Method and device for quickly realizing lattice signature algorithm based on parallel architecture

Abstract

The invention discloses a lattice signature algorithm rapid implementation method and device based on a parallel architecture, and the method comprises the steps: generating a random number sequence needed by a polynomial vector y based on the parallel architecture in a manner that the random number generation and sampling steps of the polynomial vector are separated, and obtaining the polynomial vector y in a lattice signature algorithm, a random number sequence required by a polynomial matrix A is generated by adopting a hybrid calculation mechanism of SHAKE128 and SHAKE256, the polynomial matrix A in a lattice signature algorithm is obtained, Hash calculation is performed on a polynomial vector w by adopting a hybrid calculation mechanism of a KECCAK absorption and extrusion stage realized based on multiple paths, and when the polynomial vector w is subjected to Hash calculation, multiple rounds of absorption and extrusion operation are performed in parallel. According to the method, the generation efficiency of the polynomial vector y in the signature rejection process can be effectively improved, so that the execution efficiency of the whole signature is effectively improved. The method can be effectively applied to the algorithms such as ML-DSA, BLISS and HAETAE.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for rapidly implementing a lattice signature algorithm based on a parallel architecture. Background Technology

[0002] With the development of quantum computing, the security of cryptographic algorithms based on the large integer factorization and discrete logarithm difficulties is threatened. Cryptographic algorithms based on lattice difficulties are widely considered resistant to quantum computer attacks. Lattice signature algorithms are typically designed based on two structures: "Hash and Sign" and "Fiat-Shamir with Aborts". For example, the ML-DSA algorithm in the post-quantum signature standard published by NIST is based on the "Fiat-Shamir with Aborts" structure. Signatures based on "Fiat-Shamir with Aborts" use rejection sampling to ensure security. This technique rejects invalid signatures during the signing process and restarts the signing step until a valid signature is obtained. Therefore, rejection sampling causes the signing process to restart multiple times, consuming significant computational resources. Researching how to reduce the time required for the rejection sampling process is crucial for improving the efficiency of signature algorithms.

[0003] Lattice-hard cryptographic algorithms heavily rely on polynomial operations, with polynomial generation being one of the most time-consuming computational components. Polynomial generation can be divided into two steps: generating a random sequence and sampling polynomial coefficients. In the ML-DSA algorithm, the polynomial matrix A has... OK In column A, the random sequence of polynomials is generated by the SHAKE128 function. The polynomial coefficients in A are sampled using a rejection sampling technique, where coefficients greater than q are rejected after each 24-bit sample. Note that the rejection sampling used for the coefficients of the sampling matrix A differs from the rejection sampling technique used in the "Fiat-Shamir with Aborts" structured signature algorithm. The length of the polynomial vector y is... The random sequence of polynomials in y is generated by the SHAKE256 function. During the entire signature process, the polynomial matrix A only needs to be generated once, while the polynomial vector y needs to be regenerated every time the signature is restarted, thus making the lattice signature algorithm inefficient. Summary of the Invention

[0004] The purpose of this invention is to propose a fast implementation method and apparatus for lattice signature algorithms based on a parallel architecture, which reduces the signing time required during the rejection sampling process of signature algorithms designed based on the "Fiat-Shamir with Aborts" structure, thereby accelerating the implementation efficiency of signature algorithms on platforms such as CPU and GPU, and is applicable to various lattice cryptographic signature algorithms.

[0005] To achieve the objectives of this invention, a method and apparatus for rapidly implementing lattice cryptographic signature algorithms based on a parallel architecture are proposed. This invention designs a hybrid computation mechanism for generating multiple random sequences, suitable for lattice signature algorithms with the "Fiat-Shamir with Aborts" structure, which can effectively improve the efficiency of parallel implementation of the algorithm.

[0006] To achieve the above objectives, the first aspect of this invention provides a method for rapidly implementing a lattice signature algorithm based on a parallel architecture, comprising: The random number sequence required to generate the polynomial matrix A is generated using a hybrid SHAKE128 and SHAKE256 computational mechanism, and the polynomial matrix A in the lattice signature algorithm is obtained. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously in the process of generating the random number sequence required to generate the polynomial matrix A. Based on a parallel architecture, the random number sequence required for the polynomial vector y is generated by separating the random number generation and sampling steps of the polynomial vector, and the polynomial vector y in the lattice signature algorithm is obtained. A circular queue structure is used to manage the generated random number sequence. A hybrid computational mechanism based on multi-path implementation of KECCAK absorption and squeezing stages is used to perform hash calculation on polynomial vector w, wherein multiple rounds of absorption and squeezing operations are performed in parallel during the hash calculation of polynomial vector w.

[0007] In one implementation, the random number sequence required for the polynomial vector y is generated using a parallel architecture that separates the random number generation and sampling steps for the polynomial vector, including: At the beginning of each round of resigning, the polynomial vector y is sampled, and the random numbers required to generate y are sampled in multiple stages of the signing process. The global state nonce is maintained as part of the initial state for generating the random sequence of y.

[0008] In one implementation, the stage of generating the random number sequence required for the polynomial vector y using a parallel architecture that separates the random number generation and sampling steps for the polynomial vector includes: generating the polynomial matrix A, sampling the polynomial vector y each time the signature is restarted, and sampling the polynomial vector y. When performing hash calculations.

[0009] In one implementation, a circular queue structure is used to manage the generated random number sequence, including: Based on the dimension of the polynomial vector y The number of parallel paths P used to generate the random number sequence determines the queue size N. Two pointers are set when the queue is first generated. , used to identify the start and end positions of the queue respectively; When a random number sequence is available to generate the polynomial in the vector y, the random number sequence is stored in the queue according to the pointer e, and the pointer is updated. ; When sampling the polynomial vector y in each round of the signature process, the magnitude of the polynomial vector y is used as a guide. Read the random number sequence from the queue and update the pointer. .

[0010] In one implementation, a mixed SHAKE128 and SHAKE256 computational mechanism is used to generate the random number sequence required for the polynomial matrix A, and the polynomial matrix A in the lattice signature algorithm is obtained, including: When generating A, if there exists Then there exist available spare random number sequence computation resources, for the th Second-rate The function call to generate a random sequence will... In the generation of random numbers for the first path Road to the The internal state of the KECCAK path is set to the initial state of the random number sequence of matrix A, and the first KECCAK path is set to the initial state of the random number sequence of matrix A. Road to the The internal state of the KECCAK path is set to the initial state of a random number sequence of y; For route 1 to route 2 The internal state of the KECCAK path is filled according to the SHAKE128 function, for the ... The internal state of KECCAK from path P to path P is filled according to the SHAKE256 method; Run the KECCAK generator function in multiple rounds. After each round of the KECCAK function, the first... Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the last state in A is squeezed. The coefficients of the nth polynomial are sampled; then the nth polynomial is sampled. Road to the The internal state of the road KECCAK is squeezed according to the SAKGE256 algorithm, and the result is stored in a circular queue. Determine the last one in A If all polynomial coefficients have been sampled, the process ends; otherwise, the next round of KECCAK function calculations continues, only sampling the coefficients of the first polynomial. Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the first... Road to the The internal state of the KECCAK path is not processed.

[0011] In one implementation, a hybrid computational mechanism of multiple-path ECCAK absorption and squeezing stages is used to perform hash calculation on the polynomial vector w. During the hash calculation of the polynomial vector w, multiple rounds of absorption and squeezing operations are performed in parallel, including: Using KECCAK's first-way calculation The hash value, others The path is initialized to the initial state of the random number sequence y. Before the first round of KECCAK function calculation, the random sequence generation of y has completed the absorption phase and uses the first path absorption. The first 1088 bits of data are used to fill channels 2 through 4 using the SHAKE256 method; After completing the first round of the KECCAK function, the first path continues to absorb. Data, after output The data in the internal state of the path KECCAK is stored, and the output data is saved to a circular queue; In each round While absorbing the data, the random number sequence of y is squeezed. exist Once the random number sequence for path y is full, the squeezing operation stops, and in each subsequent round of KECCAK calculation, the absorption operation is performed only on the first path. After the absorption of w is completed, the first channel of KECCAK data is filled according to the SHAKE256 method, and the calculation is performed. The hash value is used to output the result of the first path, with a length of [value missing]. of The hash value.

[0012] Based on the same inventive concept, a second aspect of the present invention provides a device for rapidly implementing a lattice signature algorithm based on a parallel architecture, comprising: The SHAKE128 and SHAKE256 hybrid computation module is used to generate the random number sequence required for the polynomial matrix A using the SHAKE128 and SHAKE256 hybrid computation mechanism, and to obtain the polynomial matrix A in the lattice signature algorithm. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously during the process of generating the random number sequence required for the polynomial matrix A. The random number sequence management module is used to generate the random number sequence required for the polynomial vector y by separating the random number generation and sampling steps of the polynomial vector based on a parallel architecture, and to obtain the polynomial vector y in the lattice signature algorithm. The generated random number sequence is managed by a circular queue structure. The KECCAK absorption and squeeze stage hybrid computing module is used to perform hash calculations on polynomial vector w using a multi-way KECCAK absorption and squeeze stage hybrid computing mechanism. During the hash calculation of polynomial vector w, multiple rounds of absorption and squeeze operations are performed in parallel.

[0013] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the fast implementation method of the lattice signature algorithm based on parallel architecture described in the first aspect.

[0014] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the fast implementation method of the lattice signature algorithm based on parallel architecture described in the first aspect.

[0015] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows: (1) Compared with existing technologies for polynomial vectors Currently, hashing methods only sample the single-path SHAKE256 algorithm. This invention migrates its computation to a multi-path implementation based on a parallel architecture and proposes techniques to effectively utilize its computation process. Furthermore, existing methods neglect the use of idle polynomial generation computational resources for A, resulting in wasted computation. This invention effectively utilizes this computational process.

[0016] (2) This invention proposes a hybrid calculation mechanism of SHAKE128 and SHAKE256 and a hybrid calculation mechanism of KECCAK absorption and squeezing stages. By utilizing these two mechanisms, combined with efficient random number sequence management, the generation matrix A can be effectively utilized in conjunction with the polynomial vector. The spare computing resources used for hashing are reduced, and the random sequence generation algorithm is called less when generating the polynomial vector y, which effectively improves the implementation efficiency of the lattice signature algorithm.

[0017] (3) This invention can effectively improve the efficiency of the ML-DSA algorithm and can be applied to other lattice signature algorithms based on the “Fiat-Shamir with Aborts” structure, such as BLISS and HAETAE. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a fast implementation method for a lattice signature algorithm based on a parallel architecture in an embodiment of the present invention; Figure 2 This is a flowchart of the hybrid calculation mechanism of SHAKE128 and SHAKE256 in an embodiment of the present invention; Figure 3 This is a flowchart illustrating the hybrid computation mechanism of the KECCAK absorption and extrusion stages in an embodiment of the present invention. Figure 4 This is a block diagram of a device for rapidly implementing a lattice signature algorithm based on a parallel architecture, as described in this embodiment of the invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 The functions in the SHA-3 standard are based on a sponge structure design, featuring two phases: absorption and squeezing, and various parameter designs tailored to functional and security requirements. During the absorption phase, the SHA-3 series functions read the input bits and execute the KECCAK function once after reading a certain number of bits of input data. During the squeezing phase, the SHA-3 series functions output the data from the internal state of the KECCAK function and execute the KECCAK function once after outputting a certain number of bits of data. The ML-DSA algorithm uses the SHAKE128 and SHAKE256 functions from the SHA-3 standard as the random number generation function and hash function, respectively. The KECCAK function is the core operation function of the SHA-3 standard, with an internal state length of 1600 bits. In a parallel architecture of the computing platform, multiple KECCAK functions can be implemented. Multiple KECCAK functions can simultaneously perform multiple random sequence generation operations in polynomial generation.

[0022] The following is an introduction to the "Fiat-Shamir with Aborts" structural signature algorithm.

[0023] In the “Fiat-Shamir with Aborts” struct signature, the polynomial vector y is sampled to the specified distribution. The sampling process first involves generating a random number sequence using the SHAKE function, and then sampling polynomials with a specific distribution from this sequence. The polynomial matrix A is generated from the seed in the public key using the random number generation function and the sampling process. The polynomial vector is then calculated. c is the result of the hash operation on messages M and w, which will be calculated subsequently. The function N will evaluate conditions such as the norm of z. If z does not meet the conditions, the signature process will be restarted, and y will be sampled again. If z meets the conditions, the signature will be output. .

[0024] Random number generators and hash functions In lattice cryptography, random number generators and hash functions are typically implemented using the SHA-3 family of functions. The SHA-3 family includes four hash functions (SHA3-224, SHA3-256, SHA3-384, and SHA3-512) and two expandable output functions. These algorithms may have different padding and input / output methods depending on different security requirements, but internally they all use the KECCAK function for computation. Random number generators in lattice cryptography are typically implemented using SHAKE128 or SHAKE256, and hash functions are implemented using SHAKE256 or SHA3-512.

[0025] The relevant symbols and definitions involved in this invention are as follows: In matrix A, the first Line number A polynomial; In vector y, the first A polynomial; The random sequence used to fill the polynomial in the sampling vector y, with its nonce value being... ; Multi-way random number sequence generation algorithms can be divided into multi-way SHAKE128 algorithms and multi-way SHAKE256 algorithms. While the filling, absorption, and squeezing phases of the multi-way SHAKE128 and multi-way SHAKE256 algorithms differ, they both use the same multi-way KECCAK algorithm to update their internal state.

[0026] The number of KECCAK functions that can be computed simultaneously in a P-way KECCAK implementation is determined by the parallel architecture of the device used. The internal KECCAK state computed independently in each group in a P-way KECCAK implementation is called a "way". A P-way KECCAK implementation can be divided into the internal states of the 1st, 2nd, and Pth KECCAKs. A sequence of random numbers for a polynomial vector y (matrix A) can be used to generate a complete polynomial. ( A set of random number sequences is generated, where the length of the random sequence of the polynomial vector y is fixed. However, due to the rejection sampling technique used in the polynomial sampling of matrix A, the length of the random sequence of the polynomial matrix A is not fixed. Each set of polynomial random sequences can be generated by one SHAKE128 or SHAKE256 stream.

[0027] This embodiment discloses a fast implementation method for a lattice signature algorithm based on a parallel architecture. Please refer to [link to relevant documentation]. Figure 1 ,include: S101: The random number sequence required to generate the polynomial matrix A is generated using a hybrid SHAKE128 and SHAKE256 algorithm, and the polynomial matrix A in the lattice signature algorithm is obtained. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously during the process of generating the random number sequence required to generate the polynomial matrix A.

[0028] Specifically, the SHAKE128 and SHAKE256 hybrid computation mechanism: In signatures designed based on the "Fiat-Shamir with Aborts" structure, a polynomial matrix A exists. The number of random number sequences required to generate matrix A is determined by the size of A. In a parallel architecture, multiple sets of random numbers can be generated simultaneously, sampling multiple polynomials in A. However, the number of random number sequences that can be generated simultaneously is determined by the hardware architecture used. After multiple calls to the multi-path random number sequence generation algorithm, there may be redundant random number sequences. For example, in the ML-DSA-65 algorithm implemented based on AVX2, the 4-path SHAKE128 algorithm is called 8 times to generate the random number sequences needed for matrix A, and the size of matrix A is... At this point, there are two redundant random number sequences. Please refer to [link / reference]. Figure 2 The embodiments of the present invention utilize the following steps to effectively utilize the computational resources required for the spare random number sequence when generating A: a) When generating A, if there exists Then there exist available spare random number sequence computation resources, for the th Second-rate The function call to generate a random sequence will... In the generation of random numbers for the first path Road to the The internal state of the path's KECCAK is set to the initial state of the random number sequence of matrix A (i.e., 32 bytes). (and 2 bytes of nonce), will the first Road to the The internal state of the KECCAK path is set to the initial state of the random number sequence of y (i.e., 64 bytes). (and a 2-byte nonce).

[0029] b) For route 1 to route 2 The internal state of the KECCAK path is filled according to the SHAKE128 function, for the ... The internal state of KECCAK from path P to path P is filled in according to the SHAKE256 method.

[0030] c) The minimum number of SHAKE128 rounds required to generate each polynomial in A is: Therefore, the number of KECCAK rounds required to generate a random sequence of A is not less than the number of KECCAK rounds required to generate a random sequence of y. First, run the 4-way KECCAK generation function for 5 rounds. After each round of the KECCAK function, for the ... Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the last state in A is squeezed. The coefficients of the nth polynomial are sampled. Road to the The internal state of the KECCAK path is squeezed according to the SAHKE256 algorithm, and the result is stored in a circular queue. d) After 5 rounds of KECCAK function execution and squeezing operations, two new random sequences of polynomial y are added to the circular queue. At this point, determine the last... If the coefficients of the first polynomial have not been sampled, and the random bits of the corresponding random sequence have been exhausted, then proceed to the next round of KECCAK function calculation. In this case, only the first polynomial coefficient is sampled. Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the first... Road to the The internal state of the KECCAK path is not processed.

[0031] e) Repeatedly execute the KECCAK function multiple times, squeezing and... Coefficient sampling operation, until All coefficients have been sampled.

[0032] S102: Based on a parallel architecture, the random number generation and sampling steps of the polynomial vector are separated to generate the random number sequence required for the polynomial vector y, and the polynomial vector y in the lattice signature algorithm is obtained. A circular queue structure is used to manage the generated random number sequence.

[0033] Specifically, S102 is for random number sequence management, which is divided into two parts: the separation of the multinomial vector y random number generation and sampling steps, and a circular queue structure. Separation of random number generation and sampling for polynomial vector y: Most current methods sample the coefficients of y immediately after random number generation. In this invention, the random number sequence generation and polynomial coefficient sampling steps are separated. The polynomial vector y is sampled only at the beginning of each round of re-signing, while the random numbers needed to generate y can be sampled at multiple stages of the signing process. After separation, a global state nonce needs to be maintained as part of the initial state for generating the random sequence of y. The nonce value is incremented by 1 after each generation of a random number sequence of y. The stages for generating the random sequence required for y are divided into the following three stages: 1) When generating the polynomial matrix A.

[0034] 2) Each time the signature is restarted, the polynomial vector y is sampled.

[0035] 3) For polynomial vectors When performing hash calculations.

[0036] Circular queue structure: A circular queue structure is used to manage multiple generated random number sequences. Based on the dimension of the polynomial vector y The number of parallel paths P generated by the random number sequence determines the queue size N. Two pointers are set when the queue is initially generated. , respectively, indicate the start and end positions of the queue.

[0037] Whenever a sequence of random numbers is available to generate a polynomial in vector y, the sequence is stored in a queue according to pointer e, and the polynomial is calculated. . When sampling the polynomial vector y in each round of the signature process, the magnitude of the polynomial vector y is used as a guide. Read the random number sequence from the queue and calculate .

[0038] S103: A hybrid computing mechanism based on multi-way implementation of KECCAK absorption and squeezing stages is used to perform hash calculation on the polynomial vector w, wherein multiple rounds of absorption and squeezing operations are performed in parallel during the hash calculation of the polynomial vector w.

[0039] Specifically, the KECCAK hashing mechanism combines absorption and squeezing phases: multiple rounds of absorption are required when hashing a polynomial vector w. See also... Figure 3 In this embodiment, the single-way hash algorithm implementation is replaced with a multi-way implementation under a parallel architecture, which can be implemented in the following way: a) Calculate using KECCAK's first path The hash value, others The path is initialized to the initial state of the random number sequence y. Before the first round of KECCAK function calculation, the random sequence generation of y has completed the absorption phase and uses the first path absorption. The first 1088 bits of data. At this point, the first channel has not finished absorbing, and only the second to fourth channels are filled using the SHAKE256 method.

[0040] b) After completing the first round of the KECCAK function, the first path continues to absorb... The data shows that the random sequence generation of y has entered the squeezing stage, and the output is as follows: The data in the internal state of the path KECCAK is stored, and the output data is saved to a circular queue.

[0041] c) Subsequently, in each round... While absorbing the data, a squeezing operation is performed on the random number sequence of y.

[0042] d) In Once the random number sequence for path y is full, the squeezing operation stops. At this point, the polynomial vector... The absorption operation is not yet complete. In each subsequent round of KECCAK calculation, the absorption operation is only performed on the first path.

[0043] e) After the absorption of w is completed, fill the first channel of KECCAK data according to the SHAKE256 method, and calculate... The hash value is used to output the result of the first path, with a length of [value missing]. of The hash value.

[0044] In summary, this invention proposes a fast implementation method and apparatus based on a parallel architecture for lattice signature algorithms designed with the "Fiat-Shamir with Aborts" structure. This invention effectively improves the generation efficiency of the polynomial vector y during the rejection signature process, thereby significantly improving the overall execution efficiency of the signature process. This invention can be effectively applied to algorithms such as ML-DSA, BLISS, and HAETAE.

[0045] The innovation of this invention lies in the new method of arranging and manipulating the internal data of the multi-way SHAKE implementation, and combining it with an efficient random number sequence management algorithm, which effectively utilizes the redundant computing resources in the parallel implementation to generate random sequences of y, thereby improving the efficiency of the algorithm.

[0046] Example 2 Based on the same inventive concept, this embodiment discloses a fast implementation device for a lattice signature algorithm based on a parallel architecture. Please refer to [link to relevant documentation]. Figure 4 ,include: The SHAKE128 and SHAKE256 hybrid computation module 201 is used to generate the random number sequence required for the polynomial matrix A using the SHAKE128 and SHAKE256 hybrid computation mechanism, and to obtain the polynomial matrix A in the lattice signature algorithm. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously during the process of generating the random number sequence required for the polynomial matrix A. The random number sequence management module 202 is used to generate the random number sequence required for the polynomial vector y by separating the random number generation and sampling steps of the polynomial vector based on a parallel architecture, and to obtain the polynomial vector y in the lattice signature algorithm. The generated random number sequence is managed by a circular queue structure. The KECCAK absorption and squeeze stage hybrid computing module 203 is used to perform hash calculation on the polynomial vector w using a multi-path-based KECCAK absorption and squeeze stage hybrid computing mechanism, wherein multiple rounds of absorption and squeeze operations are performed in parallel during the hash calculation of the polynomial vector w.

[0047] Since the apparatus described in Embodiment 2 of this invention is the same apparatus used to implement the fast implementation method of the lattice signature algorithm based on parallel architecture in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this apparatus based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All apparatuses used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0048] Example 3 Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in Embodiment 1.

[0049] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the fast implementation method of the lattice signature algorithm based on parallel architecture in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0050] Example 4 The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in Embodiment 1.

[0051] Since the computer device described in Embodiment 4 of this invention is the same computer device used to implement the fast implementation method of the lattice signature algorithm based on parallel architecture in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0052] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0053] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0054] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A fast implementation method for a lattice signature algorithm based on a parallel architecture, characterized in that, include: The random number sequence required to generate the polynomial matrix A is generated using a hybrid SHAKE128 and SHAKE256 computational mechanism, and the polynomial matrix A in the lattice signature algorithm is obtained. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously in the process of generating the random number sequence required to generate the polynomial matrix A. Based on a parallel architecture, the random number sequence required for the polynomial vector y is generated by separating the random number generation and sampling steps of the polynomial vector, and the polynomial vector y in the lattice signature algorithm is obtained. A circular queue structure is used to manage the generated random number sequence. A hybrid computational mechanism based on multi-path implementation of KECCAK absorption and squeezing stages is used to perform hash calculation on polynomial vector w, wherein multiple rounds of absorption and squeezing operations are performed in parallel during the hash calculation of polynomial vector w.

2. The fast implementation method of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, Based on a parallel architecture, the random number sequence required to generate the polynomial vector y is generated by separating the random number generation and sampling steps of the polynomial vector, including: At the beginning of each round of resigning, the polynomial vector y is sampled, and the random numbers required to generate y are sampled in multiple stages of the signing process. The global state nonce is maintained as part of the initial state for generating the random sequence of y.

3. The fast implementation method of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, The parallel architecture employs a method that separates the random number generation and sampling steps for polynomial vectors to generate the random number sequence required for the polynomial vector y. This process includes: generating the polynomial matrix A, sampling the polynomial vector y each time the signature is restarted, and sampling the polynomial vector y. When performing hash calculations.

4. The fast implementation method of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, A circular queue structure is used to manage the generated random number sequence, including: Based on the dimension of the polynomial vector y The number of parallel paths P used to generate the random number sequence determines the queue size N. Two pointers are set when the queue is first generated. These are used to identify the start and end positions of the queue, respectively. When a random number sequence is available to generate the polynomial in the vector y, the random number sequence is stored in the queue according to the pointer e, and the pointer is updated. ; When sampling the polynomial vector y in each round of the signature process, the magnitude of the polynomial vector y is used as a guide. Read the random number sequence from the queue and update the pointer. .

5. The method for fast implementation of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, The random number sequence required to generate the polynomial matrix A is generated using a hybrid SHAKE128 and SHAKE256 computation mechanism, and the polynomial matrix A in the lattice signature algorithm is obtained, including: When generating A, if there exists Then there exist available spare random number sequence computation resources, for the th Second-rate The function call to generate a random sequence will... In the generation of random numbers for the first path Road to the The internal state of the KECCAK path is set to the initial state of the random number sequence of matrix A, and the first KECCAK path is set to the initial state of the random number sequence of matrix A. Road to the The internal state of the KECCAK path is set to the initial state of a random number sequence of y; For route 1 to route 2 The internal state of the KECCAK path is filled according to the SHAKE128 function, for the ... The internal state of KECCAK from path P to path P is filled according to the SHAKE256 method; Run the KECCAK generator function in multiple rounds. After each round of the KECCAK function, the first... Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the last state in A is squeezed. The coefficients of the nth polynomial are sampled; then the nth polynomial is sampled. Road to the The internal state of the road KECCAK is squeezed according to the SAKGE256 algorithm, and the result is stored in a circular queue. Determine the last one in A If all polynomial coefficients have been sampled, the process ends; otherwise, the next round of KECCAK function calculations continues, only sampling the coefficients of the first polynomial. Road to the The internal state of the KECCAK path is squeezed according to the SHAKE128 algorithm, and the first... Road to the The internal state of the KECCAK path is not processed.

6. The fast implementation method of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, A multi-path ECCAK hybrid absorption and squeezing mechanism is used to perform hash calculations on a polynomial vector w. During the hash calculation of the polynomial vector w, multiple rounds of absorption and squeezing operations are performed in parallel, including: Using KECCAK's first-way calculation The hash value, others The path is initialized to the initial state of the random number sequence y. Before the first round of KECCAK function calculation, the random sequence generation of y has completed the absorption phase and uses the first path absorption. The first 1088 bits of data are used to fill channels 2 through 4 using the SHAKE256 method; After completing the first round of the KECCAK function, the first path continues to absorb. Data, after output The data in the internal state of the path KECCAK is stored, and the output data is saved to a circular queue; In each round While absorbing the data, the random number sequence of y is squeezed. exist Once the random number sequence for path y is full, the squeezing operation stops, and in each subsequent round of KECCAK calculation, the absorption operation is performed only on the first path. After the absorption of w is completed, the first channel of KECCAK data is filled according to the SHAKE256 method, and the calculation is performed. The hash value is used to output the result of the first path, with a length of [value missing]. of The hash value.

7. The fast implementation method of the lattice signature algorithm based on parallel architecture as described in claim 1, characterized in that, Parallel architectures include GPUs and AVX.

8. A device for rapidly implementing a lattice signature algorithm based on a parallel architecture, characterized in that, include: The SHAKE128 and SHAKE256 hybrid computation module is used to generate the random number sequence required for the polynomial matrix A using the SHAKE128 and SHAKE256 hybrid computation mechanism, and to obtain the polynomial matrix A in the lattice signature algorithm. The SHAKE128 algorithm and the SHAKE256 algorithm are called simultaneously during the process of generating the random number sequence required for the polynomial matrix A. The random number sequence management module is used to generate the random number sequence required for the polynomial vector y by separating the random number generation and sampling steps of the polynomial vector based on a parallel architecture, and to obtain the polynomial vector y in the lattice signature algorithm. The generated random number sequence is managed by a circular queue structure. The KECCAK absorption and squeeze stage hybrid computing module is used to perform hash calculations on polynomial vector w using a multi-way KECCAK absorption and squeeze stage hybrid computing mechanism. During the hash calculation of polynomial vector w, multiple rounds of absorption and squeeze operations are performed in parallel.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the fast implementation method of the lattice signature algorithm based on a parallel architecture as described in any one of claims 1 to 7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the fast implementation method of the lattice signature algorithm based on parallel architecture as described in any one of claims 1 to 7.

Images