation of the current BIKE cryptographic algorithm. Summary of the Invention

[0009] In order to solve the above problems of the prior art, the present invention provides a binary polynomial multiplier and encryption method for the cryptographic algorithm BIKE, which combines inter-block sparsity and intra-block sparsity to greatly reduce the amount of calculation.

[0010] The present invention is achieved through the following technical solutions:

[0011] A binary polynomial multiplier for a cryptographic algorithm BIKE, comprising: a preprocessing module, a first storage module, a second storage module, a third storage module, a PE array, and a vector-matrix conversion module;

[0012] The preprocessing module is used to convert the binary polynomial The corresponding vector Divide into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and split the non-zero vector blocks into d / 8 data units, d Indicates the size of the vector block; d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial is a sparse polynomial;

[0013] The first storage module is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; when the overflow flag of the non-zero vector block is 0, only the 4-bit elements in each data unit are stored; when the overflow flag of the non-zero vector block is 1, the 8-bit elements in each data unit are stored;

[0014] The second storage module is used to store binary polynomials ;

[0015] The third storage module is used to store binary polynomials ; The corresponding vector is the vector ;

[0016] The PE array is used to store the non-zero vector blocks stored in the first storage module and the matrix Multiply the corresponding rows in and add them to the vector Perform accumulation and write the output into the third storage module for updating;

[0017] The vector-matrix conversion module is used to convert the binary polynomial The coefficients of are arranged in a circular manner to obtain a circulant matrix , the circulant matrix The redundant blocks corresponding to the zero vector blocks in the n vector blocks are deleted, and the matrix is ​​obtained. .

[0018] Preferably, the first storage module is a multi-BANK structure, including A_BANK1, A_BANK2 and A_BANK3; A_BANK1, A_BANK2 and A_BANK3 all have d bit width and w Depth, where w Represents a binary polynomial sparsity; the A_BANK1 is used to store the block number and overflow flag corresponding to the non-zero vector block; each non-zero vector block is divided into two parts, which are stored in A_BANK2 and A_BANK3 respectively.

[0019] Furthermore, for A_BANK2 and A_BANK3, if the overflow flag of the non-zero vector block is 0, each part of the non-zero vector block is stored in a corresponding address space; if the overflow flag of the non-zero vector block is 1, each part is split and stored in two address spaces.

[0020] Furthermore, the PE array includes two processing unit arrays, namely PEA1 and PEA2, and PEA1 and PEA2 correspond to A_BANK2 and A_BANK3 respectively.

[0021] Furthermore, the outputs of the last row of processing units in PEA1 are connected to the inputs of the first row in PEA2.

[0022] Furthermore, each processing unit array is composed of multiple processing units, each processing unit includes 16 computing units; each computing unit includes four AND gates and four XOR gates.

[0023] Furthermore, the number of processing units in each processing unit array P num satisfy:

[0024]

[0025] Preferably, the register file in the vector-matrix conversion module is initialized to a binary polynomial of d bit coefficient, each subsequent read of the other d bit coefficients, forming d×d Matrix of size .

[0026] An encryption method comprising: generating a key using the following binary polynomial multiplication method; performing BIKE cryptographic calculation on plaintext using the key and the following binary polynomial multiplication method to generate ciphertext;

[0027] The binary polynomial multiplication is:

[0028] Binary polynomial The corresponding vector Divide into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and split the non-zero vector blocks into d / 8 data units, d Indicates the size of the vector block; d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial is a sparse polynomial;

[0029] Binary polynomial The coefficients of are arranged in a circular manner to obtain a circulant matrix , delete the redundant blocks in the circulant matrix 𝐵 corresponding to the zero vector blocks in the n vector blocks, and get the matrix ;

[0030] Block nonzero vectors with the matrix Multiply the corresponding rows in and then add them to the vector Accumulate; if the overflow flag of the non-zero vector block is 0, the calculation step is performed once, if the overflow flag of the non-zero vector block is 1, the calculation step is performed twice; where the vector is a binary polynomial The corresponding vector, .

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention starts from the data characteristics and computational properties of polynomial sparsity in the cryptographic algorithm BIKE, converts binary polynomial multiplication into vector-matrix multiplication, splits vector and matrix blocks for block-by-block calculation, and combines inter-block sparsity and intra-block sparsity in the calculation process, thereby greatly reducing the amount of calculation.

[0033] Furthermore, the present invention designs a scalable, block-by-block computation pipeline structure to efficiently process vector blocks, thereby improving computational data throughput. The scalable hardware architecture proposed by the present invention allows for flexible hardware expansion based on varying memory bandwidths, making it easier to adapt to application requirements with varying memory bandwidths. To match the pipeline structure, multi-bank RAM is used to store sparse polynomials, enabling concurrent data access and single-cycle access to the required computational data. The hardware pipeline structure and multi-bank storage structure designed by the present invention enable efficient data block processing, reducing latency and improving throughput. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 The present invention is based on the block calculation algorithm of sparse characteristics;

[0036] Figure 2 This is an example of the calculation stage of the present invention;

[0037] Figure 3 is the sparse format of the vector A of the present invention;

[0038] Figure 4 This is a scalable and efficient pipeline structure of the present invention. DETAILED DESCRIPTION

[0039] The following describes the embodiments of the present invention through specific examples. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments, and the details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention.

[0040] It should be noted that the process equipment or devices not specifically specified in the following embodiments are all conventional equipment or devices in the art.

[0041] It should be noted that the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or apparatuses. Furthermore, unless otherwise specified, the numbering of each method step is merely a convenient tool for identifying each method step, and is not intended to limit the order of arrangement of each method step or to define the scope of the invention. Changes or adjustments to their relative relationships, without substantially changing the technical content, should also be considered within the scope of the invention.

[0042] The present invention provides a binary polynomial multiplier for a cryptographic algorithm BIKE, comprising: a preprocessing module, a first storage module, a second storage module, a third storage module, a PE array, and a vector-matrix conversion module;

[0043] The preprocessing module is used to convert the binary polynomial The corresponding vector Divide into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and split the non-zero vector blocks into d / 8 data units, d Indicates the size of the vector block; d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1; otherwise, the overflow flag of the non-zero vector block is set to 0;

[0044] The first storage module is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; when the overflow flag of the non-zero vector block is 0, only the 4-bit elements in each data unit are stored; when the overflow flag of the non-zero vector block is 1, the 8-bit elements in each data unit are stored;

[0045] The second storage module is used to store binary polynomials ;

[0046] The third storage module is used to store binary polynomials ; The corresponding vector is the vector ;

[0047] The PE array is used to store the non-zero vector blocks stored in the first storage module and the matrix Multiply the corresponding rows in and add them to the vector Perform accumulation and write the output into the third storage module;

[0048] The vector-matrix conversion module is used to convert the polynomial The coefficients of are arranged in a circular manner to obtain a circulant matrix , the circulant matrix The redundant blocks corresponding to the zero vector blocks in the n vector blocks are deleted, and the matrix is ​​obtained. .

[0049] The present invention proposes a block calculation algorithm based on sparse characteristics, such as Algorithm 1.

[0050] Algorithm 1 describes the block calculation algorithm based on sparse characteristics for binary polynomial multiplication, which is divided into two stages: preprocessing stage and calculation stage. and The corresponding vector and the circulant matrix are divided into n blocks, of which . d Indicates the block size, representing the vector block The number of bits in , is usually set to 16, 32, 64 or 128 depending on the storage bandwidth. is the order of the polynomial, safety level 1 r When the value is 12323 and the security level is 3 r 24659, security level 5 r It is 40973.

[0051] In the preprocessing stage, the main task is to detect the sparsity between blocks and identify non-zero vector blocks. Each time a non-zero vector block is detected, the counter m Just add 1, as shown in line 5 of Algorithm 1. Then, the non-zero vector blocks are divided into d / 8 data units, each data unit contains 8 bits of data. These data units are represented as unit [ k ],in k is the number of data units. For a data unit, the number of non-zero elements is expressed as f_num Whether there is a non-zero vector block overflow is determined by f_num ( unit [ k ]) is determined. If there is at least one data unit in the non-zero vector block f_num More than 4, the overflow flag of the non-zero vector block overflow [ m ] is set to 1; otherwise, the overflow flag for a non-zero vector block is set to 0. Given the sparsity within a block, overflow rarely occurs. Based on this characteristic, an algorithm is designed to use half the resources for computations on non-zero vector blocks. Overflow detection is crucial because if a non-zero vector block overflows, the block will be split and computed twice.

[0052] In the calculation phase, according to Figure 1 As shown in line 11, m non-zero vector blocks (i.e. Figure 2 in A 0, A 1, , A m-1 ) are processed in sequence. Figure 1 Line 12 of p It is initialized to a 1-bit value of 0, indicating the number of times the current non-zero vector block has been processed. For the calculation of the current non-zero vector block, the matrix All of the row n This corresponds to the "for loop" described in line 13. Here, the matrix is generated by the circulant matrix 𝐵 with redundant blocks removed (i.e., with vector The block corresponding to the zero vector block of m×n Each computation involves row multiplication and column summation, such as Figure 1 As shown in line 14 of Algorithm 1. Lines 16 to 19 introduce the method for handling data overflow. In line 14, due to the vector block The intra-block sparsity of the matrix Half of the elements in participate in the calculation. On the contrary, if overflow occurs, the steps in line 14 must be repeated to complete the calculation of the entire non-zero vector block. That is, if and p If both are equal to 1, it will jump directly to line 13 and restart the calculation process.

[0053] An example of the calculation phase process of the algorithm proposed in this invention is as follows: Figure 2 shown.

[0054] Vector Block A 1 in turn with { CB 1,0 , CB 1,1 , , CB 1,n-1} and multiply with { C 0,0 , C 0,1 , , C 0,n-1} are added. The result is { C 1,0 , C 1,1 , ,C 1,n-1}.

[0055] The present invention realizes encryption of plaintext based on the above algorithm, including: using the above binary polynomial multiplication to generate a key; performing BIKE password calculation on the plaintext using the key and the above binary polynomial multiplication to generate ciphertext.

[0056] The present invention is designed for vector The sparse format of Figure 3 shown.

[0057] The sparse format consists of three key components: block number, overflow flag, and block data. The block number specifies the vector The precise location of the non-zero vector block in the vector The position of the vector block required for calculation in . Its representation usually requires Bit. The overflow flag indicates whether the current non-zero vector block overflows. If there is at least one data unit with more than four non-zero elements in the non-zero vector block, the overflow flag of the current non-zero vector block is set to 1 (i.e., valid overflow), and vice versa. The block data contains k ( k=d / 8) data units, each data unit corresponds to an 8-bit element in the non-zero vector block. In the absence of data overflow, only 4-bit elements need to be stored, such as Figure 3 The four 3-bit indexes serve as pointers to data references, indicating the location of valid data in the data unit. The four 1-bit valid data ensure that only data related to the index is used during the calculation process. Figure 3 The lower right corner of the diagram shows the data overflow. Since all data in the current non-zero vector block need to be calculated, the data of each data unit is stored using 8 3-bit indexes and 8 1-bit data.

[0058] The scalable and efficient pipeline structure designed by the present invention is as follows: Figure 4 shown.

[0059] The structure consists of three stages, corresponding to the three stages of the pipeline: reading block information, reading arithmetic data, and performing calculations. The sparse format of the first storage module has a data size that exceeds the storage bandwidth, which makes it impossible to read all data from the global memory in the same clock cycle. To solve this problem, the present invention designs a multi-BANK structure to match the pipeline structure. The memory of the first storage module is divided into three BANKs, each of which has d bit width and w Depth (where w Represents a binary polynomial A_BANK1 stores block information, including block numbers and overflow flags, while A_BANK2 and A_BANK3 store block data. These two banks correspond one-to-one to two processing element arrays (PEAs), namely PEA1 and PEA2.

[0060] Phase 1: The main purpose is to obtain block information from A_BANK1 to determine the storage address of the second and third storage modules. When processing a new non-zero vector block, the controller can determine the starting position of the matrix block related to the calculation in the memory of the second and third storage modules based on the block information. Using the counter value h , the controller generates the address details of the second and third storage modules in order to access the matrix blocks related to the calculation in the next cycle. The access address of A_BANK1 is determined by two key factors. First, it depends on the current non-zero vector block and the entire matrix corresponding to it. The current row in the address is calculated. Second, it depends on the validity of the overflow flag. If the calculation is complete and the overflow flag is invalid, the address is increased by 1; otherwise, it remains unchanged.

[0061] Phase 2: The main task is to read the calculation-related data from different storage modules. In this phase, the second and third storage modules store data in the form of polynomial coefficients, each coefficient has d bit width and Depth. This design allows each address space to store one matrix block. A_BANK2 and A_BANK3 store data in a sparse format, where each non-zero vector block is divided into two parts, stored in A_BANK2 and A_BANK3 respectively. If an invalid overflow flag is present, each part is stored in the corresponding address space. However, if a valid overflow flag is present, one address space is insufficient to store a portion of the data. Therefore, each data unit needs to be split and stored in two address spaces.

[0062] Phase 3: This phase focuses on calculation d bit non-zero vector blocks and d×d At this stage, two main factors need to be considered: computation and data flow. For the computation structure, the two processing element arrays (PEA1 and PEA2) play a key role in the pipeline structure. They provide scalability based on the hardware structure based on the memory bandwidth. Each PEA consists of multiple processing elements (PEs), each of which contains 16 computational units. Each computational unit contains 4 AND gates and 4 XOR gates. This design enables each PE to process 4 rows and 16 columns of data. Therefore, for d bit non-zero vector blocks and d × dThe calculation of the matrix block size, the number of PEs in each PEA, is done with P num It can be expressed as follows:

[0063]

[0064] in: d / 8 means d The number of data elements in the non-zero vector block, d / 16 means that each computing unit can process 16 columns of data. Divided by 2 because there are 2 processing unit arrays in total. Figure 4 In the , the processing units are arranged in a matrix, numbered from (1,1) to ( z , z ).

[0065] The data flow consists of three parts: the non-zero vector block in the first storage module, the matrix block in the second storage module, and the vector block in the third storage module. Initially, one of the d The non-zero vector block is divided into two halves, mapped to A_BANK2 and A_BANK3 respectively. Each half requires one address space when there is no overflow, and two address spaces when the overflow flag is valid. Within one address space, the 4-bit data in each data unit is processed as a tile, and the entire block data is divided into d / 16 (i.e. z ) tiles. These tiles from A_BANK2 and A_BANK3 are labeled A2_tiles and A3_tiles respectively. Since each processing unit can calculate 16 columns of data, each tile is assigned to a row of processing units in the processing unit array, such as Figure 4 As shown by the green line in the figure. With the overflow flag enabled, each data unit is considered 8 bits of valid data and needs to be split into two address spaces for storage. This process extends the completion time to two cycles.

[0066] During operation, the data conversion process of converting polynomial coefficients into matrix blocks is essential and is performed in the Vector-Matrix Transformation module (VMT). It is composed of polynomials The coefficients of are arranged in a cyclic manner along the rows. Due to the properties of circulant matrices, this matrix block belongs to the category of Toeplitz matrices. In this matrix block, the elements on the main diagonal are equal, and the elements on the rows parallel to the main diagonal are also equal. Therefore, a d×d Matrix blocks of size 2 are required d bit coefficients, and these 2 d The coefficients of bits dThe bit coefficients can be reused for the calculation of the next matrix block. In order to facilitate pipeline processing, the register file in the VMT is initialized to d Then, it reads the rest of the d bit coefficients and update the vector in the register file b , to perform the next matrix block calculation. At the same time, by reading the vector in the register file b_r and the vector in the second memory module b , the build size is d×d This d×d Matrix blocks of size can be split into z 2 Each slice is 16×16 in size. Considering the internal sparsity of the vector block in the matrix block, only the rows related to the index in the matrix block need to be involved. Therefore, through VMT, the size of each slice is reduced from 16×16 to 8×16. In this way, z 2 The tiles constitute B_tiles and are arranged in order from (1,1) to ( z , z ) are numbered. During the calculation process, the adjusted matrix blocks are then divided, such as Figure 4 As shown by the blue line in , the upper part is given to the processing element array 1 (PEA1) and the lower part is given to the processing element array 2 (PEA2) for processing. ,like Figure 4 As shown by the red line in the figure, the data flow starts from the vector block of the third storage module, which is divided into z The 16-bit data of each tile is connected to the input of the processing element (PE), which is labeled as c_i Each subsequent line of PE output is marked as c_o , then connected to the input of the next row. The output of the last row of PE in PEA1 is marked as partial_c , connected to the input of the first row in PEA2 c_i The PEs in PEA2 are interconnected in the same way as in PEA1. The outputs of the last row of PEs in PEA2 are marked as imm_c , and then writes to the third storage module. In order to achieve concurrency of read and write operations in the same cycle, the third storage module is instantiated as a dual-port RAM.

[0067] Examples

[0068] The performance of the present invention is compared with existing designs 1-4, as shown in Table 1.

[0069] Design 1 reference: J. Hu et al ., “Optimized Polynomial Multiplier OverCommutative Rings on FPGAs: A Case Study on BIKE,” in 2019 International Conference on Field-Programmable Technology (ICFPT), Tianjin, China, 2019, pp.231-234.

[0070] Design 2 reference: J. Richter-Brockmann et al ., “Folding BIKE: ScalableHardware Implementation for Reconfigurable Devices,” IEEE Trans Comput. , vol.71, no. 5, pp. 1204-1215, May 2022.

[0071] Design 3 reference: Jan Richter-Brockmann et al ., “Racing BIKE: improved polynomial multiplication and inversion in hardware,” IACR Trans. Cryptogr. Hardw. Embed. Syst. , 2022(1):557-588, 2022.

[0072] Design 4 references: Y. Tu et al ., “LEAP: Lightweight and EfficientAccelerator for Sparse Polynomial Multiplication of HQC,” IEEE Trans. Very Large Scale Integr. , vol. 31, no. 6, pp. 892-896, June 2023.

[0073]

[0074] Compared with Design 1, the present invention achieves higher performance and efficiency while using fewer slices, and the present invention is obtained at a larger polynomial order. d =16, a performance improvement of 4.5 to 35.1 times was achieved. d =32, a performance improvement of 4.9 to 69.7 times was achieved.d = 64, a performance improvement of 5.3 times to 112.5 times was achieved. d =128, a performance improvement of 5.9 times to 164.2 times was achieved. Due to the dual advantages in area and delay optimization, ATP was significantly reduced. d =16, an improvement of 2.8 to 24.2 times was achieved. d =32, an improvement of 5.4 to 76.7 times was achieved. d = 64, an improvement of 3.8 to 85.2 times was achieved. d =128, an improvement of 3.6 times to 109.9 times was achieved.

[0075] Compared with Design 2, except for BRAM resource utilization, all indicators in the present invention have been substantially improved. d = 32, the present invention shows an increase of 5.6 times to 78.8 times, when d =64, the increase is 2.5 times to 62.4 times. d = 128, it shows an increase of 0.5x to 34.4x. Due to the significant reduction in slice utilization, the ATP enhancement is as high as 9.4x to 124.7x, 7.5x to 152.0x, and 5.4x to 151.7x under different storage bandwidth parameter settings.

[0076] Compared with Design 3, the upper limit of the delay of the present invention is equivalent or slightly lower. As for the lower limit, the present invention is d = 32, the maximum performance improvement was 11.6 times. d = 64, the maximum performance improvement was 16.3 times. d = 128, achieving a maximum performance improvement of 25.0x. Furthermore, despite a slight increase in BRAM, slice resource utilization decreased by 59.85%, 24.87%, and 22.49%, respectively. This decrease corresponds to a 13.7x, 16.0x, and 25.2x increase in ATP, respectively.

[0077] Compared with Design 4, the present invention achieves similar performance and efficiency indicators in the worst case. However, in terms of peak performance and efficiency indicators, the present invention is 21.5 times and 22.7 times higher than Design 4, respectively.

Claims

1. A binary polynomial multiplier for the cryptographic algorithm BIKE, characterized in that: include: Preprocessing module, first storage module, second storage module, third storage module, PE array, vector-matrix conversion module; The preprocessing module is used to convert the binary polynomial The corresponding vector Divide into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and split the non-zero vector blocks into d / 8 data units, d Indicates the size of the vector block; d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial is a sparse polynomial; The first storage module is used to store the block number, overflow flag and block data corresponding to the non-zero vector block; the block data includes d / 8 data units; When the overflow flag of a non-zero vector block is 0, only the 4-bit elements in each data unit are stored; When the overflow flag of the non-zero vector block is 1, the 8-bit elements in each data unit are stored; The second storage module is used to store binary polynomials ; The third storage module is used to store binary polynomials ; The corresponding vector is the vector ; The PE array is used to store the non-zero vector blocks stored in the first storage module and the matrix Multiply the corresponding rows in and add them to the vector Perform accumulation and write the output into the third storage module for updating; The vector-matrix conversion module is used to convert the binary polynomial The coefficients of are arranged in a circular manner to obtain a circulant matrix , the circulant matrix The redundant blocks corresponding to the zero vector blocks in the n vector blocks are deleted, and the matrix is ​​obtained. .

2. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 1, characterized in that: The first storage module is a multi-BANK structure, including A_BANK1, A_BANK2 and A_BANK3; A_BANK1, A_BANK2 and A_BANK3 all have d bit width and w Depth, where w Represents a binary polynomial sparsity; the A_BANK1 is used to store the block number and overflow flag corresponding to the non-zero vector block; each non-zero vector block is divided into two parts, which are stored in A_BANK2 and A_BANK3 respectively.

3. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 2, characterized in that: For A_BANK2 and A_BANK3, if the overflow flag of the non-zero vector block is 0, each part of the non-zero vector block is stored in a corresponding address space; If the overflow flag of a non-zero vector block is 1, each part is split and stored in two address spaces.

4. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 2, characterized in that: The PE array includes two processing unit arrays, namely PEA1 and PEA2, and PEA1 and PEA2 correspond to A_BANK2 and A_BANK3 respectively.

5. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: The outputs of the last row of processing units in PEA1 are connected to the inputs of the first row in PEA2.

6. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: Each processing unit array consists of multiple processing units, each processing unit contains 16 computing units; each computing unit contains four AND gates and four XOR gates.

7. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 4, characterized in that: The number of processing units in each processing unit array P num satisfy: 。 8. The binary polynomial multiplier for the cryptographic algorithm BIKE according to claim 1, wherein: The register file in the vector-matrix conversion module is initialized to a binary polynomial of d bit coefficient, each subsequent read of the other d bit coefficients, forming d×d Matrix of size .

9. An encryption method, characterized in that: include: The key is generated using binary polynomial multiplication as described below; Performing BIKE cryptographic calculation on the plaintext using the key and binary polynomial multiplication as described below to generate ciphertext; The binary polynomial multiplication is: Binary polynomial The corresponding vector Divide into n vector blocks, detect the non-zero vector blocks in the n vector blocks, and split the non-zero vector blocks into d / 8 data units, d Indicates the size of the vector block; d / 8 data units, if there is a data unit with more than 4 non-zero elements, it is considered that the non-zero vector block overflows, and the overflow flag of the non-zero vector block is set to 1, otherwise the overflow flag of the non-zero vector block is set to 0; the binary polynomial is a sparse polynomial; Binary polynomial The coefficients of are arranged in a circular manner to obtain a circulant matrix , the circulant matrix The redundant blocks corresponding to the zero vector blocks in the n vector blocks are deleted, and the matrix is ​​obtained. ; Block nonzero vectors with the matrix Multiply the corresponding rows in and then add them to the vector Accumulate; if the overflow flag of the non-zero vector block is 0, the calculation step is performed once, if the overflow flag of the non-zero vector block is 1, the calculation step is performed twice; where the vector is a binary polynomial The corresponding vector, .

Images