Reconfigurable elastic polynomial multiplier architecture and hybrid method based on hybrid basis ntt

Abstract

The application is a reconfigurable elastic polynomial multiplier architecture and a mixed method based on hybrid NTT. The application relates to the technical field of hardware acceleration of lattice-based cryptographic algorithms, and the architecture comprises a control logic unit, an arithmetic logic unit and a coefficient storage module. The control logic unit is responsible for the global scheduling and control of the whole system. The arithmetic logic unit is used for core calculation. The coefficient storage module is used for storing N / 4 polynomial coefficients. The application greatly reduces unnecessary logic and register overhead. By adopting segmented pipeline processing and dynamic power management strategy, the dynamic power consumption is significantly reduced.

Description

Technical Field

[0001] This invention relates to the field of hardware acceleration technology for lattice-based cryptographic algorithms, specifically a reconfigurable flexible polynomial multiplier architecture and hybrid method based on hybrid NTT. Background Technology

[0002] Polynomial multiplication is a core operation in lattice-based post-quantum cryptography (PQC) algorithms, and its computational efficiency directly determines the performance of algorithms such as CRYSTALS-Kyber (now ML-KEM) and CRYSTALS-Dilithium. Number-theoretic transformations (NTTs) are a key technology for accelerating polynomial multiplication, but their hardware implementation faces challenges such as high resource consumption, memory access bottlenecks, and computational latency.

[0003] In 2021, El-Kady et al. proposed an NTT implementation method based on high-level synthesis (HLS). Although this method improved design efficiency, it led to frequent data migration and reduced computational efficiency.

[0004] In 2022, Chen et al. proposed a scalable radix-2 / 4 NTT multiplication architecture (CFNTT) and adopted an efficient conflict-free memory mapping scheme to solve the conflict problem in multi-bank access. However, its architecture still has limitations in flexibility and adaptability to different algorithms.

[0005] In 2023, Zhang et al. constructed a compact in-memory NTT (BP-NTT) using a hardware-algorithm co-design approach to improve modular multiplication parallelism. However, this method relies on a specific in-memory computing (PIM) architecture and has poor versatility. In the same year, Ni et al. proposed an ultra-lightweight BRAM-free iterative NTT core for FPGAs, aiming to save on-chip storage resources and suitable for area-constrained applications such as the Internet of Things. However, its performance was compromised in terms of computational throughput.

[0006] In 2024, Liu et al. proposed an area-efficient, conflict-free, and configurable NTT / INTT acceleration architecture that improves performance by optimizing memory access patterns. However, its butterfly unit has a single function and still requires pre-computation and post-processing operations, which brings additional clock cycle overhead.

[0007] Existing hardware acceleration schemes for polynomial multiplication based on number theory transforms (NTT) suffer from the following technical bottlenecks when applied to post-quantum cryptography algorithms: Existing designs, such as the High-Level Synthesis (HLS) framework by Deepraj Soni et al., can implement multiple algorithms but cannot perform deep hardware optimization; the parallel architecture by Chen et al., while optimized for Kyber, limits its versatility. Most hardware implementations are only suitable for one algorithm and lack reconfigurable architectures that can efficiently adapt to different parameters and security levels (such as ML-KEM-512 / 768 / 1024).

[0008] While the work of Ni Z et al. aimed to reduce BRAM usage, iterative designs are often accompanied by high computational latency. Existing butterfly units (BFUs) have limited functionality, and as Liu S et al. pointed out, their designs still require pre-computation (such as coefficient reordering) and post-processing, introducing additional clock cycle overhead and increasing overall computation time.

[0009] Polynomial multiplication involves irregular access to a large number of coefficients, which can easily lead to memory conflicts. Although Guo W et al. and Chen X et al. have proposed different conflict avoidance schemes, the complexity of the access patterns or the room for improvement in mapping efficiency limit the utilization of parallel computing units and become the main obstacle to performance improvement.

[0010] Traditional modular reduction modules (such as Montgomery Reduction16 and Barrett Reduction17) are not hardware-friendly, resulting in an expansion of the bit width of intermediate operation results, which consumes a lot of logic resources and on-chip memory (BRAM), as discussed by Guo W et al. and H. Gupta et al. This is too costly for area and power-sensitive edge devices.

[0011] Existing solutions generally suffer from the following problems: (1) The polynomial multiplier structure is fixed, resulting in poor compatibility with multiple algorithm platforms; (2) The butterfly unit has a single computational function, requiring pre-computation and post-processing operations such as coefficient rearrangement, which increases latency and resource consumption; (3) Traditional modular reduction modules are not hardware-friendly, leading to an increase in the bit width of intermediate value data and consuming more hardware resources; (4) The memory mapping strategy is complex, making it difficult to completely avoid access conflicts, or sacrificing performance or area to resolve conflicts. These limitations make it extremely complex to achieve efficient and secure computation on resource-constrained lightweight edge devices such as IoT or mobile devices. Summary of the Invention

[0012] To address the high latency, high resource consumption, and memory access bottlenecks in polynomial multiplication operations in post-quantum cryptography algorithms, this invention provides a reconfigurable elastic polynomial multiplier architecture and hybrid method based on hybrid basis NTT.

[0013] This invention provides the following technical solutions: A reconfigurable flexible polynomial multiplier architecture based on hybrid-based NTT, the architecture comprising: a control logic unit, an arithmetic logic unit, and a coefficient storage module; The control logic unit is responsible for the global scheduling and control of the entire system. Its core is the near memory mapping unit, which dynamically generates the data read address, Twiddle factor address, and data write-back address. The near memory mapping unit ensures that in each iteration of the polynomial transformation, the four parallel operands are located in different storage banks, thereby fundamentally avoiding read and write conflicts. The arithmetic logic unit, used for core computation, specifically includes: a reconfigurable flexible computing array, a Twiddle factor ROM, and an address arbiter; The coefficient storage module includes four independent dual-port RAM banks, each bank storing N / 4 polynomial coefficients.

[0014] Preferably, the reconfigurable elastic computing array includes four structurally heterogeneous butterfly units, BFU0, BFU1, BFU2 and BFU3.

[0015] Preferably, BFU0 and BFU3 perform standard radix-2 butterfly operations; BFU1 is responsible for efficient modular addition and modular subtraction operations.

[0016] Preferably, BFU2 is a built-in additional modular multiplier for calculating intermediate values ​​of (a*ω1 ± b*ω2) mod q and can be configured as a Twiddle factor generator.

[0017] Preferably, the multi-bank function in the coefficient storage module supports simultaneous reading and writing of four coefficients per clock cycle, providing data support for the four-way parallel butterfly operation. Data write-back writes the calculation results of the BFU back to the specified bank address.

[0018] A cryptographic coprocessor integrating a reconfigurable elastic multinomial multiplier architecture based on hybrid NTT for accelerating the operation of at least one of CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium algorithms.

[0019] A hybrid-based 2 / 4 NTT method, the method being based on a reconfigurable elastic polynomial multiplier architecture based on hybrid-based NTT, the method comprising the following steps: In radix-4 NTT mode, BFU0-BFU3 form a complete 4-point butterfly arithmetic unit, which processes 4 input coefficients at a time; In radix-2 NTT mode or PWM mode, BFU0 and BFU3 operate independently as two parallel radix-2 butterfly units, while BFU1 and BFU2 are configured to perform modular addition, modular subtraction, or auxiliary modular multiplication operations.

[0020] Preferably, the method further includes the following steps: Input a coefficient index address 'a' in binary representation; Calculate the sum of the least significant bits of the address; Take the sum modulo 4 to obtain the Bank index BI where the coefficient should be stored; Take the remaining high-order bits of this address as the internal offset address BA in the aforementioned Bank; The mapping ensures that in each level and each iteration of the butterfly operation, the four coefficients that need to participate in the operation are allocated to four different physical banks, thus achieving conflict-free parallel access.

[0021] A computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement a hybrid 2 / 4 NTT method.

[0022] A computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement a hybrid 2 / 4 NTT method.

[0023] The present invention has the following beneficial effects: This invention aims to address the problems of low efficiency, large storage space consumption, and large intermediate result storage requirements in existing post-quantum cryptography algorithms, especially those such as CRYSTALS-Dilithium and CRYSTALS-Kyber, when performing operations such as key generation, encapsulation, decapsulation, signature generation, and signature verification.

[0024] The core of this invention is applicable to the hardware implementation of multinomial multipliers based on NTT lattice cryptography algorithms such as CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium, and has the following advantages: With Deepraj Soni et al. Compared to the general framework, this invention achieves deep hardware-level optimization through elastic computing arrays and configurable BFUs. Compared to the dedicated architecture of Chen Tao et al., this architecture can simultaneously perform key generation, encapsulation, decapsulation, signature generation, and signature verification for all security levels of CRYSTALS-Dilithium and CRYSTALS-Kyber (ML-KEM), solving the limitation of existing solutions that "one architecture corresponds to one algorithm" and significantly improving the utilization value of hardware resources and deployment flexibility.

[0025] The proposed hybrid radix 2 / 4 NTT algorithm completely eliminates pre-computation and post-processing steps (such as bit reversal) by recombining the computation sequence, achieving pure in-place computation. Compared to the iterative design by Ni Z et al., this invention employs a four-way parallel pipeline and deeply integrates NTT / INTT with dot product (PWM) operations. Experiments show that this design achieves a 2.1x speedup for the ML-KEM algorithm, and reduces key encapsulation time (KET) by 1.2 to 2.1 times compared to the latest schemes.

[0026] This invention innovatively proposes a hierarchical, conflict-free near-memory mapping scheme. Compared with the conflict graph scheme of Chen X et al. or the access mode optimization of Guo W et al., this method, through a determined address mapping function, mathematically guarantees that in any iteration step, the four coefficients of parallel access will necessarily be distributed in four independent physical memory banks, achieving 100% memory bandwidth utilization and fundamentally solving the memory bottleneck problem that restricts parallelism.

[0027] Through algorithm-hardware co-optimization, this invention designs a highly optimized configurable modular arithmetic unit and BFU structure, significantly reducing unnecessary logic and register overhead. Employing segmented pipelined processing and dynamic power management strategies, dynamic power consumption is significantly reduced. Overall results show that, at 28nm process technology, compared to state-of-the-art solutions, this invention achieves up to 75% power reduction and 65.8% energy efficiency improvement, while also achieving a 17x improvement in throughput-per-area efficiency, making it highly suitable for resource-constrained applications such as the Internet of Things (IoT). Attached Figure Description

[0028] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 The diagram shown is a partial system architecture diagram of the RePM accelerator of this invention. Figure 2 The diagram shows a typical base 2 NTT butterfly unit (BFU0 / BFU3) hardware structure diagram of the present invention; Figure 3 The diagram shown is a simplified hardware structure diagram of the butterfly unit (BFU1) without modular multiplication according to the present invention. Figure 4The diagram shown is a hardware structure diagram of the butterfly unit (BFU2) requiring additional modular multiplication according to the present invention. Figure 5 The diagram shown illustrates the reconfigurable elastic computing array architecture of this invention. Detailed Implementation

[0030] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] The present invention will be described in detail below with reference to specific embodiments. Specific Implementation Example 1: according to Figures 1 to 5 As shown, the specific optimization technical solution adopted by the present invention to solve the above-mentioned technical problems is: The present invention relates to a reconfigurable elastic polynomial multiplier architecture and hybrid method based on hybrid NTT.

[0033] This invention provides a reconfigurable flexible polynomial multiplier architecture based on hybrid NTT, the architecture comprising: a control logic unit, an arithmetic logic unit, and a coefficient storage module; The control logic unit is responsible for the global scheduling and control of the entire system. Its core is the near memory mapping unit, which dynamically generates the data read address, Twiddle factor address, and data write-back address. The near memory mapping unit ensures that in each iteration of the polynomial transformation, the four parallel operands are located in different storage banks, thereby fundamentally avoiding read and write conflicts. The arithmetic logic unit, used for core computation, specifically includes: a reconfigurable flexible computing array, a Twiddle factor ROM, and an address arbiter; The coefficient storage module includes four independent dual-port RAM banks, each bank storing N / 4 polynomial coefficients.

[0034] By reconstructing the traditional NTT computation sequence and optimizing the scheduling of Twiddle factors, the radix-4 algorithm is embedded into the radix-2 computation framework. This achieves in-place computation without pre-computation (bit reversal) and without post-processing, and supports the reuse of the same set of Twiddle factors in both NTT and INTT, significantly reducing computational complexity and latency. The core of this method lies in solving the compatibility problem of directly applying the radix-4 algorithm to specific polynomial lengths (such as n=256 in ML-KEM).

[0035] The array consists of four functionally heterogeneous, independently configurable butterfly units (BFU0, BFU1, BFU2, BFU3). BFU0 and BFU3 perform standard radix-2 butterfly operations; BFU1 handles efficient modular addition and subtraction; and BFU2 integrates an additional modular multiplier for calculating complex intermediate values ​​and generating multi-mode Twiddle factors. Dynamic scheduling of computing resources via a central command encoder (CE) and configuration register (CR) enables the array to flexibly adapt to various operation modes such as NTT, INTT, and PWM, making it the core component for achieving cross-algorithm (ML-KEM, Dilithium) support and high-performance computing. Specific Implementation Example 2: The only difference between Embodiment 2 and Embodiment 1 of this application is that: The reconfigurable elastic computing array comprises four structurally heterogeneous butterfly units: BFU0, BFU1, BFU2, and BFU3. Specific Implementation Example 3: The only difference between Embodiment 3 and Embodiment 2 of this application is that: BFU0 and BFU3 perform standard radix-2 butterfly operations; BFU1 is responsible for efficient modular addition and subtraction operations. Specific Implementation Example 4: The only difference between Embodiment 4 and Embodiment 3 of this application is that: BFU2 is a built-in extra modular multiplier for calculating intermediate values ​​of (a*ω1 ± b*ω2) mod q and can be configured as a Twiddle factor generator. Specific Implementation Example 5: The difference between Embodiment 5 and Embodiment 4 of the present invention lies only in: The multi-bank function in the coefficient storage module supports simultaneous reading and writing of four coefficients per clock cycle, providing data support for four-way parallel butterfly operations. Data write-back writes the calculation results of BFU back to the specified bank address. Specific Implementation Example Six: The difference between Embodiment Six and Embodiment Five of the present invention lies only in: The present invention provides a cryptographic coprocessor that integrates a reconfigurable elastic multinomial multiplier architecture based on hybrid NTT, for accelerating the operation of at least one of CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium algorithms. Specific Implementation Example 7: The difference between Embodiment Seven and Embodiment Six of the present invention lies only in: This invention provides a hybrid-based 2 / 4 NTT method, which operates based on a reconfigurable elastic polynomial multiplier architecture based on hybrid-based NTT. The method includes the following steps: In radix-4 NTT mode, BFU0-BFU3 form a complete 4-point butterfly arithmetic unit, which processes 4 input coefficients at a time; In radix-2 NTT mode or PWM mode, BFU0 and BFU3 operate independently as two parallel radix-2 butterfly units, while BFU1 and BFU2 are configured to perform modular addition, modular subtraction, or auxiliary modular multiplication operations. Specific Implementation Example 8: The difference between Embodiment 8 and Embodiment 7 of the present invention lies only in: The method further includes the following steps: Input a coefficient index address 'a' in binary representation; Calculate the sum of the least significant bits of the address; Take the sum modulo 4 to obtain the Bank index BI where the coefficient should be stored; Take the remaining high-order bits of this address as the internal offset address BA in the aforementioned Bank; The mapping ensures that in each level and each iteration of the butterfly operation, the four coefficients that need to participate in the operation are allocated to four different physical banks, thus achieving conflict-free parallel access.

[0043] To address the inherent conflict problem in polynomial coefficient access, a deterministic mapping function based on address bit operations is proposed. This function segments the binary representation of any coefficient index address, using the sum of specific low-order bits modulo 4 as the memory bank index (BI), and the remaining high-order bits as the intra-block offset address (BA). This mechanism mathematically guarantees that in all stages and iterations of the butterfly operation, the four coefficients accessed in parallel are absolutely uniformly distributed across four independent physical memory banks, thus achieving 100% conflict-free parallel access and completely eliminating the memory access bottleneck.

[0044] It covers a complete closed loop from algorithm optimization to hardware implementation. This includes: adopting a deep pipeline design to hide operation latency; utilizing a dynamic matrix computation strategy to initiate computation during matrix / vector generation, greatly reducing the storage requirements and waiting time for intermediate results; designing highly optimized dedicated modular arithmetic units (such as BFU2) to reduce intermediate bit width and lower resource consumption; and time-division multiplexing common computing resources such as the Keccak core and sampling modules among different algorithms to maximize hardware utilization efficiency. Specific Implementation Example Nine: The difference between Embodiment Nine and Embodiment Eight of the present invention lies only in: The present invention provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement a hybrid 2 / 4 NTT method. Specific Implementation Example 10: The only difference between Embodiment 10 and Embodiment 9 of the present invention is that: The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a hybrid 2 / 4 NTT method. Specific Implementation Example Eleven: The only difference between Embodiment Eleven and Embodiment Nine of the present invention is that: This invention provides a reconfigurable elastic polynomial multiplier architecture based on hybrid basis NTT and its near-memory mapping method, aiming to solve the problems of high latency, high resource consumption, and memory access bottlenecks in polynomial multiplication operations in post-quantum cryptography algorithms. The technical solution of this invention is described in detail below with reference to the accompanying drawings.

[0048] The RePM architecture proposed in this invention mainly consists of three parts: a control logic unit, an arithmetic logic unit, and a coefficient storage module.

[0049] The control logic unit is responsible for the global scheduling and control of the entire system. Its core is the near-memory mapping unit, which dynamically generates the data read address, Twiddle factor address, and data write-back address based on the conflict-free address mapping algorithm proposed in this invention (see Algorithm 2). This unit ensures that in each iteration of the polynomial transformation, the four parallel operands reside in different storage banks, thereby fundamentally avoiding read-write conflicts.

[0050] Arithmetic logic unit: This is the core of the calculation in this invention, and it consists of the following sub-modules: The reconfigurable elastic computing array consists of four structurally heterogeneous butterfly units (BFU0, BFU1, BFU2, BFU3). These BFUs are not simple copies, but are specifically optimized for different computational steps in the hybrid-based NTT algorithm, as shown in the attached diagram. Figure 2 , 3 As shown in Figure 4.

[0051] Twiddle Factor ROM: Used to store the rotation factors required in NTT / INTT operations. The address generator generates addresses based on the current operation stage and iteration step, reads the corresponding factors from the ROM, and sends them to the corresponding BFU.

[0052] Address arbitrator: coordinates access requests from multiple BFUs to the storage module, ensuring orderly and efficient data flow.

[0053] The coefficient storage module consists of four independent dual-port RAM banks, each storing N / 4 polynomial coefficients. This multi-bank architecture supports simultaneous reading and writing of four coefficients per clock cycle, providing data support for four-way parallel butterfly operations. The data write-back unit writes the BFU calculation results back to the designated bank address.

[0054] This invention first proposes a hybrid radix 2 / 4 NTT algorithm. This algorithm embeds the radix 4 algorithm into a radix 2 framework by reconstructing the computation sequence of the traditional NTT. Its innovation lies in: Eliminating pre-computation and post-processing: Through clever Twiddle factor arrangement and loop structure adjustment, the necessary pre-computation or post-processing step of bit reversal is completely eliminated, realizing true in-place computation.

[0055] Twiddle factor reuse: The same set of Twiddle factors can be reused in NTT and its inverse operation INTT, reducing the need for ROM storage capacity.

[0056] Compatibility: This algorithm is applicable to polynomial lengths that do not satisfy the strict radix-4 condition, such as ML-KEM (N=256 / 512), thus expanding the application scope of radix-4 NTT.

[0057] Workflow of elastic computing arrays: The four BFUs in the arithmetic logic unit work together under the scheduling of the control unit.

[0058] In radix-4 NTT mode, BFU0-BFU3 constitute a complete 4-point butterfly arithmetic unit, processing 4 input coefficients at a time.

[0059] In radix-2 NTT mode or PWM (dot multiplication) mode, BFU0 and BFU3 can operate independently as two parallel radix-2 butterfly units, while BFU1 and BFU2 are configured to perform modular addition, modular subtraction, or auxiliary modular multiplication operations.

[0060] BFU2 is the most complex unit, with an additional modular multiplier built in for calculating intermediate values ​​such as (a*ω1 ± b*ω2) mod q, and can be configured as a Twiddle factor generator.

[0061] This reconfigurability enables the array to efficiently adapt to the diverse computational requirements of algorithms such as ML-KEM encryption and decryption and Dilithium signature verification, thereby maximizing the utilization of computing resources.

[0062] Implementation of conflict-free near-memory mapping method: The core of this method lies in mapping the index addresses of polynomial coefficients to specific storage bank numbers and offset addresses within those banks. The steps are as follows: Input a coefficient index address a (in binary representation).

[0063] Calculate the sum of the least significant bits of the address.

[0064] Take the sum modulo 4 to obtain the Bank Index (BI) where the coefficient should be stored.

[0065] Take the remaining high-order bits of the address as its internal offset address (BA) in the aforementioned Bank.

[0066] This mapping ensures that in each level and each iteration of the butterfly operation, the four coefficients that need to participate in the operation are necessarily allocated in four different physical banks, thus achieving completely conflict-free parallel access.

[0067] Based on the above, the present invention also provides the following technical solutions: A polynomial multiplication method for post-quantum cryptography employs the mixed-radix 2 / 4 number-theoretic transform (NTT) algorithm, which achieves in-situ computation without bit reversal by reconstructing the computation sequence and scheduling the Twiddle factor; and uses the aforementioned conflict-free near-memory mapping method to access the polynomial coefficients.

[0068] A reconfigurable elastic computing array comprises four structurally distinct and functionally configurable butterfly units (BFUs), a command encoder (CE), and a configuration register (CR). The command encoder is used to receive external instructions and parameters, dynamically allocate computing tasks and parameters to the four BFUs, and configure their operating modes to perform NTT, INTT, or dot multiplication (PWM) operations.

[0069] A conflict-free memory mapping method for storing polynomial coefficients includes: receiving a coefficient index address; calculating the sum of a specific low-order bit of the address and taking the modulo of the number of memory banks to obtain a memory bank index (BI); taking the remaining high-order bits of the address to obtain an intra-block offset address (BA); and accessing the corresponding memory bank and address unit according to the BI and BA.

[0070] A polynomial multiplier hardware system includes: a reconfigurable flexible computing array as described above; a control logic unit for generating control signals and Twiddle factor addresses for the computing array; a coefficient storage module consisting of multiple dual-port memory banks for storing polynomial coefficients; and a near-memory mapping unit for executing a conflict-free memory mapping method to provide conflict-free data access for the computing array.

[0071] The above description is merely a preferred embodiment of a reconfigurable elastic polynomial multiplier architecture and hybrid method based on hybrid-based NTT. The scope of protection for a reconfigurable elastic polynomial multiplier architecture and hybrid method based on hybrid-based NTT is not limited to the above embodiments; all technical solutions falling within this conceptual framework are within the protection scope of this invention. It should be noted that for those skilled in the art, any improvements and variations made without departing from the principles of this invention should also be considered within the protection scope of this invention.

Claims

1. A reconfigurable elastic polynomial multiplier based on hybrid basis NTT, characterized in that: The multiplier includes: a control logic unit, an arithmetic logic unit, and a coefficient storage module; The control logic unit is responsible for the global scheduling and control of the entire system. Its core is the near memory mapping unit, which dynamically generates the data read address, Twiddle factor address, and data write-back address. The near memory mapping unit ensures that in each iteration of the polynomial transformation, the four parallel operands are located in different storage banks, thereby fundamentally avoiding read and write conflicts. The arithmetic logic unit, used for core computation, specifically includes: a reconfigurable flexible computing array, a Twiddle factor ROM, and an address arbiter; The coefficient storage module includes four independent dual-port RAM banks, each bank storing N / 4 polynomial coefficients; The reconfigurable elastic computing array comprises four structurally heterogeneous butterfly units: BFU0, BFU1, BFU2, and BFU3. BFU0 and BFU3 perform standard radix-2 butterfly operations; BFU1 is responsible for efficient modular addition and subtraction operations. BFU2 is a built-in extra modular multiplier for calculating intermediate values ​​of (a*ω1 ± b*ω2) mod q and can be configured as a Twiddle factor generator; The multi-bank function in the coefficient storage module supports simultaneous reading and writing of four coefficients per clock cycle, providing data support for four-way parallel butterfly operations. Data write-back writes the calculation results of BFU back to the specified bank address.

2. A cryptographic coprocessor, characterized in that: The processor integrates a reconfigurable elastic polynomial multiplier based on hybrid NTT as described in claim 1, for accelerating the operation of at least one of CRYSTALS-Kyber and CRYSTALS-Dilithium algorithms.

3. A hybrid-based 2 / 4 NTT method, said method being based on a reconfigurable elastic polynomial multiplier based on hybrid-based NTT as described in claim 1, characterized in that: The method includes the following steps: In radix-4 NTT mode, BFU0-BFU3 form a complete 4-point butterfly arithmetic unit, which processes 4 input coefficients at a time; In radix-2 NTT mode or PWM mode, BFU0 and BFU3 operate independently as two parallel radix-2 butterfly units, while BFU1 and BFU2 are configured to perform modular addition, modular subtraction, or auxiliary modular multiplication operations.

4. The method according to claim 3, characterized in that: The method further includes the following steps: Input the binary representation of the coefficient index address 'a'; Calculate the sum of the least significant bits of the address; Take the sum modulo 4 to obtain the Bank index BI where the coefficient should be stored; Take the remaining high-order bits of this address as the internal offset address BA in the aforementioned Bank; The mapping ensures that in each level and each iteration of the butterfly operation, the four coefficients that need to participate in the operation are allocated to four different physical banks, thus achieving conflict-free parallel access.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the method as claimed in any one of claims 3-4.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the method of any one of claims 3-4.

Images