Secret key packaging method and device and computer equipment

Abstract

The invention discloses a secret key packaging method and device and computer equipment, and relates to the technical field of data security, and the method comprises the steps: carrying out the displacement processing of input data read from a storage module through a displacement device according to an obtained secret key modulus parameter; adding the shifted input data and a fixed value through an adder to obtain intermediate data; using a shifter and an adder to carry out preset addition and subtraction and position combination operation on the intermediate data to obtain a combination operation result; and packaging the high-order data extracted from the combined operation result into a compressed ciphertext key by using a key packaging module, and outputting the compressed ciphertext key. Therefore, the use of a multiplier in the processing process is avoided, the hardware resource occupation and the operation complexity are remarkably reduced, the requirements of different secret key modulus parameters can be met, and the overall operation performance and the resource utilization rate are improved.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of data security technology, and in particular, to a key encapsulation method, apparatus, and computer device. Background Art

[0002] The Kyber algorithm is a standardized post-quantum key encapsulation algorithm announced by NIST. It can resist attacks on public-key cryptography when future quantum computing arrives. With the continuous research and evolution of quantum computing, practical quantum computing has become possible. It will pose a major threat to the current public-key cryptosystems such as ECC and RSA, because quantum computing can break the cryptosystems in polynomial time. The Kyber algorithm is specifically designed to resist quantum computing, so that there is a public-key cryptosystem that can be used in the quantum era.

[0003] The Kyber algorithm needs to implement modular addition, subtraction, and multiplication within modulus 3329 on a lattice. Among them, in the processing of ciphertext, the Kyber algorithm uses compression technology to compress the ciphertext size while preserving confidentiality. The compression is implemented proportionally, and the data within 12 bits and within 3329 is compressed into data within 4, 5, 10, or 11 bits. It involves operations such as dividing by parameters and the round operation of rounding, which are difficult to handle both in hardware and software. Summary of the Invention

[0004] In view of this, embodiments of the present application at least provide a key encapsulation method, apparatus, and computer device.

[0005] The technical solution of the embodiments of the present application is implemented as follows: On the one hand, an embodiment of the present application provides a key encapsulation method, and the method includes: Performing displacement processing on the input data read from the storage module by a shifter according to the obtained key modulus parameter; Adding the displaced input data to a fixed value by an adder to obtain intermediate data; Performing a preset addition, subtraction, and position combination operation on the intermediate data by the shifter and the adder to obtain a combined operation result; Using a key encapsulation module to encapsulate the high-order data extracted from the combined operation result as a compressed ciphertext key for output.

[0006] On the other hand, an embodiment of the present application provides a key encapsulation apparatus, and the apparatus includes: A shifter, configured to perform displacement processing on the input data read from the storage module according to the obtained key modulus parameter; An adder, configured to add the displaced input data to a fixed value to obtain intermediate data; A shifter and an adder, which are also used to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combined operation result; A key encapsulation module, which is used to encapsulate the high-order data extracted from the combined operation result into a compressed ciphertext key for output.

[0007] On the other hand, an embodiment of the present application provides a computer device, including: A processor, which is used to receive a key service request carrying key modulus parameters; The computer device further includes the key encapsulation device described in the above embodiment.

[0008] In some embodiments, the processor is further used to receive, through a bus interface, a key service request carrying key modulus parameters sent by an external control module, read the input data from a storage module, and extend the bit length of the input data to a processing bit width corresponding to the modulus parameters.

[0009] In the embodiment of the present application, by improving the ciphertext compression process based on the Kyber algorithm to be implemented by using a shifter, an adder and a combined operation, the use of a multiplier in the processing process is avoided, the hardware resource occupation and operation complexity are significantly reduced, the requirements of different key modulus parameters can be adapted, and the overall operation performance and resource utilization rate are improved.

[0010] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and do not limit the technical solution of the present application. Description of the Drawings

[0011] The drawings here are incorporated into the specification and constitute a part of this specification. These drawings show embodiments consistent with the present application and are used together with the specification to explain the technical solution of the present application.

[0012] Figure 1 It is a schematic diagram of the implementation process of a key encapsulation method provided by an embodiment of the present application; Figure 2 It is a schematic diagram of the scenario of a key encapsulation method provided by an embodiment of the present application; Figure 3 It is a schematic diagram of the process logic of a key encapsulation method provided by an embodiment of the present application; Figure 4 It is a schematic diagram of the calculation logic of a key encapsulation method provided by an embodiment of the present application; Figure 5 It is a schematic diagram of the composition structure of a key encapsulation device provided by an embodiment of the present application; Figure 6 It is a schematic diagram of the composition structure of a computer device provided by an embodiment of the present application. Detailed implementation manners

[0013] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be construed as limitations on the present application. All other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of the present application.

[0014] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict.

[0015] The terms "first / second / third" involved are only used to distinguish similar objects and do not represent a specific order for the objects. It can be understood that "first / second / third" can be interchanged with a specific order or sequence when allowed, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which this application belongs. The terms used herein are only for the purpose of describing this application and are not intended to limit this application.

[0017] An embodiment of the present application provides a key encapsulation method, which can be executed by a processor of a computer device. Herein, the computer device may refer to a device with key encapsulation capabilities such as a server, a laptop computer, a tablet computer, a desktop computer, a smart TV, a set-top box, a mobile device (such as a mobile phone, a portable video player, a personal digital assistant, a dedicated messaging device, a portable gaming device), etc.

[0018] Figure 1 As shown in Figure 1 the following, the method includes the following steps 101 to step 104: Step 101, a shifter performs a displacement process on the input data read from the storage module according to the obtained key modulus parameter.

[0019] Here, a key service request carrying a key modulus parameter is received by a processor. In an embodiment of the present application, the key modulus parameter refers to the parameter d used for compression operations in the Kyber algorithm, and its value is 4, 5, 10, or 11, indicating that the data within modulus 3329 is compressed to 4 bits, 5 bits, 10 bits, or 11 bits. The key service request refers to an instruction initiated by a user or a system that requires post-quantum cryptographic services. This instruction contains the key modulus parameter d, which is used to guide subsequent compression operations. The system receives the key service request from the user or an upper-layer module through a communication interface. The request contains the key modulus parameter d, and the system analyzes this parameter and passes it to a subsequent processing module. The key modulus parameter d determines the specific manner of subsequent displacement and operations, ensuring that the compression process meets the requirements of the Kyber algorithm.

[0020] In an embodiment of the present application, the input data refers to the 12-bit data x to be compressed, whose value range is [0, 3329), and it is stored in the storage module of the system. The displacement processing refers to shifting the input data x to the left by d bits, that is, performing the operation x << d, where d is the key modulus parameter.

[0021] The system reads the input data x from the storage module and generates a displacement control signal according to the key modulus parameter d. The displacement module shifts x to the left by d bits according to this signal, generating the displaced data x << d. This step prepares for subsequent addition operations, ensuring that the data can be correctly aligned with a fixed value.

[0022] Step 102, add the displaced input data to a fixed value through an adder to obtain intermediate data.

[0023] In an embodiment of the present application, the fixed value refers to a fixed addend selected according to the key modulus parameter d, such as 1664 or 13, which is used to implement the Round operation of rounding. The intermediate data refers to the result of adding the displaced input data to the fixed value, which is used for subsequent addition, subtraction, and displacement combination operations.

[0024] The system selects the corresponding fixed value according to the key modulus parameter d (for example, 1664 when d = 4 / 5, and 13 when d = 10 / 11), and adds this fixed value to the displaced input data x << d. The adder performs this operation and generates the intermediate data m.

[0025] Step 103, perform a preset addition, subtraction, and position combination operation on the intermediate data using a displacer and an adder to obtain a combined operation result.

[0026] In the embodiments of the present application, the addition, subtraction and displacement combination operation refers to a technique that replaces multiplication operations through shifting and addition / subtraction. For example, 315 is decomposed into (1 << 8) + (1 << 6) - (1 << 2) - 1 to reduce the consumption of hardware resources. The combination operation result refers to the temporary result obtained after the intermediate data undergoes the addition, subtraction and displacement combination operation.

[0027] The system selects the corresponding operation mode according to the key modulus parameter d (for example, when d = 4, it is m << 4 + m << 2 - m >> 2 - m >> 4). The operation module performs the specified addition, subtraction and displacement operations on the intermediate data m through a multi-stage shifter and adder to generate the combination operation result. This step avoids the direct use of a multiplier, significantly reducing the hardware resource occupancy and operation latency.

[0028] Step 104, use the key encapsulation module to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

[0029] In the embodiments of the present application, the high-order data refers to several highest significant bits in the combination operation result, and its number of bits is determined by the key modulus parameter d. For example, when d = 4, it is 4 bits. The compressed ciphertext key refers to the final output data generated after the compression operation, and its size meets the requirements of the Kyber algorithm.

[0030] The system extracts the high-order data from the combination operation result and outputs it as the compressed ciphertext key. The output module passes the result to the subsequent key encapsulation module or storage module to complete the entire compression operation process.

[0031] The present application improves the ciphertext compression process based on the Kyber algorithm to be implemented using a shifter, adder and combination operation, avoiding the use of a multiplier in the processing process, significantly reducing the hardware resource occupancy and operation complexity, being able to adapt to the requirements of different key modulus parameters, and improving the overall operation performance and resource utilization rate.

[0032] In some embodiments, step 102 includes: Step 1021, determine whether the key modulus parameter is a first type of parameter or a second type of parameter.

[0033] In the embodiments of the present application, the system reads the value of the key modulus parameter d through the parameter parsing module and makes a judgment according to the preset classification rules. For example, d = 4 / 5 is the first type, and d = 10 / 11 is the second type. The judgment logic is based on the numerical range of the key modulus parameter d, and the system generates the corresponding category identification signal to guide the subsequent displacement processing module to select the correct displacement number of bits.

[0034] Step 1022, when the key modulus parameter is a first type of parameter, use a shifter to shift the input data to the left by a first preset number of bits.

[0035] In an embodiment of the present application, according to the judgment result of step 1021, if the key modulus parameter d belongs to the first type of parameter, the system controls the displacement module to shift the input data x to the left by d bits (i.e., x << d). For example, when d = 4, it is shifted 4 bits to the left, and when d = 5, it is shifted 5 bits to the left. The displacement operation is implemented by a hardware shifter or software instructions to generate the displaced data x << d, providing aligned data for subsequent addition operations.

[0036] Step 1023, when the key modulus parameter is a second type of parameter, use a shifter to shift the input data to the left by a second preset number of bits.

[0037] In an embodiment of the present application, according to the judgment result of step 1021, if the key modulus parameter d belongs to the second type of parameter, the system controls the displacement module to shift the input data x to the left by d - 7 bits (i.e., x << (d - 7)). For example, when d = 10, it is shifted 3 bits to the left, and when d = 11, it is shifted 4 bits to the left. This optimized design reduces the bit-width requirement of the adder and lowers the hardware complexity. The displaced data x << (d - 7) is added to the fixed value 13 to generate intermediate data.

[0038] Wherein, the first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter.

[0039] In an embodiment of the present application, through the design of classification judgment and dynamic displacement bits, efficient processing of ciphertext compression in the Kyber algorithm is achieved. The system selects the corresponding displacement strategy according to the category of the key modulus parameter d, ensuring that the data can meet the accuracy requirements during compression and optimize the use of hardware resources. The first type of parameter is directly shifted d bits to the left, and the second type of parameter is shifted d - 7 bits to the left, significantly reducing the bit-width and logical complexity of the adder, and improving the operation efficiency and resource utilization rate.

[0040] In some embodiments, step 103 includes: Step 1031, when the key modulus parameter is a first type of parameter, use an adder to select a first fixed value for addition operation to obtain intermediate data, and the first fixed value is an integer multiple of the first type of parameter and is associated with the displacement number of bits.

[0041] In an embodiment of the present application, the first fixed value: refers to the fixed addend used for the compression operation of the first type of parameter (d = 4 or 5) in the Kyber algorithm, and its value is 1664. This value is an approximation of q / 2 (q = 3329) and is used to implement the rounding Round operation.

[0042] After the system determines that the key modulus parameter d belongs to the first type of parameters (d = 4 or 5), it selects the corresponding first fixed value 1664 from the preset parameter library. The adder module adds the shifted input data (x << d) to the first fixed value 1664 to generate the intermediate data m = (x << d) + 1664. This step ensures the accuracy of the Round operation and provides a unified data format for subsequent combination operations. The design of the first fixed value 1664 is associated with the shift bit number d to ensure that the operation result meets the compression requirements of the Kyber algorithm.

[0043] Step 1032, in the case where the key modulus parameter is the second type of parameter, use the adder to select the second fixed value for addition operation to obtain the intermediate data, and the second fixed value is an integer multiple of the second type of parameter and is associated with the shift bit number.

[0044] In the embodiment of the present application, the second fixed value refers to the fixed addend used for the compression operation of the second type of parameter (d = 10 or 11) in the Kyber algorithm, and its value is 13. This value is a simplified form of 1664 (i.e., an approximation of q / 2), which reduces the bit width requirement of the adder through optimized design.

[0045] After the system determines that the key modulus parameter d belongs to the second type of parameters (d = 10 or 11), it selects the corresponding second fixed value 13 from the preset parameter library. The adder module adds the shifted input data (x << (d - 7)) to the second fixed value 13 to generate the intermediate data m = (x << (d - 7)) + 13. This step significantly reduces the logic complexity and hardware resource occupancy of the adder through optimized design of the fixed value and the shift bit number, while ensuring that the operation accuracy is consistent with the requirements of the Kyber algorithm.

[0046] The embodiment of the present application significantly improves the efficiency and performance of hardware implementation while ensuring operation accuracy through a classification processing method, and is applicable to encryption scenarios with limited resources.

[0047] In some embodiments, step 104 includes: Step 1041, use the adder to add the result of shifting the intermediate data to the left by the third preset bit number by the shifter and the result of shifting the intermediate data to the left by the fourth preset bit number by the shifter to obtain the addition result.

[0048] In the embodiments of the present application, the third preset number of bits refers to the number of bits of left shift determined according to the key modulus parameter d, and is used for a specific shift operation of the intermediate data m. For example, when d = 4, the third preset number of bits is 4 (i.e., m << 4). The fourth preset number of bits refers to another number of bits of left shift determined according to the key modulus parameter d, and is used for a specific shift operation of the intermediate data m. For example, when d = 4, the fourth preset number of bits is 2 (i.e., m << 2).

[0049] The system selects the corresponding third preset number of bits and fourth preset number of bits according to the key modulus parameter d (such as 4 and 2 when d = 4). The shift module shifts the intermediate data m by the third preset number of bits and the fourth preset number of bits respectively to generate m << 4 and m << 2. The adder module adds these two results to generate an addition result (m << 4 + m << 2). This step replaces the multiplication operation through shift and addition operations, reducing the consumption of hardware resources while ensuring the operation accuracy.

[0050] Step 1042: Use an adder to subtract the result of shifting the intermediate data to the right by the fifth preset number of bits through a shifter from the result of shifting the intermediate data to the right by the sixth preset number of bits through a shifter to obtain a subtraction result.

[0051] In the embodiments of the present application, the fifth preset number of bits refers to the number of bits of right shift determined according to the key modulus parameter d, and is used for a specific shift operation of the intermediate data m. For example, when d = 4, the fifth preset number of bits is 2 (i.e., m >> 2). The sixth preset number of bits refers to another number of bits of right shift determined according to the key modulus parameter d, and is used for a specific shift operation of the intermediate data m. For example, when d = 4, the sixth preset number of bits is 4 (i.e., m >> 4).

[0052] The system selects the corresponding fifth preset number of bits and sixth preset number of bits according to the key modulus parameter d (such as 2 and 4 when d = 4). The shift module shifts the intermediate data m by the fifth preset number of bits and the sixth preset number of bits respectively to generate m >> 2 and m >> 4. The subtractor module subtracts these two results to generate a subtraction result (m >> 2 - m >> 4). This step further optimizes the hardware implementation through shift and subtraction operations, avoiding complex multiplication operations.

[0053] Step 1043: Use a processor to combine the addition result and the subtraction result to obtain a combined operation result.

[0054] In the embodiments of the present application, the system inputs the addition result (m << 4 + m << 2) and the subtraction result (m >> 2 - m >> 4) into a combining module. The combining module performs an addition operation to generate a combined operation result ((m << 4 + m << 2) + (m >> 2 - m >> 4)).

[0055] Embodiments of this application use shifting and addition / subtraction operations to replace complex multiplication operations, significantly reducing the hardware resource occupation and operation latency. The combination of addition results and subtraction results ensures that the operation accuracy is exactly consistent with the algorithm standard.

[0056] In some embodiments, step 105 includes: Step 1051: Use the key encapsulation module to determine the truncation bit number according to the bit length of the modulus parameter.

[0057] In embodiments of this application, the bit length of the modulus parameter refers to the output bit length corresponding to the key modulus parameter d in the Kyber algorithm, and its value is 4, 5, 10, or 11 bits, representing the bit width of the compressed data. The truncation bit number refers to the number of high-order bits to be extracted from the combined operation result, and its value is the same as the bit length of the modulus parameter d.

[0058] The system reads the value of the key modulus parameter d (4, 5, 10, or 11) through the parameter parsing module and directly uses this value as the truncation bit number. The control module generates a truncation control signal, which specifies the specific bit width requirements for the subsequent high-order bit extraction operation. Thus, it ensures that the system can dynamically adjust the bit width of the output data according to different compression requirements.

[0059] Step 1052: Use the key encapsulation module to extract the high-order bits of the truncation bit number from the combined operation result.

[0060] In embodiments of this application, the high-order bits refer to the consecutive bit sequence of the most significant bit in the combined operation result, and its length is equal to the truncation bit number.

[0061] The data extraction module of the system receives the combined operation result and the truncation bit number parameter. The bit selection circuit continuously selects the corresponding number of bits starting from the highest bit of the combined operation result according to the truncation bit number parameter. For example, when d = 4, the highest 4 bits are extracted; when d = 11, the highest 11 bits are extracted. The extraction operation is implemented through a hardware multiplexer or a software bit mask to ensure no loss of data accuracy.

[0062] Step 1053: Use the key encapsulation module to map the high-order bits to a compressed data format that conforms to the preset standard to obtain the ciphertext key for output.

[0063] In embodiments of this application, the preset standard refers to the specification requirements of the NIST FIPS203 standard for the output data format of the Kyber algorithm. The compressed data format refers to the output data organization form that conforms to the Kyber algorithm standard, and its bit width strictly corresponds to the modulus parameter d.

[0064] The format conversion module of the system standardizes the extracted high-order bits. For data with a width less than the target bit width, zeros are automatically padded; for data that exceeds (which should not theoretically exist), truncation is performed. The processed data is encapsulated into a data structure compliant with the NIST FIPS203 standard and transmitted to the key encapsulation module or the storage module through the output interface. Before output, the verification circuit verifies whether the data bit width meets the requirements of the d parameter.

[0065] In the embodiments of this application, the output bit width is dynamically determined according to the modulus parameter, the effective data bits are accurately extracted and converted into a standard format, ensuring full compatibility with the NIST standard. At the same time, through the hardware-optimized bit extraction and format conversion logic, the data processing efficiency is significantly improved.

[0066] In some embodiments, step 101 includes: Step 1011, using the processor to receive, through the bus interface, a key service request carrying the key modulus parameter sent by an external control module.

[0067] In the embodiments of this application, the bus interface refers to a standardized communication interface for data transmission in a computer system, including address lines, data lines, and control lines, and is used for information exchange between modules.

[0068] The bus interface module of the system continuously monitors the bus activities. When a valid key service request is detected, it starts the data reception process. The interface circuit analyzes the bus protocol and extracts the key fields in the request, including the operation code and the key modulus parameter d. The verification circuit verifies the legality of the parameter d (whether it belongs to 4 / 5 / 10 / 11). After passing, the parameter is stored in the configuration register, and at the same time, a ready signal is sent to the control core. The bus transceiver adopts a pipeline design and supports receiving new requests and processing the current request simultaneously.

[0069] Step 1012, using the processor to read the input data from the storage module.

[0070] In the embodiments of this application, the storage module refers to the random access memory (RAM) unit in the system for temporarily storing data to be processed, and its bit width is 12 bits to accommodate the original input data x ∈ [0, 3329).

[0071] The system reads the 12-bit input data x from the RAM through the memory interface according to the storage address generated by the address generator. The storage controller manages the read and write timing to ensure that the data acquisition is completed within a single clock cycle. The data cache register temporarily stores the read result, and at the same time, the parity check circuit verifies the data integrity. For burst transmission scenarios, the prefetch buffer can preload data at adjacent addresses in advance to improve the throughput. The read operation is executed in parallel with the bus interface receiving the request, achieving instruction-level parallelism.

[0072] Step 1013: Use the processor to extend the bit length of the input data to the processing bit width corresponding to the modulus parameter.

[0073] In the embodiments of the present application, the processing bit width refers to the standardized data bit width required by subsequent operation modules, and its value is determined by the modulus parameter d, with a minimum of 19 bits (when d = 4) and a maximum of 24 bits (when d = 11). Bit length extension refers to the operation of adjusting 12-bit input data to a unified processing bit width through sign extension or zero padding.

[0074] The bit width adjustment module of the system selects the corresponding extension strategy according to the d parameter in the configuration register. For all d values, first zero-extend the 12-bit input x to the 19-bit basic bit width. When d = 10 / 11, additional high-order zeros are added to make the total bit width reach 24 bits. The extension circuit is implemented by a multi-level selector and completes the bit width conversion within 1 clock cycle. The extended data is output to the pipeline register, and the high-order filled bits are marked as invalid data areas for subsequent operation modules to identify.

[0075] In the embodiments of the present application, parameter reception is implemented through a standardized bus interface, memory optimization technology is used to ensure data reading efficiency, and the data bit width is dynamically adjusted to meet the requirements of subsequent operations. A three-stage pipeline of request parsing, data acquisition, and format preprocessing is implemented, achieving a throughput of processing one input data per clock cycle at the hardware level. The preprocessing stage ensures that all subsequent modules receive standardized data with a unified bit width, eliminating operation bottlenecks caused by input differences, providing stable data supply and timing guarantee for the entire compression process, and significantly improving the overall performance of the system.

[0076] In some embodiments, the fixed value is generated through the following steps: Step 201: Use the processor to select the corresponding base according to the category of the key modulus parameter.

[0077] In the embodiments of the present application, the base refers to the reference value used to generate the fixed value in the Kyber algorithm compression operation, and its value is related to the category of the key modulus parameter d. For the first type of parameter (d = 4 / 5), the base is 315; for the second type of parameter (d = 10 / 11), the base is 161271.

[0078] The parameter selection module of the system determines its category by decoding the value of the key modulus parameter d (4 / 5 / 10 / 11). When d = 4 or 5, the parameter selection module reads the first type of base 315 from the configuration register; when d = 10 or 11, it reads the second type of base 161271. This selection process is implemented by a multiplexer hardware circuit and completes the base output within a single clock cycle to ensure that the subsequent operation modules can obtain the correct reference value in a timely manner.

[0079] Step 202: Use an adder to add the shifted base number by the seventh preset number of bits to the offset to obtain a second addition result.

[0080] In the embodiments of the present application, the seventh preset number of bits refers to the number of bits shifted left determined according to the base number type for base number adjustment. For the base number 315, the seventh preset number of bits is 8; for the base number 161271, the seventh preset number of bits is 17. The offset is a compensation value used to correct the operation result, and its value is related to the base number type. For the base number 315, the offset is -5; for the base number 161271, the offset is -4097.

[0081] After the operation module of the system receives the base number, it selects the corresponding seventh preset number of bits according to the base number type to perform a left shift operation. The shifter shifts the base number by a specified number of bits (the base number 315 is shifted left by 8 bits, and the base number 161271 is shifted left by 17 bits) to generate a shifted result. The adder then adds the shifted result to the corresponding offset (the shifted result of the base number 315 plus -5, and the shifted result of the base number 161271 plus -4097) to produce a second addition result. This step is implemented through a hardware shifter and adder pipeline to ensure that the operation is completed within one clock cycle.

[0082] Step 203: Use a processor to adjust the second addition result to match the bit width of the intermediate data to obtain a fixed value.

[0083] In the embodiments of the present application, the bit width adjustment module of the system receives the second addition result and performs a sign extension or truncation operation according to the current bit width of the intermediate data m. For the case of d = 4 / 5, the result is adjusted to 19 bits; for the case of d = 10 / 11, the result is adjusted to 24 bits. The adjustment process is implemented through a bit selection circuit to ensure strict matching with the intermediate data bit width while retaining the valid data bits. The finally output fixed value is stored in the pipeline register for use by the subsequent addition operation module.

[0084] The embodiments of the present application intelligently select the operation base number according to the key modulus parameter, and generate a fixed value that precisely matches the intermediate data through an optimized shift addition and bit width adjustment pipeline, thereby avoiding pre-storing all possible fixed values and significantly saving storage resources. At the same time, the hardware pipeline architecture ensures that a new fixed value can be generated in each clock cycle to support continuous data stream processing.

[0085] In some embodiments, the steps of the displacement processing include: Step 301: Select a displacement path corresponding to the key modulus parameter through a multiplexer.

[0086] In the embodiments of the present application, a multiplexer is a digital circuit component that selects one output from multiple inputs according to a control signal and is used to select different displacement processing paths in this step. The displacement path refers to a displacement operation configuration preset according to the key modulus parameter d (4 / 5 / 10 / 11), including parameters such as the displacement direction and the number of bits.

[0087] The path selection module of the system receives the key modulus parameter d as the control signal. The parameter decoder converts the d value into a 4-bit hot code signal to drive the channel selection of the multiplexer. Each input channel is connected to different displacement configuration parameters: channel 0 (d = 4) is configured to shift left by 4 bits, channel 1 (d = 5) is configured to shift left by 5 bits, channel 2 (d = 10) is configured to shift left by 3 bits, and channel 3 (d = 11) is configured to shift left by 4 bits. The selector latches the output at the rising edge of the clock to ensure the stable transmission of the displacement parameters to the next stage.

[0088] Step 302, use a shifter to perform dynamic displacement adjustment on the input data according to the displacement path.

[0089] In the embodiments of the present application, a shifter is a storage circuit with a displacement function that can perform left or right shift operations on data. Dynamic displacement adjustment refers to performing a configurable displacement operation on the input data according to the displacement path parameters selected in real time.

[0090] The displacement execution module of the system receives 12-bit input data and the displacement parameters from the multiplexer. The barrel shifter performs precise displacement according to the displacement parameters: for d = 4, it performs x << 4, for d = 5, it performs x << 5, for d = 10, it performs x << 3, and for d = 11, it performs x << 4. The displacement operation is completed within a single clock cycle, and a carry-save adder is used to optimize the critical path. The bit width of the displaced data is expanded to 19 - 24 bits (depending on the d value), and at the same time, a displacement overflow flag is generated for subsequent modules to detect.

[0091] Step 303, use a processor to cache the adjusted input data into an intermediate register.

[0092] In the embodiments of the present application, an intermediate register is a storage unit used to temporarily store the temporary data during the processing process and has a storage capacity matching the maximum processing bit width (24 bits).

[0093] The data buffer module of the system receives the displaced data and selects the target register to write according to the current processing stage. The register bank adopts a dual-buffer design, allowing the previous stage module to write to the current register while the next stage module reads from another register. The write enable signal is strictly synchronized with the system clock to ensure that the setup time and hold time meet the timing requirements. The output end of the register is configured with a tri-state gate to achieve orderly access when multiple modules share the bus.

[0094] In the embodiments of the present application, parameterized displacement path selection is achieved through hardware multiplexing. A high-performance barrel shifter is used to ensure single-cycle displacement operations, and a dual-buffered register bank is used to eliminate pipeline stalls. Thus, on the premise of ensuring strict timing, fast switching between different compression modes is supported, and a throughput of processing one data item per clock cycle is achieved. The dynamic configuration ability of the displacement bits enables the system to flexibly adapt to various compression scenarios of the Kyber algorithm, and the register caching mechanism provides a stable data supply for subsequent arithmetic modules, achieving the best balance between high performance and flexibility overall.

[0095] The products carrying the key encapsulation method provided by some embodiments of the present application are applied in a secure environment using the post-quantum Kyber algorithm. As Figure 2 shown: When user S1 has a need for password security services, a password service request will be sent to server S2. For the key encapsulation mechanism of post-quantum cryptography, it will involve the invocation of Kyber and encapsulation operations. Server S2 will control PQC module S3, especially the Kyber module, to perform encapsulation operations. The key encapsulation process will call the compress module S4 algorithm to execute compression tasks.

[0096] Referring to Figure 3 , in a common hardware implementation, the processor 401 controls the execution of the Kyber module P3 through the bus P2, which is simplified to input the msg, start the operation, and the data is operated and transmitted between the Kyber module P3 and the storage module P4, and finally the result is calculated. The compress module S4 therein will affect the operation performance and the hardware area.

[0097] The embodiments of the present application are mainly applied in the post-quantum Kyber algorithm. The Kyber compression operation involves round and division operations. Using this patent can reduce the resource cost of this process, and at the same time reduce the logical complexity and improve the operation performance.

[0098] The present application fully aligns the precision under the parameters of 4 / 5 / 10 / 11, and further optimizes the values of the operations Q / 2 and 1 / Q.

[0099] It should be noted that the following "( )2" represents binary data, where "_" is a visual aid symbol between consecutive bytes in binary data. For example, in "10_0000_0000_0000_0000", there are 5 bytes, with 4 bits in a group. "10" is the abbreviated writing of "0010", also in a group of 4 bits.

[0100] When d = 4 / 5, perform the operation of (((x << d) + 1664) * 315) >> 20; When d = 10 / 11, perform the operation of (((x << d) + 1664) * 161271) >> 29.

[0101] The execution process where d = 10 / 11 can compatibly handle the operation of d = 4 / 5. Therefore, in the case of resource constraints, (((x << d) + 1664) * 161271) >> 29 can be uniformly used for processing, thereby saving resource costs in terms of hardware or software.

[0102] Furthermore, 1664 = 13 * 2^7. For d = 4 / 5, the corresponding 1 << 4 and 1 << 5 parts can be extracted. For d = 10 / 11, it can be optimized to (((x << (d - 7)) + 13) * 161271) >> 22. It has a lower logical complexity compared to the original operation of (((x << d) + 1664) * 161271) >> 29. The added number inside the parentheses is reduced from 1664 with 12 bits to 13 with 4 bits, thus reducing the logical complexity and area of the adder.

[0103] And for d = 11, (((x << (d - 7)) + 13) * 161271) >> 22 is converted to: (((x << 4) + 13) * 161271) >> 22, where x is shifted left by 4 bits and added with 13 of 4 bits, and the result can be directly obtained by splicing.

[0104] Therefore, there is unified processing of (((x << (d - 4)) + 104) * 161271) >> 25; Separate processing for: D = 4, ((x + 104) * 315) >> 16; D = 5, ((x + 52) * 315) >> 15; D = 10, (((x << 3) + 13) * 161271) >> 22; D = 11, ((x, 4'd13) * 161271) >> 22; In hardware, the operations for 315 and 161271 can also be converted to shift and addition operations, reducing the use of multiplication resources.

[0105] 315 = (1_0011_1011)2 = (1_0000_0000)2 + (100_0000)2 - (100)2 - (1)2 = 1 << 8 + 1 << 6 - 1 << 2 - 1; 161271 = (10_0111_0101_1111_0111)₂ = (10_0000_0000_0000_0000)₂ + (1000_0000_0000_0000)₂ + (100_0000_0000)₂ + (10_0000_0000)₂ - (1_0000_0000_0000)₂ - (1000)₂ - 1 = 1 << 17 + 1 << 15 + 1 << 10 + 1 << 9 - 1 << 12 - 1 << 3 - 1; Combined with external right shift, the adder bit width can be reduced; finally, it is reduced to: D = 4, m = x + 104, y = (m << 4 + m << 2 - m >> 2 - m >> 4) >> 12; D = 5, m = x + 52, y = (m << 5 + m << 3 - m >> 1 - m >> 3) >> 12; D = 10, m = x << 3 + 13, y = (m << 9 + m << 7 + m << 2 + m << 1 - m << 4 - m >> 5 - m >> 8) >> 14; D = 11, m = {x, 4'd13}, y = (m << 12 + m << 10 + m << 5 + m << 4 - m << 7 - m >> 2 - m >> 5) >> 17.

[0106] In the case of limited resources, the unified processing of (((x << (d - 4)) + 104) * 161271) >> 25 is reduced to: M = (x << (d - 4)) + 104; Y = (m << 9 + m << 7 + m << 2 + m << 1 - m << 4 - m >> 5 - m >> 8) >> 17; Using shift and addition / subtraction to complete the operation can use the fewest and smallest adders while ensuring accuracy.

[0107] As Figure 4 shown, the calculation process is as follows: Step M1, the input data x will undergo 4 types of shift processing and be selected by the parameter d; Step M2, add the displacement structure and the fixed 104 to obtain the 19-bit M data; Step M3, perform the operation of (m << 9 + m << 7 + m << 2 + m << 1 - m << 4 - m >> 5 - m >> 8) in Y, and take the higher 11 bits of the addition result as the output result.

[0108] By using the key encapsulation method provided by some embodiments of the present application, correct compression results can be obtained without any loss, and without the participation of a multiplier. Only addition, subtraction, and shift operations are required to complete rounding and division operations. At the same time, the size and number of adders are optimized, saving area and improving computational performance.

[0109] Based on the foregoing embodiments, an embodiment of the present application provides a key encapsulation device, as Figure 5 shown. The key encapsulation device 40 includes: Wherein: A shifter 403, configured to perform a shift operation on the input data read from the storage module according to the obtained key modulus parameter; wherein, the key modulus parameter is carried in the key service request received by the processor 401; An adder 402, configured to add the shifted input data to a fixed value to obtain intermediate data; The shifter 403 and the adder 402 are further configured to perform a preset addition, subtraction, and position combination operation on the intermediate data to obtain a combined operation result; A key encapsulation module 404 is used to encapsulate the high-order data extracted from the combined operation result as a compressed ciphertext key for output.

[0110] In some embodiments of the present application, the shifter 403 is further configured to, when the key modulus parameter is the first type of parameter, shift the input data to the left by a first preset number of bits; when the key modulus parameter is the second type of parameter, use the shifter to shift the input data to the left by a second preset number of bits; wherein, the first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter.

[0111] In some embodiments of the present application, the adder 402 is further configured to: when the key modulus parameter is the first type of parameter, select a first fixed value for addition operation to obtain intermediate data, and the first fixed value is an integer multiple of the first type of parameter and is associated with the shift number of bits; when the key modulus parameter is the second type of parameter, select a second fixed value for addition operation to obtain intermediate data, and the second fixed value is an integer multiple of the second type of parameter and is associated with the shift number of bits.

[0112] In some embodiments of the present application, the adder 402 is further configured to: add the result of shifting the intermediate data to the left by a third preset number of bits through the shifter to the result of shifting the intermediate data to the left by a fourth preset number of bits through the shifter to obtain an addition result; subtract the result of shifting the intermediate data to the right by a fifth preset number of bits through the shifter from the result of shifting the intermediate data to the right by a sixth preset number of bits through the shifter to obtain a subtraction result; Among them, the processor 401 is further configured to combine the addition result and the subtraction result to obtain a combined operation result.

[0113] In some embodiments of the present application, the key encapsulation module 404 is further configured to: determine the truncation number according to the bit length of the modulus parameter; extract the high-order bits of the truncation number from the combined operation result; map the high-order bits to a compressed data format that conforms to the preset standard to obtain a ciphertext key for output.

[0114] In some embodiments of the present application, the adder 402 is further configured to shift the radix to the left by a seventh preset number of bits and then add it to the offset to obtain a second addition result; Among them, the radix is selected by the processor 401 according to the category of the key modulus parameter; and, the processor 401 is further configured to adjust the second addition result to match the bit width of the intermediate data to obtain a fixed value.

[0115] In some embodiments of the present application, the device further includes a multiplexer, and the multiplexer is configured to select a displacement path corresponding to the key modulus parameter; The shifter 403 is further configured to perform dynamic displacement adjustment on the input data according to the displacement path; the processor 401 is further configured to cache the adjusted input data into an intermediate register.

[0116] By improving the ciphertext compression process based on the Kyber algorithm to be implemented using a shifter, an adder, and a combined operation, the embodiments of the present application avoid the use of a multiplier in the processing process, significantly reduce the hardware resource occupancy and the operation complexity, can adapt to the requirements of different key modulus parameters, and improve the overall operation performance and resource utilization rate.

[0117] The description of the above device embodiments is similar to the description of the above method embodiments and has similar beneficial effects to the method embodiments. In some embodiments, the functions or modules included in the device embodiments of the present application can be used to execute the methods described in the above method embodiments. For the technical details not disclosed in the device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

[0118] Based on the foregoing embodiments, the embodiments of the present application further provide a computer device, as Figure 6 shown. The computer device 50 includes: A processor 401, configured to receive a key service request carrying a key modulus parameter; The computer device 50 further includes: the above-mentioned key encapsulation device 40.

[0119] In some embodiments, the processor 401 is further configured to receive, via a bus interface, a key service request carrying key modulus parameters sent by an external control module, read the input data from a storage module, and extend the bit length of the input data to a processing bit width corresponding to the modulus parameters.

[0120] It should be understood that the phrase "in one embodiment" or "in an embodiment" mentioned throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the present application. Therefore, the appearances of "in one embodiment" or "in an embodiment" throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. It should be understood that in various embodiments of the present application, the order of the above steps / processes is not meant to imply a sequential execution order. The execution order of each step / process should be determined based on its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. The serial numbers of the embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0121] It should be noted that in this article, the term "comprising", "including" or any other variation thereof is intended to cover a non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0122] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined, or may be integrated into another system, or some features may be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms.

[0123] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units; they may be located in one place or distributed to multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] In addition, each functional unit in the embodiments of the present application may be all integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the above integrated unit may be implemented in the form of hardware, or in the form of a combination of hardware and software functional units.

[0125] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions. The foregoing program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps including the above method embodiments; and the foregoing storage medium includes: removable storage devices, read-only memory (ROM), magnetic disks, or optical discs and other various media that can store program codes.

[0126] Alternatively, if the above integrated unit of the present application is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence or the part that contributes to the related technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in the embodiments of the present application. And the foregoing storage medium includes: removable storage devices, ROM, magnetic disks, or optical discs and other various media that can store program codes.

[0127] The above is only the implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered by the protection scope of the present application.

Claims

1. A key encapsulation method, characterized in that: The key encapsulation method comprises: Performing shift processing on the input data read from the storage module according to the obtained key modulus parameter through the shifter; The intermediate data is obtained by adding the shifted input data and the fixed value through the adder; Using a shifter and an adder to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result; The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

2. The key encapsulation method according to claim 1, wherein: The shifting process of the input data read from the storage module according to the obtained key modulus parameter by the shifter includes: When the key modulus parameter is a first type parameter, using a shifter to left-shift the input data by a first preset number of bits; When the key modulus parameter is a second type parameter, using a shifter to left-shift the input data by a second preset number of bits; The first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter, and the value range of the first type of parameters is smaller than that of the second type of parameters.

3. The key encapsulation method according to claim 2, wherein: The step of adding the shifted input data and the fixed value by an adder to obtain intermediate data includes: When the key modulus parameter is a first type parameter, selecting a first fixed value by an adder to perform an addition operation to obtain intermediate data, where the first fixed value is an integer multiple of the first type parameter and is associated with the number of shift bits; When the key modulus parameter is a second type parameter, an adder is used to select a second fixed value for addition operation to obtain intermediate data, where the second fixed value is an integer multiple of the second type parameter and is associated with the number of shift bits.

4. The key encapsulation method according to any one of claims 1 to 3, characterized in that: in, The key modulus parameter is carried in the key service request received by the processor; The method of using the shifter and the adder to perform a preset addition, subtraction and position combination operation on the intermediate data to obtain a combination operation result includes: adding, by an adder, a result of left-shifting the intermediate data by a third preset number of bits by the shifter and a result of left-shifting the intermediate data by a fourth preset number of bits by the shifter to obtain an addition result; subtracting, by an adder, a result of right-shifting the intermediate data by a fifth preset number of bits by the shifter from a result of right-shifting the intermediate data by a sixth preset number of bits by the shifter to obtain a subtraction result; The processor is configured to combine the addition result and the subtraction result to obtain a combined operation result.

5. The key encapsulation method according to any one of claims 1 to 3, characterized in that: The key encapsulation module is used to encapsulate the high-order data extracted from the combined operation result into a compressed ciphertext key for output, including: Determining the number of truncated bits according to the bit length of the modulus parameter using a key encapsulation module; Extracting high-order bits of the truncated number of bits from the combination operation result using a key encapsulation module; The key encapsulation module is used to map the high-order bits into a compressed data format that complies with the preset standard to obtain a ciphertext key for output.

6. The key encapsulation method according to claim 4, wherein: The fixed value is generated by the following steps: A second addition result is obtained by using an adder to shift the base generated based on the key modulus parameter to the left by a seventh preset bit number and then adding the shifted bit to the offset; wherein the base is selected by the processor according to the category of the key modulus parameter; and the processor adjusts the second addition result to match the bit width of the intermediate data to obtain a fixed value.

7. The key encapsulation method according to any one of claims 1 to 3, characterized in that: The steps of the displacement processing include: Selecting a displacement path corresponding to the key modulus parameter through a multiplexer; Using a shifter to dynamically adjust the input data according to the shift path; The processor is used to cache the adjusted input data into an intermediate register.

8. A key encapsulation device, characterized in that: The key encapsulation device comprises: A shifter, configured to perform shift processing on the input data read from the storage module according to the obtained key modulus parameter; An adder, used to add the shifted input data to a fixed value to obtain intermediate data; The shifter and adder are further used to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result; The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

9. A computer device, characterized in that: include: A processor, configured to receive a key service request carrying a key modulus parameter; The computer device further comprises: the key encapsulation device according to claim 8.

10. The computer device according to claim 9, wherein: The processor is also used to receive a key service request carrying a key modulus parameter sent by an external control module through a bus interface, read the input data from the storage module, and expand the bit length of the input data to a processing bit width corresponding to the modulus parameter.

Images