Modular multiplier based on lookup table and modular multiplication operation method

Abstract

The invention relates to a modular multiplier based on a lookup table and a modular multiplication operation method, and the modular multiplier comprises a multiplier module which is used for carrying out the three-decomposition of a multiplier and a multiplicand, and obtaining a first polynomial of the multiplication operation of the multiplier and the multiplicand; performing four decomposition on a multiplier and a multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial; performing operation based on each second polynomial to obtain a product of multiplication operation of the multiplier and the multiplicand; the modular reduction module is connected with the multiplier module and is used for carrying out large-bit-width modular reduction operation based on the product and the modulus to obtain a first calculation result; and performing small-bit-width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result, thereby reducing the consumption of hardware resources and the complexity of circuit design, and effectively reducing the calculation time delay.

Description

Technical Field

[0001] The present application relates to the field of hardware computing technology, and in particular to a modular multiplier based on a lookup table and a modular multiplication operation method. Background Art

[0002] Privacy-preserving computing technology, with its "available but invisible" security feature, has garnered widespread attention from both academia and industry. However, performance bottlenecks have hindered its widespread adoption. While privacy-preserving computing protocols and algorithms vary, certain underlying fundamental operations, such as modular multiplication and modular addition, are widely and frequently used. The efficiency of modular multiplication significantly impacts the overall performance of privacy-preserving computing. Therefore, designing dedicated accelerators for atomic operations like modular multiplication is crucial for improving the performance of privacy-preserving computing. We propose a universal modular multiplication method based on a lookup table that is compatible with different elliptic curves used by different privacy-preserving computing protocols, achieving an excellent balance between design area and performance while ensuring high throughput.

[0003] Currently, the two most commonly used modular multiplication algorithms are Montgomery Modular Multiplication (MMM) and Barrett Modular Multiplication (BMM). The implementation methods for these two types of modular multiplication algorithms can be divided into two main categories: iterative modular multiplication and pipelined modular multiplication. In iterative modular multiplication, the multiplier is decomposed into a series of words, which are multiplied with the multiplicand in sequence in each iteration. This implementation allows for reuse of multiplication units, thus reducing hardware area. However, the multiple iterations mean that a large number of clock cycles are required to complete a modular multiplication operation, severely limiting throughput. In pipelined modular multiplication, the entire modular multiplication process is divided into three consecutive full-word multiplications, each of which is performed by three parallel full-word multipliers in three consecutive stages of the pipeline. Compared to iterative modular multiplication, pipelined modular multiplication achieves higher throughput but also incurs a significant design area overhead. Furthermore, Montgomery modular multiplication requires additional pre- and post-processing of the operands, namely, converting the multiplier and multiplicand from the integer domain to the Montgomery domain, and converting the modular multiplication result back from the Montgomery domain to the integer domain. For Barrett modular multiplication, this approach requires selecting appropriate pre-calculation parameters to prevent excessive errors introduced during the modular reduction process.

[0004] In the existing technology, when using the Karatsuba algorithm to split large-bit-width operands, multiple decompositions are required, which not only increases the consumption of hardware resources, but also increases the complexity of circuit design. The modular reduction calculation based on the lookup table has too long a delay and cannot be efficiently pipelined. Summary of the Invention

[0005] Based on this, it is necessary to provide a modular multiplier and modular multiplication method based on a lookup table to address the above technical problems.

[0006] In a first aspect, an embodiment of the present application provides a modular multiplier based on a lookup table, the modular multiplier comprising:

[0007] a multiplier module configured to perform a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; perform a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain respective second polynomials for each multiplication operation in the first polynomial; and perform an operation based on each second polynomial to obtain a product of the multiplication operation of the multiplier and the multiplicand;

[0008] A modular reduction module is connected to the multiplier module and is used to perform a large-bit-width modular reduction operation based on the product and the modulus to obtain a first calculation result; and perform a small-bit-width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

[0009] In one embodiment, the multiplier module includes:

[0010] a multiplier unit configured to perform a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; perform a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial for each multiplication operation in the first polynomial; and perform operations based on each second polynomial to obtain a result of each multiplication operation in the first polynomial;

[0011] a first operand generating unit, configured to generate a first number of operands based on the operation results of each multiplication operation in the first polynomial;

[0012] a first operand reorganization unit, configured to reorganize the first number of operands to generate a second number of operands;

[0013] The first adder unit is configured to accumulate a second number of operands to obtain a product of a multiplication operation of the multiplier and the multiplicand.

[0014] In one embodiment, the multiplier unit includes a plurality of groups of multipliers, each of the multipliers is used to calculate each multiplication operation in the first polynomial, and each of the multipliers includes:

[0015] a decomposition unit, configured to perform a four-factor decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial;

[0016] a plurality of first sub-multipliers, configured to perform multiplication operations on respective multiplication operations of the first bit width in the second polynomial to obtain a plurality of first products;

[0017] a plurality of second sub-multipliers, configured to perform multiplication operations on respective multiplication operations of a second bit width in the second polynomial to obtain a plurality of second products;

[0018] a second operand generation unit for generating a third number of operands based on the plurality of first products and the plurality of second products;

[0019] a second operand reorganization unit, configured to reorganize the third number of operands to generate a fourth number of operands;

[0020] The second adder unit is configured to accumulate the fourth number of operands to obtain operation results of each multiplication operation in the first polynomial.

[0021] In one embodiment, the multiplier unit further includes two groups of multiplexers,

[0022] The two groups of multiplexers are used to select, in a first clock cycle, each multiplication operation with a third bit width in the first polynomial as an input to the multiple groups of multipliers; and in a second clock cycle, select each multiplication operation with a fourth bit width in the first polynomial as an input to the multiple groups of multipliers.

[0023] In one embodiment, the modular reduction module includes:

[0024] a large bit width reduction unit, configured to split the product into two equal parts to obtain a high-order part and a low-order part; split the high-order part into a plurality of blocks, and construct a lookup table for each block based on the modulus; and determine a lookup result corresponding to each block based on the lookup table for each block;

[0025] a multi-operand accumulation unit, configured to accumulate the search results corresponding to the blocks and the low-order portion to obtain a first calculation result;

[0026] The small bit width reduction unit is configured to perform a small bit width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

[0027] In one embodiment, the multi-operand accumulation unit includes:

[0028] A CSA array is used to compress the search results corresponding to each block and the low-order portion to obtain a compressed result;

[0029] The tree adder is used to accumulate the compression results to obtain a first calculation result.

[0030] In one embodiment, the small bit width reduction unit is specifically configured to:

[0031] The first calculation result is split to obtain a first high-order part, and a lookup table of the first high-order part is constructed based on the modulus; based on the lookup table of the first high-order part, a lookup result of the first high-order part is determined; based on the lookup result of the first high-order part and the first calculation result, a modular multiplication result is obtained.

[0032] In one embodiment, the small bit width reduction unit is specifically configured to:

[0033] The first calculation result is split to obtain a first high-order part, and a lookup table for the first high-order part is constructed based on the modulus, wherein the lookup table for the first high-order part includes an initial lookup table, a first lookup table, and a second lookup table. An initial lookup result is determined based on the initial lookup table of the first high-order part, and a first lookup result of the first lookup table and a second lookup result of the second lookup table are determined based on the initial lookup result. A first difference between the first calculation result and the first lookup result is calculated, and a second difference between the first calculation result and the second lookup result is calculated. It is determined whether the second difference is a negative value; if so, the first difference is a modular multiplication result, otherwise, the second difference is a modular multiplication result.

[0034] In one embodiment, the multiplier module further includes:

[0035] A filling unit is used to fill the high bits of the multiplicand and the multiplier to match the bit width of the multiplier.

[0036] In a second aspect, an embodiment of the present application further provides a modular multiplication method based on a lookup table, applying the modular multiplier described in the first aspect above, the method comprising:

[0037] Using the multiplier module, performing a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; performing a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial for each multiplication operation in the first polynomial; and performing an operation based on each of the second polynomials to obtain a product of the multiplication operation of the multiplier and the multiplicand;

[0038] Using the modular reduction module, a large-bit-width modular reduction operation is performed on the product and the modulus to obtain a first calculation result; and a small-bit-width modular reduction operation is performed on the first calculation result and the modulus to obtain a modular multiplication result.

[0039] The above-mentioned modular multiplier and modular multiplication operation method based on the lookup table adopts a recursive decomposition method through the multiplier module to appropriately split the multiplier and the multiplicand with a large bit width, thereby reducing the number of decompositions, reducing the consumption of hardware resources and the complexity of circuit design, and effectively reducing the calculation delay by combining large-bit-width modular reduction operations and small-bit-width modular reduction operations through the modular reduction module.

[0040] The details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0042] Figure 1 This is a block diagram of a modular multiplier based on a lookup table according to one embodiment of the present application;

[0043] Figure 2 is a structural block diagram of a multiplier module according to one embodiment of the present application;

[0044] Figure 3 is a general architecture diagram of a modular multiplier based on a lookup table according to one embodiment of the present application;

[0045] Figure 4 This is a schematic diagram of the reorganization of operands decomposed by Karatsuba algorithm 3 in one embodiment of the present application;

[0046] Figure 5 This is a block diagram of the structure of a KO-4 multiplier according to one embodiment of the present application;

[0047] Figure 6 This is a diagram of the overall architecture of a KO-4 multiplier according to one embodiment of the present application;

[0048] Figure 7 This is a schematic diagram of the recursive decomposition of the Karatsuba algorithm in one embodiment of the present application;

[0049] Figure 8 Schematic diagram of reorganization of operands decomposed by Karatsuba algorithm 4 in some embodiments of the present application;

[0050] Figure 9 This is a structural block diagram of the modular reduction module in some embodiments of the present application. DETAILED DESCRIPTION

[0051] In order to more clearly understand the purpose, technical solutions and advantages of this application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0052] The embodiment of the present application provides a modular multiplier based on a lookup table, such as Figure 1 As shown, the modular multiplier includes: a multiplier module 10 and a modular reduction module 20.

[0053] The multiplier module 10 is configured to perform a three-factor decomposition on a multiplier and a multiplicand to obtain a first polynomial for the multiplication operation of the multiplier and the multiplicand; perform a four-factor decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial for each multiplication operation in the first polynomial; and perform operations based on each second polynomial to obtain a product of the multiplication operation of the multiplier and the multiplicand.

[0054] The modular reduction module 20 is connected to the multiplier module, and is used to perform a large-bit-width modular reduction operation based on the product and the modulus to obtain a first calculation result; and perform a small-bit-width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

[0055] The modular multiplier can support calculations of common bit widths, such as 128 bits, 256 bits, 384 bits, and 512 bits. This embodiment of the application will be explained using 256 bits as an example.

[0056] The multiplier module 10 as a whole uses the Karatsuba algorithm to decompose the multiplier and the multiplicand respectively. In the decomposition process, a two-layer recursive Karatsuba decomposition algorithm is used. First, the high bits of the multiplier and the multiplicand need to be filled with 0s to expand them to 258 bits. The resulting numbers are recorded as and Then and Using the Karatsuba algorithm (KO-3) with 3-decomposition, this process can be expressed as , , to , to 86 bits respectively. and The product can be expressed as the following expression (1), where n=86.

[0057]

[0058] Next, define two matrices and :

[0059]

[0060] Combine the above two matrices with and Multiply them and get and . , .

[0061]

[0062]

[0063] get and After that, the two are element-wise multiplied to obtain .in, , , " ” is the element-wise product operation.

[0064]

[0065] Then by introducing a predefined constant matrix With 1 basis vector , and compare them with the previously calculated After multiplying to calculate the Karatsuba algorithm after 3 decomposition and The product result of this calculation is the following expression (2).

[0066]

[0067]

[0068] Expanding expression (2) will transform the original expression (1) into expression (3).

[0069] Here, expression (3) means that the multiplier module 10 performs three-decomposition on the multiplier and the multiplicand to obtain the first polynomial for the multiplication operation of the multiplier and the multiplicand.

[0070]

[0071] Comparing Expression (1) and Expression (3), we can see that Expression (1) requires 9 multiplications, while Expression (3) only requires 6 multiplications. The change reduces the number of multiplications.

[0072] The multiplication operations required in expression (3) are , , , , as well as .

[0073] Then, the multipliers and multiplicands of the six multiplication operations required in expression (3) are decomposed into four parts respectively.

[0074] The first three multiplication operations required in expression (3) ( , , ) is an 86-bit wide multiplication, and the last three ( , as well as ) is an 87-bit multiplication. The latter three require an addition before multiplication. Based on this feature, the 86-bit multiplier can be pipelined and time-division multiplexed for the latter three, thus saving the hardware area required for the design. To enable multiplier reuse, the bit width of the three groups of multipliers is uniformly set to 88 bits. This is to ensure compatibility with 86-bit and 87-bit multiplication and to enable the Karatsuba algorithm to perform a 4-decomposition of the multiplicand and multiplier required for the multiplication operation in Expression (3).

[0075] Take one of the multiplication operations as an example to illustrate. First, the multiplicand and multiplier of the multiplication operation in expression (3) need to be filled with 0 in the high bit and expanded to 88 bits. The obtained numbers are recorded as and .right and The Karatsuba algorithm with 4 decomposition is used respectively, denoted as , , to , to Both are 22 bits. and The product can be written as the following expression (4), where m = 22.

[0076]

[0077] Same as Karatsuba algorithm of 3 decomposition, the coefficient matrix is ​​introduced and , and respectively with , Multiplying them, we get and .in, , .

[0078] ,

[0079] ,

[0080] Then and Perform element-wise product operation to get matrix .in, , .

[0081]

[0082] Similar to the Karatsuba algorithm of 3-decomposition, a predefined constant matrix is ​​introduced With 1 basis vector , and compare them with the previously calculated After multiplying to calculate the Karatsuba algorithm after 4 decomposition and The product result of the calculation is expressed as follows (5).

[0083]

[0084]

[0085] Expanding expression (5) will transform the original expression (5) into expression (6).

[0086] Here, expression (6) means that the multiplier module 10 performs a four-factor decomposition on the multiplier and the multiplicand of one of the multiplication operations in the first polynomial to obtain a second polynomial of the multiplication operation.

[0087]

[0088] Comparing Expression (4) and Expression (6), we can see that Expression (4) requires 16 multiplications, while Expression (6) only requires 10 multiplications. The change reduces the number of multiplications.

[0089] The multiplication operations required in expression (6) are , , , , , , , , , .

[0090] The modular multiplier based on the lookup table in the embodiment of the present application appropriately splits the multiplier and the multiplicand of large bit width by recursively decomposing the Karatsuba algorithm in the multiplier module, thereby reducing the number of decompositions, reducing the consumption of hardware resources and the complexity of circuit design, and effectively reducing the calculation delay by combining the large bit width modular reduction operation and the small bit width modular reduction operation through the modular reduction module.

[0091] In one embodiment, Figure 2 As shown, the multiplier module 10 includes a multiplier unit 11 , a first operand generation unit 12 , a first operand reorganization unit 13 , and a first adder unit 14 .

[0092] The multiplier unit 11 is used to perform a three-factor decomposition on the multiplier and the multiplicand to obtain a first polynomial for the multiplication operation of the multiplier and the multiplicand; perform a four-factor decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial for each multiplication operation in the first polynomial; and perform operations based on each second polynomial to obtain each operation result of each multiplication operation in the first polynomial.

[0093] The first operand generating unit 12 is configured to generate a first number of operands based on operation results of each multiplication operation in the first polynomial.

[0094] The first operand reorganization unit 13 is configured to reorganize the first number of operands to generate a second number of operands.

[0095] The first adder unit 14 is configured to accumulate the second number of operands to obtain a product of the multiplication operation of the multiplier and the multiplicand.

[0096] For details, see Figure 3 The overall architecture of the modular multiplier based on the lookup table is shown in FIG. The multiplier unit 11 first fills the high bits of the multiplier and the multiplicand with 0 and expands them to 258 bits to obtain and Then and Decomposition is performed using the Karatsuba algorithm of 3 decomposition. , , ~ ~ 86 bits respectively. Then the multiplication operations required in the first polynomial are , , , , 、 The numbers are input into KO-4 multiplier for further decomposition and calculation.

[0097] The multiplier unit 11 of the present application adopts the idea of ​​time division multiplexing. The multiplier unit 11 only needs 3 groups of 88-bit KO-4 multipliers. The specific manifestation of time division multiplexing of the multiplier is as follows: in the first clock cycle, two groups of multiplexers will select two groups of data with a bit width of 86 bits as the multiplier and multiplicand of the multiplier; in the second clock cycle, the two groups of multiplexers will select the 87-bit calculation result obtained after 1 additional addition as the input of the multiplier. Since an 88-bit wide multiplier is implemented, both inputs need to be filled with 0 in the high bit to match the bit width of the multiplier. In the third clock cycle, the three groups of 88-bit wide KO-4 multipliers calculate , , , and then these three numbers will be sent to the adder array to calculate , , , to prepare for subsequent calculations. In the fourth clock cycle, three groups of 88-bit multipliers will complete the required , , , , , The first operand generation unit 12 calculates the value of the first operand based on these 6 values ​​and the first clock cycle. , , Generate the 5 numbers required for the operand reorganization in the Karatsuba algorithm of 3 decomposition. In the 5th clock cycle, the first operand reorganization unit 13 will first Figure 4 The 5 operands are reorganized and compressed into 3 operands. After that, the 3 operands are input to the first adder unit 14, and the carry-save adder CSA compresses the 3 operands into 2 operands, and after 1 addition and bit splicing, the final value is obtained. and The product of .

[0098] In one embodiment, the multiplier unit 11 includes a plurality of groups of KO-4 multipliers, each of the KO-4 multipliers being used to calculate each multiplication operation in the first polynomial. Figure 5 As shown, the KO-4 multiplier in the embodiment of the present application includes:

[0099] The decomposition unit 110 is configured to perform a four-factor decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial.

[0100] The plurality of first sub-multipliers 120 are configured to perform multiplication operations on the multiplication operations of the first bit width in the second polynomial to obtain a plurality of first products.

[0101] The plurality of second sub-multipliers 130 are configured to perform multiplication operations on the multiplication operations of the second bit width in the second polynomial to obtain a plurality of second products.

[0102] The second operand generating unit 140 is configured to generate a third number of operands based on the plurality of first products and the plurality of second products.

[0103] a second operand reorganization unit 150, configured to reorganize the third number of operands to generate a fourth number of operands;

[0104] The second adder unit 160 is configured to accumulate the fourth number of operands to obtain operation results of each multiplication operation in the first polynomial.

[0105] For details, see Figure 6 The overall architecture of the KO-4 multiplier shown in FIG is illustrated by taking one of the multiplication operations in the first polynomial as an example. The specific calculation process is as follows: for the 88-bit multiplicand and multiplier, it is recorded as and , decomposition unit 110 pairs and The Karatsuba algorithm of 4 decomposition is used for decomposition, which is recorded as , , and we get 10 multiplication operations that need to be performed.

[0106] in, , , , is four 22-bit wide multiplication operations, , , , , , is 6 22-bit multiplication operations. The difference from the 3-decomposition Karatsuba algorithm is that the 6 groups of 23-bit wide operands are obtained by subtraction, such as ( , so a 23-bit wide signed multiplier is required for hardware implementation. The purpose of subtraction is to make the expression (6) , , , , The coefficients are all partially accumulated, which is beneficial to the design and implementation of subsequent hardware.

[0107] Therefore, the KO-4 multiplier in the present application includes four 22-bit wide unsigned multipliers and six 23-bit wide signed multipliers.

[0108] In an exemplary embodiment, when the multiplier unit 11 adopts the idea of ​​time division multiplexing, the multiplier unit 11 only needs three groups of 88-bit wide KO-4 multipliers, and each group of 88-bit wide multipliers requires four groups of 22-bit wide unsigned multipliers and six groups of 23-bit wide signed multipliers. The overall splitting method is as follows: Figure 7 shown.

[0109] Continue to see Figure 6 The overall implementation of the 4-factor Karatsuba algorithm requires a total of 3 cycles to complete the 88-bit multiplication operation. The first clock cycle performs subtraction and multiplication operations, obtaining 10 sets of products and storing them in registers; the second cycle performs operand generation operations, and then the operand reassembly generates the number generated by the 5 operands. The high 22 bits and A total of 7 numbers are compressed into 3 numbers by reorganizing their bits, and finally the 3 numbers are compressed into 2 numbers through the carry-save adder CSA. Figure 8 It shows how the operand combination compresses 7 numbers. Its cleverness lies in making full use of the zero bits in some numbers to compactly reorganize the 7 numbers and minimize the number of operands. The third clock cycle adds the two numbers compressed in the second clock cycle and adds the result to the sum. The lower 22 bits Perform bit splicing to get the final multiplication result ,Right now and The multiplication result of .

[0110] In one embodiment, the multiplier unit further includes two groups of multiplexers, and the two groups of multiplexers are used to select the multiplication operations of the third bit width in the first polynomial as the input of the multiple groups of multipliers in the first clock cycle; and select the multiplication operations of the fourth bit width in the first polynomial as the input of the multiple groups of multipliers in the second clock cycle.

[0111] In the embodiment of the present application, two groups of multiplexers are used to multiplex the KO-4 multiplier through the idea of ​​time division multiplexing, thereby reducing the overhead of hardware circuit design area and saving hardware costs.

[0112] In one embodiment, the multiplier module further includes a padding unit for padding the high bits of the multiplicand and the multiplier to match the bit width of the multiplier.

[0113] In one embodiment, Figure 9 As shown, the modular reduction module 20 includes: a large bit width reduction unit 21, a multi-operand accumulation unit 22 and a small bit width reduction unit 23.

[0114] The large bit width reduction unit 21 is used to split the product into two equal parts to obtain a high-order part and a low-order part; split the high-order part into multiple blocks, and construct a lookup table for each block based on the modulus; and determine the lookup result corresponding to each block based on the lookup table for each block.

[0115] The multi-operand accumulation unit 22 is used to accumulate the search results corresponding to the blocks and the low-order part to obtain a first calculation result.

[0116] The small bit width reduction unit 23 is configured to perform a small bit width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

[0117] For details, see Figure 3 As shown in the overall architecture diagram of the modular multiplier based on the lookup table, the modular reduction module 20 includes three stages, namely large bit width reduction, multi-operand accumulation and small bit width reduction.

[0118] The large bit width reduction unit 21 first needs to obtain the product of the multiplier module Divide the high-order 256 bits into two equal parts, each part occupies 256 bits. Then split the high-order 256 bits into k bits per part. For example, if each part is 18 bits, it can be split into 15 blocks. The block is recorded as This process can be expressed by expression (7), where is the modulus, for No. The corresponding bit, for The lower 256 bits of the .

[0119]

[0120] In expression (7) The calculation can be performed in advance, where M is the modulus, and the calculation result is stored using storage resources (e.g., BRAM on FPGA) to build a lookup table. As an index to recall the corresponding pre-computed modular reduction value in the lookup table, 1 Corresponding to a lookup table with a depth of 1024 (ie, the number of entries is 1024). During the recall process, the index The address is split into two parts, each part occupies 9 bits, corresponding to 512 entries. The two parts will respectively recall the matching entries from their respective corresponding 512 entries and transmit them to the multi-operand accumulation unit 22 of the next stage.

[0121] The multi-operand accumulation unit 22 receives the operands generated in the previous stage, including 30 entries returned from 15 groups of lookup tables and There are 31 operands in total. To speed up the accumulation, the CSA array is used to compress the number of operands and the addition tree is used to complete the accumulation. If the accumulation of a large number of operands is completed within one clock cycle, the hardware circuit timing will be tight. Therefore, multi-level registers are inserted to complete the calculation in a pipeline manner. The final result of the multi-operand accumulation is .

[0122] Small bit width reduction unit 23, the multi-operand accumulation stage is to sum 31 256-bit data, which theoretically produces a 261-bit result. There will still be overflow, so the summation result of the previous stage needs to be Reduce again. Compared to large bit width reduction, which needs to process the overflow of 256 bits, small bit width reduction only needs to process the overflow of 5 bits. In order to speed up the reduction efficiency, the final result The formula Calculated, where The selection needs to be close to .for The choice of is calculated using the following expression (8).

[0123]

[0124] in, is the modulus The bit width of , for The overflow bit width is 256 bits. , = 5. Calculated using expression (8) Will satisfy The proof process is as follows:

[0125]

[0126] From the above derivation, we can see that the final reduction result is Available through or The calculation is completed. In the small bit width reduction stage, The value range of is very small, so we can High 6 bits ( ) calculated , and Calculated in advance and stored in the lookup table -Table, first lookup table -Table and second lookup table -Table. The whole process of reducing the small bit width can be described as follows: The upper 6 bits are used as the lookup table -Table index to recall the corresponding , and As the first lookup table -Table and second lookup table -Table index query and Then, Respectively with the first lookup table -Table and second lookup table -Table recall results are subtracted to get the first difference and the second difference If the second difference If negative, the modular multiplication result On the contrary, .

[0127] The modular reduction module 20 of the embodiment of the present application effectively reduces the calculation delay through the three-stage full-pipeline modular reduction of the lookup table, and improves the throughput of the modular reduction calculation through a multi-stage pipeline.

[0128] In one embodiment, the multi-operand accumulation unit 22 includes a CSA array and a tree adder. The CSA array is used to compress the search results corresponding to each block and the low-order part to obtain a compressed result; the tree adder is used to accumulate the compressed results to obtain a first calculation result.

[0129] In one embodiment, the small bit width reduction unit is specifically used to: split the first calculation result to obtain a first high-order part, and construct a lookup table of the first high-order part based on the modulus; determine the lookup result of the first high-order part based on the lookup table of the first high-order part; and obtain a modular multiplication result based on the lookup result of the first high-order part and the first calculation result.

[0130] In one embodiment, the small bit width reduction unit is specifically used to: split the first calculation result to obtain a first high-order part, and construct a lookup table for the first high-order part based on the modulus, the lookup table for the first high-order part including an initial lookup table, a first lookup table, and a second lookup table; based on the initial lookup table of the first high-order part, determine the initial lookup result, and based on the initial lookup result, determine the first lookup result of the first lookup table and the second lookup result of the second lookup table; calculate a first difference between the first calculation result and the first lookup result, and calculate a second difference between the first calculation result and the second lookup result; determine whether the second difference is a negative value; if so, the first difference is a modular multiplication result, otherwise, the second difference is a modular multiplication result.

[0131] The present application also provides a modular multiplication method based on a lookup table, using the modular multiplier described in any of the above embodiments, the method comprising the following steps:

[0132] Step 201: Using the multiplier module, perform a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for the multiplication of the multiplier and the multiplicand; perform a quaternary decomposition on the multiplier and the multiplicand of each multiplication in the first polynomial to obtain a second polynomial for each multiplication in the first polynomial; and perform an operation based on each of the second polynomials to obtain a product of the multiplication of the multiplier and the multiplicand.

[0133] Step 202: Using the modular reduction module, perform a large-bit-width modular reduction operation on the product and the modulus to obtain a first calculation result; and perform a small-bit-width modular reduction operation on the first calculation result and the modulus to obtain a modular multiplication result.

[0134] It should be understood that the specific embodiments described herein are only used to explain this application and are not used to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0135] Obviously, the accompanying drawings are merely examples or embodiments of the present application. A person skilled in the art can also apply the present application to other similar situations based on these drawings without inventive effort. Furthermore, it is understandable that, although the work involved in this development process may be complex and lengthy, certain design, manufacturing, or production changes based on the technical content disclosed in this application are merely routine technical means for a person skilled in the art and should not be considered to constitute a deficiency in the disclosure of the present application.

Claims

1. A modular multiplier based on a lookup table, characterized in that: The modular multiplier comprises: a multiplier module configured to perform a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; perform a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain respective second polynomials for each multiplication operation in the first polynomial; and perform an operation based on each second polynomial to obtain a product of the multiplication operation of the multiplier and the multiplicand; A modular reduction module is connected to the multiplier module and is used to perform a large-bit-width modular reduction operation based on the product and the modulus to obtain a first calculation result; and perform a small-bit-width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

2. The modular multiplier according to claim 1, wherein: The multiplier module comprises: a multiplier unit configured to perform a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; perform a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial for each multiplication operation in the first polynomial; and perform operations based on each second polynomial to obtain a result of each multiplication operation in the first polynomial; a first operand generating unit, configured to generate a first number of operands based on the operation results of each multiplication operation in the first polynomial; a first operand reorganization unit, configured to reorganize the first number of operands to generate a second number of operands; The first adder unit is configured to accumulate a second number of operands to obtain a product of a multiplication operation of the multiplier and the multiplicand.

3. The modular multiplier according to claim 2, wherein: The multiplier unit includes a plurality of groups of multipliers, each of the multipliers is used to calculate each multiplication operation in the first polynomial, and each of the multipliers includes: a decomposition unit, configured to perform a four-factor decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial; a plurality of first sub-multipliers, configured to perform multiplication operations on respective multiplication operations of the first bit width in the second polynomial to obtain a plurality of first products; a plurality of second sub-multipliers, configured to perform multiplication operations on respective multiplication operations of a second bit width in the second polynomial to obtain a plurality of second products; a second operand generation unit for generating a third number of operands based on the plurality of first products and the plurality of second products; a second operand reorganization unit, configured to reorganize the third number of operands to generate a fourth number of operands; The second adder unit is configured to accumulate the fourth number of operands to obtain operation results of each multiplication operation in the first polynomial.

4. The modular multiplier according to claim 3, wherein: The multiplier unit also includes two groups of multiplexers, The two groups of multiplexers are used to select, in a first clock cycle, each multiplication operation with a third bit width in the first polynomial as an input to the multiple groups of multipliers; and in a second clock cycle, select each multiplication operation with a fourth bit width in the first polynomial as an input to the multiple groups of multipliers.

5. The modular multiplier according to claim 1, wherein: The modular reduction module includes: a large bit width reduction unit, configured to split the product into two equal parts to obtain a high-order part and a low-order part; split the high-order part into a plurality of blocks, and construct a lookup table for each block based on the modulus; and determine a lookup result corresponding to each block based on the lookup table for each block; a multi-operand accumulation unit, configured to accumulate the search results corresponding to the blocks and the low-order portion to obtain a first calculation result; The small bit width reduction unit is configured to perform a small bit width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

6. The modular multiplier according to claim 5, characterized in that The multi-operand accumulation unit comprises: A CSA array is used to compress the search results corresponding to each block and the low-order portion to obtain a compressed result; The tree adder is used to accumulate the compression results to obtain a first calculation result.

7. The modular multiplier according to claim 5, characterized in that The small bit width reduction unit is specifically used for: Splitting the first calculation result to obtain a first high-order portion, and constructing a lookup table for the first high-order portion based on the modulus; and determining a search result for the first high-order portion based on the lookup table for the first high-order portion. A modular multiplication result is obtained based on the search result of the first high-order part and the first calculation result.

8. The modular multiplier according to claim 5, wherein: The small bit width reduction unit is specifically used for: Splitting the first calculation result to obtain a first high-order portion, and constructing a lookup table for the first high-order portion based on the modulus, wherein the lookup table for the first high-order portion includes an initial lookup table, a first lookup table, and a second lookup table; determining an initial lookup result based on the initial lookup table for the first high-order portion, and determining a first lookup result of the first lookup table and a second lookup result of the second lookup table based on the initial lookup result; Calculating a first difference between the first calculation result and the first search result, and calculating a second difference between the first calculation result and the second search result; Determine whether the second difference is a negative value; if so, the first difference is a modular multiplication result; otherwise, the second difference is a modular multiplication result.

9. The modular multiplier according to claim 1, wherein: The multiplier module further includes: A filling unit is used to fill the high bits of the multiplicand and the multiplier to match the bit width of the multiplier.

10. A modular multiplication method based on a lookup table, characterized in that: Applying the modular multiplier according to any one of claims 1 to 9, the method comprises: Using the multiplier module, performing a ternary decomposition on a multiplier and a multiplicand to obtain a first polynomial for a multiplication operation of the multiplier and the multiplicand; performing a quaternary decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial for each multiplication operation in the first polynomial; and performing an operation based on each of the second polynomials to obtain a product of the multiplication operation of the multiplier and the multiplicand; Using the modular reduction module, a large-bit-width modular reduction operation is performed on the product and the modulus to obtain a first calculation result; and a small-bit-width modular reduction operation is performed on the first calculation result and the modulus to obtain a modular multiplication result.

Images