Matrix block multiplication circuit suitable for post-quantum lattice cryptographic algorithm FodoKEM

Abstract

The invention belongs to the related technical field of post-quantum-lattice cryptographic information security and integrated circuit design, and particularly relates to a matrix block multiplication circuit suitable for a post-quantum-lattice cryptographic algorithm FrodoKEM, the circuit is designed for the characteristic that a large-size matrix is generated by row, and the circuit comprises a calculation array and a calculation scheduling control module comprising an RAM (Random Access Memory); and the calculation scheduling control module adopts a flexible input path and an intermediate result cache mechanism to ensure that a calculation array realizes high-efficiency pipeline calculation of matrix data. The calculation array comprises two parallel vector calculation units and supports efficient parallel execution of matrix multiplication and addition operation. The structure has good control flexibility, can support different types of matrix calculation tasks at the same time, and meets various configuration requirements. And through matching with the rate generated by the matrix, the throughput rate of the whole system is obviously improved. The structure is compact and efficient, is suitable for the resource-limited post quantum cryptography hardware accelerator, and realizes safe calculation with high hardware efficiency.

Description

Technical Field

[0001] This invention belongs to the technical field of post-quantum lattice cryptography information security and integrated circuit design, and more specifically, relates to a matrix block multiplication circuit suitable for the post-quantum lattice cryptography algorithm FrodoKEM. Background Technology

[0002] In the context of a highly developed digital society, the importance of information security is increasingly prominent. However, the rapid evolution of quantum computing technology is posing a fundamental challenge to traditional cryptographic systems. Existing public-key encryption algorithms, represented by RSA and elliptic curve cryptography (ECC), rely on the computational complexity of mathematical problems such as integer factorization and discrete logarithms for their security. The introduction of Shor's algorithm makes it possible for quantum computers to efficiently solve these problems in polynomial time, thus jeopardizing the effectiveness of traditional cryptographic systems.

[0003] To address this challenge, post-quantum cryptography (PQC) has emerged, dedicated to designing cryptographic algorithms that maintain security even under quantum computing models. Since 2016, the National Institute of Standards and Technology (NIST) has led the standardization work for PQC. Lattice-based cryptography, due to its high efficiency, strong security reducibility, and implementation flexibility, has become one of the mainstream research directions. Among them, the learning with errors (LWE) problem is a crucial core of lattice cryptography.

[0004] FrodoKEM is a key encapsulation mechanism (KEM) based on the standard LWE problem. Its implementation involves numerous high-dimensional matrix modular multiplication operations (modular multiplication is a specific operation where multiplication is performed first, followed by modular multiplication. Specifically, given a modulus q, performing a modular multiplication on a number involves dividing that number by q, and the remainder is the result; modular multiplication involves performing the multiplication step first, then applying the modular multiplication to the result). This results in high computational intensity and complex computational paths. To ensure its quantum resistance, FrodoKEM uses large parameters (such as high-dimensional matrices and large moduli), enhancing security while also placing higher performance demands on hardware and software implementations. Because it does not rely on ring structures or other additional mathematical assumptions, it possesses stronger theoretical conservatism and is suitable for deployment in applications with extremely high security requirements.

[0005] Especially in the SHAKE version of FrodoKEM, matrix A is not stored in its entirety but is dynamically generated row-by-row using a pseudo-random function. This generation method limits (meaning that because it is generated row-by-row, it needs to be stored in RAM according to the row format, making column-by-column reading cumbersome) the flexibility of data access (if A can be accessed column-by-column when calculating B', then S' can be traversed row-by-row, following the same loop order as calculating B), posing unique scheduling and resource mapping challenges for matrix multiplication operations. Against this backdrop, there is an urgent need for a multiplier array structure with high flexibility that can efficiently adapt to different matrix generation and computation strategies. This structure should support efficient execution of row-by-row generation and on-demand computation of matrix multiplication tasks without relying on preloading of the complete matrix, thereby meeting the performance, area, and versatility requirements of post-quantum cryptography algorithms in practical hardware deployments. Summary of the Invention

[0006] To address the above-mentioned deficiencies or improvement needs of existing technologies, this invention provides a matrix block multiplication circuit suitable for the post-quantum lattice cryptography algorithm FrodoKEM. Its purpose is to design a matrix calculation scheme that balances computational efficiency and structural versatility, taking into account the characteristic that matrix A in the algorithm only supports row-by-row generation.

[0007] To achieve the above objectives, according to one aspect of the present invention, a matrix block multiplication circuit suitable for the post-quantum lattice cryptographic algorithm FrodoKEM is provided, comprising: a computing array, and a computing scheduling and control module including RAM; The computing array contains Parallel vector computation units The value can be any integer between 0 and 3. Each parallel vector computation unit is used to perform different vector dot product and addition operations in a single matrix block operation within one block operation clock cycle. Each computation unit is responsible for the product operation between a row of 1x4 vectors in the left multiplication block and a column of 4x1 vectors in the right multiplication block, as well as the addition operation of the product result to an element in the addition block. The sizes of the left multiplication block, right multiplication block, and addition block are respectively... , , , ; The computation scheduling and control module is used to divide the left multiplication matrix, right multiplication matrix, and initial addition matrix involved in the target matrix operation into blocks, resulting in left multiplication blocks, right multiplication blocks, and initial addition blocks. When the right multiplication matrix is ​​generated column-wise and the left multiplication matrix is ​​generated horizontally, the generated portion of the right multiplication matrix is ​​stored in RAM in a column-wise block manner, the left multiplication matrix is ​​stored in RAM in a horizontal block manner, and the initial addition block is also stored in RAM. The module then controls the computation array to read the right multiplication blocks column-wise and the left multiplication blocks horizontally from RAM to perform single matrix block operations sequentially. During the operation, control signals control each... The result of each addition operation of each computing unit is temporarily stored in the register of that computing unit, so that when the computing unit performs the addition operation in the next block operation clock cycle, it reads it and accumulates it as an element in the addition block, until the column direction reading and calculation of the right multiplication matrix is ​​completed, and then writes the final addition operation result back to RAM. The element of the addition block used by the computing unit to perform the addition operation in the first block operation clock cycle is an element corresponding to the row and column of the left multiplication vector and the right multiplication vector that is pre-loaded in the register under the control of the computing scheduling control module. When the right-multiplication matrix is ​​generated horizontally and the left-multiplication blocks remain fixed during one round of horizontal reading and calculation of the right-multiplication matrix, the generated part of the right-multiplication matrix is ​​horizontally stored in RAM in blocks, and all left-multiplication blocks of the left-multiplication matrix are stored in RAM. First, the computing array is controlled to pre-read the left-multiplication blocks required for one round of horizontal calculation from RAM; then, the computing array is controlled to horizontally read the right-multiplication blocks from RAM to perform single matrix block operations in sequence. During the operation, the result of each addition operation of each computing unit is written back to the storage space of the RAM where the addition block participating in the current addition operation is located through the control signal, and the value of one element in the addition block participating in the current addition operation is overwritten.

[0008] further, The value is 3. The value is 2. The value is 2.

[0009] Furthermore, the computation scheduling control module is used to pre-control the matrix in FrodoKEM according to the matrix required for the target matrix operation. , , and / or Prior to matrix Generate and store the data, where the target matrix is ​​operated on as follows: or When controlling storage, , Reusing the same storage space across different computation periods, in the matrix The new values ​​obtained during the calculation process continuously cover The storage space in which the new value is calculated Elements for reuse The storage space in the matrix The new values ​​obtained during the calculation process continuously cover In the storage space Elements at the corresponding positions are reused. The storage space; also used to control the matrix in FrodoKEM. The rows are generated and stored horizontally, where, and The two operations are not performed simultaneously; during storage control, when the calculation... hour, The storage space is used for temporary storage. When calculating hour, The storage space is used for temporary storage. Used for storage The temporary space is divided into two areas, which are used alternately for ping-pong read and write operations.

[0010] Furthermore, the multiplier is implemented on the FPGA, and the required RAM storage space is achieved by piecing together fixed-size BRAMs on the FPGA, where the matrix... and The storage space is planned in the same RAM block formed by piecing together BRAM, matrix The storage space is planned in another RAM formed by piecing together BRAMs, and the remaining space in each RAM is used to store, except for... , , , , , , Other than FrodoKEM, it requires other variables and / or matrices that occupy less space.

[0011] Furthermore, each computation unit contains four multiplication units and one addition tree. The four multiplication units correspond to the four multiplication operations required to perform vector dot product, and the addition tree performs all addition operations. Each computation unit is configured with input ports for inputting the left multiplication vector, the right multiplication vector, and the addend. Used in calculation and When inputting a vector of matrix A, the matrix is ​​used in the calculation algorithm. , Time pair applied to input matrix , The vector, input port For input and The vector, input port Used to input addends; Each multiplication unit includes: A bit-unsigned multiplier, four sets of registers, one set of two-way selectors, sign extraction logic, absolute value extraction logic, XOR logic, and two's complement conditional negation logic; wherein, one input port of the one set of two-way selectors is ANDed with... The connection includes: input port 0 connected to the output of the first register; control port connected to the output of the AND gate; and output port connected to the input of the first register. The output of the first register is also connected to sign extraction logic and absolute value extraction logic. The input of the AND gate is the valid control signal and the fwd_en control signal output by the computation scheduling control module, which are used to jointly determine whether input port 0 or input port 1 of the two-way selector is enabled. Enabling input port 0 means... The input is the data stored in the holding register. Enabling one input port means that the matrix required for subsequent calculations can continue to be preloaded from the storage space. or The vector; the output of the absolute value extraction logic is connected to one 4-bit input of the unsigned multiplier, and the other 16-bit input of the unsigned multiplier is connected to the output of the second register, the input of the second register is connected to... The output of the unsigned multiplier is connected to the input of the third register. The output of the sign extraction logic is connected to the input of the fourth register. The output of the fourth register is connected to the input of the XOR logic. The input of the XOR logic is also connected to the sub_en control port, which is used to cooperate with the output of the sign extraction logic to determine whether the two's complement conditional negation logic should perform the two's complement negation operation. The output of the XOR logic and the output of the third register are connected to the input of the two's complement conditional negation logic. The output of the two's complement conditional negation logic is connected to the input of the addition tree. The output of the adder tree is connected to input port 1 of another two-way selector, input port 0 is connected to the output of the fifth register, the output port is connected to the input of the fifth register, and the control port is connected to the Valid control port. If input port 0 is enabled under the control of the control signal in the Valid control port, it means that the calculation is in an idle state so that the calculation unit can perform preloading. The input of the adder tree is also connected to the output port of the third two-way selector. The 1-channel input port of the third two-way selector is connected to the output of the fifth register, its control port is connected to the acc_en control port, and its 0-channel input port is connected to... The acc_en control port is used to determine whether the third two-way selector has its 0-way input port or its 1-way input port enabled. Having its 0-way input port enabled means that the addends required for subsequent calculations will continue to be preloaded from the storage space. Having its 1-way input port enabled means that the vector dot product result of the computation unit is accumulated in the addition tree as an addend.

[0012] Furthermore, the computational scheduling and control module is used to send control signals to each control port based on the clock to achieve the control required for matrix operations.

[0013] According to another aspect of the present invention, an accelerator hardware system for the post-quantum lattice cryptographic algorithm FrodoKEM is provided, comprising the matrix block multiplication circuit described above for performing matrix operations.

[0014] In summary, compared with the prior art, the technical solutions conceived by this invention have the following main advantages: 1. This invention proposes a matrix block multiplication circuit suitable for the post-qubit lattice cryptography algorithm FrodoKEM (SHAKE version). Addressing the limitation that matrix A in the algorithm can only be generated row-by-row, a matrix computation scheme balancing computational efficiency and structural versatility is designed. A multiplier array architecture based on block processing is employed. By setting up input channels with local buffering capabilities and multiple sets of multiply-accumulate units, a data path supporting pipelined scheduling is constructed, enabling efficient completion of segmented computation tasks for large matrices. This structure is designed to support the control requirements of different matrix computation stages, and can compatiblely execute the computation of B and B′ under the same hardware architecture, effectively improving the module's control flexibility and resource utilization.

[0015] 2. By configuring the scale of the computing unit, the overall computing speed can be flexibly adjusted, which facilitates matching with the SHAKE module in terms of data generation speed, enabling the two to work together, effectively alleviating the rhythm difference between data generation and computing, and improving system operating efficiency. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of a matrix-based computation scheduling strategy provided in an embodiment of the present invention; wherein, (a) is The corresponding computation scheduling strategy diagram; (b) is A diagram illustrating the corresponding computation scheduling strategy; Figure 2 This is a schematic diagram of the computing array structure provided in an embodiment of the present invention; Figure 3 A schematic diagram of matrix storage provided in an embodiment of the present invention; Figure 4This is a schematic diagram of the storage data flow in matrix calculation provided in an embodiment of the present invention; Figure 5 A schematic diagram of a matrix block multiplication circuit and a single computing unit structure suitable for the post-quantum lattice cryptography algorithm FrodoKEM is provided for embodiments of the present invention. Figure 6 Input port in the computing unit provided in the embodiments of the present invention A schematic diagram of the preloaded data stream; Figure 7 Input port in the computing unit provided in the embodiments of the present invention A schematic diagram of the preloaded data stream; Figure 8 This is a schematic diagram of the IDLE mode data flow of the computing unit provided in an embodiment of the present invention; Figure 9 Matrix provided for embodiments of the present invention Calculate the data flow diagram; Figure 10 Matrix provided for embodiments of the present invention Schematic diagram of the computational data flow. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0018] Example 1 A matrix block multiplication circuit suitable for the post-quantum lattice cryptographic algorithm FrodoKEM includes: a computing array and a computing scheduling and control module containing RAM; The computing array contains Parallel vector computation units The value can be any integer between 0 and 3. Each parallel vector computation unit is used to perform different vector dot product and addition operations in a single matrix block operation within one block operation clock cycle. Each computation unit is responsible for the product operation between a row of 1x4 vectors in the left multiplication block and a column of 4x1 vectors in the right multiplication block, as well as the addition operation of the product result to an element in the addition block. The sizes of the left multiplication block, right multiplication block, and addition block are respectively... , , , ; The computation scheduling and control module is used to divide the left multiplication matrix, right multiplication matrix, and initial addition matrix involved in the target matrix operation into blocks, resulting in left multiplication blocks, right multiplication blocks, and initial addition blocks. When the right multiplication matrix is ​​generated column-wise and the left multiplication matrix is ​​generated horizontally, the generated part of the right multiplication matrix is ​​stored in RAM in a column-wise block manner, the left multiplication matrix is ​​stored in RAM in a horizontal block manner, and the initial addition block is also stored in RAM. The module controls the computation array to read the right multiplication blocks column-wise and the left multiplication blocks horizontally from RAM to perform single matrix block operations sequentially. During the operation, control signals control each computation unit to add the matrices each time. The result of the operation is temporarily stored in the register of the computing unit so that the computing unit can read it and accumulate it as an element of the addition block when performing the addition operation in the next block operation clock cycle (the time for a single block operation is one cycle) until the column direction reading and calculation of the right multiplication matrix is ​​completed. The result of the final addition operation is then written back to RAM. The element of the addition block used by the computing unit to perform the addition operation in the first block operation clock cycle is an element corresponding to the row and column of the left multiplication vector and the right multiplication vector that is pre-loaded in the register under the control of the computing scheduling control module. When the right-multiplication matrix is ​​generated horizontally and the left-multiplication blocks remain fixed during one round of horizontal reading and calculation of the right-multiplication matrix, the generated part of the right-multiplication matrix is ​​horizontally stored in RAM in blocks, and all left-multiplication blocks of the left-multiplication matrix are stored in RAM. First, the computing array is controlled to pre-read the left-multiplication blocks required for one round of horizontal calculation from RAM; then, the computing array is controlled to horizontally read the right-multiplication blocks from RAM to perform single matrix block operations in sequence. During the operation, the result of each addition operation of each computing unit is written back to the storage space of the RAM where the addition block participating in the current addition operation is located through the control signal, and the value of one element in the addition block participating in the current addition operation is overwritten.

[0019] This can be considered a preferred implementation method. The value is 3. The value is 2. A value of 2 is chosen to better balance efficiency and accuracy.

[0020] In the post-quantum lattice cryptography FrodoKEM algorithm, the main large matrix operations involved are: and ,in The size is n×n; The size is n×8; The size is 8×n, and the set of values ​​for n is {640, 976, 1344}. The matrix... Each time, the matrix can only be generated row-wise using SHAKE. More than two-thirds of the entire algorithm's time is consumed in the calculation of these two matrices, therefore, they require in-depth analysis.

[0021] To achieve large-size matrix calculations in the FrodoKEM algorithm, this embodiment employs... Figure 1 The computation scheduling strategy based on matrix partitioning shown is executed by the computation scheduling control module. By dividing a large matrix into several smaller blocks and combining them with block-level loop control and scheduling mechanisms, pipelined execution of matrix multiplication and addition operations can be achieved. Figure 1 The matrix partitioning involves three nested algorithm execution loops, all of which are reflected in the method. Different loop orders lead to different matrix block reading strategies, with the innermost loop directly determining the working mode of the computation array. For the innermost loop: Figure 1 (a) in the diagram shows the matrix. The calculation process involves left multiplication by traversing the matrix row by row, and right multiplication by the matrix. Iterate column-wise, performing multiplication and accumulation operations on the matrix blocks retrieved in each cycle, and finally combining them with the matrix... The corresponding matrix blocks are added together; Figure 1 (b) shows the matrix The calculation process, in which the left multiplication matrix is ​​used. The matrix blocks remain fixed, and the matrix A is right-multiplied and traversed row by row. The matrix blocks retrieved in each cycle are all related to the matrix A. Multiply the matrix blocks and add the matrix at the corresponding position. The temporary accumulated result is written back to RAM. When the same position is traversed again, the temporary accumulated value is read, added to the new product result, and then written back to RAM, until all calculations are completed. Specifically, regarding large matrix partitioning and computation scheduling strategies for high-performance computing, such as Figure 1 As shown, Figure 1 The 'a' in the diagram represents matrix operations. Related matrix partitioning and computation scheduling strategies, Figure 1 b in the diagram represents matrix operations. The relevant matrix partitioning and computation scheduling strategies, among which, for The green arrow in 'a' represents the matrix block traversal pattern of the first level (i.e., the innermost) loop. For the matrix... In other words, it means reading a 2×4 matrix block from the storage space row by row in each cycle. In other words, it involves reading a 4x4 matrix block from memory each cycle, column by column, then multiplying the two matrix blocks together, and the result of the multiplication is... Adding a 2×4 matrix block together yields... A 2×4 matrix block. During this process, due to the matrix... It only needs to be read once, so it can be prefetched from the memory cell and placed in the internal register of the multiplier array; The orange arrow represents the second loop, which is the next round of reading and calculation. In this loop, the operations of the first loop are repeated, but with some changes. By iterating through all the distinct columns, the result is also a matrix. Different columns, thus obtaining a matrix. The complete two-line calculation result; The red arrow represents the third loop. This operation repeats the second loop and iterates through the selected elements. All distinct rows, so that the matrix can be calculated. The calculation results for all rows.

[0022] for The green arrow in 'b' represents the matrix block traversal pattern of the first level (i.e., the innermost) loop. In other words, it means reading a 4×2 matrix block from the memory unit row by row in each cycle. Similarly, it reads a 4×4 matrix block from the memory unit row by row in each cycle, while The matrix blocks remain unchanged. Then matrix blocks and Multiplying matrix blocks, the result of the multiplication is... The result is obtained by adding a 4×2 matrix block (or a temporary calculation result for one cycle at this position) to get a 4×2 temporary calculation result. The final result is obtained only when the value at this position is calculated for the last time. The result of calculating a 2×4 matrix block. In this process, due to the matrix... It only needs to be read once, so it can be prefetched from storage and placed in the internal registers of the computing array; The orange arrow represents the second loop, which repeats the operations of the first loop, but with... Take different rows, like this These four columns of data have already been fully utilized. Each time the second loop is executed, the temporary calculation results for all positions are refreshed. The red arrow represents the third loop. This operation repeats the second loop, iterating through the selected elements. All distinct rows will be traversed simultaneously. The final result is obtained after multiple refreshes of the temporary calculation results for all the different columns. .

[0023] Apart from and The remaining two operations are and They are similar to matrix partitioning and loop strategies in matrix... The calculation process is the same, so I won't go into detail here (just pay attention to the calculation). (When multiplication results are preceded by a negative sign).

[0024] like Figure 2 The computing array structure shown contains Each parallel vector computation unit can perform a multiplication of a 2x4 and a 4x4 matrix block. Each unit, as shown in the red dashed box in the diagram, can perform the product operation between a 1x4 row vector from the 2x4 matrix block and a 4x1 vector from the 4x4 matrix block, as well as the addition operation between the product result and an element in the 2x4 addition block. This vector computation unit contains four multiplication units and one addition tree unit. For the vector computation unit enclosed in the red dashed box, its input is a vector... ,vector Addends The output is obtained The same principle applies to other computing units.

[0025] This can be considered a preferred implementation method throughout the entire and In the calculation process, , , , They are all pre-generated and stored, among which , A single storage space is reused. The final calculation results also reuse space, including the matrix. Save to storage space, matrix Save to Storage space, such as Figure 3 As shown, the matrix The size is too large, so we do not intend to store the entire matrix. It only temporarily stores the rows needed for the first loop iteration, retrieving them during calculation. At that time, Space is used for temporary storage ,calculate At that time, Space is used for temporary storage Furthermore, the temporary space is divided into two regions, which are read and written alternately in different first-level cycles (technically known as ping-pong read / write operations). (For example, if divided into region 1 and region 2, when performing operations on region 1, the last few rows will be generated in advance.) Then write it to region 2. Once generated, region 2 can be read for calculation, and at the same time, generation can continue to the next region. And write it to region 1, and so on).

[0026] In other words, the computation scheduling control module is used to pre-control the matrix in FrodoKEM based on the matrix required for the target matrix operation. , , and / or Prior to matrix Generate and store the data, where the target matrix is ​​operated on as follows: or When controlling storage, take into account , The time periods using the same storage space will not overlap. , Reusing the same storage space across different computation periods, in the matrix The new values ​​obtained during the calculation process continuously cover The storage space in which the new value is calculated Elements for reuse The storage space in the matrix The new values ​​obtained during the calculation process continuously cover In the storage space Elements at the corresponding positions are reused. The storage space; also used to control the matrix in FrodoKEM. The rows are generated and stored horizontally, where, and The two operations are not performed simultaneously; during storage control, when the calculation... hour, The storage space is used for temporary storage. When calculating hour, The storage space is used for temporary storage. Used for storage The temporary space is divided into two areas, which are used alternately for ping-pong read and write operations.

[0027] In practical implementation, matrix The specific generation process involves inputting seedA and row number into the Hash module, and then generating the matrix. The corresponding rows will be generated continuously.

[0028] As a preferred implementation, the multiplier can be implemented on an FPGA. The required RAM storage space is achieved by piecing together fixed-size BRAMs on the FPGA, wherein the matrix... and The storage space is planned in the same RAM block formed by piecing together BRAM, matrix The storage space is planned in another RAM formed by piecing together BRAMs, and the remaining space in each RAM is used to store, except for... , , , , , , Other than FrodoKEM, it requires other variables and / or matrices that occupy less space.

[0029] like Figure 4 As shown, the left side is before calculation, and the right side is after calculation. For example, the matrix... , , , , Each element is represented by a 16-bit binary number, while the matrix , Each element is represented by a 5-bit binary number, but for ease of storage (in hardware implementation, a bit width that is a power of two is more convenient), 8 bits of space are used for storage. Thus, when reading the matrix blocks, each cycle reads (i.e., the bandwidth) 128 bits. All data is stored in RAM (the storage units mentioned earlier). Since this design is implemented on an FPGA, the basic storage unit of the FPGA is a fixed-size BRAM. The required RAM is implemented by piecing together BRAMs. Here... and By splicing together the storage space, two 36K BRAM resources can be saved.

[0030] This can be used as a preferred implementation method, such as Figure 5 As shown, each computation unit contains four multiplication units and one addition tree. The four multiplication units correspond to the four multiplication operations required to perform vector dot product, and the addition tree performs all addition operations. Each computation unit is configured with input ports for inputting the left multiplication vector, the right multiplication vector, and the addend. Used in calculation and Input matrix Vectors, matrices in computational algorithms , Time pair applied to input matrix , The vector, input port For input and The vector, input port Used to input addends; Each multiplication unit includes: A bit-unsigned multiplier, four sets of registers, one set of two-way selectors, sign extraction logic, absolute value extraction logic, XOR logic, and two's complement conditional negation logic; wherein, one input port of the one set of two-way selectors is ANDed with... The connection includes: input port 0 connected to the output of the first register; control port connected to the output of the AND gate; and output port connected to the input of the first register. The output of the first register is also connected to sign extraction logic and absolute value extraction logic. The input of the AND gate is the valid control signal and the fwd_en control signal output by the computation scheduling control module, which are used to jointly determine whether input port 0 or input port 1 of the two-way selector is enabled. Enabling input port 0 means... The input is the data stored in the holding register. Enabling one input port means that the matrix required for subsequent calculations can continue to be preloaded from the storage space. or The vector; the output of the absolute value extraction logic is connected to one 4-bit input of the unsigned multiplier, and the other 16-bit input of the unsigned multiplier is connected to the output of the second register, the input of the second register is connected to... The output of the unsigned multiplier is connected to the input of the third register. The output of the sign extraction logic is connected to the input of the fourth register. The output of the fourth register is connected to the input of the XOR logic. The input of the XOR logic is also connected to the sub_en control port, which is used to cooperate with the output of the sign extraction logic to determine whether the two's complement conditional negation logic should perform the two's complement negation operation. The output of the XOR logic and the output of the third register are connected to the input of the two's complement conditional negation logic. The output of the two's complement conditional negation logic is connected to the input of the addition tree. The output of the adder tree is connected to input port 1 of another two-way selector, input port 0 is connected to the output of the fifth register, the output port is connected to the input of the fifth register, and the control port is connected to the Valid control port. If input port 0 is enabled under the control of the control signal in the Valid control port, it means that the calculation is in an idle state so that the calculation unit can perform preloading. The input of the adder tree is also connected to the output port of the third two-way selector. The 1-channel input port of the third two-way selector is connected to the output of the fifth register, its control port is connected to the acc_en control port, and its 0-channel input port is connected to... The acc_en control port is used to determine whether the third two-way selector has its 0-way input port or its 1-way input port enabled. Having its 0-way input port enabled means that the addends required for subsequent calculations will continue to be preloaded from the storage space. Having its 1-way input port enabled means that the vector dot product result of the computation unit is accumulated in the addition tree as an addend.

[0031] The computational scheduling and control module is used to send control signals to each control port based on the clock to achieve the control required for matrix operations.

[0032] for Figure 1 The computation in this process involves 32 multiplications per cycle (multiplication of 2×4 and 4×4 matrix blocks), therefore 32 multipliers are required, such as... Figure 5 On the left. The matrix block computation for each cycle can be further decomposed into the dot product of eight vectors of length 4. Figure 5 The structure on the right performs this operation. Figure 5 The circuit structure can not only complete and It can also perform the remaining two operations in the algorithm. and Regarding the function of the register (the basic unit of digital IC design): the left side is the input, and the right side is the output. It is also controlled by a clock (a term used in synchronous circuit design for digital ICs; the clock has a fixed period). The register is updated once every cycle, and the update saves the instantaneous input value of the register to the output. Regarding the function of the selector: the blue lines are control lines. The output selects the corresponding path based on the value of the control line.

[0033] In practice, Figure 5 The structure shown is adapted as follows Figure 1 The block-based strategy shown supports multiple computation modes and preloading mechanisms. This computation unit consists of multiple multiplication units and one addition tree, capable of performing a single vector dot product, used for matrix block multiplication and addition operations. Typically, in post-quantum cryptography hardware designs, the bandwidth of the SHAKE module is set to 64, corresponding to a matrix in the FrodoKEM algorithm. Since there are four elements, one computational unit in this design contains four multiplication units. (The diagram uses...) , , Represents the input port of the module, where the port , Both are used to input values ​​modulo q (q=65536 or 32768) (65536=2). 16 32768=2 15 (Unified representation as 16 bits) Port Used to generate 5-bit signed sample values ​​(which can be split into 1-bit sign and 4-bit absolute value). In matrix computation... sum matrix At that time, port , , Corresponding to the input matrix respectively , , sum matrix , , Matrix block elements.

[0034] A multiplication unit implements a 16-bit number (port). (input) and a 5-bit signed number (port) The input is multiplied. Since the sign and absolute value of a 5-bit signed number are directly generated during the sampling process, in the matrix... or When storing in RAM, the 1-bit sign bit and 4-bit absolute value can be concatenated directly (with the sign bit placed in the high-order bits). Therefore, reading from RAM is straightforward: the lower 0-3 bits represent the absolute value, and the 4th bit is the sign bit. Multiplying the 4-bit absolute value by the 16-bit number using a 16×4-bit unsigned multiplier, and then truncating the lower 16 bits, yields a modulo 65536 result. Subsequently, the sign bit (1 for negative, 0 for positive) is XORed with sub_en (0 for addition, 1 for subtraction). If the XOR result is 1, the result needs to be inverted, so the result is then inverted and incremented by one.

[0035] wrong The reason for performing symbol decomposition on the input is: The input (denoted as) The two's complement representation of ) is (where (Represents the sign bit): Then A0 and S abs (port The absolute value of the input, after being calculated by unsigned multiplication, is: , to perform model Operation (hardware implementation directly extracts the lower 16 bits): Then the result is the sum of the four dot product values, and then... The input (denoted as) Alternatively, the calculation result from the previous cycle (selected via a selector).

[0036] To reduce hardware resource overhead, the design splits the 5-bit signed sampled value involved in the multiplication calculation into a sign bit and an absolute value, performing the multiplication operation only on the 4-bit absolute value, thereby reducing the multiplier's bit width from 16×16 to 16×4. The sign recovery process is then performed using XOR logic shared computation. The required two's complement circuit improves the logic resource reuse rate. This method avoids the need for a DSP, reducing overall resource consumption.

[0037] Two control signals, fwd_en and acc_en, are introduced into each computing unit to achieve flexible control of the data flow. fwd_en determines... The input is either held or participates in subsequent operations along the pipeline; `acc_en` controls whether the multiplication result is an accumulation or a summation. Add them together. Figures 6 to 10 This demonstrates the data flow control capabilities of the computing unit at different stages: Figure 6 and Figure 7 Preloading was demonstrated respectively. and During matrix block loading, the control path is uniformly set to 1 for fwd_en (preloading). ), acc_en is 0 (preloading) Meanwhile, setting irrelevant ports to 0 allows for compatibility with preloading operations for both types of matrices; Figure 8 When the array is idle, fwd_en is set to 0 and there is no valid data input, which can be maintained. or The matrix block data remains unchanged; Figure 9 and Figure 10 The calculations were displayed respectively. and The working mechanism of time, calculation At that time, both fwd_en and acc_en are 1, making and The matrix blocks are continuously input to participate in the multiplication operation, and The multiplication and accumulation calculation is pre-loaded, and the result of each addition is fed back to the addition tree. This process continues until a round of column-wise reading and calculation of the right multiplication matrix is ​​completed, at which point the final addition result is written back to RAM. In the first block operation clock cycle, one element of the addition block used by this calculation unit is an element pre-loaded into the register under the control of the calculation scheduling control module, corresponding to the row and column of the left and right multiplication vectors. At that time, both fwd_en and acc_en are 0, so that S' remains unchanged, and and The matrix blocks are continuously input to participate in multiplication and addition calculations, and then immediately written back to RAM after the calculation is completed, so they are not fed back to participate in the accumulation.

[0038] This structure improves overall computational bandwidth by deploying multiple multiplication units in parallel. This is due to the generation of four matrices per cycle. It requires a total of 32 multiplication operations, so Figure 1 The matrix block scheme in the code fully considers the bandwidth matching between the matrix multiplication array and the SHAKE module. For Figure 1 The matrix block partitioning scheme shown requires 8 such computing units (32 multipliers in total) to meet the computing requirements.

[0039] In summary, through block scheduling strategies, structural optimization, and flexible control mechanisms, the system achieves more efficient parallel processing of large matrix tasks in FrodoKEM and other lattice cryptographic algorithms, effectively improving system computing performance and resource utilization. It has advantages such as high computational efficiency, flexible control, and strong adaptability, making it suitable for building high-resource-efficiency post-quantum cryptography accelerator hardware systems.

[0040] Example 2 An accelerator hardware system for the post-quantum lattice cryptographic algorithm FrodoKEM includes a matrix block multiplication circuit as described in Embodiment 1 for performing matrix operations.

[0041] The relevant technical solutions are the same as above, and will not be repeated here.

[0042] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A matrix block multiplication circuit suitable for the post-quantum lattice cryptographic algorithm FrodoKEM, characterized in that, It comprises: a computing array and a computing scheduling control module containing RAM; wherein the calculation array comprises parallel vector calculation units, taking any integer from 0 to 3, The parallel vector calculation units are used to complete different vector multiplication and addition operations in a single matrix block operation in parallel within one block operation clock cycle. Each calculation unit is used to perform the multiplication operation between a row 1*4 vector of the left multiplication block and a column 4*1 vector of the right multiplication block in a single block operation, and the addition operation between the multiplication operation result and an element of the addition block. The sizes of the left multiplication block, the right multiplication block and the addition block are respectively , , , . The computing scheduling control module is used to block the left multiplication matrix, the right multiplication matrix and the initial addition matrix participating in the target matrix operation to obtain left multiplication blocks, right multiplication blocks and initial addition blocks; When the right multiplication matrix is generated column-wise and the left multiplication matrix is generated horizontally, the part generated by the right multiplication matrix is stored column-wise in the RAM, the left multiplication matrix is stored horizontally in the RAM, the initial addition blocks are also stored in the RAM, and the computing array is controlled to read the right multiplication blocks column-wise and the left multiplication blocks horizontally from the RAM to sequentially perform single matrix block operation. During the operation, the result of each addition operation of each computing unit is temporarily stored in the register of the computing unit under the control of the control signal, so that the computing unit reads and accumulates as an element in the addition block when performing the addition operation in the next block operation clock cycle. When a round of column-wise reading and calculation of the right multiplication matrix is completed, the result of the final addition operation is written back to the RAM. The element of the addition block used by the computing unit to perform the addition operation in the first block operation clock cycle is an element in the initial addition block corresponding to the left multiplication vector and the right multiplication vector loaded in the register under the control of the computing scheduling control module. When the right multiplication matrix is generated horizontally and the left multiplication blocks remain unchanged during a round of horizontal reading and calculation of the right multiplication matrix, the part generated by the right multiplication matrix is stored horizontally in the RAM, and all left multiplication blocks of the left multiplication matrix are stored in the RAM. First, the computing array is controlled to pre-read the left multiplication blocks required for a round of horizontal calculation from the RAM; then the computing array is controlled to read the right multiplication blocks horizontally from the RAM to sequentially perform single matrix block operation. During the operation, the result of each addition operation of each computing unit is written back to the storage space of the addition block participating in the current addition operation in the RAM and covers the value of one element in the addition block participating in the current addition operation under the control of the control signal.

2. The matrix block multiplication circuit of claim 1, wherein, has a value of 3, has a value of 2, has a value of 2.

3. The matrix block multiplication circuit of claim 1, wherein, The computational scheduling control module is used to pre-control the matrix in FrodoKEM based on the matrix required for the target matrix operation. , , and / or Prior to matrix Generate and store the data, where the target matrix is ​​operated on as follows: or When controlling storage, , Reusing the same storage space across different computation periods, in the matrix The new values ​​obtained during the calculation process continuously cover The storage space in which the new value is calculated Elements for reuse The storage space in the matrix The new values ​​obtained during the calculation process continuously cover In the storage space Elements at the corresponding positions are reused. The storage space; also used to control the matrix in FrodoKEM. The rows are generated and stored horizontally, where, and The two operations are not performed simultaneously; during storage control, when the calculation... hour, The storage space is used for temporary storage. When calculating hour, The storage space is used for temporary storage. Used for storage The temporary space is divided into two areas, which are used alternately for ping-pong read and write operations.

4. The matrix block multiplication circuit of claim 3, wherein, The multiplier is implemented on FPGA, the required RAM storage space is achieved by BRAM splicing of fixed size on FPGA, wherein the storage space of matrix and is planned in the same piece of RAM formed by BRAM splicing, the storage space of matrix is planned in another piece of RAM formed by BRAM splicing, and the remaining space in each RAM is used to store other variables and / or matrices required by FrodoKEM except , , , , , , .

5. The matrix block multiplication circuit of claim 1, wherein, Each computing unit contains four multiplication units for implementing the four multiplication operations required for vector dot product and an addition tree for performing all addition operations; each computing unit is configured with input ports for inputting left multiplication vector, right multiplication vector and addend for inputting vectors of matrix A when computing and for inputting vectors of matrix , when computing algorithm , for inputting vectors applied to input matrix , and for inputting vectors of for inputting addend; Each multiplication unit includes: A bit-unsigned multiplier, four sets of registers, one set of two-way selectors, sign extraction logic, absolute value extraction logic, XOR logic, and two's complement conditional negation logic; wherein, one input port of the one set of two-way selectors is ANDed with... The connection includes: input port 0 connected to the output of the first register; control port connected to the output of the AND gate; and output port connected to the input of the first register. The output of the first register is also connected to sign extraction logic and absolute value extraction logic. The input of the AND gate is the valid control signal and the fwd_en control signal output by the computation scheduling control module, which are used to jointly determine whether input port 0 or input port 1 of the two-way selector is enabled. Enabling input port 0 means... The input is the data stored in the holding register. Enabling one input port means that the matrix required for subsequent calculations can continue to be preloaded from the storage space. or The vector; the output of the absolute value extraction logic is connected to one 4-bit input of the unsigned multiplier, and the other 16-bit input of the unsigned multiplier is connected to the output of the second register, the input of the second register is connected to... The output of the unsigned multiplier is connected to the input of the third register. The output of the sign extraction logic is connected to the input of the fourth register. The output of the fourth register is connected to the input of the XOR logic. The input of the XOR logic is also connected to the sub_en control port, which is used to cooperate with the output of the sign extraction logic to determine whether the two's complement conditional negation logic should perform the two's complement negation operation. The output of the XOR logic and the output of the third register are connected to the input of the two's complement conditional negation logic. The output of the two's complement conditional negation logic is connected to the input of the addition tree. The output of the addition tree is connected to the 1-way input port and the 0-way input port of another two-way selector, the output of the fifth register, the input of the fifth register, and the control port is connected to the Valid control port. If the 0-way input port is opened under the control of the control signal in the Valid control port, it means that the calculation is in an idle state so that the computing unit performs pre-loading; The input of the addition tree is also connected to the output port of a third two-way selector, the 1-way input port of the third two-way selector is connected to the output of a fifth register, the control port is connected to the acc_en control port, and the 0-way input port is connected to the output of the second two-way selector. The acc_en control port is used to determine whether the 0-way input port or the 1-way input port of the third two-way selector is enabled. Enabling the 0-way input port means that the addend required for the subsequent calculation is pre-loaded from the storage space, and enabling the 1-way input port means that the vector dot product result of the calculation unit is accumulated as the addend in the addition tree.

6. The matrix block multiplication circuit of claim 5, wherein, The computing scheduling control module is used to send control signals to each control port based on the clock to achieve the control required for matrix operation.

7. An accelerator hardware system for a post-quantum lattice cryptography algorithm, FrodoKEM, characterized in that, A matrix block multiplication circuit as claimed in any one of claims 1 to 6 is used to perform matrix operation.

Images