Modular multiplier circuit applied to post quantum cryptography algorithm and calculation method thereof

Abstract

The invention provides a modular multiplier circuit applied to a post quantum cryptography algorithm and a calculation method thereof, and the circuit comprises a first calculation module which is used for calculating a result of (a * b1) modq, and obtaining a first calculation result f; wherein mod represents a complementation algorithm; the second calculation module is used for calculating a result of (a * b2) modq to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22th bit of the data b, and b1 represents data from the 0th bit to the 4th bit of the data b; and the third calculation module is used for calculating a result of the (f + g) modq so as to obtain a final output result. According to the structure, only one DSP is used, and a register is inserted through a modular reduction method and a critical path, so that the circuit performance is further improved.

Description

Technical Field

[0001] The present application relates to the technical field of post-quantum cryptographic algorithms, and in particular to a modular multiplier circuit and a calculation method thereof applied to post-quantum cryptographic algorithms. Background Art

[0002] Digital signatures play an integral role in today's increasingly digital and connected world. They not only protect sensitive financial transactions and legal contracts, but also maintain the integrity of important healthcare and government documents, becoming the cornerstone of trust and security in a variety of online activities. Digital signatures effectively prevent forgery and tampering by verifying the origin and integrity of information and ensuring that only authorized users can access and modify important data.

[0003] However, with the rapid development of quantum computers, traditional public key encryption algorithms such as Elliptic Curve Diffie-Hellman (ECDH) and RSA will face major security challenges. Quantum computers have powerful parallel processing capabilities and can crack these traditional cryptographic systems in a short time through quantum algorithms (such as Shor's algorithm), making the digital signature mechanism that relies on these algorithms vulnerable. Therefore, there is an urgent need to develop a new generation of cryptographic algorithms that can resist quantum attacks, which is the research background of post-quantum cryptographic algorithms.

[0004] Currently, four algorithms (Kyber, Dilithium, Falcon, and SPHINCS+) have been successfully selected and entered the standardization process. These algorithms have their own characteristics and are suitable for different application scenarios. Among these four algorithms, in the implementation process of the Dilithium algorithm, modular multiplication is the most complex and most hardware-intensive key operation. From the perspective of hardware implementation, designing an efficient modular multiplier is of great significance to improving the computing efficiency of the entire system.

[0005] Application Contents

[0006] In view of the above problems, the present application provides a modular multiplier circuit and a calculation method thereof applied to a post-quantum cryptographic algorithm.

[0007] In a first aspect, the present application provides a modular multiplier circuit applied to a post-quantum cryptographic algorithm, comprising:

[0008] A first calculation module, the first calculation module is used to calculate the result of (a×b1) modq to obtain a first calculation result f; wherein mod represents a remainder algorithm;

[0009] A second calculation module, the second calculation module is used to calculate the result of (a×b2) modq to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22nd bit of data b, and b2 represents data from the 0th bit to the 4th bit of data b;

[0010] The third calculation module is used to calculate the result of (f+g) mod q, so as to obtain the final output result.

[0011] Wherein, the first calculation module includes:

[0012] A multiplication calculator, used for receiving data a and data b1, and performing multiplication operation on data a and data b1 to obtain data c; the data c is 41-bit data;

[0013] A first register, connected to the multiplication calculator, for storing data c;

[0014] A first adder, connected to the first register, for performing addition calculation on data c1 and data c2 to obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of data c, and c2 represents data from the 28th bit to the 40th bit of data c;

[0015] A second adder, connected to the first register, is used to perform addition calculation on data c2 and data c3 to obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of data c;

[0016] A first shifter, connected to the first adder, for shifting d1 left by 13 bits to obtain d3;

[0017] A second shifter, connected to the first register, is used to intercept the data from the 0th bit to the 17th bit of the data c and shift it left by 5 bits to obtain d4;

[0018] a first subtractor, connected to the second shifter and the second adder, and configured to perform a subtraction calculation on the data d2 and the data d4;

[0019] a third adder, connected to the first shifter and the first subtractor, and configured to perform addition calculation on the output of the first subtractor and the data d3 to obtain the first calculation result f;

[0020] The second register is connected to the third adder and is used for storing the first calculation result f.

[0021] Wherein, the second calculation module includes:

[0022] a first data selection unit, a fourth adder and a third register connected in sequence, wherein the first data selection unit is used to select data a as input of the fourth adder according to the data of the 2nd bit to the 4th bit of the data b, perform addition calculation, and store the result in the third register;

[0023] a second data selection unit, a fifth adder and a fourth register connected in sequence, wherein the second data selection unit is used to select data a as input of the fifth adder according to the data from the 0th bit to the 1st bit of the data b, perform addition calculation, and store the result in the fourth register;

[0024] A third shifter, connected to the third register, for left-shifting the output result of the fourth adder by 2 bits;

[0025] a sixth adder, connected to the third shifter and the fourth register, and configured to perform addition calculation on the output of the third shifter and the output of the fifth adder, thereby outputting a second calculation result g;

[0026] A fifth register, connected to the sixth adder, is used to store the second calculation result g.

[0027] Wherein, the first data selection unit comprises: a plurality of first data input paths, each of which comprises:

[0028] a fourth shifter and a first multiplexer, wherein a first input terminal of the first multiplexer is connected to the fourth shifter, a second input terminal receives reference data, a third input terminal receives data from the 2nd bit to the 4th bit of data b, and an output terminal is connected to the fourth adder;

[0029] The second data selection unit comprises: a plurality of second data input paths, each second data input path comprising:

[0030] A fifth shifter and a second multiplexer, wherein the first input terminal of the second multiplexer is connected to the fifth shifter, the second input terminal receives reference data, the third input terminal receives data from the 0th bit to the 1st bit of data b, and the output terminal is connected to the fifth adder.

[0031] Wherein, the first data selection unit comprises: at least three first data input paths;

[0032] In one of the first data input paths, the third input end of the first multiplexer receives the 4th bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 2 bits and outputs it to the fourth adder through the output end of the first multiplexer;

[0033] In one of the first data input paths, the third input end of the first multiplexer receives the data of the 3rd bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 1 bit and outputs it to the fourth adder through the output end of the first multiplexer;

[0034] In one of the first data input paths, the third input end of the first multiplexer receives the second bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 0 bits and outputs it to the fourth adder through the output end of the first multiplexer;

[0035] Among them, the reference data is 0.

[0036] Wherein, the second data selection unit comprises: at least two second data input paths;

[0037] In one of the second data input paths, the third input terminal of the second multiplexer receives the data of the 1st bit of data b and compares it with the reference data. If they are consistent, the output terminal of the second multiplexer outputs the reference data. If they are inconsistent, the fifth shifter shifts the data a left by 1 bit and outputs it to the fifth adder through the output terminal of the second multiplexer.

[0038] In one of the second data input paths, the third input end of the second multiplexer receives the 0th bit of data b and compares it with the reference data. If they are consistent, the output end of the second multiplexer outputs the reference data. If they are inconsistent, the fifth shifter shifts the data a left by 0 bits and outputs it to the fifth adder through the output end of the second multiplexer.

[0039] Wherein, the third calculation module includes:

[0040] a seventh adder, configured to add the first calculation result f and the second calculation result g to obtain h;

[0041] The sixth shifter is used to intercept the data from the 23rd bit to the 28th bit of data h and shift it left by 13 bits;

[0042] The second subtractor is connected to the seventh adder and the sixth shifter, and is used to subtract the output of the sixth shifter from the data from the 23rd bit to the 28th bit of data h;

[0043] The sixth register is connected to the second subtractor and is used to store the output of the second subtractor;

[0044] The seventh register is used to intercept and store the data from the 0th bit to the 22nd bit of data h;

[0045] The eighth adder is used to add the output of the second subtractor and the data from the 0th bit to the 22nd bit of data h stored in the first register;

[0046] The third subtractor is used to subtract the output i of the eighth adder from data q;

[0047] The third multiplexer is connected to the eighth adder and the third subtractor. If i < q, then the output i is the final output result; otherwise, the output i - q is the final output result.

[0048] In a second aspect, the present application provides a calculation method for a modular multiplier circuit, including:

[0049] Calculating the result of (a × b1) mod q to obtain a first calculation result f; where mod represents the remainder algorithm;

[0050] Calculating the result of (a × b2) mod q to obtain a second calculation result g; where a is 23-bit data, b is 23-bit data, b1 represents the data from the 5th bit to the 22nd bit of data b, and b1 represents the data from the 0th bit to the 4th bit of data b;

[0051] Calculating the result of (f + g) mod q to obtain the final output result.

[0052] The present invention discloses a low-DSP resource modular multiplier structure suitable for implementing the post-quantum cryptography Dilithium algorithm on an FPGA. This structure uses a method of decomposing the high-order multiplier, combines the characteristics of the DSP and the properties of the modulus q, and realizes the modular multiplication circuit structure for 23-bit data a and b. This structure only uses 1 DSP, and further improves the circuit performance through the modular reduction method and inserting registers in the critical path.

[0053] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0055] Figure 1 It is a structural schematic diagram of an embodiment of a modular multiplier circuit applied to a post-quantum cryptographic algorithm provided by the present application;

[0056] Figure 2 This is a schematic diagram of the structure of an embodiment of the first computing module 11 of the present application;

[0057] Figure 3 This is a structural diagram of an embodiment of the second calculation module 12 of the present application;

[0058] Figure 4 This is a schematic diagram of the structure of an embodiment of the third computing module of the present application;

[0059] Figure 5 It is a flowchart diagram of an embodiment of a calculation method of the analog multiplier circuit of the present application. DETAILED DESCRIPTION

[0060] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to be able to fully convey the scope of the present disclosure to those skilled in the art. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0061] Various structural schematic diagrams according to embodiments of the present disclosure are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may further design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0062] The operation circuit and operation method of the present application are described below with reference to the accompanying drawings.

[0063] See also Figure 1 , Figure 1 It is a structural schematic diagram of an embodiment of a modular multiplier circuit applied to a post-quantum cryptographic algorithm provided by the present application, which includes a first computing module 11, a second computing module 12 and a third computing module 13.

[0064] The first calculation module 11 is used to calculate the result of (a×b1)modq to obtain a first calculation result f, wherein mod represents a modulo algorithm.

[0065] The second calculation module 12 is used to calculate the result of (a×b2) modq to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents the data from the 5th bit to the 22nd bit of data b (expressed as b[22:5]), and b2 represents the data from the 0th bit to the 4th bit of data b (expressed as b[4:0]).

[0066] The third calculation module 13 is used to calculate the result of (f+g) mod q, so as to obtain the final output result.

[0067] The present invention designs a low DSP resource and efficient modular multiplier circuit suitable for the FPGA hardware design of the post-quantum cryptography Dilithium algorithm. By using the divide-and-conquer idea similar to the Karatsuba algorithm, the high-order data is divided into two, the DSP resources on the FPGA are fully utilized, and the modular reduction is used to simplify the calculation process. The final implementation is: input two 23-bit numbers a and b, and complete the modular multiplication operation (a×b) modq in four cycles, where q is 8380417.

[0068] Since the maximum input bit width of the DSP multiplier in the FPGA is 18 and 25, the multiplication of two 23-bit data a and b, a[22:0]×b[22:0], is divided into two parts, namely a[22:0]×b[22:5] and a[22:0]×b[4:0], as shown in equations (1)-(2). These two parts are obtained by further calculation and then added together:

[0069] c=a×b[22:5]#(1)

[0070] g=a×b[4:0]#(2)

[0071] In formula (1), b[22:5] is b1, and formula (1) is executed by the first calculation module 11 ; in formula (2), b[4:0] is b2, and formula (2) is executed by the second calculation module 12 .

[0072] For details, please combine Figure 2 , Figure 2 The first calculation module 11 includes: a multiplication calculator, a first register, a first adder, a second adder, a first shifter, a second shifter, a first subtractor, a third adder, and a second register.

[0073] The multiplication calculator is used to receive data a and data b1, and perform multiplication operation on data a and data b1 to obtain data c, as shown in the above formula (1); the data c is 41-bit data; it is calculated by DSP in hardware. The first register is connected to the multiplication calculator and is used to store data c. The first adder is connected to the first register and is used to perform addition operation on data c1 and data c2 to obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of data c (expressed as c[27:18]), and c2 represents data from the 28th bit to the 40th bit of data c (expressed as c[40:28]). The second adder is connected to the first register and is used to perform addition operation on data c2 and data c3 to obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of data c (expressed as c[40:18]). The first shifter is connected to the first adder and is used to shift d1 left by 13 bits, which is equivalent to 2 to the 13th power, to obtain d3. The second shifter is connected to the first register, and is used to intercept the data from the 0th bit to the 17th bit of the data c (expressed as c[17:0]) and shift it left by 5 bits, which is equivalent to ×2 to the 5th power, to obtain d4. The first subtractor is connected to the second shifter and the second adder, and is used to perform a subtraction calculation on the data d2 and the data d4. The third adder is connected to the first shifter and the first subtractor, and is used to perform an addition calculation on the output of the first subtractor and the data d3, to obtain the first calculation result f. The second register is connected to the third adder, and is used to store the first calculation result f.

[0074] By modulus q = 8380417 = 2 23 -2 13 +1, can use formula 2 23 ≡2 13 -1(modq) performs modular reduction. During the calculation process, we have:

[0075] f=c·2 5

[0076] =c[40:18]·2 23 +c[1t:0]·2 5

[0077] =(c[40:18]·213 -c[40:18])·+c[1t:0]·2 5

[0078] =c[40:28]·2 23 +c[2t:18]·2 13 -c[40:18]+c[1t:0]·2 5

[0079] =c[40:28]·2 13 -c[40:28]+c[2t:18]·2 13 -c[40:18]+c[1t:0]·2 5

[0080] =(c[40:28]+c[2t:18])·2 13 -(c[40:28]+c[40:18])+c[1t:0]·2 5 #(3)

[0081] Please combine Figure 3 , Figure 3 This is a schematic diagram of the structure of an embodiment of the second calculation module of the present application. The second calculation module 12 includes:

[0082] The first data selection unit n, the fourth adder and the third register are connected in sequence, the first data selection unit n is used to select data a as the input of the fourth adder according to the data from the 2nd bit to the 4th bit of data b (expressed as b[4:2]), perform addition calculation, and store the result in the third register. The first data selection unit includes: a plurality of first data input paths, each of which includes: a fourth shifter and a first multiplexer, the first input end of the first multiplexer is connected to the fourth shifter, the second input end receives reference data, the third input end receives the data from the 2nd bit to the 4th bit of data b (expressed as b[4:2]), and the output end is connected to the fourth adder.

[0083] In a specific embodiment, the first data selection unit n includes: at least three first data input paths; in one of the first data input paths, the third input end of the first multiplexer receives the data of the 4th bit of data b, i.e., b[4], and compares it with the reference data 0. If they are consistent, the output end of the first multiplexer outputs the reference data 0. If they are inconsistent, the fourth shifter shifts the data a left by 2 bits and outputs it to the fourth adder through the output end of the first multiplexer. In one of the first data input paths, the third input end of the first multiplexer receives the data of the 3rd bit of data b, i.e., b[3], and compares it with the reference data 0. If they are consistent, the output end of the first multiplexer outputs the reference data 0. If they are inconsistent, the fourth shifter shifts the data a left by 1 bit and outputs it to the fourth adder through the output end of the first multiplexer. In one of the first data input paths, the third input end of the first multiplexer receives the second bit of data b, i.e., b[2], and compares it with the reference data 0. If they are consistent, the output end of the first multiplexer outputs the reference data 0. If they are inconsistent, the fourth shifter shifts the data a left by 0 bits and outputs it to the fourth adder through the output end of the first multiplexer. The reference data is 0.

[0084] The second calculation module 12 further includes:

[0085] The second data selection unit m, the fifth adder and the fourth register are connected in sequence, the second data selection unit m is used to select data a as the input of the fifth adder according to the data from the 0th bit to the 1st bit of data b (expressed as b[1:0]), perform addition calculation, and store the result in the fourth register. The second data selection unit m includes: a plurality of second data input paths, each second data input path includes: a fifth shifter and a second multiplexer, the first input end of the second multiplexer is connected to the fifth shifter, the second input end receives reference data, the third input end receives the data from the 0th bit to the 1st bit of data b (expressed as b[1:0]), and the output end is connected to the fifth adder.

[0086] In a specific embodiment, the second data selection unit m includes: at least two second data input paths; in one of the second data input paths, the third input end of the second multiplexer receives the data of the 1st bit of data b, i.e., b[1], and compares it with the reference data 0. If they are consistent, the output end of the second multiplexer outputs the reference data 0. If they are inconsistent, the fifth shifter shifts the data a left by 1 bit and outputs it to the fifth adder through the output end of the second multiplexer. In one of the second data input paths, the third input end of the second multiplexer receives the data of the 0th bit of data b, i.e., b[0], and compares it with the reference data 0. If they are consistent, the output end of the second multiplexer outputs the reference data 0. If they are inconsistent, the fifth shifter shifts the data a left by 0 bit and outputs it to the fifth adder through the output end of the second multiplexer.

[0087] The second calculation module 12 further includes: a third shifter, a sixth adder, and a fifth register.

[0088] The third shifter is connected to the third register, and is used to shift the output result of the fourth adder (i.e., the output result of the fourth adder stored in the third register) to the left by 2 bits. The sixth adder is connected to the third shifter and the fourth register, and is used to perform addition calculation on the output of the third shifter and the output of the fifth adder, thereby outputting a second calculation result g. The fifth register is connected to the sixth adder, and is used to register the second calculation result g.

[0089] During the calculation process, the formula for g is obtained from equations (6)-(8):

[0090] d=a·b[4]·2 2 +a·b[3]·2 1 +a·b[2]#(6)

[0091] e=a·b[1]·2 1 +a·b[0]#(7)

[0092] g = d 2 2 +e#(8)

[0093] It should be noted that a left shift of n bits means ×2 n .

[0094] See also Figure 4 , Figure 4 This is a structural diagram of an embodiment of the third computing module of the present application. The third computing module specifically includes: a seventh adder, a sixth shifter, a second subtractor, a sixth register, a seventh register, an eighth adder, a third adder, and a third multiplexer.

[0095] Among them, the seventh adder is used to add the first calculation result f and the second calculation result g to obtain h; specifically:

[0096] h = a × b

[0097] = a × (b[22:5] · 2 5 + b[4:0])

[0098] = a × (c · 2 5 + b[4:0])

[0099] = f + g#(4)

[0100] The sixth shifter is used to intercept the data from the 23rd bit to the 28th bit of the data h (denoted as h[28:23]) and shift it left by 13 bits. The second subtractor, connected to the seventh adder and the sixth shifter, is used to subtract the output of the sixth shifter from the data from the 23rd bit to the 28th bit of the data h, denoted as h[28:23] · 2 13 - h[28:23]. The sixth register is connected to the second subtractor and is used to store the output of the second subtractor. The seventh register is used to intercept and store the data from the 0th bit to the 22nd bit of the data h (denoted as h[22:0]). The eighth adder is used to add the output of the second subtractor and the data from the 0th bit to the 22nd bit of the data h stored in the first register. The third subtractor is used to subtract the data q from the output i of the eighth adder.

[0101] h is a 29-bit number, which is equivalent to a × b under mod q, but it is not the least residue of a × b modulo q. Therefore, further reduction is required:

[0102] i = h[28:23] · 2 23 + h[22:0]

[0103] = h[28:23] · 2 13 - h[28:23] + h[22:0]#(9)

[0104] The third multiplexer is connected to the eighth adder and the second subtractor. If i < q, it outputs i as the final output result; otherwise, it outputs i - q as the final output result.

[0105] Generally speaking, this modular multiplier makes full use of the resources of the FPGA and realizes the modular multiplication operation with a DSP and a series of simple and efficient shifter and adder circuits.

[0106] The present invention discloses a low DSP resource modular multiplier structure suitable for FPGA to implement the post-quantum cryptography Dilithium algorithm. The structure adopts a method of decomposing high-bit multipliers, combines the characteristics of DSP and the properties of the modulus q, and implements a modular multiplication circuit structure of 23-bit data a and b. The structure uses only one DSP, and further improves the circuit performance through modular reduction method and critical path insertion register.

[0107] See also Figure 5 , is a flow chart of an embodiment of a calculation method of the analog multiplier circuit of the present application, which specifically includes:

[0108] Step S51: Calculate the result of (a×b1)modq to obtain a first calculation result f; wherein mod represents the modulo algorithm.

[0109] Step S52: Calculate the result of (a×b2) modq to obtain the second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22nd bit of data b, and b1 represents data from the 0th bit to the 4th bit of data b.

[0110] Step S53: Calculate the result of (f+g) mod q to obtain the final output result.

[0111] In this embodiment, the specific process of step S51 to step S53 can be found in the above explanation and will not be repeated here.

[0112] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the application described herein, and the description of the specific language above is for the purpose of disclosing the best mode of implementation of the application.

[0113] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0114] Similarly, it should be understood that in order to streamline the present disclosure and assist in understanding one or more of the various aspects of the application, in the above description of exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof.

[0115] Those skilled in the art will appreciate that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. The modules or units or components in the embodiment can be combined into one module or unit or component, and in addition they can be divided into multiple submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including abstracts and drawings) and all processes or units of any method or device disclosed in this manner can be combined in any combination. Unless otherwise explicitly stated, each feature disclosed in this specification (including accompanying abstracts and drawings) can be replaced by alternative features that provide the same, equivalent or similar purposes.

[0116] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present application and to form different embodiments.

[0117] It should be noted that the above embodiments illustrate the present application rather than limit the present application. Any reference symbol between brackets should not be constructed as a limitation to the present application. The word "comprising" does not exclude the existence of components or steps not listed in the present application. The word "one" or "an" before a component does not exclude the existence of multiple such components. The present application can be implemented by means of hardware including several different components and by means of a suitably programmed computer. In the embodiments in which several devices are listed, several of these devices can be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims

1. A modular multiplier circuit applied to a post-quantum cryptographic algorithm, characterized in that: include: A first calculation module, the first calculation module is used to calculate the result of (a×b1) modq to obtain a first calculation result f; wherein mod represents a remainder algorithm; A second calculation module, the second calculation module is used to calculate the result of (a×b2) modq to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22nd bit of data b, and b2 represents data from the 0th bit to the 4th bit of data b; The third calculation module is used to calculate the result of (f+g) mod q, so as to obtain the final output result.

2. The analog multiplier circuit according to claim 1, characterized in that: The first calculation module includes: A multiplication calculator, used for receiving data a and data b1, and performing multiplication operation on data a and data b1 to obtain data c; the data c is 41-bit data; A first register, connected to the multiplication calculator, for storing data c; A first adder, connected to the first register, for performing addition calculation on data c1 and data c2 to obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of data c, and c2 represents data from the 28th bit to the 40th bit of data c; A second adder, connected to the first register, is used to perform addition calculation on data c2 and data c3 to obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of data c; A first shifter, connected to the first adder, for shifting d1 left by 13 bits to obtain d3; A second shifter, connected to the first register, is used to intercept the data from the 0th bit to the 17th bit of the data c and shift it left by 5 bits to obtain d4; a first subtractor, connected to the second shifter and the second adder, and configured to perform a subtraction calculation on the data d2 and the data d4; a third adder, connected to the first shifter and the first subtractor, and configured to perform addition calculation on the output of the first subtractor and the data d3 to obtain the first calculation result f; The second register is connected to the third adder and is used for storing the first calculation result f.

3. The analog multiplier circuit according to claim 1, characterized in that: The second calculation module includes: a first data selection unit, a fourth adder and a third register connected in sequence, wherein the first data selection unit is used to select data a as input of the fourth adder according to the data of the 2nd bit to the 4th bit of the data b, perform addition calculation, and store the result in the third register; a second data selection unit, a fifth adder and a fourth register connected in sequence, wherein the second data selection unit is used to select data a as input of the fifth adder according to the data from the 0th bit to the 1st bit of the data b, perform addition calculation, and store the result in the fourth register; A third shifter, connected to the third register, for left-shifting the output result of the fourth adder by 2 bits; a sixth adder, connected to the third shifter and the fourth register, and configured to perform addition calculation on the output of the third shifter and the output of the fifth adder, thereby outputting a second calculation result g; A fifth register, connected to the sixth adder, is used to store the second calculation result g.

4. The analog multiplier circuit according to claim 3, characterized in that: The first data selection unit comprises: a plurality of first data input paths, each of which comprises: a fourth shifter and a first multiplexer, wherein a first input terminal of the first multiplexer is connected to the fourth shifter, a second input terminal receives reference data, a third input terminal receives data from the 2nd bit to the 4th bit of data b, and an output terminal is connected to the fourth adder; The second data selection unit comprises: a plurality of second data input paths, each second data input path comprising: A fifth shifter and a second multiplexer, wherein the first input terminal of the second multiplexer is connected to the fifth shifter, the second input terminal receives reference data, the third input terminal receives data from the 0th bit to the 1st bit of data b, and the output terminal is connected to the fifth adder.

5. The modular multiplier circuit according to claim 4, characterized in that: The first data selection unit comprises: at least three first data input paths; In one of the first data input paths, the third input end of the first multiplexer receives the 4th bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 2 bits and outputs it to the fourth adder through the output end of the first multiplexer; In one of the first data input paths, the third input end of the first multiplexer receives the data of the 3rd bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 1 bit and outputs it to the fourth adder through the output end of the first multiplexer; In one of the first data input paths, the third input end of the first multiplexer receives the second bit of data b and compares it with the reference data. If they are consistent, the output end of the first multiplexer outputs the reference data. If they are inconsistent, the fourth shifter shifts the data a left by 0 bits and outputs it to the fourth adder through the output end of the first multiplexer; Among them, the reference data is 0.

6. The modular multiplier circuit according to claim 4, characterized in that: The second data selection unit comprises: at least two second data input paths; In one of the second data input paths, the third input terminal of the second multiplexer receives the data of the 1st bit of data b and compares it with the reference data. If they are consistent, the output terminal of the second multiplexer outputs the reference data. If they are inconsistent, the fifth shifter shifts the data a left by 1 bit and outputs it to the fifth adder through the output terminal of the second multiplexer. In one of the second data input paths, the third input terminal of the second multiplexer receives the 0th bit data of data b, and compares it with the reference data. If they are the same, the output terminal of the second multiplexer outputs the reference data. If they are different, the fifth shifter shifts data a left by 0 bits, and outputs it to the fifth adder through the output terminal of the second multiplexer.

7. The analog multiplier circuit according to claim 1, characterized in that: The third calculation module includes: A seventh adder, configured to add the first calculation result f and the second calculation result g to obtain h; A sixth shifter, configured to intercept the data of the 23rd bit to the 28th bit of data h and shift it left by 13 bits; A second subtractor, connected to the seventh adder and the sixth shifter, configured to subtract the output of the sixth shifter from the data of the 23rd bit to the 28th bit of data h; A sixth register, connected to the second subtractor, configured to store the output of the second subtractor; A seventh register, configured to intercept and store the data of the 0th bit to the 22nd bit of data h; An eighth adder, configured to add the output of the second subtractor and the data of the 0th bit to the 22nd bit of data h stored in the first register; A third subtractor, configured to subtract the output i of the eighth adder from data q; A third multiplexer, connected to the eighth adder and the third subtractor. If i < q, then output i as the final output result; otherwise output i - q as the final output result.

8. A calculation method for a modular multiplier circuit, characterized in that: It includes: Calculate the result of (a × b1) mod q to obtain the first calculation result f; where, mod represents the remainder algorithm; Calculate the result of (a × b2) mod q to obtain the second calculation result g; where, a is 23-bit data, b is 23-bit data, b1 represents the data of the 5th bit to the 22nd bit of data b, and b1 represents the data of the 0th bit to the 4th bit of data; Calculate the result of (f + g) mod q to obtain the final output result.

Images