Key encapsulation method, device and computer equipment

Abstract

The present application discloses a key encapsulation method, apparatus, and computer equipment, relating to the field of data security technology. The method comprises: performing shift processing on input data read from a storage module according to an acquired key modulus parameter using a shifter; adding the shifted input data to a fixed value using an adder to obtain intermediate data; performing preset addition, subtraction, and position combination operations on the intermediate data using the shifter and adder to obtain a combined operation result; and encapsulating the high-order data extracted from the combined operation result into a compressed ciphertext key using a key encapsulation module for output. This avoids the use of a multiplier during the processing process, significantly reduces hardware resource usage and computational complexity, can adapt to the requirements of different key modulus parameters, and improves overall computational performance and resource utilization.

Description

Technical Field

[0001] The present application relates to, but is not limited to, the field of data security technology, and in particular to a key encapsulation method, apparatus, and computer device. Background Art

[0002] The Kyber algorithm is a standardized post-quantum key encapsulation algorithm published by NIST. It is designed to resist attacks on public key cryptography in the future, especially when quantum computing becomes available. With the continuous advancement of quantum computing research, practical quantum computing is becoming possible. This poses a significant threat to current public key cryptography systems based on ECC and RSA, as quantum computing can crack these systems in polynomial time. The Kyber algorithm is specifically designed to resist quantum computing, ensuring that public key cryptography remains viable in the quantum era.

[0003] The Kyber algorithm requires modular addition, subtraction, and multiplication operations within the lattice modulo 3329. Kyber uses compression techniques to reduce the size of ciphertext while preserving confidentiality. Compression is achieved by scaling, compressing the 12-bit 3329 data into 4, 5, 10, or 11 bits. This involves dividing by a parameter and performing round operations with four-input and five-input operations, which are difficult to handle in both hardware and software. Summary of the Invention

[0004] In view of this, embodiments of the present application provide at least one key encapsulation method, apparatus, and computer device.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In one aspect, an embodiment of the present application provides a key encapsulation method, the method comprising:

[0007] Performing shift processing on the input data read from the storage module according to the obtained key modulus parameter through the shifter;

[0008] The intermediate data is obtained by adding the shifted input data and the fixed value through the adder;

[0009] Using a shifter and an adder to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result;

[0010] The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

[0011] On the other hand, an embodiment of the present application provides a key encapsulation device, the device comprising:

[0012] A shifter, configured to perform shift processing on the input data read from the storage module according to the obtained key modulus parameter;

[0013] An adder, used to add the shifted input data to a fixed value to obtain intermediate data;

[0014] The shifter and adder are further used to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result;

[0015] The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

[0016] In another aspect, an embodiment of the present application provides a computer device, including:

[0017] A processor, configured to receive a key service request carrying a key modulus parameter;

[0018] The computer device further includes the key encapsulation device described in the above embodiment.

[0019] In some embodiments, the processor is further used to receive a key service request carrying a key modulus parameter sent by an external control module through a bus interface, read the input data from a storage module, and expand the bit length of the input data to a processing bit width corresponding to the modulus parameter.

[0020] In the embodiment of the present application, the ciphertext compression process based on the Kyber algorithm is improved to be implemented using a shifter, an adder and a combined operation, thereby avoiding the use of a multiplier in the processing process, significantly reducing the hardware resource occupancy and computational complexity, and being able to adapt to the requirements of different key modulus parameters, thereby improving the overall computing performance and resource utilization.

[0021] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and do not limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and, together with the specification, are used to illustrate the technical solutions of the present application.

[0023] Figure 1 A schematic diagram of the implementation process of a key encapsulation method provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of a scenario of a key encapsulation method provided in an embodiment of the present application;

[0025] Figure 3A logical flow diagram of a key encapsulation method provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of the calculation logic of a key encapsulation method provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of the structure of a key encapsulation device provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions of this application are further elaborated in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0030] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0031] The terms "first / second / third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first / second / third" can be interchanged with a specific order or sequence where permitted so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing this application only and are not intended to limit this application.

[0033] The present invention provides a key encapsulation method that can be executed by a processor of a computer device. The computer device may include a server, laptop, tablet, desktop computer, smart TV, set-top box, mobile device (e.g., mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or other device with key encapsulation capabilities.

[0034] Figure 1 A schematic diagram of the implementation process of a key encapsulation method provided in an embodiment of the present application is shown as follows: Figure 1As shown, the method includes the following steps 101 to 104:

[0035] Step 101: Perform shift processing on input data read from a storage module according to an acquired key modulus parameter by a shifter.

[0036] Here, a key service request carrying a key modulus parameter is received by the processor. In an embodiment of the present application, the key modulus parameter refers to the parameter d used for compression operations in the Kyber algorithm, and its value is 4, 5, 10 or 11, indicating that the data within the modulus 3329 is compressed to 4 bits, 5 bits, 10 bits or 11 bits. A key service request refers to an instruction initiated by a user or system requiring post-quantum cryptographic services, which contains the key modulus parameter d and is used to guide subsequent compression operations. The system receives a key service request from a user or upper-layer module through a communication interface. The request contains the key modulus parameter d, which the system parses and passes to the subsequent processing module. The key modulus parameter d determines the specific method of subsequent displacement and operation, ensuring that the compression process meets the requirements of the Kyber algorithm.

[0037] In this embodiment of the present application, the input data refers to 12-bit data x to be compressed, with a value range of [0, 3329), stored in the system's storage module. Bit shifting refers to shifting the input data x to the left by d bits, i.e., performing an operation where x << d, where d is the key modulus parameter.

[0038] The system reads input data x from the storage module and generates a shift control signal based on the key modulus parameter d. The shift module uses this signal to shift x left by d bits, generating the shifted data x << d. This step prepares for the subsequent addition operation and ensures that the data is correctly aligned with the fixed value.

[0039] Step 102: Add the shifted input data and the fixed value by an adder to obtain intermediate data.

[0040] In the embodiments of the present application, the fixed value refers to a fixed addend selected based on the key modulus parameter d, such as 1664 or 13, used to implement the rounding operation. The intermediate data refers to the result of adding the shifted input data to the fixed value, and is used for subsequent addition, subtraction, and shift combination operations.

[0041] The system selects a fixed value based on the key modulus parameter d (e.g., 1664 for d = 4 / 5, 13 for d = 10 / 11) and adds this fixed value to the shifted input data x << d. The adder performs this operation and generates the intermediate data m.

[0042] Step 103: Use a shifter and an adder to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result.

[0043] In the embodiments of this application, combined addition, subtraction, and bit shift operations refer to techniques that replace multiplication operations with shifts and addition and subtraction. For example, decomposing 315 into (1<<8)+(1<<6)-(1<<2)-1 reduces hardware resource consumption. The combined operation result refers to the temporary result obtained after the combined addition, subtraction, and bit shift operations are performed on the intermediate data.

[0044] The system selects the corresponding operation mode based on the key modulus parameter d (for example, when d = 4, m<<4 + m<<2 - m>>2 - m>>4). The operation module uses multi-stage shifters and adders to perform the specified addition, subtraction, and bit shift operations on the intermediate data m to generate the combined operation result. This step avoids the direct use of multipliers, significantly reducing hardware resource usage and operation latency.

[0045] Step 104: Using a key encapsulation module, the high-order data extracted from the combination operation result is encapsulated into a compressed ciphertext key for output.

[0046] In this embodiment of the present application, high-order data refers to the most significant bits in the result of the combined operation. The number of bits is determined by the key modulus parameter d, for example, 4 bits when d=4. The compressed ciphertext key refers to the final output data generated after the compression operation, and its size meets the requirements of the Kyber algorithm.

[0047] The system extracts the high-order data from the combined operation result and outputs it as the compressed ciphertext key. The output module passes the result to the subsequent key encapsulation module or storage module, completing the entire compression operation process.

[0048] This application improves the ciphertext compression process based on the Kyber algorithm to use shifters, adders and combined operations, avoiding the use of multipliers in the processing process, significantly reducing hardware resource usage and computational complexity, and being able to adapt to the requirements of different key modulus parameters, thereby improving overall computing performance and resource utilization.

[0049] In some embodiments, step 102 includes:

[0050] Step 1021: Determine whether the key modulus parameter is a first-category parameter or a second-category parameter.

[0051] In this embodiment of the present application, the system uses a parameter parsing module to read the value of the key modulus parameter d and make a judgment based on a preset classification rule, for example, classifying d = 4 / 5 as the first category and d = 10 / 11 as the second category. The judgment logic is based on the value range of the key modulus parameter d, and the system generates a corresponding category identification signal to guide the subsequent bit shift processing module to select the correct number of bit shifts.

[0052] Step 1022: When the key modulus parameter is a first type parameter, use a shifter to left-shift the input data by a first preset number of bits.

[0053] In this embodiment of the present application, based on the determination result of step 1021, if the key modulus parameter d belongs to the first category of parameters, the system controls the shift module to shift the input data x to the left by d bits (i.e., x << d). For example, if d = 4, the input data is shifted to the left by 4 bits, and if d = 5, the input data is shifted to the left by 5 bits. The shift operation is implemented using a hardware shifter or software instructions to generate the shifted data x << d, providing aligned data for the subsequent addition operation.

[0054] Step 1023: When the key modulus parameter is a second type parameter, use a shifter to left-shift the input data by a second preset number of bits.

[0055] In this embodiment of the present application, based on the determination in step 1021 that the key modulus parameter d belongs to the second category, the system controls the shift module to shift the input data x to the left by d-7 bits, i.e., x << (d-7). For example, if d = 10, the shift is 3 bits, and if d = 11, the shift is 4 bits. This optimized design reduces the adder's bit width requirements and hardware complexity. The shifted data x << (d-7) is added to the fixed value 13 to generate intermediate data.

[0056] The first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter.

[0057] This embodiment of the present application achieves efficient ciphertext compression in the Kyber algorithm through the design of classification judgment and dynamic bit shifting. The system selects the corresponding shift strategy based on the category of the key modulus parameter d, ensuring that the data compression process meets accuracy requirements while optimizing hardware resource utilization. The first type of parameter is directly shifted left by d bits, while the second type of parameter is shifted left by d-7 bits. This significantly reduces the adder bit width and logical complexity, improving computational efficiency and resource utilization.

[0058] In some embodiments, step 103 includes:

[0059] Step 1031: When the key modulus parameter is a first type parameter, use an adder to select a first fixed value to perform addition operation to obtain intermediate data, where the first fixed value is an integer multiple of the first type parameter and is associated with the number of shift bits.

[0060] In this embodiment of the present application, the first fixed value refers to the fixed addend used in the Kyber algorithm for the first type of parameter (d=4 or 5) compression operation, and its value is 1664. This value is an approximation of q / 2 (q=3329) and is used to implement the Round operation.

[0061] After determining that the key modulus parameter d belongs to the first category (d = 4 or 5), the system selects the corresponding first fixed value 1664 from the preset parameter library. The adder module adds the shifted input data (x << d) to the first fixed value 1664, generating the intermediate data m = (x << d) + 1664. This step ensures the accuracy of the Round operation and provides a unified data format for subsequent combined operations. The design of the first fixed value 1664 is linked to the number of shift bits d, ensuring that the result meets the compression requirements of the Kyber algorithm.

[0062] Step 1032: When the key modulus parameter is a second type parameter, use an adder to select a second fixed value to perform addition operation to obtain intermediate data, where the second fixed value is an integer multiple of the second type parameter and is associated with the number of shift bits.

[0063] In this embodiment of the present application, the second fixed value refers to the fixed addend used for the compression operation of the second type of parameter (d=10 or 11) in the Kyber algorithm, and its value is 13. This value is a simplified form of 1664 (i.e., an approximate value of q / 2), and the bit width requirement of the adder is reduced through optimized design.

[0064] After determining that the key modulus parameter d belongs to the second category (d = 10 or 11), the system selects the corresponding second fixed value 13 from the preset parameter library. The adder module adds the shifted input data (x << (d - 7)) to the second fixed value 13, generating the intermediate data m = (x << (d - 7)) + 13. By optimizing the design of the fixed value and the number of shift bits, this step significantly reduces the adder's logic complexity and hardware resource usage, while ensuring that the calculation accuracy is consistent with the requirements of the Kyber algorithm.

[0065] The embodiment of the present application significantly improves the efficiency and performance of hardware implementation while ensuring calculation accuracy through classification processing, and is suitable for encryption scenarios with limited resources.

[0066] In some embodiments, step 104 includes:

[0067] Step 1041 , using an adder, adds a result of the intermediate data being shifted left by a third preset number of bits by the shifter and a result of the intermediate data being shifted left by a fourth preset number of bits by the shifter to obtain an addition result.

[0068] In this embodiment of the present application, the third preset number of bits refers to a left shift number determined based on the key modulus parameter d, and is used for a specific shift operation on the intermediate data m. For example, when d=4, the third preset number of bits is 4 (i.e., m<<4). The fourth preset number of bits refers to another left shift number determined based on the key modulus parameter d, and is used for a specific shift operation on the intermediate data m. For example, when d=4, the fourth preset number of bits is 2 (i.e., m<<2).

[0069] Based on the key modulus parameter d, the system selects the corresponding third and fourth preset digits (e.g., 4 and 2 for d=4). The shift module shifts the intermediate data m left by the third and fourth preset digits, respectively, to generate m<<4 and m<<2. The adder module adds these two results to generate the addition result (m<<4 + m<<2). This step replaces multiplication operations with shift and addition operations, reducing hardware resource consumption while ensuring operational accuracy.

[0070] Step 1042 , using an adder, subtracts the result of the intermediate data being right-shifted by a fifth preset number of bits by the shifter from the result of the intermediate data being right-shifted by a sixth preset number of bits by the shifter to obtain a subtraction result.

[0071] In this embodiment of the present application, the fifth preset number of bits refers to a right shift number determined based on the key modulus parameter d, and is used for a specific shift operation on the intermediate data m. For example, when d=4, the fifth preset number of bits is 2 (i.e., m>>2). The sixth preset number of bits refers to another right shift number determined based on the key modulus parameter d, and is used for a specific shift operation on the intermediate data m. For example, when d=4, the sixth preset number of bits is 4 (i.e., m>>4).

[0072] The system selects the corresponding fifth and sixth preset digits based on the key modulus parameter d (e.g., 2 and 4 for d=4). The shift module right-shifts the intermediate data m by the fifth and sixth preset digits, respectively, to generate m>>2 and m>>4. The subtractor module subtracts these two results, generating the subtraction result (m>>2 - m>>4). This step further optimizes the hardware implementation through shifting and subtraction operations, avoiding complex multiplication operations.

[0073] Step 1043: Use a processor to combine the addition result and the subtraction result to obtain a combined operation result.

[0074] In this embodiment of the present application, the system inputs the addition result (m<<4 + m<<2) and the subtraction result (m>>2 - m>>4) into the merging module. The merging module performs the addition operation to generate the combined operation result ((m<<4 + m<<2) + (m>>2 - m>>4)).

[0075] The embodiment of the present application uses shifting and addition and subtraction to replace complex multiplication operations, significantly reducing hardware resource usage and operation delay. The combination of addition and subtraction results ensures that the operation accuracy is completely consistent with the algorithm standard.

[0076] In some embodiments, step 105 includes:

[0077] Step 1051: Determine the number of truncated bits according to the bit length of the modulus parameter using a key encapsulation module.

[0078] In this embodiment of the present application, the modulus parameter bit length refers to the output bit length corresponding to the key modulus parameter d in the Kyber algorithm, which can be 4, 5, 10, or 11 bits, representing the bit width of the compressed data. The truncation bit number refers to the number of high-order bits to be extracted from the result of the combined operation, and its value is the same as the bit length of the modulus parameter d.

[0079] The system uses the parameter parsing module to read the value of the key modulus parameter d (4, 5, 10, or 11) and directly uses this value as the number of truncation bits. The control module generates a truncation control signal that specifies the specific bit width required for subsequent high-order bit extraction operations. This ensures that the system can dynamically adjust the bit width of the output data based on different compression requirements.

[0080] Step 1052: Use a key encapsulation module to extract the high-order bits of the truncated digits from the combination operation result.

[0081] In the embodiment of the present application, the high-order bits refer to the continuous bit sequence of the most significant bits in the combination operation result, and the length of the sequence is equal to the number of truncated bits.

[0082] The system's data extraction module receives the result of the combination operation and a truncation bit parameter. Based on the truncation bit parameter, the bit selection circuit sequentially selects a corresponding number of bits from the combination operation result, starting with the most significant bit. For example, when d = 4, the most significant 4 bits are extracted; when d = 11, the most significant 11 bits are extracted. This extraction operation is implemented using a hardware multiplexer or software bit mask to ensure data accuracy is not lost.

[0083] Step 1053: Use a key encapsulation module to map the high-order bits into a compressed data format that complies with a preset standard to obtain a ciphertext key for output.

[0084] In this embodiment, the pre-set standard refers to the NIST FIPS 203 standard for the Kyber algorithm output data format. The compressed data format refers to the output data organization format that conforms to the Kyber algorithm standard, and its bit width strictly corresponds to the modulus parameter d.

[0085] The system's format conversion module normalizes the extracted high-order bits. Data that falls short of the target bit width is automatically padded with zeros, and data that exceeds the target bit width (which theoretically should not exist) is truncated. The processed data is encapsulated into a data structure compliant with NIST FIPS 203 and transmitted to the key encapsulation module or storage module via the output interface. Before output, a checksum circuit verifies that the data bit width meets the d parameter requirements.

[0086] The embodiment of the present application dynamically determines the output bit width based on the modulus parameters, accurately extracts the valid data bits, and converts them into a standard format, ensuring full compatibility with NIST standards. At the same time, the hardware-optimized bit extraction and format conversion logic significantly improves data processing efficiency.

[0087] In some embodiments, step 101 includes:

[0088] Step 1011: Utilize the processor to receive a key service request carrying a key modulus parameter from an external control module via a bus interface.

[0089] In the embodiment of the present application, the bus interface refers to a standardized communication interface for data transmission in a computer system, including address lines, data lines and control lines, which are used for information exchange between modules.

[0090] The system's bus interface module continuously monitors bus activity and initiates data reception when it detects a valid key service request. The interface circuit parses the bus protocol and extracts key fields from the request, including the opcode and key modulus parameter d. The checksum circuit verifies the validity of parameter d (whether it falls within 4 / 5 / 10 / 11). If valid, it stores the parameter in the configuration register and simultaneously sends a ready signal to the control core. The bus transceiver utilizes a pipelined design, allowing it to simultaneously receive new requests and process current ones.

[0091] Step 1012: Utilize a processor to read the input data from a storage module.

[0092] In the embodiment of the present application, the storage module refers to a random access memory (RAM) unit in the system for temporarily storing data to be processed, and its bit width is 12 bits to accommodate the original input data x∈[0, 3329).

[0093] Based on the memory address generated by the address generator, the system reads 12 bits of input data x from the RAM through the memory interface. The memory controller manages read and write timing to ensure data retrieval within a single clock cycle. A data cache register temporarily stores the read result, while a parity check circuit verifies data integrity. For burst transfers, a prefetch buffer preloads data from adjacent addresses to increase throughput. Read operations are executed in parallel with bus interface receive requests, achieving instruction-level parallelism.

[0094] Step 1013: Use a processor to expand the bit length of the input data to a processing bit width corresponding to the modulus parameter.

[0095] In the embodiments of the present application, the processing bit width refers to the standardized data bit width required by the subsequent operation module. Its value is determined by the modulus parameter d, with a minimum of 19 bits (when d = 4) and a maximum of 24 bits (when d = 11). Bit length extension refers to the operation of adjusting 12-bit input data to a uniform processing bit width through sign extension or zero padding.

[0096] The system's bit width adjustment module selects the appropriate expansion strategy based on the d parameter in the configuration register. For all values ​​of d, the 12-bit input x is first zero-extended to a base bit width of 19 bits. When d = 10 / 11, additional high-order zeros are added to bring the total bit width to 24 bits. The expansion circuitry uses a multi-stage selector, completing the bit width conversion within a single clock cycle. The expanded data is output to the pipeline register, with its high-order padding bits marked as invalid data for subsequent computational modules.

[0097] In the embodiment of the present application, parameter reception is achieved through a standardized bus interface, memory optimization technology is used to ensure data reading efficiency, and the data bit width is dynamically adjusted to meet the needs of subsequent operations. A three-level pipeline of request parsing, data acquisition, and format preprocessing is implemented, achieving a throughput of processing one input data per clock cycle at the hardware level. The preprocessing stage ensures that all subsequent modules receive standardized data of uniform bit width, eliminating the computational bottleneck caused by input differences, providing a stable data supply and timing guarantee for the entire compression process, and significantly improving the overall performance of the system.

[0098] In some embodiments, the fixed value is generated by the following steps:

[0099] Step 201: Utilize a processor to select a corresponding base according to the category of the key modulus parameter.

[0100] In this embodiment, the cardinality refers to the base number used to generate fixed values ​​in the Kyber algorithm compression operation. Its value is related to the type of key modulus parameter d. For the first type of parameters (d=4 / 5), the cardinality is 315; for the second type of parameters (d=10 / 11), the cardinality is 161271.

[0101] The system's parameter selection module determines the category by decoding the key modulus parameter d (4 / 5 / 10 / 11). When d = 4 or 5, the parameter selection module reads the first-category radix 315 from the configuration register; when d = 10 or 11, it reads the second-category radix 161271. This selection process is implemented using a multiplexer hardware circuit, which outputs the radix within a single clock cycle, ensuring that subsequent calculation modules can obtain the correct base value in a timely manner.

[0102] Step 202: Utilize an adder to shift the base number to the left by a seventh preset bit number and then add the shifted number to the offset to obtain a second addition result.

[0103] In this embodiment of the present application, the seventh preset bit refers to the number of left-shift bits determined by the radix type and is used for radix adjustment. For radix 315, the seventh preset bit is 8; for radix 161271, the seventh preset bit is 17. The offset is a compensation value used to correct the calculation result, and its value depends on the radix type. For radix 315, the offset is -5; for radix 161271, the offset is -4097.

[0104] After receiving the radix, the system's arithmetic module selects the seventh preset bit number corresponding to the radix type and performs a left shift operation. The shifter shifts the radix left by the specified number of bits (8 bits for radix 315 and 17 bits for radix 161271), generating a shifted result. The adder then adds the shifted result to the corresponding offset (-5 for radix 315 and -4097 for radix 161271) to produce the second addition result. This step is implemented using a hardware shifter and adder pipeline, ensuring the operation completes within a single clock cycle.

[0105] Step 203: Using a processor, adjust the second addition result to match the bit width of the intermediate data to obtain a fixed value.

[0106] In an embodiment of the present application, the system's bit width adjustment module receives the second addition result and performs sign extension or truncation based on the current bit width of the intermediate data m. For cases where d = 4 / 5, the result is adjusted to 19 bits; for cases where d = 10 / 11, the result is adjusted to 24 bits. This adjustment process is implemented by a bit selection circuit, preserving valid data bits while ensuring a strict match with the intermediate data bit width. The final output fixed value is stored in a pipeline register for use by the subsequent addition module.

[0107] This embodiment of the application intelligently selects the calculation base based on the key modulus parameter and generates fixed values ​​that precisely match the intermediate data through an optimized shift-add and bit-width adjustment pipeline, thus avoiding the need to pre-store all possible fixed values ​​and significantly saving storage resources. Furthermore, the hardware pipeline architecture ensures that a new fixed value is generated every clock cycle, supporting continuous data stream processing.

[0108] In some embodiments, the displacement processing step includes:

[0109] Step 301: Select a displacement path corresponding to the key modulus parameter through a multiplexer.

[0110] In this embodiment of the present application, a multiplexer is a digital circuit component that selects an output from multiple inputs based on a control signal. In this step, it is used to select different shift processing paths. A shift path is a predefined shift operation configuration based on the key modulus parameter d (4 / 5 / 10 / 11), including parameters such as the shift direction and number of bits.

[0111] The system's path selection module receives the key modulus parameter d as a control signal. The parameter decoder converts the d value into a 4-bit hot code signal, which drives the channel selection of the multiplexer. Each input channel is connected to a different shift configuration parameter: channel 0 (d=4) is configured for a 4-bit left shift, channel 1 (d=5) for a 5-bit left shift, channel 2 (d=10) for a 3-bit left shift, and channel 3 (d=11) for a 4-bit left shift. The selector latches the output on the rising edge of the clock to ensure stable transmission of the shift parameter to the next stage.

[0112] Step 302: Use a shifter to dynamically shift the input data according to the shift path.

[0113] In the embodiment of the present application, the shifter is a storage circuit with a shift function that can realize left or right shift operations of data. Dynamic shift adjustment refers to performing a configurable shift operation on the input data according to the shift path parameters selected in real time.

[0114] The system's shift execution module receives 12-bit input data and a shift parameter from a multiplexer. The barrel shifter performs a precise shift based on the shift parameter: x<<4 for d = 4, x<<5 for d = 5, x<<3 for d = 10, and x<<4 for d = 11. The shift operation is completed in a single clock cycle, using a carry-save adder to optimize the critical path. The data width after the shift is expanded to 19-24 bits (depending on the value of d), and a shift overflow flag is generated for detection by subsequent modules.

[0115] Step 303: Utilize the processor to cache the adjusted input data into an intermediate register.

[0116] In the embodiment of the present application, the intermediate register is a storage unit for temporarily storing temporary data during the processing process, and has a storage capacity that matches the maximum processing bit width (24 bits).

[0117] The system's data buffer module receives the shifted data and selects the target register to write to based on the current processing stage. The register bank utilizes a double-buffered design, allowing the previous module to write to the current register while the next module reads from another register. The write enable signal is strictly synchronized with the system clock, ensuring that setup and hold times meet timing requirements. Tri-state gates are configured at the register outputs to ensure ordered access when multiple modules share a shared bus.

[0118] This embodiment of the application implements parameterized shift path selection through hardware multiplexing, employs a high-performance barrel shifter to ensure single-cycle shift operations, and combines it with a double-buffered register bank to eliminate pipeline stalls. This allows for rapid switching between different compression modes while maintaining strict timing, achieving a throughput of one data item per clock cycle. The dynamic configuration of the number of shift bits enables the system to flexibly adapt to various compression scenarios of the Kyber algorithm, while the register cache mechanism provides a stable data supply for subsequent computational modules, achieving an optimal balance of high performance and flexibility.

[0119] The product carrying the key encapsulation method provided by some embodiments of the present application is applied in a secure environment using the post-quantum Kyber algorithm. Figure 2 As shown:

[0120] When user S1 needs cryptographic security services, it will initiate a cryptographic service request to server S2. The key encapsulation mechanism for post-quantum cryptography involves Kyber. To perform the encapsulation operation, server S2 controls PQC module S3, specifically the Kyber_ module, to perform the encapsulation operation. The key encapsulation process calls the compress module S4 algorithm to perform the compression task.

[0121] Reference Figure 3 In a common hardware implementation, processor 401 controls the execution of Kyber module P3 via bus P2. This is simplified to inputting a message, initiating the computation, and then computing and transferring the data between Kyber module P3 and storage module P4, ultimately yielding the result. The compression module S4 affects both computational performance and hardware area.

[0122] The embodiments of this application are primarily used in the Kyber post-quantum algorithm. Kyber compression operations involve round and divide operations. Using this patent can reduce the resource cost of this process, while also reducing logical complexity and improving computational performance.

[0123] This application fully aligns the accuracy under parameters 4 / 5 / 10 / 11, and further optimizes the values ​​of Q / 2 and 1 / Q.

[0124] It should be noted that the following "()2" represents binary data, where "_" is used as a visual auxiliary symbol between consecutive bytes in binary data. For example, in "10_0000_0000_0000_0000", there are 5 bytes, which are grouped into 4 bits, and "10" is the abbreviated "0010", which is also grouped into 4 bits.

[0125] When d = 4 / 5, perform the operation (((x<<d) + 1664) * 315)>>20;

[0126] When d = 10 / 11, the operation (((x<<d) + 1664) * 161271)>>29 is performed.

[0127] The execution process of d = 10 / 11 is compatible with the operation of d = 4 / 5. Therefore, when resources are limited, (((x << d) + 1664) * 161271) >> 29 can be used for processing, thereby saving resource costs in hardware or software.

[0128] Furthermore, 1664 = 13*2^7. For d = 4 / 5, the corresponding 1<<4 and 1<<5 parts can be proposed. For d = 10 / 11, it can be optimized to (((x<<(d-7)) + 13) * 161271) >> 22. Compared with the original (((x<<d) + 1664) * 161271) >> 29 operation, this has lower logic complexity. The addend within the brackets is reduced from 12 bits (1664) to 4 bits (13), thus reducing the logic complexity and area of ​​the adder.

[0129] And for d = 11, (((x<<(d-7))+13)*161271)>>22 converts to:

[0130] (((x<<4)+13)*161271)>>22, where x is shifted left by 4 bits and then added to the 4-bit 13, and the result can be directly concatenated.

[0131] Therefore, there is a unified treatment (((x<<(d-4))+104)*161271)>>25;

[0132] Treated separately for:

[0133] D = 4, ((x + 104) * 315) >> 16;

[0134] D = 5, ((x + 52) * 315) >>15;

[0135] D = 10, (((x<<3)+13)*161271)>>22;

[0136] D = 11, ((x, 4'd13) * 161271) >> 22;

[0137] In hardware, operations of 315 and 161271 can also be converted into shift and addition operations to reduce the use of multiplication resources.

[0138] 315 = (1_0011_1011)2 = (1_0000_0000)2 + (100_0000)2 - (100)2 - (1)2 = 1<<8 + 1<<6 - 1<<2 - 1;

[0139] 161271 = (10_0111_0101_1111_0111)2 = (10_0000_0000_0000_0000)2 + (1000_0000_0000_0000)2 + (100_0000_0000)2 + (10_0000_0000)2 - (1_0000_0000_0000)2 - (1000)2 - 1 = 1<<17 + 1<<15 + 1<<10 + 1<<9 - 1<12 - 1<<3 - 1;

[0140] Combined with the external right shift, the adder bit width can be reduced; the final reduction is:

[0141] D = 4, m = x + 104, y = (m<<4 + m<<2–m>>2- m>>4)>>12;

[0142] D = 5, m = x + 52, y = (m<<5 + m<<3–m>>1- m>>3)>>12;

[0143] D = 10, m = x <

[0144] D = 11, m = {x, 4'd13}, y = (m<<12 + m<<10 + m<<5 + m<<4-m<<7-m>>2-m>>5)>>17.

[0145] Under limited resources, the unified processing (((x<<(d-4))+104)*161271)>>25 is reduced to:

[0146] M = (x<<(d-4))+104;

[0147] Y = (m<<9 + m<<7 + m<<2 + m<<1-m<<4-m>>5-m>>8)>>17;

[0148] Using shifting and addition and subtraction to complete the operation can ensure accuracy while using the least and smallest adder.

[0149] like Figure 4 As shown, the calculation process is as follows:

[0150] In step M1, the input data x undergoes four shifting operations and is selected by the parameter d;

[0151] Step M2, adding the shift structure and the fixed 104 to obtain 19-bit M data;

[0152] In step M3, perform the operation (m<<9 + m<<7 + m<<2 + m<<1-m<<4-m>>5-m>>8) in Y, and take the high 11 bits of the addition result as the output result.

[0153] The key encapsulation method provided in some embodiments of this application can achieve accurate compression results without any loss, without requiring multipliers, and only requiring addition, subtraction, and bit shifting to complete integer and division operations. This also optimizes the size and number of adders, saving area while improving computing performance.

[0154] Based on the above embodiments, the present application provides a key encapsulation device, such as Figure 5 As shown, the key encapsulation device 40 includes:

[0155] a shifter 403 configured to perform shift processing on the input data read from the storage module according to the obtained key modulus parameter, wherein the key modulus parameter is carried in the key service request received by the processor 401;

[0156] Adder 402, used to add the shifted input data and the fixed value to obtain intermediate data;

[0157] The shifter 403 and the adder 402 are further used to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result;

[0158] The key encapsulation module 404 is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

[0159] In some embodiments of the present application, the shifter 403 is also used to shift the input data left by a first preset number of bits when the key modulus parameter is the first type of parameter; and to shift the input data left by a second preset number of bits using the shifter when the key modulus parameter is the second type of parameter; wherein the first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter.

[0160] In some embodiments of the present application, the adder 402 is further used to: when the key modulus parameter is a first type parameter, select a first fixed value for addition operation to obtain intermediate data, the first fixed value is an integer multiple of the first type parameter and is associated with the number of shift bits; when the key modulus parameter is a second type parameter, select a second fixed value for addition operation to obtain intermediate data, the second fixed value is an integer multiple of the second type parameter and is associated with the number of shift bits.

[0161] In some embodiments of the present application, the adder 402 is further configured to: add a result of shifting the intermediate data left by a third preset number of bits by the shifter to a result of shifting the intermediate data left by a fourth preset number of bits by the shifter to obtain an addition result; and subtract a result of shifting the intermediate data right by a fifth preset number of bits by the shifter from a result of shifting the intermediate data right by a sixth preset number of bits by the shifter to obtain a subtraction result;

[0162] The processor 401 is further configured to combine the addition result and the subtraction result to obtain a combined operation result.

[0163] In some embodiments of the present application, the key encapsulation module 404 is further used to: determine the number of truncated bits based on the bit length of the modulus parameter; extract the high-order bits of the truncated bits from the combination operation result; and map the high-order bits to a compressed data format that complies with a preset standard to obtain a ciphertext key for output.

[0164] In some embodiments of the present application, the adder 402 is further configured to shift the base number left by a seventh preset bit number and then add the shifted number to obtain a second addition result;

[0165] The base is selected by the processor 401 according to the category of the key modulus parameter; and the processor 401 is further configured to adjust the second addition result to match the bit width of the intermediate data to obtain a fixed value.

[0166] In some embodiments of the present application, the device further includes a multiplexer, the multiplexer being configured to select a displacement path corresponding to the key modulus parameter;

[0167] The shifter 403 is further configured to dynamically shift the input data according to the shift path; the processor 401 is further configured to cache the adjusted input data into an intermediate register.

[0168] The embodiment of the present application improves the ciphertext compression process based on the Kyber algorithm to be implemented using a shifter, an adder, and a combined operation, thereby avoiding the use of a multiplier in the processing process, significantly reducing hardware resource usage and computational complexity, and being able to adapt to the requirements of different key modulus parameters, thereby improving overall computing performance and resource utilization.

[0169] The description of the above device embodiment is similar to the description of the above method embodiment and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the device provided in the embodiments of the present application can be used to perform the methods described in the above method embodiments. For technical details not disclosed in the device embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

[0170] Based on the above embodiments, the present application further provides a computer device, such as Figure 6 As shown, the computer device 50 includes:

[0171] Processor 401 is configured to receive a key service request carrying a key modulus parameter;

[0172] The computer device 50 further includes: the key encapsulation device 40 mentioned above.

[0173] In some embodiments, the processor 401 is also used to receive a key service request carrying a key modulus parameter sent by an external control module through a bus interface, read the input data from the storage module, and expand the bit length of the input data to a processing bit width corresponding to the modulus parameter.

[0174] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned steps / processes does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0175] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0176] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0177] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0178] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0179] Those skilled in the art will understand that all or part of the steps of the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, and other media that can store program codes.

[0180] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0181] The above is only an implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A key encapsulation method, characterized in that: The key encapsulation method comprises: The input data read from the storage module is shifted by a shifter according to the obtained key modulus parameter, wherein the key modulus parameter refers to the parameter used for compression operation in the Kyber algorithm; The intermediate data is obtained by adding the shifted input data and the fixed value through the adder; Using a shifter and an adder to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result; The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

2. The key encapsulation method according to claim 1, wherein: The shifting process of the input data read from the storage module according to the obtained key modulus parameter by the shifter includes: When the key modulus parameter is a first type parameter, using a shifter to left-shift the input data by a first preset number of bits; When the key modulus parameter is a second type parameter, using a shifter to left-shift the input data by a second preset number of bits; The first preset number of bits and the second preset number of bits are determined according to the bit length of the key modulus parameter, and the value range of the first type of parameters is smaller than that of the second type of parameters.

3. The key encapsulation method according to claim 2, wherein: The step of adding the shifted input data and the fixed value by an adder to obtain intermediate data includes: When the key modulus parameter is a first type parameter, selecting a first fixed value by an adder to perform an addition operation to obtain intermediate data, where the first fixed value is an integer multiple of the first type parameter and is associated with the number of shift bits; When the key modulus parameter is a second type parameter, an adder is used to select a second fixed value for addition operation to obtain intermediate data, where the second fixed value is an integer multiple of the second type parameter and is associated with the number of shift bits.

4. The key encapsulation method according to any one of claims 1 to 3, characterized in that: in, The key modulus parameter is carried in the key service request received by the processor; The method of using the shifter and the adder to perform a preset addition, subtraction and position combination operation on the intermediate data to obtain a combination operation result includes: adding, by an adder, a result of left-shifting the intermediate data by a third preset number of bits by the shifter and a result of left-shifting the intermediate data by a fourth preset number of bits by the shifter to obtain an addition result; subtracting, by an adder, a result of right-shifting the intermediate data by a fifth preset number of bits by the shifter from a result of right-shifting the intermediate data by a sixth preset number of bits by the shifter to obtain a subtraction result; The processor is configured to combine the addition result and the subtraction result to obtain a combined operation result.

5. The key encapsulation method according to any one of claims 1 to 3, characterized in that: The key encapsulation module is used to encapsulate the high-order data extracted from the combined operation result into a compressed ciphertext key for output, including: Determining the number of truncated bits according to the bit length of the key modulus parameter using a key encapsulation module; Extracting high-order bits of the truncated number of bits from the combination operation result using a key encapsulation module; The key encapsulation module is used to map the high-order bits into a compressed data format that complies with the preset standard to obtain a ciphertext key for output.

6. The key encapsulation method according to claim 4, wherein: The fixed value is generated by the following steps: A second addition result is obtained by using an adder to shift the base generated based on the key modulus parameter to the left by a seventh preset bit number and then adding the shifted bit to the offset; wherein the base is selected by the processor according to the category of the key modulus parameter; and the processor adjusts the second addition result to match the bit width of the intermediate data to obtain a fixed value.

7. The key encapsulation method according to any one of claims 1 to 3, characterized in that: The steps of the displacement processing include: Selecting a displacement path corresponding to the key modulus parameter through a multiplexer; Using a shifter to dynamically adjust the input data according to the shift path; The processor is used to cache the adjusted input data into an intermediate register.

8. A key encapsulation device, characterized in that: The key encapsulation device comprises: A shifter, configured to perform shift processing on the input data read from the storage module according to the obtained key modulus parameter, wherein the key modulus parameter refers to the parameter used for compression operation in the Kyber algorithm; An adder, used to add the shifted input data to a fixed value to obtain intermediate data; The shifter and adder are further used to perform preset addition, subtraction and position combination operations on the intermediate data to obtain a combination operation result; The key encapsulation module is used to encapsulate the high-order data extracted from the combination operation result into a compressed ciphertext key for output.

9. A computer device, characterized in that: include: A processor, configured to receive a key service request carrying a key modulus parameter; The computer device further comprises: the key encapsulation device according to claim 8.

10. The computer device according to claim 9, wherein: The processor is also used to receive a key service request carrying a key modulus parameter sent by an external control module through a bus interface, read the input data from the storage module, and expand the bit length of the input data to a processing bit width corresponding to the key modulus parameter.

Images