A sparse adder circuit suitable for HQC algorithm

Abstract

This invention discloses a sparse adder circuit suitable for the HQC algorithm, belonging to the field of digital circuits. The circuit is designed based on the efficient addition strategy using non-zero value position information proposed in this invention. By automatically skipping zero-value operations during the operation, it can significantly reduce invalid computations. At the hardware level, a pipelined structure and collision avoidance strategy are adopted. By optimizing the data path and scheduling mechanism, data collisions are completely eliminated, achieving fully pipelined addition processing. This significantly improves the throughput and overall execution efficiency, enhancing the hardware processing efficiency of post-quantum cryptography algorithms, and is particularly suitable for cryptographic security applications with high real-time requirements.

Description

Technical Field

[0001] This invention belongs to the field of digital circuits, and more specifically, relates to a sparse adder circuit suitable for the HQC algorithm. Background Technology

[0002] In the digital age, information security has become a crucial cornerstone for national security, economic stability, and the protection of personal privacy. Whether it's military communications, financial transactions, industrial control systems, or everyday e-commerce and social media applications, all rely heavily on the security provided by existing cryptographic systems. However, the security of traditional cryptographic protocols rests on the intractability of certain mathematical problems within the classical computing model, and the rapid development of quantum computing poses a serious challenge to this foundation. Once quantum computers are put into practical use, widely used public-key cryptosystems (such as RSA and ECC) will face the risk of being cracked; this threat is known as the "quantum threat."

[0003] HQC was chosen to advance standardization due to its good balance between security and efficiency, in order to enrich the technical system for future key establishment.

[0004] Against this backdrop, designing an efficient hardware implementation structure tailored to the characteristics of the HQC algorithm has significant theoretical and practical value. In particular, its computation involves numerous sparse vector and matrix operations, and traditional adders are not optimized for these sparse operations, resulting in low computational efficiency.

[0005] Therefore, there is an urgent need for a dedicated sparse adder circuit and corresponding operation method tailored to the characteristics of the HQC algorithm, in order to improve the overall operation efficiency. Summary of the Invention

[0006] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a sparse adder circuit suitable for the HQC algorithm, thereby solving the technical problem of low computational efficiency of traditional adders in processing the HQC algorithm.

[0007] To achieve the above objectives, according to a first aspect of the present invention, a sparse adder circuit suitable for the HQC algorithm is provided, comprising: first and second input terminals, first to fourth register blocks, first to third two-stage registers, first and second comparators, first and second two-way selectors, a shifter, an XOR gate array, and a multiplexer module; The dense polynomial data is pre-stored in the first RAM, and the non-zero value location information of the sparse polynomial is pre-stored in the second RAM; the non-zero value location information of the sparse polynomial includes block address and intra-block location information. The sparse polynomial non-zero value position valid signal is input through the first input terminal and then split into two paths. One path is used as a read enable signal and input to the read enable terminal of the first RAM. The other path is delayed for two clock cycles through the first two-stage register and then used as a write enable signal and input to the write enable terminal of the third RAM. After the non-zero value position information of the sparse polynomial is input through the second input terminal, the intra-block position information is delayed for two clock cycles by the first and second register blocks and then input to the shifter. The shifter shifts a preset constant 1 to the left according to the intra-block position information to form a mask of a preset size. The block address is input to the first input terminal of the first comparator, the first input terminal of the second comparator, the third register block, and the read address terminal of the first RAM. The block address after a one-clock-cycle delay by the third register block is input to the second input terminal of the first comparator and the fourth register block. The block address after another one-clock-cycle delay by the fourth register block is input to the write address terminal of the third RAM and the second terminal of the second comparator. The signals output by the first and second comparators are delayed for two clock cycles by the second and third register stages and then input to the multiplexing module. The first RAM has a two-clock-cycle read delay, which is used to read the corresponding dense polynomial data according to the read address when the read enable signal is valid and input it to the multiplexing module. When the block address of the current clock cycle is the same as the block address of the previous clock cycle, the output of the first comparator is 1; otherwise, it is 0. When the block address of the current clock cycle is the same as the block address of the previous two clock cycles, the output of the second comparator is 1; otherwise, it is 0. When the outputs of both the first and second comparators are 0, the multiplexing module outputs the data read from the first RAM according to the block address signal of the current clock cycle to the XOR gate array. When the outputs of both the first and second comparators are 1, or when the outputs of the first and second comparators are 1 and 0 respectively, the multiplexing module outputs the result polynomial data of the previous clock cycle to the XOR gate array. When the outputs of the first and second comparators are 0 and 1 respectively, the multiplexing module outputs the result polynomial data of the previous two clock cycles to the XOR gate array. The XOR gate array is used to perform an XOR operation on a mask of a preset size and the data output by the multiplexing module to obtain a result polynomial data; the result polynomial data is input to the write data terminal of the third RAM and the multiplexing module respectively; the preset size is the storage bit width of the first to third RAM; The third RAM is used to write the result polynomial data according to the write address when the write enable signal is valid.

[0008] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: This invention addresses the characteristics of sparse vector operations in the HQC algorithm by proposing an efficient addition strategy based on non-zero position information. This strategy effectively utilizes sparse structures to reduce redundant operations. Based on this addition strategy, a sparse adder circuit suitable for the HQC algorithm is designed. At the hardware level, by optimizing the data path and scheduling mechanism, data conflicts are completely eliminated, achieving fully pipelining addition processing. This significantly improves the throughput and overall execution efficiency, and can significantly enhance the hardware processing efficiency of post-quantum cryptography algorithms, making it particularly suitable for cryptographic security applications with high real-time requirements. Attached Figure Description

[0009] Figure 1 A schematic diagram of the connection between the sparse adder circuit and peripheral devices for the HQC algorithm provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a sparse adder circuit suitable for the HQC algorithm provided in an embodiment of the present invention. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0011] This invention provides a sparse adder circuit suitable for the HQC algorithm, such as... Figure 1 As shown, it includes: first and second input terminals, first to fourth register blocks, first to third level registers, first and second comparators, first and second two-way selectors, shifters, XOR gate arrays and multiplexing modules; The dense polynomial data is pre-stored in the first RAM, and the non-zero value location information of the sparse polynomial is pre-stored in the second RAM; the non-zero value location information of the sparse polynomial includes the block address and the location information within the block; the result polynomial data is stored in the third RAM; the storage bit width of the first to the third RAM is the same. The sparse polynomial non-zero value position valid signal is input through the first input terminal and then split into two paths. One path is used as a read enable signal and input to the read enable terminal of the first RAM. The other path is delayed for two clock cycles through the first two-stage register and then used as a write enable signal and input to the write enable terminal of the third RAM. After the non-zero value position information of the sparse polynomial is input through the second input terminal, the intra-block position information is delayed for two clock cycles by the first and second register blocks and then input to the shifter. The shifter shifts a preset constant 1 to the left according to the intra-block position information to form a mask of a preset size. The block address is input to the first input terminal of the first comparator, the first input terminal of the second comparator, the third register block, and the read address terminal of the first RAM. The block address after a one-clock-cycle delay by the third register block is input to the second input terminal of the first comparator and the fourth register block. The block address after another one-clock-cycle delay by the fourth register block is input to the write address terminal of the third RAM and the second terminal of the second comparator. The signals output by the first and second comparators are delayed for two clock cycles by the second and third register stages and then input to the multiplexing module. The first RAM has a two-clock-cycle read delay, which is used to read the corresponding dense polynomial data according to the read address when the read enable signal is valid and input it to the multiplexing module. When the block address of the current clock cycle is the same as the block address of the previous clock cycle, the output of the first comparator is 1; otherwise, it is 0. When the block address of the current clock cycle is the same as the block address of the previous two clock cycles, the output of the second comparator is 1; otherwise, it is 0. When the outputs of both the first and second comparators are 0, the multiplexing module outputs the data read from the first RAM according to the block address signal of the current clock cycle to the XOR gate array. When the outputs of both the first and second comparators are 1, or when the outputs of the first and second comparators are 1 and 0 respectively, the multiplexing module outputs the result polynomial data of the previous clock cycle to the XOR gate array. When the outputs of the first and second comparators are 0 and 1 respectively, the multiplexing module outputs the result polynomial data of the previous two clock cycles to the XOR gate array. The XOR gate array is used to perform an XOR operation on a mask of a preset size and the data output by the multiplexing module to obtain a result polynomial data; the result polynomial data is input to the write data terminal of the third RAM and the multiplexing module respectively; the preset size is the storage bit width of the first to third RAM; The third RAM is used to write the result polynomial data according to the write address when the write enable signal is valid.

[0012] Preferably, the preset size is 128 bits, that is, the storage width of the dense polynomial and the result polynomial is 128 bits, and the storage width of the third and fourth registers is 128 bits.

[0013] Preferably, the storage width of the block address is 9 bits, that is, the storage width of the fifth and sixth register blocks is 9 bits; the storage width of the location information within the block is 7 bits, that is, the storage width of the first and second register blocks is 7 bits.

[0014] Preferably, the initial values ​​of the third and fourth register blocks are 9'h1ff, and the initial values ​​of the first, second, fifth, and sixth register blocks and the first to third level registers are all 0.

[0015] Preferably, the non-zero value location information of the sparse polynomial is directly stored in the second RAM during the sampling stage.

[0016] Specifically, we will first introduce the specific operations of polynomial addition in the HQC algorithm.

[0017] Let polynomials a and b be denoted as

[0018]

[0019] The coefficients of each polynomial are in In this context, each polynomial's coefficients have only two possibilities: 0 and 1. Let b be a sparse polynomial and a be a dense polynomial. A sparse polynomial is one in which only a very small number of coefficients are 1, and the rest are 0.

[0020] If we denote the addition operation in the HQC algorithm as a + b, then

[0021] Therefore, polynomial addition in HQC is actually a bitwise XOR operation between two polynomials. However, since the value of n is very large, and most of the coefficients in polynomial b are 0, if every coefficient of polynomial b is XORed with polynomial a, there will be many redundant operations.

[0022] Based on this, the present invention proposes an efficient addition strategy based on non-zero value position information. That is, without performing bitwise XOR operations, it only inverts the corresponding positions in polynomial a based on the non-zero value positions in polynomial b. Since polynomials a and b are obtained through sampling operations, the present invention directly stores the non-zero value position information of sparse polynomial b during the sampling stage, eliminating the need for further detection of non-zero value position information.

[0023] The polynomial length in the HQC algorithm is divided into three lengths based on the security level: 17669, 35851, and 57637. The 17669-length polynomial corresponds to two types of sparse vectors, representing sparse polynomials with 66 and 75 non-zero values ​​respectively. The 35851 and 57637-length polynomials also correspond to two types of sparse vectors: sparse polynomials with 100 and 114 non-zero values, and sparse polynomials with 131 and 149 non-zero values ​​respectively.

[0024] To improve the data read / write efficiency of other operations in the HQC algorithm, this invention sets the polynomial storage width to 128 bits. Therefore, the polynomial storage depths for the three security levels are 139, 281, and 451, respectively. If traditional XOR operations are used for addition, with a 128-bit storage width, polynomial operations at different security levels would require at least 139, 281, and 451 clock cycles, respectively.

[0025] like Figure 2 As shown, ports 1 to 8 are the input or output ports of this sparse adder, and in order, they are the dense polynomial read enable output port, dense polynomial write enable output port, dense polynomial read address output terminal, dense polynomial write address output terminal, sparse polynomial non-zero value position valid signal input port, sparse polynomial non-zero value position input port, dense polynomial write data output port, and dense polynomial read data signal input port. Port 5 inputs the sparse polynomial non-zero value position valid signal, used to indicate that the input sparse polynomial non-zero value position of port 6 is valid; port 1 is the direct output of port 5, that is, when the sparse polynomial non-zero value position valid signal is 1, the dense polynomial read enable signal is also 1; port 2 is an unconditional delay of two clock cycles for port 5, used to align the first RAM read timing (the first RAM designed in this invention has a two-clock-cycle read delay). The sparse polynomial non-zero value location information input at port 6 can be divided into two parts: a 9-bit block address and a 7-bit intra-block position signal. The block address signal indicates the address of the non-zero value location within a 128-bit wide RAM, while the intra-block position signal indicates the specific bit within the 128-bit RAM where the non-zero value is located. Ignoring data conflicts, after a two-clock-cycle delay, a 128-bit mask is obtained from the intra-block position signal. This mask is then XORed with the 128-bit data read from the first RAM based on the block address signal to obtain the resulting polynomial data to be written back to the third RAM.

[0026] Because the RAM designed in this invention has a two-clock-cycle read delay, and non-zero value positions may appear multiple times within the same 128-bit space, a data conflict will occur if two or three consecutive non-zero value positions are within the same 128-bit space. This means the 128-bit data read from the block address signal has already been updated during the read process. To resolve data conflicts, this invention introduces a multiplexer module. The multiplexer module is implemented by comparing the non-zero value block address inputs of three consecutive clock cycles. If the non-zero value block addresses of the first and second clock cycles are the same, or the non-zero value block addresses of the first and third clock cycles are the same, a data conflict occurs. In this case, the multiplexer module is selected based on the type of data conflict, ensuring that the 128-bit data read from the block address signal is the updated data.

[0027] As a preferred option, such as Figure 2 As shown in the dashed box, the multiplexing module includes: a first and a second 2-to-1 multiplexer and a fifth and a sixth register block; The first input of the first 2-to-1 multiplexer is connected to the output of the second 2-to-1 multiplexer; the read data terminal of the first RAM is connected to the first input of the second 2-to-1 multiplexer; the fifth and sixth register blocks are cascaded, with the input of the fifth register block connected to the output of the XOR gate array, and the output connected to the second input of the first 2-to-1 multiplexer; the output of the fifth register block is connected to the second input of the second 2-to-1 multiplexer. The first and second input terminals of the first 2-to-1 multiplexer are selected when the output signal of the first comparator is 0 and 1, respectively, and the first and second input terminals of the second 2-to-1 multiplexer are selected when the output signal of the second comparator is 0 and 1, respectively.

[0028] As another preferred embodiment, the multiplexing module includes: a three-to-one multiplexer and fifth and sixth register blocks; The fifth and sixth register blocks are cascaded, with the input of the fifth register block connected to the output of the XOR gate array; the outputs of the fifth and sixth register blocks and the read data terminal of the first RAM are respectively connected to the first, second, and third inputs of the three-to-one multiplexer.

[0029] In other words, the circuit of the sparse adder provided by this invention issues a read dense polynomial request after receiving the non-zero position and valid signal of the sparse polynomial in the first cycle. However, the dense polynomial RAM (i.e., the first RAM) will not output the corresponding 128-bit data until the third cycle. In order to align the intra-block position signal of "which bit to flip" with the output of the dense polynomial RAM, the circuit delays the intra-block position signal by two cycles through the first and second register blocks, so that it arrives at the XOR gate array at the same time as the read data in the third cycle. At this time, the circuit generates a mask based on the delayed intra-block position signal, and performs an XOR operation with the data output by the dense polynomial RAM to flip the target bit. Then, the flipped 128-bit data is written back to the third RAM.

[0030] When multiple non-zero bits fall consecutively within the same 128-bit block, the data from the previous flip is only written back to the third RAM on the third clock cycle. However, the next read request might access the same address again on the second clock cycle. At this point, the first RAM might not have been updated yet, and the read value would still be the old one. To avoid this "reading old data" situation, the circuit compares the block addresses of non-zero bits across several consecutive clock cycles. If the current block address is found to be the same as the previous one or two clock cycles, it indicates that a same-block access has indeed occurred. In this case, the circuit no longer reads data from the first RAM but directly uses the updated 128-bit data that was just written back in the previous one or two clock cycles, sending it to the XOR operation path via the multiplexer module. In this way, regardless of the distribution of the non-zero bits in the sparse polynomial, the circuit can process one bit per clock cycle without interruption, maintaining continuous pipeline operation while ensuring that the latest data is always obtained, preventing errors.

[0031] The third and fourth register blocks are used to compare whether the input block addresses are duplicated. They are initialized to 9'h1ff, which means all 9 bits are 1, before the circuit starts working (because the block address will not reach 9'h1ff during the algorithm implementation, so this initialization will not affect the calculation of the first two non-zero location information); all other registers and register blocks are initialized to 0.

[0032] The efficient addition strategy, pipelined structure, and conflict avoidance strategy designed in this invention reduce the number of clock cycles for addition operations to the number of non-zero values ​​in the sparse vector. For polynomial operations with six different numbers of non-zero values ​​in HQC, the required clock cycles are 66, 75, 100, 114, 131, and 149 respectively. Compared to the 139, 281, and 451 clock cycles required by traditional XOR operations, this represents a significant leap in computational efficiency.

[0033] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A sparse adder circuit suitable for the HQC algorithm, characterized in that, include: First and second input terminals, first to fourth register blocks, first to third level registers, first and second comparators, first and second two-way selectors, shifter, XOR gate array and multiplexing module; The dense polynomial data is pre-stored in the first RAM, and the non-zero value location information of the sparse polynomial is pre-stored in the second RAM; the non-zero value location information of the sparse polynomial includes block address and intra-block location information. The sparse polynomial non-zero value position valid signal is input through the first input terminal and then split into two paths. One path is used as a read enable signal and input to the read enable terminal of the first RAM. The other path is delayed for two clock cycles through the first two-stage register and then used as a write enable signal and input to the write enable terminal of the third RAM. After the non-zero value position information of the sparse polynomial is input through the second input terminal, the intra-block position information is delayed for two clock cycles by the first and second register blocks and then input to the shifter. The shifter shifts a preset constant 1 to the left according to the intra-block position information to form a mask of a preset size. The block address is input to the first input terminal of the first comparator, the first input terminal of the second comparator, the third register block, and the read address terminal of the first RAM. The block address after a one-clock-cycle delay by the third register block is input to the second input terminal of the first comparator and the fourth register block. The block address after another one-clock-cycle delay by the fourth register block is input to the write address terminal of the third RAM and the second terminal of the second comparator. The signals output by the first and second comparators are delayed for two clock cycles by the second and third register stages and then input to the multiplexing module. The first RAM has a two-clock-cycle read delay, which is used to read the corresponding dense polynomial data according to the read address when the read enable signal is valid and input it to the multiplexing module. When the block address of the current clock cycle is the same as the block address of the previous clock cycle, the output of the first comparator is 1; otherwise, it is 0. When the block address of the current clock cycle is the same as the block address of the previous two clock cycles, the output of the second comparator is 1; otherwise, it is 0. When the outputs of both the first and second comparators are 0, the multiplexing module outputs the data read from the first RAM according to the block address signal of the current clock cycle to the XOR gate array. When the outputs of both the first and second comparators are 1, or when the outputs of the first and second comparators are 1 and 0 respectively, the multiplexing module outputs the result polynomial data of the previous clock cycle to the XOR gate array. When the outputs of the first and second comparators are 0 and 1 respectively, the multiplexing module outputs the result polynomial data of the previous two clock cycles to the XOR gate array. The XOR gate array is used to perform an XOR operation on a mask of a preset size and the data output by the multiplexing module to obtain a result polynomial data; the result polynomial data is input to the write data terminal of the third RAM and the multiplexing module respectively; the preset size is the storage bit width of the first to third RAM; The third RAM is used to write the result polynomial data according to the write address when the write enable signal is valid.

2. The circuit as described in claim 1, characterized in that, The multiplexing module includes: a first and a second 2-to-1 multiplexer and a fifth and a sixth register block; The first input of the first 2-to-1 multiplexer is connected to the output of the second 2-to-1 multiplexer; the read data terminal of the first RAM is connected to the first input of the second 2-to-1 multiplexer; the fifth and sixth register blocks are cascaded, with the input of the fifth register block connected to the output of the XOR gate array, and the output connected to the second input of the first 2-to-1 multiplexer; the output of the fifth register block is connected to the second input of the second 2-to-1 multiplexer. The first and second input terminals of the first 2-to-1 multiplexer are selected when the output signal of the first comparator is 0 and 1, respectively, and the first and second input terminals of the second 2-to-1 multiplexer are selected when the output signal of the second comparator is 0 and 1, respectively.

3. The circuit as described in claim 1, characterized in that, The multiplexing module includes: a 3-to-1 multiplexer and fifth and sixth register blocks; The fifth and sixth register blocks are cascaded, with the input of the fifth register block connected to the output of the XOR gate array; the outputs of the fifth and sixth register blocks and the read data terminal of the first RAM are respectively connected to the first, second, and third inputs of the three-to-one multiplexer.

4. The circuit as described in claim 2 or 3, characterized in that, The preset size is 128 bits.

5. The circuit as described in claim 4, characterized in that, The storage width of the block address is 9 bits, and the storage width of the location information within the block is 7 bits.

6. The circuit as described in claim 5, characterized in that, The initial values ​​of the third and fourth register blocks are 9'h1ff, and the initial values ​​of the first, second, fifth, and sixth register blocks and the first to third level registers are all 0.

7. The circuit as described in claim 1, characterized in that, The non-zero value location information of the sparse polynomial is directly stored in the second RAM during the sampling stage.

Images