Modular multiplier circuit applied to post-quantum cryptographic algorithm and calculation method thereof

Abstract

The application provides a modular multiplier circuit applied to a post-quantum cryptographic algorithm and a calculation method thereof, comprising: a first calculation module, which is used for calculating the result of (a*b1)mod q to obtain a first calculation result f; wherein mod represents a remainder algorithm; a second calculation module, which is used for calculating the result of (a*b2)mod q to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22nd bit of the data b, and b2 represents data from the 0th bit to the 4th bit of the data b; and a third calculation module, which is used for calculating the result of (f+g)mod q to obtain a final output result. The structure only uses one DSP, and further improves the circuit performance through modular reduction method and key path insertion register.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of post-quantum cryptography algorithms, and particularly relates to a modular multiplication circuit applied to a post-quantum cryptography algorithm and a calculation method thereof. BACKGROUND

[0002] In today's increasingly digital and interconnected world, digital signatures play an indispensable role. They not only protect sensitive financial transactions and legal contracts, but also maintain the integrity of important medical and government documents, becoming the cornerstone of trust and security in various online activities. Digital signatures verify the source and integrity of information, ensuring that only authorized users can access and modify important data, effectively preventing forgery and tampering.

[0003] However, with the rapid development of quantum computers, traditional public key encryption algorithms such as Elliptic Curve Diffie-Hellman (ECDH) and RSA will face major security challenges. Quantum computers have powerful parallel processing capabilities and can break these traditional cryptographic systems through quantum algorithms (such as Shor's algorithm) in a short time, making digital signature mechanisms relying on these algorithms vulnerable. Therefore, it is urgent to develop a new generation of cryptographic algorithms that can resist quantum attacks, which is the research background of post-quantum cryptography algorithms.

[0004] Currently, four algorithms (Kyber, Dilithium, Falcon, and SPHINCS+) have been successfully selected and entered the standardization process. These algorithms each have their own characteristics and are suitable for different application scenarios. Among the four algorithms, in the implementation process of the Dilithium algorithm, modular multiplication is the most complex and hardware resource-consuming key operation. From the perspective of hardware implementation, designing an efficient modular multiplier is of great significance to improve the operation efficiency of the entire system.

[0005] Application Content

[0006] In view of the above problems, the application provides a modular multiplier circuit applied to a post-quantum cryptography algorithm and a calculation method thereof,

[0007] In a first aspect, the application provides a modular multiplier circuit applied to a post-quantum cryptography algorithm, comprising:

[0008] A first calculation module, the first calculation module is configured to calculate the result of (a x b1) mod q to obtain a first calculation result f; wherein mod represents a remainder algorithm;

[0009] The second calculation module is configured to calculate a result of (a×b2)mod q, and obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22nd bit of the data b, and b2 represents data from the 0th bit to the 4th bit of the data b;

[0010] The third calculation module is configured to calculate a result of (f+g)mod q, and obtain a final output result.

[0011] The first calculation module comprises:

[0012] The multiplication calculator is configured to receive the data a and the data b1, and perform multiplication operation on the data a and the data b1, and obtain data c; the data c is 41-bit data.

[0013] The first register is connected to the multiplication calculator, and is configured to register the data c.

[0014] The first adder is connected to the first register, and is configured to perform addition operation on the data c1 and the data c2, and obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of the data c, and c2 represents data from the 28th bit to the 40th bit of the data c.

[0015] The second adder is connected to the first register, and is configured to perform addition operation on the data c2 and the data c3, and obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of the data c.

[0016] The first shifter is connected to the first adder, and is configured to left shift d1 by 13 bits, and obtain d3.

[0017] The second shifter is connected to the first register, and is configured to intercept data from the 0th bit to the 17th bit of the data c, and left shift the data by 5 bits, and obtain d4.

[0018] The first subtracter is connected to the second shifter and the second adder, and is configured to perform subtraction operation on the data d2 and the data d4.

[0019] The third adder is connected to the first shifter and the first subtracter, and is configured to perform addition operation on the output of the first subtracter and the data d3, and obtain the first calculation result f.

[0020] The second register is connected to the third adder, and is configured to register the first calculation result f.

[0021] The second calculation module comprises:

[0022] a first data selection unit, a fourth adder and a third register connected in sequence, the first data selection unit being configured to select data a according to data of the 2nd bit to the 4th bit of data b as an input of the fourth adder, perform addition calculation, and register the result in the third register;

[0023] a second data selection unit, a fifth adder and a fourth register connected in sequence, the second data selection unit being configured to select data a according to data of the 0th bit to the 1st bit of data b as an input of the fifth adder, perform addition calculation, and register the result in the fourth register;

[0024] a third shifter connected to the third register, configured to left shift the output result of the fourth adder by 2 bits;

[0025] a sixth adder connected to the third shifter and the fourth register, configured to perform addition calculation on the output of the third shifter and the output of the fifth adder, and output a second calculation result g;

[0026] a fifth register connected to the sixth adder, configured to register the second calculation result g.

[0027] The first data selection unit comprises a plurality of first data input paths, each first data input path comprising:

[0028] a fourth shifter and a first multiplexer, a first input end of the first multiplexer being connected to the fourth shifter, a second input end receiving reference data, a third input end receiving data of the 2nd bit to the 4th bit of data b, and an output end being connected to the fourth adder;

[0029] The second data selection unit comprises a plurality of second data input paths, each second data input path comprising:

[0030] a fifth shifter and a second multiplexer, a first input end of the second multiplexer being connected to the fifth shifter, a second input end receiving reference data, a third input end receiving data of the 0th bit to the 1st bit of data b, and an output end being connected to the fifth adder.

[0031] The first data selection unit comprises at least three first data input paths;

[0032] In one of the first data input paths, the third input terminal of the first multiplexer receives data of the 4th bit of data b, compares it with reference data, if consistent, the output terminal of the first multiplexer outputs the reference data, if inconsistent, the fourth shifter left shifts data a by 2 bits, and outputs to the fourth adder through the output terminal of the first multiplexer;

[0033] In one of the first data input paths, the third input terminal of the first multiplexer receives data of the 3rd bit of data b, compares it with reference data, if consistent, the output terminal of the first multiplexer outputs the reference data, if inconsistent, the fourth shifter left shifts data a by 1 bit, and outputs to the fourth adder through the output terminal of the first multiplexer;

[0034] In one of the first data input paths, the third input terminal of the first multiplexer receives data of the 2nd bit of data b, compares it with reference data, if consistent, the output terminal of the first multiplexer outputs the reference data, if inconsistent, the fourth shifter left shifts data a by 0 bit, and outputs to the fourth adder through the output terminal of the first multiplexer;

[0035] In the embodiment, the reference data is 0.

[0036] In the embodiment, the second data selection unit includes at least two second data input paths.

[0037] In one of the second data input paths, the third input terminal of the second multiplexer receives data of the 1st bit of data b, compares it with reference data, if consistent, the output terminal of the second multiplexer outputs the reference data, if inconsistent, the fifth shifter left shifts data a by 1 bit, and outputs to the fifth adder through the output terminal of the second multiplexer.

[0038] In one of the second data input paths, the third input terminal of the second multiplexer receives data of the 0th bit of data b, compares it with reference data, if consistent, the output terminal of the second multiplexer outputs the reference data, if inconsistent, the fifth shifter left shifts data a by 0 bit, and outputs to the fifth adder through the output terminal of the second multiplexer.

[0039] In the embodiment, the third calculation module includes:

[0040] The seventh adder is configured to add the first calculation result f and the second calculation result g to obtain h.

[0041] The sixth shifter is used for intercepting data from the 23rd bit to the 28th bit of the data h and shifting left by 13 bits;

[0042] The second subtracter is connected with the seventh adder and the sixth shifter and is used for subtracting the data from the 23rd bit to the 28th bit of the data h from the output of the sixth shifter;

[0043] The sixth register is connected with the second subtracter and is used for storing the output of the second subtracter;

[0044] The seventh register is used for intercepting and storing the data from the 0th bit to the 22th bit of the data h;

[0045] The eighth adder is used for adding the data from the 0th bit to the 22th bit of the data h stored in the first register to the output of the second subtracter;

[0046] The third subtracter is used for subtracting the data q from the output i of the eighth adder;

[0047] The third multiplexer is connected with the eighth adder and the third subtracter, and if i < q, the output i is the final output result; otherwise, the output i-q is the final output result.

[0048] In a second aspect, the application provides a calculation method of a modular multiplier circuit, comprising:

[0049] Calculating the result of (a x b1) mod q to obtain a first calculation result f; wherein mod represents a remainder algorithm;

[0050] Calculating the result of (a x b2) mod q to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents the data from the 5th bit to the 22th bit of the data b, and b2 represents the data from the 0th bit to the 4th bit of the data b;

[0051] Calculating the result of (f+g) mod q to obtain a final output result.

[0052] The application discloses a low-DSP resource modular multiplier structure suitable for FPGA implementation of a post-quantum password Dilithium algorithm.

[0053] The above description is only a summary of the technical solutions of the present application. In order to enable one skilled in the art to better understand the technical means of the present application, the following detailed description of the specific embodiments of the present application can be implemented according to the content of the description, and in order to enable the above and other purposes, characteristics and advantages of the present application to be more obvious and easy to understand, the following detailed description of the specific embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0054] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not meant to limit the present application. Moreover, the same reference numerals in the drawings indicate the same or similar elements throughout the several drawings. In the drawings:

[0055] Figure 1 is a structural schematic diagram of an embodiment of a Montgomery multiplier circuit applied to a post-quantum cryptographic algorithm provided by the present application;

[0056] Figure 2 is a structural schematic diagram of an embodiment of the first calculation module 11 of the present application;

[0057] Figure 3 is a structural schematic diagram of an embodiment of the second calculation module 12 of the present application;

[0058] Figure 4 is a structural schematic diagram of an embodiment of the third calculation module of the present application;

[0059] Figure 5 is a flowchart of an embodiment of the calculation method of the Montgomery multiplier circuit of the present application. DETAILED DESCRIPTION

[0060] Exemplary embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are shown. While the present disclosure is shown in the drawings and described as being implemented in exemplary embodiments, it is to be understood that the present disclosure is not limited to the embodiments disclosed herein and can be carried out in various forms. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art. Furthermore, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily obscuring the concept of the present disclosure.

[0061] Various structural schematic diagrams according to embodiments of the present disclosure are shown in the drawings. These diagrams are not drawn to scale, in which certain details are exaggerated for the purpose of clarity and certain details can be omitted. The shapes of various regions, layers, and their relative sizes and positional relationships shown in the drawings are only exemplary, and in actuality, they can deviate due to manufacturing tolerances or technical limitations, and regions / layers with different shapes, sizes, and relative positions can be additionally designed by those skilled in the art according to actual needs.

[0062] The operation circuit and the operation method of the present application will be described below in conjunction with the accompanying drawings.

[0063] Please refer to Figure 1 , Figure 1 is a structural schematic diagram of an embodiment of a modular multiplier circuit applied to a post-quantum cryptography algorithm provided by the present application, which comprises a first calculation module 11, a second calculation module 12 and a third calculation module 13.

[0064] The first calculation module 11 is used for calculating the result of (a×b1)modq to obtain a first calculation result f; wherein mod represents a remainder algorithm.

[0065] The second calculation module 12 is used for calculating the result of (a×b2)modq to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents the data of the 5th bit to the 22nd bit of the data b (represented as b[22:5]), and b2 represents the data of the 0th bit to the 4th bit of the data b (represented as b[4:0]).

[0066] The third calculation module 13 is used for calculating the result of (f+g)modq to obtain a final output result.

[0067] The present application designs a low-DSP resource efficient modular multiplier circuit suitable for FPGA hardware design of post-quantum cryptography Dilithium algorithm. By the idea of divide and conquer similar to Karatsuba algorithm, the high-bit data is divided into two parts, the DSP resources on the FPGA are fully utilized, and the calculation process is simplified by using modular reduction. Finally, the input of two 23-bit numbers a and b is realized, and the modular multiplication operation (a×b)modq is completed within four cycles, wherein q is 8380417.

[0068] Since the maximum input bit width of the DSP multiplier in the FPGA is 18 and 25, the multiplication a[22:0]×b[22:0] of the two 23-bit data a and b is divided into two parts, i.e. a[22:0]×b[22:5] and a[22:0]×b[4:0], as shown in equations (1)-(2). The two parts are obtained by further calculation, and then added at last:

[0069] c=a×b[22:5]#(1)

[0070] g=a×b[4:0]#(2)

[0071] Wherein, b[22:5] in equation (1) is b1, equation (1) is executed by the first calculation module 11, b[4:0] in equation (2) is b2, and equation (2) is executed by the second calculation module 12.

[0072] Specifically, please refer to Figure 2 , Figure 2 Figure 1 is a structural schematic diagram of an embodiment of a first calculation module of the application. The first calculation module 11 comprises a multiplication calculator, a first register, a first adder, a second adder, a first shifter, a second shifter, a first subtractor, a third adder, and a second register.

[0073] The multiplication calculator is configured to receive data a and data b1, and perform multiplication operation on the data a and the data b1 to obtain data c, as shown in the above formula (1); the data c is 41-bit data; and the data c is calculated by a DSP in hardware. The first register is connected to the multiplication calculator, and is configured to register the data c. The first adder is connected to the first register, and is configured to perform addition operation on data c1 and data c2 to obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of the data c (represented as c[27:18]), and c2 represents data from the 28th bit to the 40th bit of the data c (represented as c[40:28]). The second adder is connected to the first register, and is configured to perform addition operation on data c2 and data c3 to obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of the data c (represented as c[40:18]). The first shifter is connected to the first adder, and is configured to left shift d1 by 13 bits, which is equivalent to 2 raised to the power of 13, to obtain d3. The second shifter is connected to the first register, and is configured to intercept data from the 0th bit to the 17th bit of the data c (represented as c[17:0]) and left shift the data by 5 bits, which is equivalent to 2 raised to the power of 5, to obtain d4. The first subtractor is connected to the second shifter and the second adder, and is configured to perform subtraction operation on the data d2 and the data d4. The third adder is connected to the first shifter and the first subtractor, and is configured to perform addition operation on the output of the first subtractor and the data d3 to obtain the first calculation result f. The second register is connected to the third adder, and is configured to register the first calculation result f.

[0074] wherein q = 8380417 = 2 23 -2 13 +1, the formula 2 23 ≡ 2 13 -1 (mod q) can be used for modular reduction. In the calculation process, there are:

[0075] f = c · 2 5

[0076] = c[40:18] · 2 23 + c[17:0] · 2 5

[0077] = (c[40:18] · 213 - c[40:28] + c[2t:18] · 2 5

[0078] = c[40:28] · 2 23 + c[2t:18] · 2 13 - c[40:28] + c[2t:18] · 2 5

[0079] = c[40:28] · 2 13 - c[40:28] + c[2t:18] · 2 13 - c[40:28] + c[2t:18] · 2 5

[0080] = (c[40:28] + c[2t:18]) · 2 13 - (c[40:28] + c[40:18]) + c[1t:0] · 2 5 #(3)

[0081] Please combine Figure 3 , Figure 3 is a structural schematic diagram of an embodiment of the second calculation module of the present application. The second calculation module 12 comprises:

[0082] The first data selection unit n, the fourth adder and the third register are connected in sequence, the first data selection unit n is used for selecting data a as the input of the fourth adder according to the data (represented as b[4:2]) of the 2nd bit to the 4th bit of data b, performing addition calculation, and registering the result in the third register. The first data selection unit comprises: a plurality of first data input paths, each first data input path comprises: a fourth shifter and a first multiplexer, the first input end of the first multiplexer is connected with the fourth shifter, the second input end receives reference data, the third input end receives the data (represented as b[4:2]) of the 2nd bit to the 4th bit of data b, and the output end is connected with the fourth adder.

[0083] In a specific embodiment, the first data selection unit n comprises at least three first data input paths; in one of the first data input paths, the third input end of the first multiplexer receives the data of the 4th bit of the data b, i.e. b[4], and compares it with the reference data 0, if consistent, the output end of the first multiplexer outputs the reference data 0, if inconsistent, the fourth shifter left shifts the data a by 2 bits and outputs it through the output end of the first multiplexer to the fourth adder. In one of the first data input paths, the third input end of the first multiplexer receives the data of the 3rd bit of the data b, i.e. b[3], and compares it with the reference data 0, if consistent, the output end of the first multiplexer outputs the reference data 0, if inconsistent, the fourth shifter left shifts the data a by 1 bit and outputs it through the output end of the first multiplexer to the fourth adder. In one of the first data input paths, the third input end of the first multiplexer receives the data of the 2nd bit of the data b, i.e. b[2], and compares it with the reference data 0, if consistent, the output end of the first multiplexer outputs the reference data 0, if inconsistent, the fourth shifter left shifts the data a by 0 bit and outputs it through the output end of the first multiplexer to the fourth adder. Wherein, the reference data is 0.

[0084] The second calculation module 12 further comprises:

[0085] The second data selection unit m, the fifth adder and the fourth register connected in sequence, the second data selection unit m is used for selecting the data a as the input of the fifth adder according to the data of the 0th bit to the 1st bit of the data b (represented as b[1:0]), performing addition calculation, and registering the result in the fourth register. The second data selection unit m comprises a plurality of second data input paths, each second data input path comprises a fifth shifter and a second multiplexer, the first input end of the second multiplexer is connected with the fifth shifter, the second input end receives the reference data, the third input end receives the data of the 0th bit to the 1st bit of the data b (represented as b[1:0]), and the output end is connected with the fifth adder.

[0086] In a specific embodiment, the second data selection unit m comprises: at least two second data input paths; in one second data input path, the third input end of the second multiplexer receives the data of the 1st bit of the data b, i.e. b[1], and compares it with the reference data 0, if consistent, the output end of the second multiplexer outputs the reference data 0, if inconsistent, the fifth shifter left shifts the data a by 1 bit and outputs it to the fifth adder through the output end of the second multiplexer. In one second data input path, the third input end of the second multiplexer receives the data of the 0th bit of the data b, i.e. b[0], and compares it with the reference data 0, if consistent, the output end of the second multiplexer outputs the reference data 0, if inconsistent, the fifth shifter left shifts the data a by 0 bit and outputs it to the fifth adder through the output end of the second multiplexer.

[0087] The second calculation module 12 further comprises: a third shifter, a sixth adder and a fifth register.

[0088] The third shifter is connected with the third register and is used for left shifting the output result of the fourth adder (i.e. the output result of the fourth adder stored in the third register) by 2 bits. The sixth adder is connected with the third shifter and the fourth register and is used for performing addition calculation on the output of the third shifter and the output of the fifth adder, thereby outputting the second calculation result g. The fifth register is connected with the sixth adder and is used for storing the second calculation result g.

[0089] In the calculation process, the calculation formula of g is obtained from formulas (6)-(8):

[0090] d=a·b[4]·2 2 +a·b[3]·2 1 +a·b[2]#(6)

[0091] e=a·b[1]·2 1 +a·b[0]#(7)

[0092] g=d·2 2 +e#(8)

[0093] It should be noted that left shifting n bits means ×2n. n .

[0094] Please refer to Figure 4 , Figure 4 which is a structural schematic diagram of an embodiment of the third calculation module of the present application. The third calculation module specifically comprises: a seventh adder, a sixth shifter, a second subtractor, a sixth register, a seventh register, an eighth adder, a third adder and a third multiplexer.

[0095] wherein the seventh adder is used to add the first calculation result f and the second calculation result g to obtain h; specifically:

[0096] h = a x b

[0097] = a x (b[22:5] x 2 5 + b[4:0])

[0098] = a x (c x 2 5 + b[4:0])

[0099] = f + g#(4)

[0100] The sixth shifter is used to intercept the data of the 23rd bit to the 28th bit of the data h (denoted as h[28:23]) and left shift 13 bits. The second subtracter, connected with the seventh adder and the sixth shifter, is used to subtract the output of the sixth shifter from the data of the 23rd bit to the 28th bit of the data h, denoted as h[28:23] x 2 13 - h[28:23]. The sixth register is connected with the second subtracter and is used to register the output of the second subtracter. The seventh register is used to intercept and register the data of the 0th bit to the 22nd bit of the data h (denoted as h[22:0]). The eighth adder is used to add the output of the second subtracter and the data of the 0th bit to the 22nd bit of the data h registered in the first register. The third subtracter is used to subtract the output i of the eighth adder from the data q.

[0101] h is a 29-bit number, which is equivalent to a x b under mod q, but is not the minimum remainder of a x b mod q. Therefore, further reduction is needed:

[0102] i = h[28:23] x 2 23 + h[22:0]

[0103] = h[28:23] x 2 13 - h[28:23] + h[22:0]#(9)

[0104] The third multiplexer is connected with the eighth adder and the second subtracter, and outputs i as the final output result if i < q; otherwise, outputs i - q as the final output result.

[0105] Overall, the modular multiplier makes full use of the resources of FPGA and realizes the modular multiplication operation by using one DSP and a series of simple and efficient shifter and adder circuits.

[0106] The application discloses a low-DSP resource modular multiplier structure suitable for FPGA implementation of a post-quantum password Dilithium algorithm.

[0107] Please refer to Figure 5 , a flowchart of an embodiment of a calculation method of a modular multiplier circuit of the application, specifically comprising:

[0108] Step S51: the result of (a* b1) mod q is calculated, and a first calculation result f is obtained; wherein, mod represents a remainder algorithm.

[0109] Step S52: the result of (a* b2) mod q is calculated, and a second calculation result g is obtained; wherein, a is 23bit data, b is 23bit data, b1 represents data from the 5th bit to the 22nd bit of data b, and b2 represents data from the 0th bit to the 4th bit of data b.

[0110] Step S53: the result of (f+g) mod q is calculated, and a final output result is obtained.

[0111] In the embodiment, the specific process of steps S51 to S53 can be understood by referring to the above description, and will not be repeated here.

[0112] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will be apparent from the description above. In addition, the present application is not intended to be limited to any particular programming language. It will be appreciated that there are many programming languages that can be used to implement the teachings herein, and any such programming language can be used in connection with the various aspects of the application.

[0113] In the specification provided herein, a large number of specific details are described. However, it can be understood that the embodiments of the application can be practiced without these specific details. In some examples, well-known methods, structures and techniques are not described in detail in order not to obscure the understanding of the specification.

[0114] Similarly, it should be appreciated that, in the above description of exemplary embodiments of the application, various features of the application are sometimes grouped together in a single embodiment, figure, or description of a related aspect. This is done for the purpose of clarity in understanding the various aspects of the application.

[0115] Those skilled in the art will appreciate that the modules in the apparatuses in the embodiments can be adapted and placed in one or more apparatuses other than the embodiments. The modules or units or components in the embodiments can be combined into one module or unit or component, and further can be divided into multiple sub-modules or sub-units or sub-components. Except that at least some of such features and / or processes or units are mutually exclusive, all the features disclosed in this specification (including the abstract and drawings) and all the processes or units of any methods or apparatuses disclosed herein can be combined with any combinations. Unless explicitly stated otherwise, each feature disclosed in this specification (including the abstract and drawings) can be replaced by an alternative feature providing the same, equivalent or similar function.

[0116] Further, those skilled in the art will appreciate that a combination of features of different embodiments means that such combination is within the scope of the present application and forms a different embodiment.

[0117] It should be noted that the above-mentioned embodiments illustrate rather than limit the application. Any reference signs in the claims should not be construed as limiting the scope of the application. The word "comprising" does not exclude the presence of elements or steps other than those listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The application can be implemented by means of both hardware and software, and any combination thereof. In the embodiments in which a number of devices are listed, several of these devices can be embodied by one and the same hardware item. The use of the words first, second and third etc. does not imply any ordering. These words can be construed as names.

Claims

1. A modular multiplier circuit applied to a post-quantum cryptography algorithm, characterized by, The application relates to a data processing method and device. a first calculation module, configured to calculate a result of (axb1) mod q to obtain a first calculation result f; wherein mod represents a remainder algorithm; a second calculating module, configured to calculate a result of (a×b2)mod q to obtain a second calculating result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data from the 5th bit to the 22th bit of the data b, and b2 represents data from the 0th bit to the 4th bit of the data b. a third computing module, configured to compute a result of (f+g) mod q to obtain a final output result. The first calculation module comprises: a multiplication calculator, which is used for receiving data a and data b1 and performing multiplication calculation on the data a and the data b1 to obtain data c; the data c is 41-bit data; a first register, which is connected with the multiplication calculator and is used for storing the data c; a first adder, which is connected with the first register and is used for performing addition calculation on data c1 and data c2 to obtain d1; wherein c1 represents data from the 18th bit to the 27th bit of the data c, and c2 represents data from the 28th bit to the 40th bit of the data c; a second adder, which is connected with the first register and is used for performing addition calculation on data c2 and data c3 to obtain d2; wherein c3 represents data from the 18th bit to the 40th bit of the data c; a first shifter, which is connected with the first adder and is used for left shifting d1 by 13 bits to obtain d3; a second shifter, which is connected with the first register and is used for intercepting data from the 0th bit to the 17th bit of the data c and left shifting the data by 5 bits to obtain d4; a first subtracter, which is connected with the second shifter and the second adder and is used for performing subtraction calculation on data d2 and data d4; a third adder, which is connected with the first shifter and the first subtracter and is used for performing addition calculation on the output of the first subtracter and data d3 to obtain the first calculation result f; a second register, which is connected with the third adder and is used for storing the first calculation result f; The second calculation module comprises: a first data selection unit, a fourth adder and a third register which are connected in sequence; the first data selection unit is used for selecting data a as the input of the fourth adder according to data from the 2nd bit to the 4th bit of data b, performing addition calculation and storing the result into the third register; a second data selection unit, a fifth adder and a fourth register which are connected in sequence; the second data selection unit is used for selecting data a as the input of the fifth adder according to data from the 0th bit to the 1st bit of data b, performing addition calculation and storing the result into the fourth register; a third shifter, which is connected with the third register and is used for left shifting the output result of the fourth adder by 2 bits; a sixth adder, which is connected with the third shifter and the fourth register and is used for performing addition calculation on the output of the third shifter and the output of the fifth adder to output the second calculation result g; a fifth register, which is connected with the sixth adder and is used for storing the second calculation result g; The third calculation module comprises: a seventh adder, which is used for adding the first calculation result f and the second calculation result g to obtain h; a sixth shifter, which is used for intercepting data from the 23rd bit to the 28th bit of data h and left shifting the data by 13 bits; a second subtracter, which is connected with the seventh adder and the sixth shifter and is used for subtracting data from the 23rd bit to the 28th bit of data h from the output of the sixth shifter; a sixth register, which is connected with the second subtracter and is used for storing the output of the second subtracter; a seventh register for intercepting and storing data of the 0th bit to the 22nd bit of the data h; an eighth adder for adding the output of the second subtractor and the data of the 0th bit to the 22nd bit of the data h stored in the first register; a third subtractor for subtracting the output of the eighth adder i from the data q; a third multiplexer connected with the eighth adder and the third subtractor, and outputting i as the final output result if i the modulus q is 8380417.

2. The modular multiplier circuit of claim 1, wherein, The first data selection unit comprises a plurality of first data input paths, each of which comprises: a fourth shifter and a first multiplexer, the first input end of the first multiplexer being connected with the fourth shifter, the second input end receiving reference data, the third input end receiving data of the 2nd bit to the 4th bit of the data b, and the output end being connected with the fourth adder; The second data selection unit comprises a plurality of second data input paths, each of which comprises: a fifth shifter and a second multiplexer, the first input end of the second multiplexer being connected with the fifth shifter, the second input end receiving reference data, the third input end receiving data of the 0th bit to the 1st bit of the data b, and the output end being connected with the fifth adder.

3. The modular multiplier circuit of claim 2, wherein, The first data selection unit comprises at least three first data input paths; in one of the first data input paths, the third input end of the first multiplexer receives data of the 4th bit of the data b, and compares it with the reference data, if they are consistent, the output end of the first multiplexer outputs the reference data, if they are inconsistent, the fourth shifter shifts the data a leftward by 2 bits, and outputs it through the output end of the first multiplexer to the fourth adder; in one of the first data input paths, the third input end of the first multiplexer receives data of the 3rd bit of the data b, and compares it with the reference data, if they are consistent, the output end of the first multiplexer outputs the reference data, if they are inconsistent, the fourth shifter shifts the data a leftward by 1 bit, and outputs it through the output end of the first multiplexer to the fourth adder; in one of the first data input paths, the third input end of the first multiplexer receives data of the 2nd bit of the data b, and compares it with the reference data, if they are consistent, the output end of the first multiplexer outputs the reference data, if they are inconsistent, the fourth shifter shifts the data a leftward by 0 bit, and outputs it through the output end of the first multiplexer to the fourth adder; wherein the reference data is 0.

4. The modular multiplier circuit of claim 2, wherein, The second data selection unit comprises at least two second data input paths; In one of the second data input paths, the third input end of the second multiplexer receives data of the 1st bit of data b, and compares it with reference data, if consistent, the output end of the second multiplexer outputs the reference data, if inconsistent, the fifth shifter left shifts data a by 1 bit, and outputs to the fifth adder through the output end of the second multiplexer; In one of the second data input paths, the third input end of the second multiplexer receives data of the 0th bit of data b, and compares it with reference data, if consistent, the output end of the second multiplexer outputs the reference data, if inconsistent, the fifth shifter left shifts data a by 0 bit, and outputs to the fifth adder through the output end of the second multiplexer.

5. A method of computation for a modular multiplier circuit, characterized by, The calculation method of the modular multiplier circuit is applied to any one of the modular multiplier circuits in claims 1-4, comprising: computing the result of (a x b1) mod q to obtain a first computation result f; wherein mod represents a remainder algorithm; Computing the result of (a x b2) mod q to obtain a second calculation result g; wherein a is 23-bit data, b is 23-bit data, b1 represents data of the 5th bit to the 22nd bit of the data b, and b0 represents data of the 0th bit to the 4th bit of the data b. The result of the computation (f+g) mod q is obtained, resulting in the final output result.

Images