An NTT instruction acceleration method of a RISC-V-based post-quantum cryptographic algorithm Kyber

Abstract

The application belongs to the technical field of post-quantum cryptographic algorithm, and discloses an NTT instruction acceleration method of a post-quantum cryptographic algorithm Kyber based on RISC-V, wherein 256 coefficients in NTT are divided into 16 groups, each group has 16 coefficients, each batch is loaded by using an editable register of RISC-V, and butterfly operation is sequentially performed, data interaction is completed in the register, parallel instructions are issued and executed by using operation rules, more tasks can be completed in the same clock cycle by simultaneously emitting multiple instructions, and thus the instruction execution efficiency is significantly improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of post-quantum cryptography, and particularly relates to an NTT instruction acceleration method of a post-quantum cryptographic algorithm Kyber based on RISC-V. BACKGROUND

[0002] Post-Quantum Cryptography (PQC) is a cryptographic algorithm designed to resist future quantum computer attacks. Quantum computers can efficiently solve mathematical problems that traditional public-key cryptography (such as RSA, ECC) relies on, which makes existing encryption algorithms no longer secure in the era of quantum computing. To cope with this threat, the development of post-quantum cryptography has begun to focus on cryptographic schemes that remain secure in the face of quantum computers.

[0003] Kyber is a lattice-based post-quantum public-key encryption scheme, which has been nominated as one of the candidate algorithms in the NIST post-quantum cryptography standardization process. In Kyber, the Number Theoretic Transform (NTT) is one of the key technologies to achieve efficient encryption and decryption. NTT is a kind of Fast Fourier Transform (FFT) transform on the modulus domain, similar to traditional FFT, but it operates on finite fields, especially in the modular arithmetic of large integers. NTT greatly improves the efficiency of the algorithm by accelerating polynomial multiplication, improving encryption and decryption speed, and optimizing hardware implementation. This makes Kyber a practical encryption scheme in the field of post-quantum cryptography, especially in the face of quantum computing threats. Although NTT can significantly accelerate polynomial multiplication, when performing large-scale calculations, frequent data access, high demand for computing resources and memory, hardware resource limitations, and difficulties in optimizing inverse transformation can all affect its acceleration effect. For this, there have been some research in the existing technology to solve this problem, but the existing methods rely too much on hardware design and ignore software optimization, failing to fully utilize the computing power of software instruction sets; or reduce the amount of core computation, but generate polynomial conversion overhead; unable to meet the requirements of improving instruction execution efficiency while optimizing resource utilization and improving overall energy efficiency. SUMMARY

[0004] To solve the above technical problems, the present application provides an NTT instruction acceleration method of a post-quantum cryptographic algorithm Kyber based on RISC-V, which can effectively reduce NTT cycle consumption and improve overall NTT calculation efficiency.

[0005] The application discloses an NTT instruction acceleration method of a post-quantum cryptographic algorithm Kyber based on RISC-V.

[0006] Step 1, 256 coefficients in the NTT of Kyber are divided into 16 groups, each group containing 16 coefficients; and RISC-V editable registers are used to load in batches, 16 coefficients and corresponding rotation factors being loaded each time;

[0007] Step 2, butterfly operation is sequentially performed on 8 pairs of data of each layer, including sequentially executed multiplication modules, reduction modules and addition and subtraction modules;

[0008] Step 3, when the current and next two pairs of data are multiplication module operations, the processor C can only issue one multiplication module operation instruction at a time, and the second multiplication operation instruction needs to wait for the first multiplication operation instruction to be completed; when the current and next two pairs of data are not double multiplication module operations, the processor C simultaneously issues corresponding module operation instructions to the current and next two pairs of data;

[0009] Step 4, when the first five pairs of data of the first layer execute the butterfly operation, the multiplication module of the next layer of data is inserted into the addition and subtraction module of the previous layer, the multiplication module of the second layer and the addition and subtraction module of the first layer are executed concurrently, step 3 is repeated until all group data are executed in the first layer to the third layer;

[0010] Step 5, when the first five pairs of data of the fourth layer execute the butterfly operation, the multiplication module of the next layer of data is inserted into the addition and subtraction module of the previous layer, the multiplication module of the fifth layer and the addition and subtraction module of the fourth layer are executed concurrently, step 3 is repeated until all group data are calculated in the fourth layer to the seventh layer.

[0011] Further, in step 1, the RISC-V editable register in step 1 is , which stores 16 coefficients and corresponding rotation factors of each group; serves as a temporary register for storing intermediate variables; serves as a constant register for storing modulus and , and the register serves as an intermediate variable scheduling.

[0012] Further, in step 2, the multiplication module is , the reduction module is , and the addition and subtraction module is , ; wherein a i and a j are two coefficients of NTT, i and j satisfy the butterfly distance of each layer; and ζ is a rotation factor.

[0013] Further, the butterfly distance of the first layer is 128, the butterfly distance of the second layer is 64, the butterfly distance of the third layer is 32, the butterfly distance of the fourth layer is 16, the butterfly distance of the fifth layer is 8, the butterfly distance of the sixth layer is 4, and the butterfly distance of the seventh layer is 2.

[0014] The beneficial effects of the present application are: the method loads data packet batches in the NTT into registers, fully utilizes the efficient registers of RISC-V for operation, completes data interaction in the registers, and efficiently utilizes register resources; the method designs double-launch instructions for NTT, processes more tasks in the same clock cycle through simultaneous launching of multiple instructions, thereby significantly improving instruction execution efficiency; the double-launch instructions can better utilize multiple execution units (such as arithmetic logic units, load storage units, etc.) of the processor, reduce resource idling, and improve overall energy efficiency; the present application interleaves modules that cannot be double-launched with modules that can be double-launched, adjusts the instruction sequence, ensures that there is no digital conflict, and the adjusted modules not only run in double-launch mode between instructions, but also run in double-launch mode between different modules, ensuring high double-launch state of the overall NTT. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a flowchart of the method of the present application;

[0016] Figure 2 is a design diagram of NTT double-launch instructions based on RISC-V. DETAILED DESCRIPTION

[0017] In order to make the content of the present application easier to be clearly understood, the present application will be further described in detail below according to specific embodiments and in conjunction with the drawings.

[0018] As shown in Figure 1 , the NTT instruction acceleration method of a post-quantum cryptographic algorithm Kyber based on RISC-V of the present application comprises the following steps:

[0019] Step 1, divide the 256 coefficients in the NTT of Kyber into 16 groups, each group containing 16 coefficients; use the editable registers of RISC-V to load in batches, each time loading 16 coefficients and the corresponding rotation factor;

[0020] Step 2, perform butterfly operation on 8 pairs of data in each layer in turn, including multiplication modules, reduction modules and addition and subtraction modules executed in turn;

[0021] Step 3, when the current two pairs of data are multiplication module operations, the processor C can only issue one multiplication module operation instruction at a time, and the second multiplication operation instruction needs to wait for the first multiplication operation instruction to be completed; when the current two pairs of data are not double multiplication module operations, the processor C simultaneously issues corresponding module operation instructions to the front and rear two pairs of data;

[0022] Step 4, when the first layer of the first five pairs of data executes the butterfly operation, the multiplication module of the next layer of data pair is inserted into the addition and subtraction module of the previous layer, the multiplication module of the second layer and the addition and subtraction module of the first layer are executed concurrently, and step 3 is repeated until all groups of data are executed in the first layer to the third layer;

[0023] Step 5, when the first five pairs of data of the fourth layer execute the butterfly operation, the multiplication module of the next layer of data pair is inserted into the addition and subtraction module of the previous layer, the multiplication module of the fifth layer and the addition and subtraction module of the fourth layer are executed concurrently, and step 3 is repeated until all groups of data are calculated in the fourth layer to the seventh layer.

[0024] In the application, the butterfly operation, the multiplication module is , the reduction module is , and the addition and subtraction module is , ; wherein, ζ is a rotation factor; a i and a j are two coefficients of NTT, i and j need to satisfy the butterfly distance of each layer, the first layer is 128, the second layer is 64, the third layer is 32, the fourth layer is 16, the fifth layer is 8, the sixth layer is 4, and the seventh layer is 2.

[0025] For the 7-layer NTT of Kyber, the application adopts a layered loading strategy, the first three layers are operated once, and the last four layers are operated once, that is, after 8 pairs of data of the same batch complete the operation of the first three layers, the remaining 15 groups of 8 pairs of data are loaded and operated in the first three layers; after all 16 groups of 8 pairs of data are completed in the first three layers, the operation of the last four layers is completed. The operation steps of the last four layers are the same as those of the first three layers.

[0026] Taking the first three layers of NTT with a dimension of 256 in Kyber as an example, the array set is sequentially loaded into the register .

[0027] In the first layer, it is represented as:

[0028] ,

[0029] When the two multiplication modules are completed, the reduction module is entered, that is:

[0030] ,

[0031] Then the add-subtract module operation is performed, i.e.:

[0032] .

[0033] When the first layer is completed, the second layer is executed , i.e. the multiplication module is inserted into the add-subtract module of the previous layer.

[0034] As shown in Figure 2 , in the embodiment, the red block represents the multiplication module, the green block represents the reduction module, and the blue block represents the add-subtract module. The numbers in each column represent the sequentially executed instructions, and the same color blocks with the same number in the same column represent that the instruction can be executed in double issue.

[0035] As can be seen from Figure 2 , the coefficient value will change in the first instruction, thereby affecting the source data of the second instruction. Therefore, by using a temporary register to save the coefficient, a shuffle operation is performed on the data of 8 pairs of coefficients. For example, in the first layer, the temporary register can be used to pre-save the value of (the temporary register can be repeatedly used, such as , which is restored after the completion of and can be used again in the next calculation). Therefore, the register can replace , so that the calculation formula of the add-subtract module does not have data conflicts. Data shuffling is performed in the add-subtract module of each layer to ensure double issue capability. Finally, the coefficients in the register are saved to the corresponding NTT memory.

[0036] The continuous multiplication instruction sequence cannot be double-issued. The present application interleaves the instruction sequence, and under reasonable register allocation, the multiplication module of the next layer (such as the second layer) can be alternately used with the add-subtract module of the previous layer (the first layer). When the multiplication module and the add module appear at the same time and there is no data conflict, the processor can issue the two modules at the same time and execute them in double issue mode.

[0037] For example, in the first layer, after the fifth pair of coefficients in the add module is calculated, the number 0 in the multiplication module can be double-issued with the number 5 in the add module. That is, assuming that the first layer data pair is:

[0038] (a0, a8), (a1, a9), (a2, a10), (a3, a11), (a4, a12), (a5, a13), (a6, a14), (a7, a15) ;

[0039] The second layer is:

[0040] (a0, a4), (a1, a5), (a2, a6), (a3, a7), (a8, a12), (a9, a13), (a10, a14), (a11, a15) ;

[0041] When the first layer completes the butterfly operation of (a0, a8), (a1, a9), (a2, a10), (a3, a11), (a4, a12), the second layer (a0, a4) can be done, then the first layer (a5, a13) and the second layer (a1, a5) are completed, and so on.

[0042] In this case, the application can load the coefficient before the No. 4 addition module instead of before the No. 0 multiplication module (because a4 is used in the No. 4 addition module, and after the No. 0 multiplication module is completed, the operation on a4 is continued, and then the No. 5 addition module is operated, which is equivalent to reusing the a4 of the No. 4 addition module). The No. 5 addition module is The No. 0 multiplication module is Therefore, the depth-adjusted modular operation ensures the high-speed execution of the butterfly.

[0043] The related data obtained by the application through experiments is obtained by programming, testing using C language and assembly combined on a Linux operating system. The hardware and software configurations used in the experiment are shown in Table 1, and the data source in the experiment is a polynomial with a dimension of 256 as the input of NTT.

[0044] Table 1 Experimental platform configuration

[0045]

[0046] Compared with the NTT in the prior art document 1 (i.e., J. Bos et al., “CRYSTALS-Kyber: ACCA-secure module-lattice-based KEM,” in Proc. IEEE Eur. Symp. Secur. Privacy (EuroS & P), Piscataway, NJ, USA: IEEE Press, 2018, pp. 353-367.), the method of the present application only needs 8845 cycles, and the performance is improved by 63.93% compared with the NTT implementation of 24525 cycles of the document 1. The performance of the implemented NTT in the present application is shown in Table 2.

[0047] Table 2 Performance of NTT

[0048]

[0049] In the method of the present application, all intermediate results are saved in the register during the entire NTT calculation process, and reasonable register allocation and management are required. In the 64-bit RISC-V architecture, the coefficients of the NTT are stored in the register, which can reduce the number of memory access times and expand the overflow range of the coefficients. In addition to being applicable to the RISC-V platform architecture, the present application can also be applied to other dual-issue instruction architectures with 64-bit processors, including but not limited to x86-64 (AMD64 and Intel64), ARM64, etc.

[0050] The above is only the preferred scheme of the present application, and is not intended to further limit the present application. Any equivalent changes made according to the content of the specification and drawings of the present application are within the scope of protection of the present application.

Claims

1. A method for accelerating the NTT instruction of the Kyber post-quantum cryptography algorithm based on RISC-V, characterized in that, include: Step 1: Divide the 256 coefficients in Kyber's NTT into 16 groups, with each group containing 16 coefficients; The programmable registers of RISC-V are used to load in batches, with 16 coefficients and corresponding twitch factors loaded each time. Step 2: Perform butterfly operations on the 8 pairs of data in each layer in sequence, including the multiplication module, the reduction module, and the addition and subtraction module executed in sequence; Step 3: When both pairs of data are multiplication module operations, processor C can only issue one multiplication module operation instruction at a time, and the second multiplication operation instruction must wait for the first multiplication operation instruction to complete; when the two pairs of data are not double multiplication module operations, processor C issues the corresponding module operation instructions for both pairs of data simultaneously. Step 4: After the butterfly operation is completed for the first five pairs of data in the first layer, insert the multiplication module of the next layer of data into the addition and subtraction module of the previous layer. The multiplication module of the second layer and the addition and subtraction module of the first layer are executed concurrently. Repeat step 3 until all groups of data have been executed in the first to third layers. Step 5: After the butterfly operation is completed for the first five pairs of data in the fourth layer, insert the multiplication module of the next layer's data pairs into the addition and subtraction module of the previous layer. The multiplication module of the fifth layer and the addition and subtraction module of the fourth layer are executed concurrently. Repeat step 3 until all groups of data have been calculated in the fourth to seventh layers.

2. The NTT instruction acceleration method for the Kyber post-quantum cryptography algorithm based on RISC-V according to claim 1, characterized in that, In step 1, the editable registers of the RISC-V are: It stores the 16 coefficients and corresponding rotation factors for each group; The rest are temporary registers used to store intermediate variables.

3. The NTT instruction acceleration method for the Kyber post-quantum cryptography algorithm based on RISC-V according to claim 2, characterized in that, In step 2, the multiplication module is... The reduction module is The addition and subtraction modules are , ; where a i and a j Let i and j be the two coefficients of NTT, satisfying the butterfly distance at each level; ζ is the rotation factor.

4. The NTT instruction acceleration method for the Kyber post-quantum cryptography algorithm based on RISC-V according to claim 3, characterized in that, The distance between butterflies on the first layer is 128, the distance between butterflies on the second layer is 64, the distance between butterflies on the third layer is 32, the distance between butterflies on the fourth layer is 16, the distance between butterflies on the fifth layer is 8, the distance between butterflies on the sixth layer is 4, and the distance between butterflies on the seventh layer is 2.

Images