Modular inverse operation hardware implementation system based on Hensel lemma and Newton iteration
Through the Hensel lemma and Newton iterative modular inverse computing hardware implementation system, the problems of long iteration cycle and high resource utilization in hardware implementation of traditional modular inverse algorithms are solved, and efficient and flexible modular inverse computing is realized, supporting the real-time requirements of post-quantum cryptographic algorithms.
Patent Information
- Application Number
- CN202510500225.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-21
- Publication Date
- 2025-08-01
AI Technical Summary
The traditional analog inverse algorithm takes thousands of cycles to iterate in hardware implementation, which is difficult to meet the real-time requirements. The fixed analog-digital circuit cannot adapt to the dynamically changing modulus in the quantum algorithm, resulting in high resource occupation and limited flexibility.
The system is implemented using the modular inverse operation hardware based on Hensel lemma and Newton iteration. The pi computing environment is built in real time through a dynamic analog-digital generator. Combined with bit width compression technology and randomized pipeline control, the decomposition of the modular inverse operation is a parallel pipeline operation, supporting modular expansion and inverse approximation within a single cycle.
It significantly improves the throughput rate of mode inverse calculation, reduces logic resources by 45%-50%, improves hardware efficiency by 2.8-3.5 times, and has a working frequency of 300-350MHz. Single-mode inverse calculation only takes 13 cycles, supporting efficient and flexible mode inverse calculation of post-quantum cryptography algorithms and traditional cryptography systems.
Smart Images
Figure CN120408729A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of hardware security, and particularly relates to a hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration. Background Art
[0002] In the context of the rapid development of quantum computing technology, the modern cryptography system is facing unprecedented security challenges. The mathematical problems (such as large integer factorization, elliptic curve discrete logarithm) relied on by traditional public-key cryptography algorithms (such as RSA, ECC) can be efficiently cracked by the Shor algorithm carried by quantum computers, forcing the global cryptography community to accelerate the migration to post-quantum cryptography (PQC). In the PQC standardization process led by the National Institute of Standards and Technology (NIST) in the United States, coding-based cryptography algorithms (such as Classic McEliece, BIKE) have become important candidate solutions due to their anti-quantum characteristics. However, the core operation efficiency of such algorithms highly depends on modular inverse operations over finite fields. For example, when generating parity-check matrices or constructing sparse vectors, the inverses modulo specific moduli need to be frequently calculated.
[0003] In the Classic McEliece algorithm, during its key generation phase, an invertible polynomial matrix needs to be constructed over a binary extension field in which a large number of modular inverse operations are involved to verify the non-singularity of the matrix. Similarly, in the coding-based signature scheme BIKE (BitFlipping Key Encapsulation), during the decryption phase, the modular inverse is required to recover the sparse characteristics of the error vector, and its performance is directly limited by the real-time nature of modular inverse calculation. However, traditional modular inverse implementation schemes (such as the extended Euclidean algorithm, Fermat's little theorem) face multiple bottlenecks in hardware: First, the software iterative implementation requires thousands of clock cycles, making it difficult to meet the high throughput requirements of post-quantum algorithms; Second, if the hardware circuit is optimized with a fixed modulus, although the speed in a fixed scenario can be improved, it cannot adapt to the dynamically changing moduli (such as p k or 2 m -1 type primes) in coding algorithms, resulting in severely limited flexibility. Summary of the Invention
[0004] Aiming at the problems that existing modular inverse algorithms (such as Extended Euclidean, Montgomery) require thousands of cycles for iteration in hardware implementation, making it difficult to meet the real-time requirements, and although fixed-modulus circuits can accelerate specific scenarios, they cannot adapt to the dynamically changing moduli in post-quantum algorithms and have high resource occupancy, etc., the present invention provides a hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration, and a dynamic modulus generator is used to construct p in real time iA computing environment, which combines bit-width compression technology with randomized pipeline control, solves the defects such as long bit-width of intermediate data, high occupation of logic resources, and many computing cycles, and significantly improves the throughput rate of constructing a polynomial inverse matrix based on the encoded Classic McEliece algorithm.
[0005] In the post-quantum coding algorithms (such as Classic McEliece, BIKE) and traditional ciphers (such as SM2) of the present invention, an optimized design is carried out for the modular inverse operation involved in constructing the modular inverse matrix. Through the collaborative design of the hierarchical Newton-Raphson method and Hensel's lemma, combined with dynamic bit-width compression, efficient, flexible and secure modular inverse calculation is realized. In the scenario of known modulus form (such as p k or 2 m -type prime number), by pre-computing the power expansion parameters of the modulus p i and solidifying them into the fast power module, the traditional step-by-step iterative modular inverse process is decomposed into parallelized pipeline operations.
[0006] To achieve the above object, the present invention adopts the following technical solutions:
[0007] A hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration, which is used for the modular inverse operation of prime power modulus in a secure encryption chip, includes: a modular inverse operation sub-module, a configurable fast power module, a composite operation module and a state machine control module;
[0008] The modular inverse operation sub-module calculates the initial inverse element U1 = a -1 mod p, where a is the number to be inverted and p is the modulus;
[0009] The configurable fast power module dynamically generates the modulus p i , and supports the power expansion from p 1 to p k , where i is the power and i < k;
[0010] The composite operation module calculates the inverse element through iterative operation where h is the number of iterations and U h-1 is the output of the previous iteration;
[0011] The state machine control module calls the output U1 of the modular inverse operation sub-module and calls the output p i of the configurable fast power module, inputs U1 and p i into the composite operation module for iterative operation. During the iterative process, i gradually approaches k, and finally makes i = k, and calls the composite operation module to repeat the operation once to obtain the final result C = a -1 mod p k .
[0012] Optionally, the input of the modular inverse operation sub-module is the number \(a\) for which the inverse is to be calculated and the modulus \(p\), where \(a\) is a non-zero integer and \(p\) is a positive prime number; the output is \(U1\), which is stored in the register bank.
[0013] Optionally, the input of the configurable fast power module is the modulus \(p\) and the exponent \(i\), where \(p\) is a positive prime number and \(i = 2^n\), \(n\) being a positive integer; the output is \(p\) i , which is stored in the register bank.
[0014] Optionally, the configurable fast power module first converts the input exponent \(i\) into binary form; then, starting from the least significant bit to the most significant bit, it traverses the binary bits of the exponent \(i\). Each time the binary bit is shifted left by one bit, the base is squared once. Correspondingly when the binary bit is 1, the squared base is added. The accumulated result is used as the output result.
[0015] Optionally, during the accumulation process in the configurable fast power module, a bit truncation operation is performed, and only the high \(k\) bits are retained.
[0016] Optionally, the input of the composite operation module is \(U\) h-1 and \(p\) i , and the output is \(U\) h ; during the first iteration operation, the input is \(U1\) calculated by the modular inverse operation sub-module.
[0017] Optionally, each iteration operation of the composite operation module is divided into the following four-stage pipeline:
[0018] In the first-stage pipeline, a multiplier is used to square \(U\) h-1 , and the result is obtained by calling the configurable fast power module The result is stored in register 1;
[0019] In the second-stage pipeline, the value stored in register 1 is multiplied by \(a\) through a multiplier to obtain
[0020] In the third-stage pipeline, \(U\) h-1 is multiplied by 2 through a left shift, and the result is obtained using a subtractor The result is stored in register 2;
[0021] In the fourth-stage pipeline, for the value stored in register 2 the modulus is updated to \(p\) 2i , and the result is stored in register 3 and used as the input for the next iteration.
[0022] The beneficial effects of the present invention are as follows: The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration designed by the present invention splits the critical path of modular inverse into multi-stage pipelined operations through hierarchical state machine scheduling and dynamic bit-width compression. It uses sign bit detection and correction, dynamically generates fast powers, and replaces complex multipliers with shift-subtraction, supporting the completion of modulus extension and inverse approximation within a single cycle. The actual measurement results based on the Xilinx Artix-7 FPGA platform show that, compared with the extended Euclidean algorithm and Montgomery scheme, the present invention reduces the logic resources (LUT) by 45%-50% in the Classic McEliece key generation scenario, improves the hardware efficiency by 2.8-3.5 times, has a working frequency of 300-350 MHz, and only requires 13 cycles for a single modular inverse operation (modulus p 256 ) The operation speed is three times higher than that of the traditional scheme, providing an efficient, secure, and flexible modular inverse calculation core for post-quantum cryptographic algorithms and traditional cryptographic systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 It is a schematic diagram of the pseudocode for modular inverse operation based on the binary Euclidean algorithm;
[0024] Figure 2 It is a schematic diagram of the pseudocode for modular inverse operation based on Hensel's lemma and Newton iteration;
[0025] Figure 3 It is a schematic diagram of the four-stage pipelined hardware architecture for modular inverse operation based on Hensel's lemma and Newton iteration. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0026] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application.
[0027] The present invention proposes a hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration. The core design mainly includes the following parts:
[0028] 1. Optimization of the hierarchical modular inverse algorithm based on Hensel's lemma and Newton iteration. For the modular inverse calculation requirements of dynamic moduli (such as prime powers p k , special forms 2 m -1), a hierarchical iterative architecture is proposed. First, use Hensel lifting to drive modulus extension, decompose the modular inverse into multi-stage prime power calculations, and gradually extend from p to p k through Hensel's lemma. In each stage of iteration, use Newton's iteration formula to approximate the exact solution, and compress the total number of iterations from O(k) to log2(k)+5. Secondly, through preprocessing and postprocessing elimination, when the known modulus is p kIn the scenario where the precomputed initial inverse element U1 = a -1 is modulo p and solidified in the register to avoid repeated extended Euclidean operations; through sign bit detection and modulo dynamic correction, the post-processing steps in the traditional algorithm are eliminated.
[0029] 2. A four-stage pipelined hardware architecture driven by a state machine is proposed. An efficient pipelined architecture is designed to support parallel computing and dynamic resource reuse. In the first stage of the pipeline, a multiplication-modulo composite circuit is called to calculate The intermediate data bit width is halved through the invalid bit early truncation technique. In the second stage of the pipeline, the multiplier is reused to calculate In the third stage of the pipeline, 2U is generated through a left shift circuit h-1 , triggering the subtraction circuit to calculate and automatically detecting the sign bit. If it is negative, the current modulo p i is added to correct the result. In the fourth stage of the pipeline, the modulo is updated to p 2i , and the next-level parameters are preloaded in parallel to double the pipeline throughput.
[0030] 3. A dynamic bit width compression design is proposed. Through the invalid bit truncation technique, the high bits of the intermediate data are dynamically truncated according to the sign bit and the modulo value, reducing the register bit width by 50% and the logic resource (LUT) consumption by 40%.
[0031] 4. A configurable fast power module and a double-buffered register bank are proposed. The fast power module supports the dynamic generation of p i , adapts to the special moduli of traditional prime fields and post-quantum coding algorithms, and saves more than 50% of DSP resources by replacing multiplication with shift-addition. The double-buffered register bank preloads the next-level modulo p i+1 for parallel processing with the current calculation result, reducing pipeline bubbles and increasing the throughput by 30%.
[0032] A hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration proposed by the present invention mainly includes the following parts:
[0033] 1. Modular inverse operation sub-module based on binary Euclidean algorithm: This sub-module is for modular inverse operation where the exponent of the modulus is 1, that is, the modulus is p (p is a positive prime number), and is used to calculate the inverse element of a modulo p (a is a non-zero integer, p is a positive prime number); the inputs are the number a to be inverted and the modulus p, and the output is U1 = a -1 mod p, and the output result U1 is stored in the register bank.
[0034] 2. Configurable fast power module: The inputs of this module are the modulus p and the power i (i = 2 n and n is a positive integer and i < k), and the output is p i, the output result is stored in the register bank. In this module, first, the input exponent i is converted into binary form; then, starting from the least significant bit to the most significant bit, the binary bits of the exponent i are traversed. Each time the binary bit is shifted left by one bit, the base is squared once, corresponding to When the binary bit is 1, the base after the corresponding squaring operation is accumulated During this process, for a bit truncation operation is performed, only keeping the high k bits, which is used to reduce the use of registers and high-precision multipliers. The accumulated result is the final output result.
[0035] 3. Composite operation module: This module is the core module, specifically reflecting the Hensel lifting and Newton iteration operations. The input is U h-1 (h is the number of iterations, taking positive integers, U h-1 is the output of the previous iteration), and the output is (U h is the output of this level). In particular, during the first iteration, the input is the output U of the modular inverse operation sub-module. In the first-stage pipeline, first, the multiplier is used to square U h-1 , and then the configurable fast power module is called to obtain the result The result is saved in the register bank 1. In the second-stage pipeline, the result of the first-stage pipeline is multiplied by a through the multiplier to obtain In the third-stage pipeline, U h-1 is multiplied by 2 through left shift and the subtractor is used to obtain The result is stored in register 2. In the fourth-stage pipeline, the modulus is automatically updated to p 2i , and the result is stored in register 3. This result is used as the input for the next iteration.
[0036] 4. State machine control module: This module controls the operation of all the above modules through a state machine. First, the modular inverse operation sub-module is called to obtain the output U, and the configurable fast power module is called to obtain the output p i , and the above results are all stored in the register bank. Subsequently, it enters the main module, namely the composite operation module, where multiple iteration operations are performed. Finally, let i = k, and repeat the single operation in the pipeline to obtain the final result.
[0037] Figure 1 The following shows the pseudo-code flow of the traditional binary extended Euclidean algorithm. This algorithm gradually approaches the modular inverse solution through iterative subtraction and conditional branching. Its core steps include initializing the parameters (u, v) = (a, p), and updating by calculating the remainder and coefficients through a loop, and finally outputting u -1 mod p. However, when this algorithm is implemented in hardware, it requires multiple conditional judgments and data write-backs, resulting in a high critical path delay, large resource consumption, and inability to adapt to dynamic moduli (such as pk ) requirements.
[0038] Figure 2 shows the hierarchical modular inverse algorithm process proposed by the present invention. First, the initial inverse element U1 = a is pre-computed through the modular inverse operation sub-module -1 mod p and solidified into the register bank; subsequently, based on Hensel's lemma, the modulus is gradually extended to p i , and the Newton iteration formula is used to approximate the exact solution. The negative value is dynamically corrected through sign bit detection (such as the high bit of the intermediate result), and the current modulus p is automatically added i to eliminate the post-processing step, and the total number of iterations is compressed to log2(k) + 5.
[0039] Figure 3 is the four-stage pipeline hardware architecture of the present invention. The first stage calls the configurable multiplication-modulo composite circuit to calculate The data bit width is halved through the invalid bit truncation technology, reducing the register resource occupancy by 50%; the second stage multiplexes the multiplier to calculate The third stage generates 2U through the left shift circuit h-1 , triggering the subtraction circuit to calculate the corrected intermediate value; the fourth stage updates the modulus to p 2i and preloads the parameters of the next stage, using the dual buffer register bank to eliminate pipeline bubbles. Among them, the configurable fast power module dynamically generates the modulus p through the shift-addition chain i , supporting the special moduli of traditional prime fields and post-quantum coding algorithms. During the generation process, the low-width truncation technology is adopted to compress the intermediate data bit width from 2N to N, saving more than 50% of the DSP resources.
[0040] Through the collaborative optimization of the algorithm and hardware, the present invention significantly improves the operation efficiency and security. At the algorithm level, the hierarchical modulus extension of Hensel lifting is combined with Newton-Raphson iteration to reduce the iteration level and eliminate the post-processing overhead. In the hardware implementation, a state machine-driven dynamic resource reuse architecture is adopted, integrating a configurable multiplication-modulo composite circuit and a shift-addition-subtraction unit. Through the dual buffer design of the register bank, pipeline parallelization is realized, the bit width of intermediate variables is compressed by 40%-50%, and the consumption of logic resources (LUT) is reduced by 35%-45% compared with the traditional scheme. The actual measurement based on the Xilinx Artix-7 FPGA platform shows that the present invention supports the real-time calculation of the modulus in p k (k ≤ 256), the working frequency reaches 300 - 350 MHz, and a single modular inverse operation only requires log2(k) + 5 cycles, which is 2.8 - 3.5 times faster than the extended Euclidean scheme. The present invention can be integrated into the hardware acceleration modules of algorithms such as Classic McEliece, BIKE, SM2, and RSA, significantly optimizing the key generation and signature verification efficiency.
[0041] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in this application can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.
[0042] The above are only the preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions falling within the concept of the present invention belong to the protection scope of the present invention. It should be noted that for those of ordinary skill in the art in this technical field, several improvements and refinements made without departing from the principle of the present invention should be regarded as within the protection scope of the present invention.
Claims
1. A hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration, which is used for modular inverse operation of prime power modulus in a secure encryption chip, and is characterized in that Including: A modular inverse operation sub-module, a configurable fast power module, a composite operation module, and a state machine control module; The modular inverse operation sub-module calculates the initial inverse element U1 = a -1 mod p, where a is the number for which the inverse is to be found and p is the modulus; The configurable fast power module dynamically generates the modulus p i , and supports power exponent expansion from p 1 to p k . Here, i is the power exponent and i < k; The composite operation module calculates the inverse element through iterative operations h is the number of iterations, and U h-1 is the output of the previous iteration; The state machine control module calls the modular inverse operation sub-module to output U1, and calls the configurable fast power module to output p i , and inputs U1 and p i into the composite operation module for iterative operations. During the iteration process, i gradually approaches k, and finally makes i = k. Call the composite operation module to repeat the operation once to obtain the final result C = a -1 mod p k .
2. The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration as described in claim 1, characterized in that: The input of the modular inverse operation sub-module is the number a to be inverted and the modulus p, where a is a non-zero integer and p is a positive prime number; the output is U1, which is stored in the register bank.
3. The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration as claimed in claim 1, wherein: The input of the configurable fast power module is the modulus p and the exponent i, where p is a positive prime number and i = 2 n , and n is a positive integer; the output is p i , which is stored in the register bank.
4. The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration as claimed in claim 3, wherein: The configurable fast power module first converts the input power exponent i into binary form; then traverses the binary bits of the power exponent i from the lowest bit to the highest bit. Each time the binary bit is shifted one bit to the left, the base number is squared once, corresponding to p, p 2 , p 4 , p 8 ,... When the binary bit is 1, add the squared base number p, p 2 , p 4 , p 8 ,... The accumulated result is used as the output result.
5. The hardware implementation system of modular inverse operation based on Hensel's lemma and Newton iteration as described in claim 4, characterized in that: During the accumulation process of the configurable fast power module, for a bit truncation operation is performed, and only the high k bits are retained.
6. The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration as claimed in claim 1, wherein: The input of the composite operation module is U h-1 and p i , and the output is U h ; During the first iteration operation, the input is U1 calculated by the modular inverse operation sub-module.
7. The hardware implementation system for modular inverse operation based on Hensel's lemma and Newton iteration as described in claim 6, wherein: Each iterative operation of the composite operation module is divided into the following four-stage pipeline: In the first - stage pipeline, a multiplier is used to square U h-1 and a configurable fast - power module is called to obtain the result The result is stored in register 1; In the second-level pipeline, the content stored in register 1 is multiplied by a through a multiplier to obtain In the third-stage pipeline, U h-1 is multiplied by 2 by shifting left, and the result is obtained using a subtractor The result is stored in register 2; In the fourth - stage pipeline, for what is stored in register 2 update the modulus to p 2i , and obtain the result The result is stored in register 3 and used as the input for the next iteration.