Modular multiplier based on a lookup table and modular multiplication method

Abstract

The application relates to a lookup table-based modular multiplier and a modular multiplication method. The modular multiplier comprises a multiplier module, which is used for tripartite decomposition of a multiplier and a multiplicand to obtain a first polynomial of multiplication operation of the multiplier and the multiplicand; quadruple decomposition of the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial; operation based on each second polynomial to obtain a product of the multiplication operation of the multiplier and the multiplicand; a modulus reduction module connected with the multiplier module, which is used for large-bit-width modulus reduction operation of the product and a modulus to obtain a first calculation result; small-bit-width modulus reduction operation of the first calculation result and the modulus to obtain a modular multiplication result, consumption of hardware resources and complexity of circuit design are reduced, and calculation time delay is effectively reduced.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of hardware computing, in particular to a lookup table-based modular multiplier and a modular multiplication method. BACKGROUND

[0002] Privacy computing technology has the security feature of "available but invisible" in data use, and thus has attracted extensive attention from the academic and industrial circles. However, the performance bottleneck has been restricting its large-scale application. Although the protocols and algorithms of privacy computing are different, some underlying basic operations, such as modular multiplication and modular addition, are widely and frequently used. Among them, the efficiency of modular multiplication operation has an important influence on the overall performance of privacy computing. Therefore, designing a special accelerator for modular multiplication and other atomic operations is of key significance to improve the performance of privacy computing. We propose a general modular multiplication method based on lookup table, which can be compatible with different elliptic curves adopted by different privacy computing protocols, and can achieve excellent balance between design area and performance while ensuring high throughput.

[0003] At present, the two most commonly used modular multiplication algorithms are Montgomery modular multiplication (MMM) and Barrett modular multiplication (BMM). The implementation methods of these two types of modular multiplication algorithms mainly include two categories: iterative modular multiplication and pipelined modular multiplication. In the iterative modular multiplication process, the multiplier is decomposed into a series of words, and is multiplied with the multiplicand in each iteration. This implementation allows the reuse of multiplication units, thereby occupying less area in hardware design. However, multiple iterations mean that a large number of clock cycles are required to complete a modular multiplication operation, which severely limits the throughput. For pipelined modular multiplication, the entire modular multiplication process is divided into three consecutive full-word multiplications, which are completed by three parallel full-word multipliers in the pipeline in three consecutive stages. Compared with iterative modular multiplication, pipelined modular multiplication can achieve higher throughput, but also brings significant design area overhead. In addition, for Montgomery modular multiplication, additional preprocessing and post-processing of the operands are required, i.e., transforming the multiplier and the multiplicand from the integer domain to the Montgomery domain, and transforming the modular multiplication result from the Montgomery domain back to the integer domain. For Barrett modular multiplication, this method requires selecting appropriate pre-computed parameters to control the introduction of excessive errors in the modular reduction process.

[0004] In the prior art, when Karatsuba algorithm is used to split large bit-width operands, multiple decompositions are required, which not only increases the consumption of hardware resources, but also increases the complexity of circuit design. The delay of modulo reduction calculation based on a lookup table is too long to efficiently perform pipeline operation. SUMMARY

[0005] Therefore, it is necessary to provide a modulo multiplier and a modulo multiplication method based on a lookup table to solve the above technical problems.

[0006] In a first aspect, an embodiment of the present application provides a modulo multiplier based on a lookup table, which comprises:

[0007] a multiplier module, configured to perform tri-decomposition on a multiplier and a multiplicand to obtain a first polynomial of multiplication operation of the multiplier and the multiplicand, perform quad-decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain a product of multiplication operation of the multiplier and the multiplicand.

[0008] a modulo reduction module, connected with the multiplier module, configured to perform large bit-width modulo reduction operation on the product and a modulus to obtain a first calculation result, and perform small bit-width modulo reduction operation on the first calculation result and the modulus to obtain a modulo multiplication result.

[0009] In an embodiment, the multiplier module comprises:

[0010] a multiplier unit, configured to perform tri-decomposition on a multiplier and a multiplicand to obtain a first polynomial of multiplication operation of the multiplier and the multiplicand, perform quad-decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain each operation result of each multiplication operation in the first polynomial.

[0011] a first operand generation unit, configured to generate a first number of operands based on each operation result of each multiplication operation in the first polynomial.

[0012] a first operand recombination unit, configured to recombine the first number of operands to generate a second number of operands.

[0013] a first adder unit, configured to accumulate the second number of operands to obtain a product of multiplication operation of the multiplier and the multiplicand.

[0014] In one embodiment, the multiplier unit comprises a plurality of groups of multipliers, each of the multipliers being configured to perform a multiplication operation in the first polynomial, each of the multipliers comprising:

[0015] a decomposition unit configured to decompose a multiplier and a multiplicand of each multiplication operation in the first polynomial into four parts to obtain a second polynomial of each multiplication operation in the first polynomial;

[0016] a plurality of first sub-multipliers configured to perform multiplication operations on each multiplication operation in the second polynomial with a first bit width to obtain a plurality of first products;

[0017] a plurality of second sub-multipliers configured to perform multiplication operations on each multiplication operation in the second polynomial with a second bit width to obtain a plurality of second products;

[0018] a second operand generation unit configured to generate a third number of operands based on the plurality of first products and the plurality of second products;

[0019] a second operand recombination unit configured to recombine the third number of operands to generate a fourth number of operands;

[0020] a second adder unit configured to accumulate the fourth number of operands to obtain each result of each multiplication operation in the first polynomial.

[0021] In one embodiment, the multiplier unit further comprises two groups of multiplexers,

[0022] the two groups of multiplexers being configured to select, in a first clock cycle, each multiplication operation in the first polynomial with a third bit width as an input of the plurality of groups of multipliers, and select, in a second clock cycle, each multiplication operation in the first polynomial with a fourth bit width as an input of the plurality of groups of multipliers.

[0023] In one embodiment, the modulo reduction module comprises:

[0024] a large bit width reduction unit configured to split the product into a high bit part and a low bit part, split the high bit part into a plurality of blocks, construct a lookup table of each block based on the modulus, and determine a lookup result corresponding to each block based on the lookup table of each block;

[0025] a multi-operand accumulation unit configured to accumulate the lookup result corresponding to each block and the low bit part to obtain a first calculation result;

[0026] a small bit width reduction unit configured to perform a small bit width modulo reduction operation on the first calculation result and the modulus to obtain a modulo multiplication result.

[0027] In one of the embodiments, the multi-operand accumulation unit comprises:

[0028] a CSA array, configured to compress the low-bit part and the corresponding lookup result of each block to obtain a compressed result;

[0029] a tree adder, configured to accumulate the compressed result to obtain a first calculation result.

[0030] In one of the embodiments, the small-bit-width reduction unit is specifically configured to:

[0031] split the first calculation result to obtain a first high-bit part, and construct a lookup table of the first high-bit part based on the modulus; determine a lookup result of the first high-bit part based on the lookup table of the first high-bit part; and obtain a modulo multiplication result based on the lookup result of the first high-bit part and the first calculation result.

[0032] In one of the embodiments, the small-bit-width reduction unit is specifically configured to:

[0033] split the first calculation result to obtain a first high-bit part, and construct a lookup table of the first high-bit part based on the modulus, wherein the lookup table of the first high-bit part comprises an initial lookup table, a first lookup table and a second lookup table; determine an initial lookup result based on the initial lookup table of the first high-bit part, and determine a first lookup result of the first lookup table and a second lookup result of the second lookup table based on the initial lookup result; calculate a first difference value between the first calculation result and the first lookup result, and calculate a second difference value between the first calculation result and the second lookup result; determine whether the second difference value is negative; if yes, the first difference value is the modulo multiplication result, otherwise, the second difference value is the modulo multiplication result.

[0034] In one of the embodiments, the multiplier module further comprises:

[0035] a padding unit, configured to pad the multiplicand and the multiplier with high bits to match the bit width of the multiplier.

[0036] In a second aspect, the embodiments of the present application further provide a modulo multiplication operation method based on a lookup table, which applies the modulo multiplier as described in the first aspect, and the method comprises:

[0037] performing tripartition on the multiplier and the multiplicand by using the multiplier module to obtain a first polynomial of multiplication operation of the multiplier and the multiplicand; performing quadripartition on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial; and performing operation based on each second polynomial to obtain a product of multiplication operation of the multiplier and the multiplicand.

[0038] The multiplication module is configured to perform a large-bit-width modular reduction operation on the product and the modulus to obtain a first calculation result; and perform a small-bit-width modular reduction operation on the first calculation result and the modulus to obtain a modular multiplication result.

[0039] The above lookup table-based modular multiplier and modular multiplication method reduce the number of decompositions, reduce the consumption of hardware resources and the complexity of circuit design, and effectively reduce the calculation delay by using a large-bit-width modular reduction operation and a small-bit-width modular reduction operation in combination.

[0040] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate exemplary embodiments of the present application and its description, which serve to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0042] Figure 1 is a structural block diagram of a lookup table-based modular multiplier according to one embodiment of the present application;

[0043] Figure 2 is a structural block diagram of a multiplier module according to one embodiment of the present application;

[0044] Figure 3 is a general architecture diagram of a lookup table-based modular multiplier according to one embodiment of the present application;

[0045] Figure 4 is an operand recombination diagram of a Karatsuba algorithm 3 decomposition according to one embodiment of the present application;

[0046] Figure 5 is a structural block diagram of a KO-4 multiplier according to one embodiment of the present application;

[0047] Figure 6 is a general architecture diagram of a KO-4 multiplier according to one embodiment of the present application;

[0048] Figure 7 is a recursive decomposition diagram of a Karatsuba algorithm according to one embodiment of the present application;

[0049] Figure 8 is an operand recombination diagram of a Karatsuba algorithm 4 decomposition according to some embodiments of the present application;

[0050] Figure 9 This is a structural block diagram of the module reduction module in some embodiments of this application. Detailed Implementation

[0051] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0052] This application provides a modular multiplier based on a lookup table, such as... Figure 1 As shown, the modular multiplier includes: a multiplier module 10 and a modular reduction module 20.

[0053] The multiplier module 10 is used to perform tri-decomposition on the multiplier and multiplicand to obtain a first polynomial for the multiplication operation of the multiplier and multiplicand; to perform qua-decomposition on the multiplier and multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial for each multiplication operation in the first polynomial; and to perform operations based on each second polynomial to obtain the product of the multiplication operation of the multiplier and multiplicand.

[0054] Modular reduction module 20 is connected to the multiplier module and is used to perform large-width modular reduction operation based on the product and the modulus to obtain a first calculation result; and to perform small-width modular reduction operation based on the first calculation result and the modulus to obtain a modular multiplication result.

[0055] The modular multiplier can support calculations for common bit widths, such as 128 bits, 256 bits, 384 bits, and 512 bits. This application will use a 256-bit example for explanation.

[0056] The multiplier module 10 employs the Karatsuba algorithm to decompose the multiplier and multiplicand separately. The decomposition process uses a two-level recursive Karatsuba algorithm. First, the multiplier and multiplicand are padded with 0s at the high bits to extend them to 258 bits. The resulting numbers are denoted as follows: and Then on and Using the 3-factor Karatsuba algorithm (KO-3), this process can be represented as follows: , , to , to Each is 86 bits. Therefore... and The product can be expressed as the following expression (1), where n=86.

[0057]

[0058] Next, define two matrices and :

[0059]

[0060] Multiply the above two matrices with and , respectively, to obtain and , respectively. Herein, let , .

[0061]

[0062]

[0063] Obtain and , and then perform element-wise multiplication to obtain . Herein, , , is the element-wise multiplication.

[0064]

[0065] Then, introduce a predefined constant matrix and a basis vector , multiply them with obtained above to calculate the product of and after the Karatsuba algorithm with three decompositions, and the expression of the calculation is as follows expression (2).

[0066]

[0067]

[0068] Expand expression (2) to convert the original expression (1) into expression (3).

[0069] Herein, expression (3) is that the multiplier module 10 performs three decompositions on the multiplier and the multiplicand to obtain the first polynomial of the multiplication operation of the multiplier and the multiplicand.

[0070]

[0071] Comparing expression (1) and expression (3), it can be seen that expression (1) needs to calculate 9 times of multiplication, while expression (3) only needs 6 times of multiplication, and the number of multiplications is reduced after the change.

[0072] The multiplication operations needed in expression (3) are , , , , and .

[0073] Then the multipliers and multiplicands of the 6 multiplication operations needed in expression (3) are respectively quadrupled.

[0074] The first 3 multiplication operations needed in expression (3) , , are 86-bit-width multiplications, and the last 3 , and are 87-bit-width multiplications. Before performing multiplication, the last 3 need to perform an addition first. According to this feature, the 86-bit-width multiplier can be pipelined, and the last 3 can time-division multiplex the multiplier, thereby saving the hardware area overhead required for design. In order to enable the multiplier to be multiplexed, the bit width of the 3 groups of multipliers is uniformly set to 88 bits, on the one hand to be compatible with 86-bit and 87-bit multiplications, and on the other hand to be able to use Karatsuba algorithm to quadruple the multiplicands and multipliers of the multiplication operations needed in expression (3).

[0075] Taking one of the multiplication operations as an example, first, the multiplicand and the multiplier of the multiplication operation needed in expression (3) need to be filled with 0 in the high bit to expand to 88 bits, and the obtained numbers are denoted as and . The Karatsuba algorithm of 4 decomposition is used on and , denoted as , , to , to are all 22 bits. Thus the product of and can be written as the following expression (4), where m = 22.

[0076]

[0077] Similarly to the Karatsuba algorithm of 3 decomposition, a coefficient matrix and and , , and . Wherein, , .

[0078] ,

[0079] ,

[0080] Then, the element-wise multiplication of and is performed to obtain the matrix . Wherein, , .

[0081]

[0082] Similar to the 3-split Karatsuba algorithm, then by introducing a predefined constant matrix and a base vector , they are multiplied with the previously calculated to calculate the product of the 4-split Karatsuba algorithm after and , the expression of this calculation is as follows (5).

[0083]

[0084]

[0085] Expanding the expression (5), the original expression (5) will be converted into expression (6).

[0086] Here, expression (6) is the four-split of the multiplier module 10 to the multiplier and the multiplicand of one of the multiplication operations in the first polynomial, to obtain the second polynomial of the multiplication operation.

[0087]

[0088] Comparing expression (4) and expression (6), it can be seen that expression (4) needs to calculate 16 times of multiplication, while expression (6) only needs 10 times of multiplication, and the change reduces the number of multiplications.

[0089] The multiplication operations required in expression (6) are , , , , , , , , , .

[0090] The modular multiplier based on lookup table in this application uses the Karatsuba algorithm to recursively decompose the multiplier and multiplicand with a large bit width, which reduces the number of decompositions, the consumption of hardware resources, and the complexity of circuit design. The modular reduction module uses a combination of large-bit-width modular reduction and small-bit-width modular reduction operations, which effectively reduces the computation latency.

[0091] In one embodiment, such as Figure 2 As shown, the multiplier module 10 includes a multiplier unit 11, a first operand generation unit 12, a first operand recombination unit 13, and a first adder unit 14.

[0092] The multiplier unit 11 is used to perform tri-decomposition on the multiplier and multiplicand to obtain a first polynomial of the multiplication operation of the multiplier and multiplicand; to perform qua-decomposition on the multiplier and multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial of each multiplication operation in the first polynomial; and to perform operations based on each second polynomial to obtain the operation result of each multiplication operation in the first polynomial.

[0093] The first operand generation unit 12 is used to generate a first number of operands based on the results of each multiplication operation in the first polynomial.

[0094] The first operand reorganization unit 13 is used to reorganize the first number of operands to generate a second number of operands.

[0095] The first adder unit 14 is used to accumulate the second number of operands to obtain the product of the multiplication operation of the multiplier and the multiplicand.

[0096] For details, please refer to Figure 3 The diagram shown illustrates the overall architecture of the modular multiplier based on a lookup table. Multiplier unit 11 first fills the high-order bits of the multiplier and multiplicand with 0, expanding them to 258 bits, to obtain... and Then on and The Karatsuba algorithm with 3-factor decomposition is used for decomposition. , , ~ ~ respectively. Then the multiplication operation needed in the first polynomial is calculated after being decomposed again by inputting the two numbers into the KO-4 multiplier. , , , , , .

[0097] The KO-4 multiplier unit 11 of the present application adopts the idea of time division multiplexing. The KO-4 multiplier unit 11 only needs three groups of 88-bit KO-4 multipliers. The specific performance of time division multiplexing of the multipliers is as follows: in the first clock cycle, two groups of 86-bit data are selected by the two groups of multiplexers as the multiplier and the multiplicand of the multiplier; in the second clock cycle, the 87-bit calculation result obtained by one additional addition is selected by the two groups of multiplexers as the input of the multiplier. Since the 88-bit multiplier is implemented, the two inputs both need to be filled with 0 in the high bit to match the bit width of the multiplier. In the third clock cycle, the three groups of 88-bit KO-4 multipliers calculate the three numbers , , , which are then sent to the adder array to calculate , , for the subsequent calculation. In the fourth clock cycle, the three groups of 88-bit multipliers complete the calculation of the expression (3) in the first polynomial. The first operand generation unit 12 generates five numbers needed for the recombination of the operands in the three-decomposition Karatsuba algorithm according to the six values and the calculation result obtained in the first clock cycle. , , , , , , , In the fifth clock cycle, the first operand recombination unit 13 first recombines the five operands according to the method in the expression (4) and compresses them into three operands. Then, the three operands are input into the first adder unit 14, the carry-save adder CSA compresses the three operands into two operands, and after one addition and bit splicing, the final product Figure 4 and is obtained. .

[0098] In one embodiment, the multiplier unit 11 includes a plurality of KO-4 multipliers, and each KO-4 multiplier is configured to calculate a multiplication operation in the first polynomial. As shown in FIG. 1, the KO-4 multiplier unit 11 includes three groups of KO-4 multipliers.​​Figure 5 As shown, the KO-4 multiplier in the embodiment of the present application includes:

[0099] The decomposition unit 110 is configured to perform four-wise decomposition on the multiplier and the multiplicand of each multiplication operation in the first polynomial, to obtain each second polynomial of each multiplication operation in the first polynomial.

[0100] The plurality of first sub-multipliers 120 is configured to perform multiplication operation on each multiplication operation of the first bit width in the second polynomial, to obtain a plurality of first products.

[0101] The plurality of second sub-multipliers 130 is configured to perform multiplication operation on each multiplication operation of the second bit width in the second polynomial, to obtain a plurality of second products.

[0102] The second operand generation unit 140 is configured to generate a third number of operands based on the plurality of first products and the plurality of second products.

[0103] The second operand reorganization unit 150 is configured to reorganize the third number of operands to generate a fourth number of operands.

[0104] The second adder unit 160 is configured to accumulate the fourth number of operands to obtain each operation result of each multiplication operation in the first polynomial.

[0105] Specifically, please refer to Figure 6 The overall architecture diagram of the KO-4 multiplier is shown, and one of the multiplication operations in the first polynomial is taken as an example for illustration, and the calculation process is specifically as follows: for the 88-bit multiplicand and multiplier, denoted as and The decomposition unit 110 performs decomposition on and respectively using the 4-wise decomposition Karatsuba algorithm, denoted as , to obtain 10 multiplication operations that need to be performed.

[0106] Among them, , , , are four 22-bit multiplication operations, , , , , , are six 22-bit multiplication operations. Different from the 3-wise decomposition Karatsuba algorithm, the six groups of 23-bit operands are obtained by subtraction, such as Therefore, a 23-bit signed multiplier is required in hardware implementation. The purpose of the subtraction is to make the coefficients of expression (6) all partial accumulated sums, which is beneficial to the subsequent hardware design and implementation. , , , , The coefficients of expression (6) are all partial accumulated sums, which is beneficial to the subsequent hardware design and implementation.

[0107] Therefore, the KO-4 multiplier in the present application includes four 22-bit unsigned multipliers and six 23-bit signed multipliers.

[0108] In an example embodiment, when the multiplier unit 11 adopts the time-division multiplexing idea, the multiplier unit 11 only needs three groups of 88-bit KO-4 multipliers, and each group of 88-bit multipliers needs four groups of 22-bit unsigned multipliers and six groups of 23-bit signed multipliers. The overall splitting manner is shown in Figure 7 .

[0109] Continuing to refer to Figure 6 , the overall implementation of the 4-decomposition Karatsuba algorithm needs three periods to complete the 88-bit multiplication. In the first clock period, the subtraction and multiplication operations are performed to obtain ten products and store them in registers; in the second period, the operand generation operation is performed, and then the operand recombination operation is performed to recombine the five operand-generated numbers, into 3 numbers, and finally, the 3 numbers are compressed into 2 numbers by a carry-save adder (CSA). The figure shows how the operand combination compresses the 7 numbers. The cleverness lies in that it can make full use of the zero bits in some numbers to compactly recombine the 7 numbers so as to minimize the number of operands; in the third clock period, the 2 numbers compressed in the second clock period are added, and the addition result is bit-spliced with the low 22 bits of to obtain the final multiplication result Figure 8 , i.e., the multiplication result of and . In an example embodiment, the multiplier unit further includes two groups of multiplexers, which are configured to select, in the first clock period, the third-bit-width multiplication operations in the first polynomial as the inputs of the groups of multipliers, and select, in the second clock period, the fourth-bit-width multiplication operations in the first polynomial as the inputs of the groups of multipliers.

[0110] In one of the embodiments, the multiplier unit further includes two groups of multiplexers, which are configured to select, in the first clock period, the third-bit-width multiplication operations in the first polynomial as the inputs of the groups of multipliers, and select, in the second clock period, the fourth-bit-width multiplication operations in the first polynomial as the inputs of the groups of multipliers. ​​

[0111] In this embodiment, two sets of multiplexers are used to multiplex the KO-4 multiplier using the time-division multiplexing concept, thereby reducing the overhead of hardware circuit design area and saving hardware costs.

[0112] In one embodiment, the multiplier module further includes a padding unit for padding the multiplicand and the multiplier with high bits to match the bit width of the multiplier.

[0113] In one embodiment, such as Figure 9 As shown, the modulo reduction module 20 includes: a large bit width reduction unit 21, a multi-operand accumulation unit 22, and a small bit width reduction unit 23.

[0114] The large bit width reduction unit 21 is used to split the product into two equal parts to obtain a high bit part and a low bit part; to split the high bit part into multiple blocks and to construct a lookup table for each block based on the modulus; and to determine the lookup result corresponding to each block based on the lookup table of each block.

[0115] The multi-operand accumulation unit 22 is used to accumulate the lookup results corresponding to each block with the low-order part to obtain the first calculation result.

[0116] Small-width reduction unit 23 is used to perform small-width modulo reduction operation based on the first calculation result and the modulus to obtain a modulo multiplication result.

[0117] For details, please see Figure 3 The overall architecture diagram of the modular multiplier based on the lookup table is shown. The modular reduction module 20 includes three stages: large-width reduction, multi-operand accumulation, and small-width reduction.

[0118] The large bit-width reduction unit 21 first needs to convert the product obtained by the multiplier module. Divide the data into two equal parts, each occupying 256 bits. Then, further divide the high-order 256 bits into k-bit portions, for example, 18 bits per portion, which can be divided into 15 blocks. The first... Each block is denoted as This process can be represented by expression (7), where For modulus, for No. The corresponding bit. for The lower 256 bits.

[0119]

[0120] In expression (7) The calculation can be done in advance, M is the modulus, and the calculation result is stored by using storage resources (for example, BRAM on FPGA) to construct a lookup table. Then, during the large bit-width reduction, the corresponding pre-calculated modulus reduction value in the lookup table is recalled by the index 1 corresponds to a set of lookup tables with a depth of 1024 (i.e., the number of entries is 1024). During the recall process, the index needs to be split into two parts of addresses, each with 9 bits, corresponding to 512 entries respectively. In each clock cycle, the two parts of each index recall the matching entries from the corresponding 512 entries respectively and transmit them to the next stage of the multi-operand accumulation unit 22.

[0121] The multi-operand accumulation unit 22 receives the operands generated by the previous stage, including 30 entries returned from the 15 sets of lookup tables and a total of 31 operands. In order to speed up the efficiency of accumulation, the CSA array is used to compress the number of operands, and the addition tree is used to complete the accumulation. If the accumulation of a large number of operands is completed in one clock cycle, the hardware circuit timing will be tight, so multi-stage registers are inserted to complete the calculation in a pipelined manner, and the result of the multi-operand accumulation is .

[0122] The small bit-width reduction unit 23, the multi-operand accumulation stage is to sum 31 256-bit data, which will theoretically produce a 261-bit result, and there will still be overflow conditions, so the sum result of the previous stage needs to be reduced again. Compared with the large bit-width reduction that needs to handle 256-bit overflow, the small bit-width reduction only needs to handle 5-bit overflow data. In order to speed up the efficiency of reduction, the final result can be calculated by the formula , where needs to be close to . The selection of is calculated by the following expression (8).

[0123]

[0124] wherein, is the bit width of the modulus and satisfies , is the bit width of the overflow , and specifically to 256 bits, , = 5. The calculated by expression (8) will satisfy The proof process is as follows:

[0125]

[0126] From the above derivation, the final reduction result can be calculated by or . In the small bit width reduction stage, the value range of is very small, so , , and calculated by the high 6 bits of can be calculated in advance and stored in the lookup table -Table, the first lookup table -Table and the second lookup table -Table. The whole small bit width reduction process can be described as follows: taking the high 6 bits of as the index of the lookup table -Table to recall the corresponding , and taking as the index to query the first lookup table -Table and the second lookup table -Table to obtain the pre-calculated results of and . Then, the difference between and the results recalled by the first lookup table -Table and the second lookup table -Table is obtained to obtain the first difference and the second difference . If the second difference is negative, then the modular multiplication result ; otherwise, .

[0127] The modular reduction module 20 of the embodiment of the application effectively reduces the calculation delay through the 3-stage full-flow modular reduction of the lookup table, and improves the throughput of the modular reduction calculation through the multi-stage pipeline.

[0128] In one embodiment, the multi-operand accumulation unit 22 includes a CSA array and a tree adder, the CSA array is used to compress the lookup results corresponding to the blocks and the low bit part to obtain a compression result, and the tree adder is used to accumulate the compression result to obtain a first calculation result.

[0129] In one of the embodiments, the small-width reduction unit is configured to split the first calculation result to obtain a first high-bit part, and construct a lookup table of the first high-bit part based on the modulus; determine a lookup result of the first high-bit part based on the lookup table of the first high-bit part; and obtain a modulo multiplication result based on the lookup result of the first high-bit part and the first calculation result.

[0130] In one of the embodiments, the small-width reduction unit is configured to split the first calculation result to obtain a first high-bit part, and construct a lookup table of the first high-bit part based on the modulus, the lookup table of the first high-bit part including an initial lookup table, a first lookup table and a second lookup table, determine an initial lookup result based on the initial lookup table of the first high-bit part, and determine a first lookup result of the first lookup table and a second lookup result of the second lookup table based on the initial lookup result; calculate a first difference value of the first calculation result and the first lookup result, and calculate a second difference value of the first calculation result and the second lookup result; determine whether the second difference value is negative; if yes, the first difference value is the modulo multiplication result, otherwise, the second difference value is the modulo multiplication result.

[0131] The embodiments of the present application also provide a modulo multiplication operation method based on a lookup table, which applies the modulo multiplier as described in any of the above embodiments, and the method includes the following steps:

[0132] In step 201, the multiplier module is used to tri-split a multiplier and a multiplicand to obtain a first polynomial of multiplication operation of the multiplier and the multiplicand, quad-split the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain each second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain a product of multiplication operation of the multiplier and the multiplicand.

[0133] In step 202, the modulo reduction module is used to perform large-width modulo reduction operation on the product and a modulus to obtain a first calculation result, and perform small-width modulo reduction operation on the first calculation result and the modulus to obtain a modulo multiplication result.

[0134] It should be understood that the specific embodiments described herein are merely used to explain the present application, but not to limit it. According to the embodiments provided by the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of the present application.

[0135] It is apparent that the drawings depict only some of the embodiments or examples of the application and are therefore not to be considered limiting of the scope of the application, for the application can be applied to other similar situations. Moreover, it is to be understood that unless otherwise specifically stated herein, the application can be practiced with other systems, components, materials and the like without resorting to creativity.

Claims

1. A lookup table based modular multiplier, characterized by, The modular multiplier supports calculation of multiple bit widths, and the modular multiplier comprises: a multiplier module, configured to perform tri-section on a multiplier and a multiplicand to obtain a first polynomial of multiplication operations of the multiplier and the multiplicand, perform quad-section on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain a product of the multiplication operations of the multiplier and the multiplicand; a modular reduction module connected with the multiplier module, configured to perform large-bit-width modular reduction operation on the product and a modulus to obtain a first calculation result, and perform small-bit-width modular reduction operation on the first calculation result and the modulus to obtain a modular multiplication result, wherein the modular reduction module comprises: a large-bit-width reduction unit, configured to perform two-way split on the product to obtain a high-bit part and a low-bit part, split the high-bit part into multiple blocks, and construct a lookup table of each block based on the modulus; and determine a lookup result corresponding to each block based on the lookup table of each block; a multi-operand accumulation unit, configured to accumulate the lookup result corresponding to each block and the low-bit part to obtain the first calculation result; a small-bit-width reduction unit, configured to perform small-bit-width modular reduction operation on the first calculation result and the modulus to obtain the modular multiplication result.

2. The modular multiplier of claim 1, wherein, The multiplier module comprises: a multiplier unit, configured to perform tri-section on a multiplier and a multiplicand to obtain a first polynomial of multiplication operations of the multiplier and the multiplicand, perform quad-section on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain an operation result of each multiplication operation in the first polynomial; a first operand generation unit, configured to generate a first number of operands based on the operation result of each multiplication operation in the first polynomial; a first operand reorganization unit, configured to reorganize the first number of operands to generate a second number of operands; a first adder unit, configured to accumulate the second number of operands to obtain a product of the multiplication operations of the multiplier and the multiplicand.

3. The modular multiplier of claim 2, wherein, The multiplier unit comprises multiple groups of multipliers, each of which is configured to calculate each multiplication operation in the first polynomial, and each of the multipliers comprises: a decomposition unit, configured to perform quad-section on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial of each multiplication operation in the first polynomial; a plurality of first sub-multipliers, configured to perform multiplication operation on each multiplication operation of a first bit width in the second polynomial to obtain a plurality of first products; a plurality of second sub-multipliers, configured to perform multiplication operation on each multiplication operation of a second bit width in the second polynomial to obtain a plurality of second products; a second operand generation unit, configured to generate a third number of operands based on the plurality of first products and the plurality of second products; a second operand reorganization unit, configured to reorganize the third number of operands to generate a fourth number of operands; and a first adder unit, configured to accumulate the fourth number of operands to obtain a product of the multiplication operations of the multiplier and the multiplicand. A second adder unit is configured to accumulate the fourth number of operands to obtain each operation result of each multiplication operation in the first polynomial.

4. The modular multiplier of claim 3, wherein, The multiplier unit further includes two groups of multiplexers, The two groups of multiplexers are configured to select, in a first clock cycle, each multiplication operation of a third bit width in the first polynomial as an input of the plurality of groups of multipliers; and select, in a second clock cycle, each multiplication operation of a fourth bit width in the first polynomial as the input of the plurality of groups of multipliers.

5. The modular multiplier of claim 1, wherein, The multi-operand accumulation unit includes: A CSA array is configured to compress the lookup result corresponding to each block and the low bit part to obtain a compression result. A tree adder is configured to accumulate the compression result to obtain a first calculation result.

6. The modular multiplier of claim 1, wherein, The small-bit-width reduction unit is specifically configured to: split the first calculation result to obtain a first high bit part, and construct a lookup table of the first high bit part based on the modulus; and determine a lookup result of the first high bit part based on the lookup table of the first high bit part. The small-bit-width reduction unit is specifically configured to:

7. The modular multiplier of claim 1, wherein, split the first calculation result to obtain a first high bit part, and construct a lookup table of the first high bit part based on the modulus, the lookup table of the first high bit part including an initial lookup table, a first lookup table, and a second lookup table, determine an initial lookup result based on the initial lookup table of the first high bit part, and determine a first lookup result of the first lookup table and a second lookup result of the second lookup table based on the initial lookup result; calculate a first difference value of the first calculation result and the first lookup result, and calculate a second difference value of the first calculation result and the second lookup result; determine whether the second difference value is negative; if yes, the first difference value is the modular multiplication result, otherwise, the second difference value is the modular multiplication result. The multiplier module further includes:

8. The modular multiplier of claim 1, wherein, A padding unit is configured to pad high bits of the multiplicand and the multiplier to match a bit width of the multiplier. The method includes:

9. A method of multiply-by-lookup table based multiplication, characterized by, using the multiplier module to perform tri-section on the multiplier and the multiplicand to obtain a first polynomial of multiplication operations of the multiplier and the multiplicand, perform quad-section on the multiplier and the multiplicand of each multiplication operation in the first polynomial to obtain a second polynomial of each multiplication operation in the first polynomial, and perform operation based on each second polynomial to obtain a product of the multiplication operations of the multiplier and the multiplicand; and using the modular reduction module to perform large-bit-width modular reduction operation on the product and the modulus to obtain a first calculation result, and perform small-bit-width modular reduction operation on the first calculation result and the modulus to obtain a modular multiplication result, wherein the modular reduction module includes: ​ ​ The large-bit-width reduction unit is configured to split the product into a high-bit part and a low-bit part, split the high-bit part into a plurality of blocks, and construct a lookup table for each block based on the modulus; determine a lookup result corresponding to each block based on the lookup table for each block; The multi-operand accumulation unit is configured to accumulate the lookup result corresponding to each block and the low-bit part to obtain a first calculation result; The small-bit-width reduction unit is configured to perform a small-bit-width modulus reduction operation on the first calculation result and the modulus to obtain a modulus multiplication result.

Images