ML-DSA module reduction method and device based on improved Barrett reduction

Abstract

The invention provides an ML-DSA module reduction method and device based on improved Barrett reduction, and the method comprises the steps: dividing an input signal into a first preset bit signal and a second preset bit signal according to the bit width, and carrying out the shift addition operation of the first preset bit signal, so as to generate a middle quotient value; generating a first preset bit remainder based on the intermediate value; performing splicing processing on the first preset bit remainder and the second preset bit signal to generate an intermediate remainder; and performing a correction operation on the intermediate remainder to output a remainder result. According to the operation method, an input signal is processed in a high-order mode and a low-order mode, and the bit width participating in multiplication and shifting operation is reduced; according to the method, a precomputation constant is optimized, the number of times of addition is reduced, and wide bit operation in a critical path is eliminated by means of segmentation processing and register insertion, so that the critical path is shortened, and the maximum operation frequency of a system clock is improved; and through error analysis and range limitation, the correctness of a module reduction result is ensured.

Description

Technical Field

[0001] The present application relates to the technical field of cryptography, and in particular to an ML-DSA modular reduction method and device for improving Barrett reduction. Background Art

[0002] Post-quantum cryptography refers to a new generation of public-key cryptography systems that can withstand attacks from quantum computers. Their security relies on the fact that non-traditional mathematical problems (such as lattice problems, multivariable equations, and hash functions) are NP-hard, ensuring their security even in quantum computing environments. For example, classical public-key cryptography algorithms (such as RSA and ECC) rely on large integer factorization or discrete logarithm problems. Quantum computers can crack such problems in polynomial time using Shor's algorithm, putting existing public-key cryptography systems at risk of failure. The security of the lattice-based digital signature scheme Dilithium is based on the noisy learning problem (LWE) and the short integer solution problem (SIS), which involve high-frequency modular reduction operations on polynomial rings.

[0003] Modular reduction refers to the computational process of mapping integers to a modulus range. Taking the Dilithium algorithm as an example, its fixed modulus is q = 8380417, and numbers greater than q (usually the results of 46-bit integer multiplications) need to be quickly reduced. Because the modulus value is fixed, there are two classic general algorithms: the Barrett algorithm and the Montgomery algorithm. The Barrett algorithm converts modular operations into multiplication and shift operations by precalculating the constant λ, while the Montgomery algorithm avoids explicit division through base conversion. The basic idea of ​​both algorithms is to convert division into multiplication to reduce computational complexity, but both require two multiplications and multiple large-bit-width additions.

[0004] It is noted that the structure of the modulus of the Dilithium algorithm is special. This patent makes full use of its structural characteristics. Starting from the Barrett algorithm, through clever formula transformation, it further derives an ultra-low complexity modular reduction algorithm and designs an ultra-low latency and low complexity hardware architecture. It has been significantly optimized compared to the current existing solutions and is expected to be widely promoted and applied in practice. Summary of the Invention

[0005] The present application provides an ML-DSA modular reduction method and apparatus based on improved Barrett reduction to solve the problems of increased resource consumption and reduced computational efficiency.

[0006] In a first aspect, the present application provides an ML-DSA modular reduction method based on improved Barrett reduction, comprising:

[0007] receiving an input signal, and dividing the input signal into a first preset bit signal and a second preset bit signal according to a bit width;

[0008] performing a shift-and-add operation on the first preset bit signal to generate an intermediate quotient value;

[0009] generating a first preset remainder based on the intermediate quotient value;

[0010] performing a splicing process on the first preset position remainder and the second preset position signal to generate an intermediate remainder;

[0011] A correction operation is performed on the intermediate remainder to output a remainder result.

[0012] In some feasible embodiments, performing a shift-and-add operation on the first preset bit signal to generate an intermediate quotient value includes:

[0013] performing a right shift operation on the first preset bit signal by a first digit to generate a first intermediate value, a second intermediate value, and a third intermediate value, wherein the first intermediate value is the intermediate value of the first digit shifted right, the second intermediate value is the intermediate value of the second digit shifted right, and the third intermediate value is the intermediate value of the third digit shifted right;

[0014] The first intermediate value, the second intermediate value, and the third intermediate value are accumulated and then truncated to generate the intermediate quotient value.

[0015] In some feasible embodiments, generating a first preset remainder based on the intermediate quotient value includes:

[0016] Shifting the intermediate quotient value left by a first preset number of digits to obtain an intermediate term;

[0017] Performing a subtraction and addition combination on the intermediate term and the intermediate quotient value to obtain a modified quotient product term;

[0018] A first preset bit remainder is generated, where the first preset bit remainder is a difference between the first preset bit signal and the corrected quotient product term.

[0019] In some feasible embodiments, performing a splicing process on the first preset bit remainder and the second preset bit signal to generate an intermediate remainder includes:

[0020] Shifting the first preset digit remainder left by a second preset digit to generate an extended first preset digit item;

[0021] After superimposing the extended first preset position item and the second preset position signal, correcting the intermediate quotient value by compensation subtraction;

[0022] The intermediate remainder is outputted according to the corrected intermediate quotient value.

[0023] In some feasible embodiments, performing a correction operation on the intermediate remainder to output a remainder result includes:

[0024] detecting a sign bit of the intermediate remainder;

[0025] If the sign bit is 1, superimposing the target modulus on the intermediate remainder to output a remainder result, wherein the remainder result is greater than 0 and less than the target modulus;

[0026] If the sign bit is 1, and the intermediate remainder is greater than 0 and less than the target modulus, a remainder result is output, where the remainder result is a third preset bit value of the intermediate remainder.

[0027] In some feasible embodiments, performing a correction operation on the intermediate remainder to output a remainder result includes:

[0028] If the sign bit is 0, detecting a third preset bit value of the intermediate remainder;

[0029] If the third preset bit value is greater than or equal to the target modulus and less than twice the target modulus, output a remainder result, where the remainder result is the fourth preset bit value of the intermediate remainder superimposed on the complement of the target modulus;

[0030] If the highest bit of the third preset bit value is 1, or the third preset bit value is greater than or equal to twice the target modulus, a remainder result is output, and the remainder result is the complement of the fourth preset bit value of the intermediate remainder superimposed on twice the target modulus.

[0031] In some feasible embodiments, performing a correction operation on the intermediate remainder to output a remainder result includes:

[0032] generating a control signal based on a logic judgment module, wherein the control signal is a signal generated in response to the logic judgment module generating at least two remainder results;

[0033] The control signal is input to the multiplexer to output a remainder result based on a priority rule, where the remainder result includes a first remainder result, a second remainder result, and a third remainder result. The priority rule is that the output priority of the first remainder result is greater than the output priority of the second remainder result, and the output priority of the second remainder result is greater than the output priority of the third remainder result.

[0034] In a second aspect, the present application provides an ML-DSA modular reduction device based on improved Barrett reduction, comprising: a preprocessing unit and an operation circuit;

[0035] The pre-processing unit is configured to receive an input signal; and divide the input signal into a first preset bit signal and a second preset bit signal according to the bit width;

[0036] The arithmetic circuit includes a shifter, an adder, a subtractor, and a first register;

[0037] The shifter and adder are used to perform a shift and addition operation on the first preset bit signal to generate an intermediate quotient value;

[0038] The subtractor is configured to generate a first preset bit remainder based on the intermediate quotient value;

[0039] The first register is used to store a first preset bit signal and a second preset bit signal, wherein the first preset bit signal is used to generate a first preset bit remainder, and the second preset bit signal is used to generate an intermediate remainder.

[0040] In some feasible embodiments, the operation circuit further includes a second register and a third register;

[0041] The second register is used to store the intermediate quotient value, and the third register is used to store the intermediate remainder.

[0042] As can be seen from the above technical solution, the present application provides an ML-DSA modular reduction method and device based on improved Barrett reduction, the method comprising: receiving an input signal and dividing the input signal into a first preset bit signal and a second preset bit signal according to the bit width; then performing a shift addition operation on the first preset bit signal to generate an intermediate quotient value; generating a first preset bit remainder based on the intermediate quotient value; performing a splicing process on the first preset bit remainder and the second preset bit signal to generate an intermediate remainder; performing a correction operation on the intermediate remainder to output a remainder result. The operation method divides the input signal into high and low bits for processing, reducing the bit width involved in multiplication and shift operations; utilizing the mathematical properties of the specific modulus 8380417 of the Dilithium algorithm, optimizing the pre-calculated constants in the Barrett algorithm, reducing the number of additions from four to two; and eliminating wide-bit operations in the critical path by segmented processing and inserting registers, thereby shortening the critical path and increasing the maximum operating frequency of the system clock; and ensuring the correctness of the final modular reduction result through error analysis and range limitation mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solution of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0044] Figure 1A schematic flow chart of the method provided in the embodiment of the present application;

[0045] Figure 2 A schematic diagram of the structure of the reduction module provided in an embodiment of the present application;

[0046] Figure 3 A schematic diagram of the structure of the arithmetic circuit provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following embodiments are described in detail, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numbers in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following embodiments are not intended to represent all possible implementations consistent with the present application. They are merely examples of systems and methods consistent with certain aspects of the present application, as detailed in the claims.

[0048] Traditional encryption algorithms are mainly based on large integer factorization problems and discrete logarithm problems. These problems are difficult to solve in the traditional computing field, but quantum computers can crack these difficult problems within a polynomial time range, resulting in traditional cryptographic algorithms no longer being secure, and post-quantum cryptography came into being.

[0049] The Dilithium algorithm is one of the standardized schemes for post-quantum cryptography. Its security relies on learning with errors and solving short integer problems. It is highly resistant to quantum computer attacks and can effectively ensure data security in the quantum computing era. Its core computation involves multiplication and modular reduction operations over a polynomial ring. Modular reduction is used to compress intermediate results back into the modular domain, maintaining algorithm correctness and ciphertext decoding consistency.

[0050] The Dilithium algorithm uses a fixed prime modulus q = 8380417 in its implementation and requires frequent operations mod q on intermediate results. Compared to other computations, modular operations involve division, which requires constant trial and error, consumes significant hardware resources, and cannot be pipelined. Therefore, modular reduction is a key factor affecting its operational efficiency and hardware implementation complexity. In practical applications, a typical modular reduction scenario is the fast reduction of a 46-bit unsigned integer modulo 8380417. This operation occurs frequently in polynomial multiplication and sampling operations for signing and verification, becoming a core optimization bottleneck.

[0051] The Dilithium algorithm is a post-quantum cryptographic digital signature algorithm that is resistant to quantum computer attacks. Modular reduction is a very resource-intensive part of the Dilithium algorithm because it requires traditional division, which involves multiple trial-and-error iterations and cannot be accelerated using hardware parallelization.

[0052] The Montgomery algorithm and the Barrett algorithm are the mainstream schemes for modular reduction in the field of cryptography. The traditional Barrett algorithm is as follows:

[0053]

[0054] 2:r=cq·p

[0055] 3:if r≥p then

[0056] 4:r=rp,q=q+1

[0057] 5:endif

[0058]

[0059] From the above algorithm, we can see that the traditional Barrett algorithm first finds the quotient, then finds the corresponding remainder, and finally judges the remainder and reduces it to the correct result.

[0060] Among them, calculating the quotient is the core of the Barrett algorithm. In the process of calculating the quotient, it is necessary to precalculate the constant There are five 1s in total when the constant is pre-calculated using binary representation. This means that four shift additions are required in the first step of the algorithm, resulting in the consumption of a large amount of hardware resources such as lookup tables.

[0061] And in the second step of the algorithm, q·p needs to be calculated, where the modulus p=8380417=2 23 -2 13 +1. If shift addition is used for calculation, the modulus q needs to be shifted left by 23 bits. At this time, the required data bit width is 47 bits, which takes up a lot of hardware resources. In addition, the addition chain of the 47-bit adder is too long, and the base critical path is too long, so the frequency of the system clock is reduced.

[0062] To address the above-mentioned problems of increased hardware resource consumption and reduced computational efficiency, some embodiments of the present application provide an ML-DSA modular reduction method based on improved Barrett reduction. The method divides the input signal into high bits and low bits for processing, thereby reducing the bit width involved in multiplication and shift operations. The method utilizes the mathematical properties of the specific modulus 8380417 of the Dilithium algorithm to optimize the pre-calculated constants in the Barrett algorithm, reducing the number of additions from four to two. The method also eliminates wide-bit operations in the critical path through segmented processing and register insertion, thereby shortening the critical path and increasing the maximum operating frequency of the system clock. The method also ensures the correctness of the final modular reduction result through error analysis and range limitation mechanisms.

[0063] like Figure 1As shown, the method includes the following steps:

[0064] S100: Receive an input signal, and divide the input signal into a first preset bit signal and a second preset bit signal according to the bit width.

[0065] The input signal c is a 46-bit binary integer, which is divided into a first preset bit signal and a second preset bit signal according to the bit width. The first preset bit signal c1 is the upper 33 bits, and the second preset bit signal c0 is the lower 13 bits. The division logic is based on the factorization of the target modulus q, that is, q = 8380417. The upper bit segment is used for quotient calculation, and the lower bit segment is used for remainder splicing, simplifying the modular reduction operation.

[0066] The operand of the Dilithium algorithm is 46 bits, denoted as c. Using the property of the Dilithium algorithm's specific modulus 8380417=1023*2^13+1, it is split into the upper 33 bits c1 and the lower 13 bits c0 bit by bit. Then, using the remainder division method, we can get:

[0067]

[0068]

[0069] It should be noted that in the first step of this algorithm, that is, when the modulus changes from q to q-1, because the modulus is 8380417, when the input signal c satisfies c≥8380417×8380416, the quotient q1 will be 1 greater than the correct result, resulting in a certain change in the reduction range.

[0070] S200: Perform a shift-addition operation on the first preset bit signal to generate an intermediate quotient value.

[0071] After the above processing, only the At this time, using the Barrett algorithm, since c1 is 33 bits, the pre-calculated constant At this point, the binary representation of λ contains only three 1s, meaning only two additions are required, reducing the number of additions in the first step from four to two. Using the precalculated constant λ, we then calculate the intermediate quotient q1.

[0072] In some embodiments, the first preset bit signal is right-shifted by a first order to generate a first intermediate value, a second intermediate value, and a third intermediate value; the first intermediate value, the second intermediate value, and the third intermediate value are accumulated and then truncated to generate the intermediate quotient value.

[0073] Refer to the following formula to calculate the middleman value:

[0074]

[0075] The first intermediate value A is the intermediate value of the first digit shifted right, the second intermediate value is the intermediate value of B shifted right by the second digit, and the third intermediate value C is the intermediate value of the third digit shifted right.

[0076] The first count is three times, that is, the shifter group performs three right shifts on c1. The first right shift of 30 bits generates the first intermediate value, that is, A=c1>>30; the second right shift of 20 bits generates the second intermediate value, that is, B=c1>>20; the third right shift of 10 bits generates the third intermediate value, that is, C=c1>>10.

[0077] The adder chain accumulates A, B, and C in sequence to obtain the intermediate result Sum = A + B + C. The truncation module rounds Sum, that is, discards the lower 10 bits, and outputs the intermediate quotient value q1.

[0078] It should be noted that arithmetic right shift is integer division, and the decimal part will be truncated, that is, rounded down, which will produce a certain error. The error of each term does not exceed 1, and the Barrett algorithm itself has an error that causes the quotient to have an error of 1, so the final total error is:

[0079] ε shift <3;

[0080] ε max =ε shift +ε baeertt <4;

[0081] According to ε max , the reduction range of the final remainder can be determined.

[0082] Replacing traditional multipliers with three shift-and-add operations reduces hardware resource consumption and the number of nodes in the computation graph, simplifying complexity assessment. Combining shift-and-accumulate with truncation ensures that the quotient error is below a preset threshold under limited hardware resources, avoiding multiple iterations and corrections.

[0083] S300: Generate a first preset remainder based on the intermediate quotient value.

[0084] The intermediate quotient value q1 is the quotient of the remainder division. The first preset remainder r1 can be obtained by subtracting the quotient from the dividend. In some embodiments, the intermediate quotient value is left-shifted by the first preset bit number to obtain the intermediate term, and then the intermediate term and the intermediate quotient value are combined by subtraction and addition to obtain a corrected quotient value product term to generate a first preset remainder. The first preset remainder is the difference between the first preset bit signal and the corrected quotient value product term.

[0085] Calculate the remainder of the high-order operand c1 to 1023, that is, the first preset remainder r1, by the following formula:

[0086] r1=c1-1023·q1

[0087] =c1-(1024-1)·q1

[0088] =c1-q1<<10+q1

[0089] =c1-q1<<10+q1

[0090] First, c1 is decomposed into q1 and r1 using remainder division, where 0≤r1<1023. 1023 is then converted to 1024-1. 1024·q1 is equivalent to shifting q1 left by 10 bits, the first preset number of bits. This can be quickly implemented using a hardware shifter, requiring only one shift operation and one addition or subtraction, reducing computational complexity.

[0091] In the algorithm, the calculation of q1 may not be an exact value, but may contain a certain error. For example, due to approximate calculation or bit operation limitations, the error range of q1∈[q 真实 -3,q 真实 ), that is, the actual calculated q1 may be greater than q 真实 At most it is smaller than 3, so the error range is [0,4).

[0092] For example, the true remainder is r 真实 =c1-1023·q 真实 , and 0≤r 真实 <1023. When there is an error in q1, the actual calculated remainder is: r1 = c1-1023·(q 真实 -δ)(δ∈[0,4)), after expansion: r1=(c1-1023·q 真实 )+1023·δ=r 真实 +1023·δ, due to r 真实 <1023 and δ<4, the remainder range becomes: 0≤r1<1023+1023·3=4×1023, that is: r1∈[0,4×1023).

[0093] If r1 = c1 - 1023 q1 is used directly, the remainder may exceed 1023. It is sufficient to keep r1 in the range [0, 4*1023). No correction is required. Only the intermediate remainder R needs to be corrected at the end.

[0094] The intermediate quotient value q1 is shifted left by 10 bits to generate the intermediate term D, and then the D-q1 operation is performed to generate the corrected quotient product term. This is achieved through a combination of a subtractor and an adder to eliminate the approximation error in the Barrett reduction. The generated first preset remainder r1 is the difference between c1 and the corrected term, which is used for splicing processing.

[0095] S400: performing a splicing process on the first preset position remainder and the second preset position signal to generate an intermediate remainder.

[0096] The intermediate remainder R can be obtained by shifting, splicing, and adding and subtracting operations. In some embodiments, the first preset-digit remainder is shifted left by a second preset-digit number to generate an extended first preset-digit item.

[0097] After superimposing the extended first preset position item and the second preset position signal, correcting the intermediate quotient value by compensation subtraction;

[0098] The intermediate remainder is outputted according to the corrected intermediate quotient value.

[0099] The second preset number of bits is 13 bits. The high-order remainder r1 is shifted left by 13 bits to generate an extended high-order item, that is, the first preset bit item is extended. The low-order part c0 of the input signal is superimposed on the extended high-order item to form a preliminary remainder basis, that is, the corrected intermediate quotient value. The intermediate quotient value q1 is subtracted from the preliminary remainder basis to generate an intermediate remainder.

[0100] r1·2 13 It is converted into a low-cost left shift operation, avoiding the use of multipliers. C0 splicing and Q1 compensation are completed synchronously through independent adders, shortening the critical path.

[0101] S500: Perform a correction operation on the intermediate remainder to output a remainder result.

[0102] Reducing R. The traditional Barrett algorithm reduces the range to [0, 2q). Shifting and truncating will cause the quotient to decrease, with a maximum error of 2, and the reduction range becomes [0, 4q). Since the modulus changes from q to q-1, the quotient increases, with an error of 1. Therefore, the final reduction range becomes [-q, 3q). The reduction is performed using the following algorithm:

[0103] Input:A 26-bit operand R

[0104] 1:if R

[25] ==1then

[0105] 2:result=R+q

[0106] 3:else if lower_24_bits_of(R)≥q andlower_24_bits_of(R)<2*q then

[0107] 4:result=lower_23_bits_of(R)+q complement

[0108] 5:elseif R

[24] =1orlower_24_bits_of(R)>=2·q then

[0109] 6:result=lower_23_bits_of(R)+2·q complement

[0110] 7:else then

[0111] 8:result=lower_23_bits_of(R)

[0112] 9:end if

[0113] Output:The 23-bit result∈[0,q)

[0114] In some embodiments, the sign bit of the intermediate remainder is detected, and the highest bit (R

[25] ) of the intermediate remainder R is used as the sign bit to determine the numerical range of R.

[0115] If the sign bit is 1, the intermediate remainder is superimposed on the target modulus to output the remainder result. The remainder result is greater than 0 and less than the target modulus. The remainder result is R+q. The negative remainder is corrected to the positive number range [0,q). The subtraction is converted into addition through hardware-friendly complement operation to avoid the use of wide-bit subtractors.

[0116] If the sign bit is 1 and the intermediate remainder is greater than 0 and less than the target modulus, the remainder result is output, which is the third preset bit value of the intermediate remainder. The third preset bit value is the highest bit (R

[23] ) of the lower 24 bits of the intermediate remainder R, which is used to assist in determining whether R exceeds the target modulus q. The output remainder result is lower_23_bits_of(R). By directly truncating the upper 3 bits to constrain the output bit width to 23 bits, it ensures that the result is always less than q.

[0117] If the sign bit is 0, in some embodiments, detecting a third predetermined bit value of the intermediate remainder;

[0118] If the third preset bit value is greater than or equal to the target modulus and less than twice the target modulus, output a remainder result, where the remainder result is the fourth preset bit value of the intermediate remainder superimposed on the complement of the target modulus;

[0119] If the highest bit of the third preset bit value is 1, or the third preset bit value is greater than or equal to twice the target modulus, a remainder result is output, and the remainder result is the complement of the fourth preset bit value of the intermediate remainder superimposed on twice the target modulus.

[0120] The third preset bit value is lower_24_bits_of(R), and the fourth preset bit value is lower_23_bits_of(R). If the third preset bit value is greater than or equal to the target modulus, the high-bit overflow is corrected, the lower 23 bits of R are taken and the complement of q is superimposed, and the remainder result is lower_23_bits_of(R)+q.complement, that is, the remainder result is Rq, and subtraction is implemented through the complement operation.

[0121] If lower_24_bits_of(R)=1 or lower_24_bits_of(R)≥2q, the second-highest-order overflow correction is performed. The lower 23 bits of R are taken and 2q's complement is added. The remainder result is lower_23_bits_of(R)+2q.complement, that is, the remainder result is =R-2q.

[0122] All possible error conditions are covered through four layers of conditional branches, namely negative numbers, q~2q, 2q~3q, and legal values, ensuring that the final result falls in [0,q).

[0123] It should be noted that in Verilog language, variables are defined as unsigned numbers. Therefore, when R∈[-q,0), R will be interpreted as a positive number using the two's complement. Therefore, the target modulus can be directly added. When R∈[q,2q) or R∈[2q,3q), the subtraction of large numbers can be avoided by using the two's complement method, thereby saving some resources.

[0124] like Figure 2 As shown, logic contention is avoided by the reduction module, which includes a logic judgment module, a priority encoder, and a multiplexer. The logic judgment module determines the range of R and sends the output signal to the priority encoder. Because the output signal of the logic judgment module is not a mutually exclusive priority judgment structure, a priority encoder is added to process multiple Boolean conditions and send the output to the control signal of the four-to-one multiplexer. The final reduction result is obtained by controlling the output of the four-to-one multiplexer.

[0125] The overall process of the improved Barrett algorithm is as follows:

[0126] Input:An operand c∈[0,2 46 )

[0127] 1:c1=c[45:13], c0=c[12:0]

[0128] 2:q1=c1>>30+c1>>20+c1>>10

[0129] 3:r1=c1-q1<<10+q1

[0130] 4: R = r1 << 13 + c0 - q1

[0131] 5: result = MOD(R)

[0132] Output: result = c mod 8380417

[0133] The input signals of the reduction module are R[25:0], R

[25] , R

[24] , and R[23:0]. Among them, R[25:0] is a 26-bit intermediate remainder output by the previous remainder generation module; R

[25] is the remainder sign bit, where 1 represents a negative number and 0 represents a non-negative number; R

[24] is the second highest bit, used to assist in judging whether the remainder range exceeds the target modulus q; R[23:0] is the lower 24 bits of the remainder, which participate in subsequent correction calculations.

[0134] The logic judgment module generates 4 correction conditions according to the sign bit (R

[25] ) and the numerical range (R

[24] and R[23:0]) of the input remainder.

[0135] Condition 1, R

[25] = 1, the remainder is negative, and the target modulus q needs to be added, that is, R + q; Condition 2, R ≥ q and R < 2q, the remainder exceeds the target modulus but does not exceed twice the target modulus, and the target modulus needs to be subtracted, that is, R - q; Condition 3, R ≥ 2q and R < 3q, the remainder exceeds twice the target modulus but does not exceed three times the target modulus, and twice the target modulus needs to be subtracted, that is, R - 2q; Condition 4, R < q, the remainder is already legal, and R is directly output.

[0136] In some embodiments, based on the logic judgment module, a control signal is generated, and the control signal is a signal generated in response to the logic judgment module generating at least two remainder results;

[0137] The control signal is input to the multiplexer to output the remainder result based on the priority rule. The remainder result includes the first remainder result, the second remainder result, and the third remainder result. The priority rule is that the output priority of the first remainder result is greater than the output priority of the second remainder result, and the output priority of the second remainder result is greater than the output priority of the third remainder result.

[0138] When multiple conditions are simultaneously satisfied, a control signal is generated, and the priority encoder sorts the above conditions by priority. Among them, Condition 1 > Condition 3 > Condition 2 > Condition 4, and a 2-bit control signal Sel[1:0] is generated. If the control signal is Sel = 00, Condition 1 is selected; if the control signal is Sel = 01, Condition 3 is selected; if the control signal is Sel = 10, Condition 2 is selected; if the control signal is Sel = 11, Condition 4 is selected.

[0139] The priority encoder is implemented by a combinational logic circuit to ensure that a unique correction path is selected according to preset rules when multiple conditions conflict.

[0140] Then, a four-to-one multiplexer is used to select the corresponding correction result output according to Sel[1:0]. Input channel 0: R+8380417 (condition 1 correction); input channel 1: R-2*8380417 (condition 3 correction); input channel 2: R-8380417 (condition 2 correction); input channel 3: R (condition 4 direct output).

[0141] For example, if the input remainder R=-5000, the binary sign bit R

[25] =1, R

[25] =1 is detected, trigger condition 1, priority encoding generates Sel=00, multiplexing selection: output R+8380417=8380417-5000=8375417 (satisfying 0≤result <q)。

[0142] By using two-level checks on the sign bit and the next-highest bit, conditional logic is simplified to priority encoding, reducing the number of nodes and dependencies in the computational graph. A multiplexer independently handles the selection of corrected paths, separating the adder / complement pre-storage from conditional checks, improving hardware resource utilization.

[0143] Centralizing multi-conditional judgments into the encoder module reduces control signal interference in the data path and simplifies the dynamic computation graph structure. The target modulus and complement values ​​are pre-stored in registers, allowing direct call and superposition of the results to avoid real-time computation delays. The sign bit directly drives the priority encoder to generate control signals, simplifying complex conditional logic into hardware-friendly operations and reducing the complexity and coupling of the dynamic computation graph.

[0144] According to the above-mentioned ML-DSA modular reduction method based on improved Barrett reduction, some embodiments of the present application further provide an ML-DSA modular reduction device based on improved Barrett reduction, comprising: a preprocessing unit and an operation circuit;

[0145] The pre-processing unit is configured to receive an input signal; and divide the input signal into a first preset bit signal and a second preset bit signal according to the bit width;

[0146] like Figure 3 As shown, the operation circuit includes a shifter, an adder, a subtractor, and a first register;

[0147] The shifter and adder are used to perform a shift and addition operation on the first preset bit signal to generate an intermediate quotient value;

[0148] The subtractor is configured to generate a first preset bit remainder based on the intermediate quotient value;

[0149] The first register is used to store a first preset bit signal and a second preset bit signal, wherein the first preset bit signal is used to generate a first preset bit remainder, and the second preset bit signal is used to generate an intermediate remainder, so as to ensure timing alignment.

[0150] The input signal processed by the pre-processing unit is divided into a first preset bit signal C1 and a second preset bit signal C0 , C1 is a 33-bit high-bit input signal, and C0 is a 13-bit low-bit input signal.

[0151] The shifter (>>20, >>10, >>30) performs a shift operation on the input signal and adds the results of right shifting C1 by 10 bits, 20 bits, and 30 bits to generate a partial sum to simplify the multiplication operation.

[0152] The adder (+) adds the right-shifted results of C1 (>>20, >>10, >>30) to generate a quotient (q1).

[0153] The subtractor (-) calculates a first preset remainder r1 = c1 - 1023q1 (1023 = 1024 - 1 = 1 << 10 - 1).

[0154] The first register stores C1 and C0 for subsequent generation of the intermediate remainder R.

[0155] For example, the input C1 is right shifted by 20, 10, and 30 bits, and the three are added to get the quotient q1. r1 and c0 are spliced, r1 is in the high bit and c0 is in the low bit, which is equivalent to r1*2 13 +c0, because r1 is placed in the high position, after splicing and subtracting q1, R is formed, which is the calculation completed in the second cycle.

[0156] To streamline data processing and eliminate critical paths, the operation is divided into two cycles. The first cycle calculates the quotient q1 and uses combinational logic to calculate the remainder r1. The second cycle calculates the remainder R and uses combinational logic to reduce R to obtain the correct output. During pipeline processing, registers temporarily store c1 and c0 to ensure data alignment.

[0157] In some embodiments, the operation circuit further includes a second register and a third register; the second register is used to store the generated quotient, and the third register is used to store the remainder output signal.

[0158] The second register, q1, stores the quotient (q1 = C1 >> 20 + C1 >> 10 + C1 >> 30), serving as the intermediate result of the first stage and used to generate r1. The third register, R, stores the temporary remainder, used for range determination in the next reduction step. The introduction of the second and third registers ensures the temporary storage and synchronization of intermediate data, resolves data contention issues in multi-cycle operations, and improves computational stability and scalability.

[0159] In order to verify the architecture proposed in this invention, the corresponding Verilog code was written and synthesized using the Vivado tool. The execution results are as follows:

[0160] Resource consumption LUT FF BRAM URAM DSP quantity 82 75 0 0 0

[0161] From the above results, we can see that the improved modular reduction module consumes very few resources, and the area after using DC synthesis is also better than the traditional Barrett algorithm. At the same time, it also cuts off the critical path, increases the clock operating frequency, and thus improves performance.

[0162] As can be seen from the above technical solution, the present application provides an ML-DSA modular reduction method and device based on improved Barrett reduction, the method comprising: receiving an input signal and dividing the input signal into a first preset bit signal and a second preset bit signal according to the bit width; then performing a shift addition operation on the first preset bit signal to generate an intermediate quotient value; generating a first preset bit remainder based on the intermediate quotient value; performing a splicing process on the first preset bit remainder and the second preset bit signal to generate an intermediate remainder; performing a correction operation on the intermediate remainder to output a remainder result. The operation method divides the input signal into high and low bits for processing, reducing the bit width involved in multiplication and shift operations; utilizing the mathematical properties of the specific modulus 8380417 of the Dilithium algorithm, optimizing the pre-calculated constants in the Barrett algorithm, reducing the number of additions from four to two; and eliminating wide-bit operations in the critical path by segmented processing and inserting registers, thereby shortening the critical path and increasing the maximum operating frequency of the system clock; and ensuring the correctness of the final modular reduction result through error analysis and range limitation mechanisms.

[0163] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the overall concept of this application and do not constitute a limitation on the scope of protection of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without expending creative work shall fall within the scope of protection of this application.

Claims

1. An ML-DSA modular reduction method based on improved Barrett reduction, characterized in that: include: receiving an input signal, and dividing the input signal into a first preset bit signal and a second preset bit signal according to a bit width; performing a shift-and-add operation on the first preset bit signal to generate an intermediate quotient value; generating a first preset remainder based on the intermediate quotient value; performing a splicing process on the first preset position remainder and the second preset position signal to generate an intermediate remainder; A correction operation is performed on the intermediate remainder to output a remainder result.

2. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 1, characterized in that: The performing a shift-and-add operation on the first preset bit signal to generate an intermediate quotient value includes: performing a right shift operation on the first preset bit signal by a first digit to generate a first intermediate value, a second intermediate value, and a third intermediate value, wherein the first intermediate value is the intermediate value of the first digit shifted right, the second intermediate value is the intermediate value of the second digit shifted right, and the third intermediate value is the intermediate value of the third digit shifted right; The first intermediate value, the second intermediate value, and the third intermediate value are accumulated and then truncated to generate the intermediate quotient value.

3. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 1, characterized in that: Generating a first preset remainder based on the intermediate quotient value includes: Shifting the intermediate quotient value left by a first preset number of digits to obtain an intermediate term; Performing a subtraction and addition combination on the intermediate term and the intermediate quotient value to obtain a modified quotient product term; A first preset bit remainder is generated, where the first preset bit remainder is a difference between the first preset bit signal and the corrected quotient product term.

4. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 1, characterized in that: The step of performing a splicing process on the first preset position remainder and the second preset position signal to generate an intermediate remainder includes: Shifting the first preset digit remainder left by a second preset digit to generate an extended first preset digit item; After superimposing the extended first preset position item and the second preset position signal, correcting the intermediate quotient value by compensation subtraction; The intermediate remainder is outputted according to the corrected intermediate quotient value.

5. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 1, characterized in that: The performing of a correction operation on the intermediate remainder to output a remainder result includes: detecting a sign bit of the intermediate remainder; If the sign bit is 1, superimposing the target modulus on the intermediate remainder to output a remainder result, wherein the remainder result is greater than 0 and less than the target modulus; If the sign bit is 1, and the intermediate remainder is greater than 0 and less than the target modulus, a remainder result is output, where the remainder result is a third preset bit value of the intermediate remainder.

6. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 5, characterized in that: The performing of a correction operation on the intermediate remainder to output a remainder result includes: If the sign bit is 0, detecting a third preset bit value of the intermediate remainder; If the third preset bit value is greater than or equal to the target modulus and less than twice the target modulus, output a remainder result, where the remainder result is the fourth preset bit value of the intermediate remainder superimposed on the complement of the target modulus; If the highest bit of the third preset bit value is 1, or the third preset bit value is greater than or equal to twice the target modulus, a remainder result is output, which is the complement of the fourth preset bit value of the intermediate remainder superimposed on twice the target modulus.

7. The ML-DSA modular reduction method based on improved Barrett reduction according to claim 6, characterized in that: The performing of a correction operation on the intermediate remainder to output a remainder result includes: generating a control signal based on a logic judgment module, wherein the control signal is a signal generated in response to the logic judgment module generating at least two remainder results; The control signal is input to the multiplexer to output a remainder result based on a priority rule, where the remainder result includes a first remainder result, a second remainder result, and a third remainder result. The priority rule is that the output priority of the first remainder result is greater than the output priority of the second remainder result, and the output priority of the second remainder result is greater than the output priority of the third remainder result.

8. An ML-DSA modular reduction device based on improved Barrett reduction, characterized in that: include: Preprocessing unit and operation circuit; The pre-processing unit is used to receive an input signal; And, dividing the input signal into a first preset bit signal and a second preset bit signal according to the bit width; The arithmetic circuit includes a shifter, an adder, a subtractor, and a first register; The shifter and adder are used to perform a shift and addition operation on the first preset bit signal to generate an intermediate quotient value; The subtractor is configured to generate a first preset bit remainder based on the intermediate quotient value; The first register is used to store a first preset bit signal and a second preset bit signal, wherein the first preset bit signal is used to generate a first preset bit remainder, and the second preset bit signal is used to generate an intermediate remainder.

9. The ML-DSA modular reduction device based on improved Barrett reduction according to claim 8, characterized in that: The operation circuit further includes a second register and a third register; The second register is used to store the intermediate quotient value, and the third register is used to store the intermediate remainder.

Images