Anti-quantum cryptography signature algorithm execution optimization method and system and electronic equipment

Abstract

The invention relates to the technical field of quantum computers, in particular to an anti-quantum cryptographic signature algorithm execution optimization method and system and electronic equipment. A first FIFO memory for storing a first random coefficient corresponding to a secret polynomial and a second FIFO memory for storing a second random coefficient corresponding to the secret polynomial are arranged on computing hardware; the number of times of writing a secret polynomial into a storage unit and reading the secret polynomial from the storage unit is reduced through a cache mode, in addition, a third FIFO memory is arranged to cache an intermediate operation result, the number of times of writing the operation result into a BRAM and reading the operation result from the BRAM is reduced through the cache mode, extra power consumption caused by memory access is reduced, meanwhile, the BRAM for storing a common polynomial is arranged, and the two are combined, so that the reliability of memory access is improved. In addition, the data storage mode changes the executed sequence of the data, the execution speed of the data is balanced on the whole, and the overall execution time needed by calculation is shortened.

Description

Technical Field

[0001] The present invention relates to the field of quantum computer technology, and in particular to a method, system and electronic device for optimizing execution of a quantum-resistant cryptographic signature algorithm. Background Art

[0002] Many secure communication devices and hardware infrastructures use security and confidentiality measures of classical cryptographic systems, but due to the advent of the quantum crisis, these devices are no longer secure and require new cryptographic systems to resist attacks from quantum computers. Since the National Institute of Standards and Technology (NIST) of the United States proposed a post-quantum cryptographic algorithm solicitation and transformation plan in 2016, more and more post-quantum cryptographic algorithms have been proposed. Taking the Dilithium signature algorithm in the quantum-resistant signature algorithm as an example, the Dilithium signature algorithm generates key pairs and performs many steps in the process of signing and verifying signatures. A large number of polynomial and hash operations are required. It takes a lot of time to execute these polynomial calculations in sequence, which cannot meet the needs of rapid key generation and data encryption. Therefore, the optimization of polynomial calculations is particularly important. Summary of the invention

[0003] The present invention provides a method, system and electronic device for optimizing the execution of a quantum-resistant cryptographic signature algorithm, so as to solve the problem that the quantum-resistant signature algorithm in the prior art needs to perform a large number of polynomial and hash operations, and it takes a long time to execute these polynomial calculations in sequence.

[0004] The embodiment of this specification provides a method for optimizing the execution of a quantum-resistant cryptographic signature algorithm, including:

[0005] Obtain the public polynomial and secret polynomial in the quantum-resistant cryptographic signature algorithm;

[0006] The public polynomial is sampled by a first sampling unit to obtain a polynomial matrix, and the secret polynomial is sampled by a second sampling unit to obtain a first random coefficient and a second random coefficient; the polynomial matrix is ​​stored in a BRAM (Block Random Access Memory), the first random coefficient is cached in a first FIFO (First In First Out) memory, and the second random coefficient is cached in a second FIFO memory;

[0007] Using an NTT module, performing a number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theory transformation result;

[0008] Performing point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and caching the operation results in a third FIFO memory; and performing inverse number theory transformation on the operation results in the third FIFO memory to obtain polynomial coefficients on a finite field, and the polynomial coefficients on the finite field are used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

[0009] Optionally, the obtaining of a public polynomial and a secret polynomial in a quantum-resistant cryptographic signature algorithm includes:

[0010] Receive a random seed generated by a random number generator;

[0011] Perform a hash operation on the received random seed to obtain a hash operation result;

[0012] Two Keccak operation units are used to perform Keccak operation on the random seed of the public polynomial and the random seed of the secret polynomial in the hash operation result respectively to obtain the public polynomial and the secret polynomial.

[0013] Optionally, storing the polynomial matrix into a BRAM comprises:

[0014] The polynomial matrix is ​​cached in a fourth FIFO memory, and the BRAM stores the polynomial matrix in the fourth FIFO memory in a matrix order after the polynomial matrix is ​​transposed.

[0015] Optionally, the NTT (Number Theoretic Transform) module includes a first NTT unit and a second NTT unit; the number theoretic transformation result includes a first number theoretic transformation result and a second number theoretic transformation result;

[0016] The using the NTT module to perform number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theory transformation result includes:

[0017] Using the first NTT unit to perform a number theory transformation on the first random coefficient in the first FIFO memory to obtain a first number theory transformation result, and caching the first number theory transformation result in a fifth FIFO memory;

[0018] A second NTT unit is used to perform a number-theoretic transformation on the second random coefficient in the second FIFO memory to obtain a second number-theoretic transformation result.

[0019] Optionally, performing a point multiplication operation and a modular addition operation on the number theory transformation result and the polynomial matrix in the BRAM, and caching the operation result in a third FIFO memory, comprises:

[0020] Performing a point multiplication operation on the first number theory transformation result in the fifth FIFO memory and the polynomial matrix in the BRAM to obtain a point multiplication operation result;

[0021] Perform a modular addition operation on the dot product operation result and the second number theory transformation result to obtain the operation result, and cache the operation result in a third FIFO memory.

[0022] Optionally, after obtaining the polynomial coefficients on the finite field, the method further includes:

[0023] The polynomial coefficients over the finite field are cached in the sixth FIFO memory.

[0024] Optionally, the polynomial coefficients on the finite field are used to determine the public key and the private key generated by the quantum-resistant cryptographic signature algorithm, including:

[0025] Decomposing the polynomial coefficients in the sixth FIFO memory by a coefficient decomposition unit to obtain first polynomial sub-coefficients and second polynomial sub-coefficients;

[0026] Encoding the second polynomial sub-coefficients and the random seed of the public polynomial to obtain a public key of a quantum-resistant cryptographic signature algorithm;

[0027] Performing a hash operation on the public key to obtain a hash value;

[0028] The hash value, the random seed of the public polynomial, the key in the hash operation result, the first random coefficient, the second random coefficient, and the first polynomial sub-coefficient are encoded to obtain a private key of the quantum-resistant cryptographic signature algorithm, and the public key and the private key are converted into bit widths using a seventh FIFO memory to be stored in the BRAM.

[0029] Optionally, the method further includes:

[0030] When the first NTT unit and / or the second NTT unit is in an idle state, and there is data to be processed that requires number theoretic transformation and is not generated by hash operation, the first NTT unit and / or the second NTT unit in the idle state is used to perform number theoretic transformation on the data to be processed, and the number theoretic transformation result is stored in the BRAM.

[0031] Optionally, the method further includes:

[0032] When the polynomial coefficients on the finite field are polynomial coefficients generated in the signing process, a checking unit is used to perform a norm check on the polynomial coefficients. When the norm check is qualified, the polynomial coefficients meet the requirements.

[0033] The embodiment of this specification also provides a quantum-resistant cryptographic signature algorithm execution optimization system, including:

[0034] A hash operation unit, used to obtain the public polynomial and secret polynomial in the quantum-resistant cryptographic signature algorithm;

[0035] A first sampling unit, configured to sample the common polynomial to obtain a polynomial matrix; and store the polynomial matrix in a polynomial matrix area in a BRAM;

[0036] A second sampling unit is used to sample the secret polynomial to obtain a first random coefficient and a second random coefficient; the first random coefficient is cached in a first FIFO memory, and the second random coefficient is cached in a second FIFO memory;

[0037] An NTT module, configured to perform a number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory using the NTT module to obtain a number theory transformation result;

[0038] The multiplication and addition operation unit is used to perform point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and cache the operation results in a third FIFO memory; and perform inverse number theory transformation on the operation results in the third FIFO memory to obtain polynomial coefficients on a finite field, and the polynomial coefficients on the finite field are used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

[0039] An electronic device comprises a memory and a processor, wherein the memory stores computer instructions, and the processor is configured to run the computer instructions to execute the method described above.

[0040] A storage medium stores computer instructions, wherein the computer instructions are configured to execute the above method when executed.

[0041] The beneficial effect is that: the present application sets a first FIFO memory storing a first random coefficient corresponding to a secret polynomial and a second FIFO memory storing a second random coefficient corresponding to a secret polynomial on computing hardware, and reduces the number of times the secret polynomial is written into and read from the storage unit by caching. In addition, a third FIFO memory is set to cache intermediate operation results, and reduces the number of times the operation results are written into and read from the BRAM by caching. At the same time, a BRAM storing a public polynomial is set, and the combination of the two balances the data execution speed. By using the above data storage setting, on the one hand, the number of data access and storage is reduced, and the additional power consumption caused by memory access is reduced. On the other hand, the high latency problem between modules is reduced. Furthermore, the data storage method changes the order in which data is executed, and the overall execution speed of the data is balanced, reducing the overall execution time required for the calculation. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 A flow chart of a method for optimizing execution of a quantum-resistant cryptographic signature algorithm provided in an embodiment of this specification;

[0045] Figure 2 A hardware architecture diagram for optimizing the execution of a quantum-resistant cryptographic signature algorithm provided in an embodiment of this specification;

[0046] Figure 3 A schematic diagram of the structure of a quantum-resistant cryptographic signature algorithm execution optimization system provided in an embodiment of this specification;

[0047] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification;

[0048] Figure 5 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of the present specification. DETAILED DESCRIPTION

[0049] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0050] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0051] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention unless specifically stated otherwise.

[0052] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

[0053] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0054] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0055] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0056] Reference Figure 1 A schematic diagram of a method for optimizing execution of a quantum-resistant cryptographic signature algorithm provided in an embodiment of the present specification includes: S101: obtaining a public polynomial and a secret polynomial in a quantum-resistant cryptographic signature algorithm; S102: using a first sampling unit to sample the public polynomial to obtain a polynomial matrix, and using a second sampling unit to sample the secret polynomial to obtain a first random coefficient and a second random coefficient; and storing the polynomial matrix in a BRAM, caching the first random coefficient in a first FIFO memory, and caching the second random coefficient in a second FIFO memory.

[0057] In an optional embodiment, in the process of generating a public key and a private key by a quantum-resistant cryptographic signature algorithm, taking the calculation process of A*s1+s2 in the key generation process as an example, firstly, a random seed generated by a random number generator is received, and then a hash operation is performed on the received random seed to obtain a hash operation result, wherein the hash operation result includes a random seed ρ of a public polynomial, a random seed ρ′ of a secret polynomial, and a key K for the quantum cryptographic signature algorithm. Then, two Keccak operation units are used to perform Keccak operation on the random seed ρ of the public polynomial and the random seed ρ′ of the secret polynomial in the hash operation result, respectively, to obtain a public polynomial and a secret polynomial. Then, a first sampling unit is used to sample the public polynomial to obtain a polynomial matrix A, and a second sampling unit is used to sample the secret polynomial to obtain a first random coefficient s1 and a second random coefficient s2; Figure 2As shown, finally, the polynomial matrix A is stored in the polynomial matrix area of ​​the BRAM, the first random coefficient s1 is cached in the first FIFO memory, and the second random coefficient s2 is cached in the second FIFO memory; a first FIFO memory for storing the first random coefficient s1 corresponding to the secret polynomial and a second FIFO memory for storing the second random coefficient s2 corresponding to the secret polynomial are set on the computing hardware, and the number of times the secret polynomial is written into and read from the storage unit is reduced by caching.

[0058] S103: Use the NTT module to perform number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theory transformation result; S104: Perform point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and then cache the operation result in the third FIFO memory; and perform inverse number theory transformation on the operation result in the third FIFO memory to obtain the polynomial coefficient on the finite field, and the polynomial coefficient on the finite field is used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

[0059] In an alternative embodiment, Figure 2 As shown, the NTT module is used to perform number theory transformation on the first random coefficient s1 and the second random coefficient s2, that is, s1 and s2 are positively transformed to obtain the number theory transformation result, and then the number theory transformation result is multiplied and modularly added with the polynomial matrix A in the polynomial matrix area in the BRAM. After that, as shown in Figure 3 As shown, the operation result is cached in the third FIFO memory; and the operation result in the third FIFO memory is transformed by the inverse number theory using the INTT unit to obtain the polynomial coefficient t on the finite field, and the polynomial coefficient t on the finite field is used to determine the public key and private key generated by the anti-quantum cryptographic signature algorithm. The third FIFO memory is set to cache the intermediate operation results, and the number of times the operation results are written to and read from the BRAM is reduced by caching, and the BRAM storing the public polynomial is set at the same time. The combination of the two balances the data execution speed. By using the above data storage setting, on the one hand, the number of data access and storage is reduced, and the additional power consumption caused by memory access is reduced. On the other hand, the high latency problem between modules is reduced. Moreover, the data storage method changes the order in which the data is executed, which overall balances the data execution speed and reduces the overall execution time required for the calculation.

[0060] Specifically, the polynomial coefficients on the finite field are used to determine the public key and the private key generated by the quantum-resistant cryptographic signature algorithm, including: using a coefficient decomposition unit to decompose the polynomial coefficients in the sixth FIFO memory to obtain a first polynomial sub-coefficient and a second polynomial sub-coefficient; using a data processing unit to encode the second polynomial sub-coefficient and the random seed of the public polynomial to obtain the public key of the quantum-resistant cryptographic signature algorithm; performing a hash operation on the public key to obtain a hash value; using a data processing unit to encode the hash value, the random seed of the public polynomial, the key in the hash operation result, the first random coefficient, the second random coefficient, and the first polynomial sub-coefficient to obtain the private key of the quantum-resistant cryptographic signature algorithm, and using a seventh FIFO memory to perform bit width conversion on the public key and the private key to store them in the BRAM.

[0061] In an alternative embodiment, Figure 2 As shown, the coefficient decomposition unit is used to decompose the high and low bits of the polynomial coefficients in the sixth FIFO memory to obtain the first polynomial sub-coefficient t0 and the second polynomial sub-coefficient t1; wherein the high and low bit decomposition refers to the process of decomposing a numerical value into its high and low bits, for example, for a 32-bit integer, the low 16 bits can be represented as the low bit part, and the high 16 bits are represented as the high bit part; then, the second polynomial sub-coefficient t1 and the random seed ρ of the public polynomial are encoded, that is, (ρ, t1) is encoded to obtain the public key pk of the quantum-resistant cryptographic signature algorithm, and then, the public key pk is hashed to obtain the hash value tr, and finally, the hash value tr, the random seed ρ of the public polynomial, the key K in the hash operation result, the first random coefficient s1, the second random coefficient s2 and the first polynomial sub-coefficient t0 are encoded, that is, (ρ, K, tr, s1, s2, t0) is encoded to obtain the private key sk of the quantum-resistant cryptographic signature algorithm, and the public key pk and the private key sk are converted by the seventh FIFO memory, and the public key pk and the private key sk after the bit width conversion are written into the address corresponding to the key data area in the BRAM. When there is data that needs to be signed and verified by the quantum-resistant signature algorithm, the public key pk and the private key sk can be directly extracted from the address corresponding to the key data area in the BRAM for use. By using the seventh FIFO memory to realize the bit width conversion of the public key pk and the private key sk, it is ensured that the public key pk and the private key sk are stored in the key data area in the BRAM according to the set bit width, which is convenient for data storage and transmission.

[0062] In an alternative embodiment, Figure 2As shown, the polynomial matrix is ​​cached in the fourth FIFO memory, and the BRAM stores the polynomial matrix in the fourth FIFO memory in the matrix order after the polynomial matrix is ​​transposed. The fourth FIFO memory is set to balance the pipeline speed of the polynomial matrix A, so that each module and / or unit will not generate a large delay when the polynomial matrix A is calculated.

[0063] Optionally, the NTT module includes a first NTT unit and a second NTT unit; the number theoretic transformation result includes a first number theoretic transformation result and a second number theoretic transformation result; the use of the NTT module to perform a number theoretic transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theoretic transformation result includes: using the first NTT unit to perform a number theoretic transformation on the first random coefficient in the first FIFO memory to obtain a first number theoretic transformation result, and caching the first number theoretic transformation result to a fifth FIFO memory; using the second NTT unit to perform a number theoretic transformation on the second random coefficient in the second FIFO memory to obtain a second number theoretic transformation result.

[0064] Optionally, performing a point multiplication operation and a modular addition operation on the number theory transformation result and the polynomial matrix in the BRAM, and caching the operation result in a third FIFO memory, comprises:

[0065] In an alternative embodiment, Figure 2 As shown, two NTT units are used to perform number theory transformation on the first random coefficient s1 in a FIFO memory and the second random coefficient s2 in a second FIFO memory respectively, so as to ensure that the two random coefficients are processed separately, and avoid data confusion during subsequent point multiplication and modular addition operations. At the same time, a fifth FIFO memory is set to cache the first number theory transformation result, and then the first number theory transformation result in the fifth FIFO memory is subjected to a point multiplication operation with the polynomial matrix in the BRAM to obtain the point multiplication operation result; finally, the point multiplication operation result is subjected to a modular addition operation with the second number theory transformation result to obtain the operation result, and the operation result is cached in the third FIFO memory. By caching, the second number theory transformation result is waited for and the polynomial matrix A is taken out from the polynomial matrix area in the BRAM. The increase of the memory changes the data execution order, reduces the overall execution time required for the calculation, and reduces the high delay problem between modules and / or units.

[0066] Optionally, after obtaining the polynomial coefficients on the finite field, the method further includes: caching the polynomial coefficients on the finite field into a sixth FIFO memory.

[0067] In an alternative embodiment, Figure 2As shown, by setting the sixth FIFO memory to cache the polynomial coefficients on the finite field, each module and / or unit will not generate a large delay during the polynomial calculation, thereby effectively balancing the execution speed of the data.

[0068] Optionally, the method also includes: when the first NTT unit and / or the second NTT unit is in an idle state, and there is data to be processed that requires number theoretic transformation and is not generated by hash operation, using the first NTT unit and / or the second NTT unit in the idle state to perform number theoretic transformation on the data to be processed, and storing the number theoretic transformation result in the BRAM.

[0069] In an alternative embodiment, Figure 2 As shown, when there is data to be processed that requires number theory transformation and is not generated by hash operation, if the first NTT unit and / or the second NTT unit are in an idle state, the parallel processing method between modules is used to allow the first NTT unit and / or the second NTT unit to process the data to be processed of the current external input, and the processing result is written to the operation data area of ​​the BRAM. For example, in the signing process, it is necessary to decompress the private key to obtain the coefficients of each polynomial, and then perform NTT transformation on the polynomial coefficients. At this time, the idle first NTT unit and / or the second NTT unit can be used to perform NTT transformation on these polynomials. By adopting the above scheduling method, each NTT unit can be better utilized, making the execution process of the entire algorithm more compact, and there will be no large delay in a unit or module, that is, avoiding the decrease in the execution speed of the overall anti-quantum cryptographic signature algorithm due to the delay of a unit or module.

[0070] Optionally, the method further includes: when the polynomial coefficients on the finite field are polynomial coefficients generated during the signing process, using a checking unit to perform a norm check on the polynomial coefficients, and when the norm check is qualified, the polynomial coefficients meet the requirements.

[0071] In an optional embodiment, the checking unit is responsible for performing a norm check on a specific polynomial. For example, in the process of signing using the anti-quantum signature algorithm, the checking unit is used to perform a norm check on the specific polynomial coefficient z. If one coefficient does not meet the check requirements, a fail signal will be returned to the state machine, and the signing process will be re-performed. When the norm check is qualified, the specific polynomial coefficient z meets the requirements, and the specific polynomial coefficient z can be used for signing using the anti-quantum cryptographic signature algorithm. At the same time, the polynomial coefficients on the finite field are cached in the sixth FIFO memory, which can balance the inspection time of the inspection unit during the norm check process and improve the execution efficiency of the inspection unit.

[0072] In an optional embodiment, the entire polynomial matrix A may be written into the polynomial matrix area of ​​the BRAM in advance, so there is no need to repeat the process of calculating the polynomial matrix A, thereby achieving the effect of increasing the storage area in exchange for data calculation execution speed.

[0073] The present application sets a first FIFO memory storing a first random coefficient corresponding to a secret polynomial and a second FIFO memory storing a second random coefficient corresponding to a secret polynomial on computing hardware, and reduces the number of times the secret polynomial is written into and read from the storage unit by caching. In addition, a third FIFO memory is set to cache intermediate operation results, and reduces the number of times the operation results are written into and read from the BRAM by caching. At the same time, a BRAM storing a public polynomial is set, and the combination of the two balances the data execution speed. By using the above data storage setting, on the one hand, the number of data access and storage is reduced, and the additional power consumption caused by memory access is reduced. On the other hand, the high latency problem between modules is reduced. Furthermore, the data storage method changes the order in which data is executed, and the overall execution speed of the data is balanced, reducing the overall execution time required for the calculation.

[0074] Reference Figure 3 The embodiment of this specification also provides a quantum-resistant cryptographic signature algorithm execution optimization system, including:

[0075] A hash operation unit 201, used to obtain a public polynomial and a secret polynomial in a quantum-resistant cryptographic signature algorithm;

[0076] A first sampling unit 202 is used to sample the common polynomial to obtain a polynomial matrix; and store the polynomial matrix in a polynomial matrix area in a BRAM;

[0077] A second sampling unit 203 is used to sample the secret polynomial to obtain a first random coefficient and a second random coefficient; the first random coefficient is cached in a first FIFO memory, and the second random coefficient is cached in a second FIFO memory;

[0078] An NTT module 204 is used to perform a number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory using an NTT module to obtain a number theory transformation result;

[0079] The multiplication and addition operation unit 205 is used to perform point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and cache the operation results in a third FIFO memory; and perform inverse number theory transformation on the operation results in the third FIFO memory to obtain polynomial coefficients on a finite field, and the polynomial coefficients on the finite field are used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

[0080] Optionally, the hash operation unit 201 includes:

[0081] A random seed receiving unit, used for receiving a random seed generated by a random number generator;

[0082] The hash operation subunit is used to perform a hash operation on the received random seed to obtain a hash operation result;

[0083] The Keccak operation unit is used to use two Keccak operation units to perform Keccak operation on the random seed of the public polynomial and the random seed of the secret polynomial in the hash operation result respectively, so as to obtain the public polynomial and the secret polynomial.

[0084] Optionally, the first sampling unit 202 includes:

[0085] The first cache unit is used to cache the polynomial matrix to a fourth FIFO memory, and the BRAM stores the polynomial matrix in the fourth FIFO memory in a matrix order after the polynomial matrix is ​​transposed.

[0086] Optionally, the NTT module includes a first NTT unit and a second NTT unit; the number theory transformation result includes a first number theory transformation result and a second number theory transformation result; the NTT module 204 includes:

[0087] A first number theory transformation unit, configured to perform number theory transformation on the first random coefficient in the first FIFO memory by using the first NTT unit to obtain a first number theory transformation result, and cache the first number theory transformation result in a fifth FIFO memory;

[0088] The second number theory transformation unit is used to use the second NTT unit to perform number theory transformation on the second random coefficient in the second FIFO memory to obtain a second number theory transformation result.

[0089] Optionally, the multiplication and addition operation unit 205 includes:

[0090] A point multiplication operation unit, configured to perform a point multiplication operation on the first number theory transformation result in the fifth FIFO memory and the polynomial matrix in the BRAM to obtain a point multiplication operation result;

[0091] A modular addition operation unit is used to perform a modular addition operation on the point multiplication operation result and the second number theory transformation result to obtain the operation result, and cache the operation result in a third FIFO memory.

[0092] Optionally, after obtaining the polynomial coefficients on the finite field, the device further includes:

[0093] The second cache unit is used to cache the polynomial coefficients on the finite field into a sixth FIFO memory.

[0094] Optionally, the multiplication and addition operation unit 205 further includes:

[0095] A coefficient decomposition unit, configured to use the coefficient decomposition unit to perform coefficient decomposition on the polynomial coefficients in the sixth FIFO memory to obtain first polynomial sub-coefficients and second polynomial sub-coefficients;

[0096] A first encoding unit is used to encode the second polynomial sub-coefficients and the random seed of the public polynomial to obtain a public key of a quantum-resistant cryptographic signature algorithm;

[0097] A hash value calculation unit, used to perform a hash operation on the public key to obtain a hash value;

[0098] The second encoding unit is used to encode the hash value, the random seed of the public polynomial, the key in the hash operation result, the first random coefficient, the second random coefficient and the first polynomial sub-coefficient to obtain a private key of the quantum-resistant cryptographic signature algorithm, and use the seventh FIFO memory to convert the bit width of the public key and the private key to store them in the BRAM.

[0099] Optionally, the device further comprises:

[0100] The processing unit for processing data to be processed is used to perform number-theoretic transformation on the data to be processed by using the first NTT unit and / or the second NTT unit in the idle state when the first NTT unit and / or the second NTT unit are in an idle state and there is data to be processed that requires number-theoretic transformation and is not generated by hash operation, and store the number-theoretic transformation result in the BRAM.

[0101] Optionally, the device further comprises:

[0102] The norm checking unit is used to perform a norm check on the polynomial coefficients on the finite field when the polynomial coefficients are generated in the signing process. When the norm check is qualified, the polynomial coefficients meet the requirements.

[0103] Regarding the system in the above embodiment, the process of executing the operation in each step has been described in detail in the embodiment of the method, and will not be elaborated here.

[0104] Based on the same inventive concept, an embodiment of this specification also provides an electronic device.

[0105] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0106] Reference Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. Figure 4 The electronic device 300 according to the embodiment of the present invention is described. Figure 4 The electronic device 300 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0107] like Figure 4 As shown, the electronic device 300 is in the form of a general computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different device components (including the storage unit 320 and the processing unit 310), a display unit 340, etc.

[0108] The storage unit stores program codes, which can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present invention described in the above processing method section of this specification. For example, the processing unit 310 can perform the following steps: Figure 1 Steps shown.

[0109] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache memory unit 3202 , and may further include a read-only memory unit (ROM) 3203 .

[0110] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: operating means, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0111] Bus 330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0112] The electronic device 300 may also communicate with one or more external devices 400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 300, and / or any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed through an input / output (I / O) interface 350. Furthermore, the electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 through the bus 330. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices.

[0113] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the exemplary embodiments described in the present invention can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation method of the present invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.) or on a network, including a number of instructions to enable a computing device (which can be a personal computer, server, or network device, etc.) to execute the above method according to the present invention. When the computer instructions are executed by a data processing device, the computer-readable medium can implement the above method of the present invention, that is: Figure 1 The method shown.

[0114] Reference Figure 5 A schematic diagram of a computer-readable medium provided in accordance with an embodiment of the present specification.

[0115] accomplish Figure 1The computer instructions of the method shown can be stored on one or more computer readable media. The computer readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, device or component, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0116] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution device, device, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0117] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0118] In summary, the present invention can be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that general data processing devices such as microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0119] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the present invention is not inherently related to any specific computer, virtual device or electronic device, and various general devices can also implement the present invention. The above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection scope of the present invention.

[0120] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0121] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for optimizing the execution of a quantum-resistant cryptographic signature algorithm, characterized in that: include: Obtain the public polynomial and secret polynomial in the quantum-resistant cryptographic signature algorithm; Using a first sampling unit to sample the public polynomial to obtain a polynomial matrix, and using a second sampling unit to sample the secret polynomial to obtain a first random coefficient and a second random coefficient; and storing the polynomial matrix in a BRAM, caching the first random coefficient in a first FIFO memory, and caching the second random coefficient in a second FIFO memory; Using an NTT module, performing a number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theory transformation result; Performing point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and caching the operation results in a third FIFO memory; and performing inverse number theory transformation on the operation results in the third FIFO memory to obtain polynomial coefficients on a finite field, and the polynomial coefficients on the finite field are used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

2. The method according to claim 1, characterized in that , the method of obtaining the public polynomial and the secret polynomial in the quantum-resistant cryptographic signature algorithm includes: Receive a random seed generated by a random number generator; Perform a hash operation on the received random seed to obtain a hash operation result; Two Keccak operation units are used to perform Keccak operation on the random seed of the public polynomial and the random seed of the secret polynomial in the hash operation result respectively to obtain the public polynomial and the secret polynomial.

3. The method according to claim 1, characterized in that , the storing of the polynomial matrix into BRAM comprises: The polynomial matrix is ​​cached in a fourth FIFO memory, and the BRAM stores the polynomial matrix in the fourth FIFO memory in a matrix order after the polynomial matrix is ​​transposed.

4. The method according to claim 1, characterized in that The NTT module includes a first NTT unit and a second NTT unit; the number theory transformation result includes a first number theory transformation result and a second number theory transformation result; The using the NTT module to perform number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory to obtain a number theory transformation result includes: Using the first NTT unit to perform a number theory transformation on the first random coefficient in the first FIFO memory to obtain a first number theory transformation result, and caching the first number theory transformation result in a fifth FIFO memory; A second NTT unit is used to perform a number-theoretic transformation on the second random coefficient in the second FIFO memory to obtain a second number-theoretic transformation result.

5. The method according to claim 4, characterized in that The step of performing a point multiplication operation and a modular addition operation on the number theory transformation result and the polynomial matrix in the BRAM, and caching the operation result in a third FIFO memory includes: Performing a point multiplication operation on the first number theory transformation result in the fifth FIFO memory and the polynomial matrix in the BRAM to obtain a point multiplication operation result; Perform a modular addition operation on the dot product operation result and the second number theory transformation result to obtain the operation result, and cache the operation result in a third FIFO memory.

6. The method according to claim 2, characterized in that After obtaining the polynomial coefficients on the finite field, the method further includes: The polynomial coefficients over the finite field are cached in the sixth FIFO memory.

7. The method according to claim 6, characterized in that The polynomial coefficients on the finite field are used to determine the public key and the private key generated by the quantum-resistant cryptographic signature algorithm, including: Decomposing the polynomial coefficients in the sixth FIFO memory by a coefficient decomposition unit to obtain first polynomial sub-coefficients and second polynomial sub-coefficients; Encoding the second polynomial sub-coefficients and the random seed of the public polynomial to obtain a public key of a quantum-resistant cryptographic signature algorithm; Performing a hash operation on the public key to obtain a hash value; The hash value, the random seed of the public polynomial, the key in the hash operation result, the first random coefficient, the second random coefficient, and the first polynomial sub-coefficient are encoded to obtain a private key of the quantum-resistant cryptographic signature algorithm, and the public key and the private key are converted into bit widths using a seventh FIFO memory to be stored in the BRAM.

8. The method according to claim 3, characterized in that The method further comprises: When the first NTT unit and / or the second NTT unit is in an idle state, and there is data to be processed that requires number theoretic transformation and is not generated by hash operation, the first NTT unit and / or the second NTT unit in the idle state is used to perform number theoretic transformation on the data to be processed, and the number theoretic transformation result is stored in the BRAM.

9. The method according to claim 1, characterized in that The method further comprises: When the polynomial coefficients on the finite field are polynomial coefficients generated in the signing process, a checking unit is used to perform a norm check on the polynomial coefficients. When the norm check is qualified, the polynomial coefficients meet the requirements.

10. A quantum-resistant cryptographic signature algorithm execution optimization system, characterized in that ,include: A hash operation unit, used to obtain the public polynomial and secret polynomial in the quantum-resistant cryptographic signature algorithm; A first sampling unit, configured to sample the common polynomial to obtain a polynomial matrix; and store the polynomial matrix in a polynomial matrix area in a BRAM; A second sampling unit is used to sample the secret polynomial to obtain a first random coefficient and a second random coefficient; the first random coefficient is cached in a first FIFO memory, and the second random coefficient is cached in a second FIFO memory; An NTT module, configured to perform a number theory transformation on the first random coefficient in the first FIFO memory and the second random coefficient in the second FIFO memory using the NTT module to obtain a number theory transformation result; The multiplication and addition operation unit is used to perform point multiplication and modular addition operations on the number theory transformation result and the polynomial matrix in the BRAM, and cache the operation results in a third FIFO memory; and perform inverse number theory transformation on the operation results in the third FIFO memory to obtain polynomial coefficients on a finite field, and the polynomial coefficients on the finite field are used to determine the public key and private key generated by the quantum-resistant cryptographic signature algorithm.

11. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer instructions, and the processor is configured to execute the computer instructions to perform the method according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium stores computer instructions, and the computer instructions are configured to execute the method according to any one of claims 1 to 9 when executed.

Images