Physical-level anti-quantum key packaging device and method

Abstract

The invention discloses a physical-level anti-quantum key packaging device and method, and the method comprises the steps: cutting off a byte stream to a first modulus through a bit mask operation, and generating a polynomial matrix in a constant physical clock period; calculating an inner product of a private key vector of the polynomial matrix, executing logic combination operation, compressing modulus, and generating a public key vector; after receiving the public key vector, the second communication node reconstructs a system state by using the temporary private key and outputs a ciphertext; and the first communication node receives the ciphertext, performs fault-tolerant restoration and re-encryption, drives a bottom multiplexer to generate a mask, and selects one of a real session key and a random noise key to be output in a constant physical clock period. According to the anti-quantum cryptography algorithm, logic combination operation, algebraic divide-and-conquer and physical circuit characteristics are utilized, hardware simplification is achieved, meanwhile, safety is improved, strategic expansion capacity is achieved, and the problems that an existing anti-quantum cryptography algorithm faces the computing power bottleneck and the side channel attack risk in a low-power-consumption node lacking a hardware divider circuit are solved.

Description

Technical Field

[0001] This invention belongs to the field of quantum cryptography technology and relates to a physical-level quantum-resistant key encapsulation device and method, especially for extremely restricted hardware and high-level strategic defense. Background Technology

[0002] With the rapid evolution of quantum computing technology, especially the increasing maturity of quantum decryption algorithms, traditional public-key cryptosystems based on large integer factorization and the discrete logarithm problem are facing the real threat of being completely broken in polynomial time. To address data security risks, a full migration to quantum-resistant cryptography (PQC) has become an inevitable choice for core information infrastructure.

[0003] However, deploying existing mainstream quantum-resistant cryptography schemes to extremely constrained hardware environments (such as low-power edge nodes lacking complex instruction sets) has encountered serious physical bottlenecks and security vulnerabilities:

[0004] 1. Divider Dependency: Traditional high-order PQC algorithms often rely on expensive hardware divider circuits when performing polynomial coefficient modulo reduction and Gaussian error sampling. For extremely demanding micro-computing nodes, integrating hardware dividers is unacceptable.

[0005] 2. Congestion caused by NTT: Existing solutions widely use number theory transformation (NTT) to accelerate multiplication, but at the hardware level, this leads to extremely high wiring complexity and memory access overhead, making it unable to adapt to the safe configuration expansion of high-order matrix ranks.

[0006] 3. Side-channel attack vulnerability: In the key decapsulation stage, traditional methods use conditional branch instructions with control flow jumps. The execution time difference makes it easy for attackers to bypass mathematical security through physical probing, leading to leakage of the master private key. Summary of the Invention

[0007] To address the aforementioned issues, this invention provides a physical-grade quantum-resistant key encapsulation device and method. By utilizing logical combination operations, algebraic divide-and-conquer, and physical circuit characteristics, it simplifies hardware while improving security and possesses strategic-level scalability. This solves the computational bottleneck and side-channel attack risk faced by existing quantum-resistant cryptographic algorithms in low-power nodes lacking hardware divider circuits.

[0008] The technical solution adopted in this invention is a physical-level quantum-resistant key encapsulation method, comprising the following steps:

[0009] S1. Receive a random seed, generate a pseudo-random byte stream through a hardware expandable output module, and use bit masking operations to truncate the byte stream to a preset first modulus Q, thereby generating a polynomial matrix A within a constant physical clock cycle;

[0010] S2. Calculate the inner product of the polynomial matrix A and the private key vector s to obtain the intermediate value x. Perform a logical combination operation of shift and bitwise AND with a constant bias term on the intermediate value x to compress the numerical space from the first modulus Q to the second modulus P. The combinational logic operation implicitly introduces a security error resistant to quantum attacks by discarding low-level signals through physical shift without calling the hardware division instruction, and generates the public key vector.

[0011] S3. After receiving the public key vector, the second communication node reconstructs the system state using the temporary private key, performs NTT de-encapsulation based on algebraic divide and conquer, superimposes the plaintext information onto the public key vector, and outputs the ciphertext.

[0012] S4. The first communication node receives the ciphertext and performs fault-tolerant restoration and re-encryption operations. It calculates the difference between the original ciphertext and the re-encrypted ciphertext, decrements the difference by 1, and directly drives the underlying multiplexer to generate a mask by leveraging the borrow underflow physical characteristics generated by the arithmetic logic unit in unsigned integer operations. Within a constant physical clock cycle that completely blocks timing prediction, it selects one of the real session key and the random noise key for output, thereby blocking the leakage of timing side channel information.

[0013] Furthermore, in step S2, the first modulus Q is an integer power of 2, the second modulus P is an integer power of 2, and P < Q.

[0014] Furthermore, in step S2, the logical combinational operation is as follows: after applying a preset constant additive bias to the input signal, an arithmetic right shift operation is performed, and a bitwise AND logic operation is performed with the mask word of the second modulus P space; the additive bias, right shift, and bitwise AND logic operation are all completed by the underlying pure combinational logic circuit in a single physical clock cycle without waiting, so as to avoid the side-channel leakage risk and additional computation delay caused by multi-cycle cyclic subtraction or software lookup table method from the physical timing level; the bias constant is equal to , Indicates the number of displacements.

[0015] Furthermore, in step S3, the second communication node uses an algebraic divide-and-conquer multiplier to superimpose plaintext information onto the public key vector in the form of a level offset to generate ciphertext; the multiplication process decomposes polynomial multiplication into multiple layers of low-dimensional sub-multiplication operations, with the intermediate layers retaining full-precision extended bit width, and only after the last level of polynomial recombination and accumulation, it is directly aligned to the target modulus space through a hardware truncation circuit, thereby eliminating the delay of the modulus extraction circuit in the intermediate calculation layers.

[0016] Furthermore, the algebraic divide-and-conquer multiplier constructs a hierarchical combinational logic network based on the Karatsuba algorithm or the Toom-Cook algorithm; when processing the cross-multiplication of polynomial coefficients, a delayed modulus reduction strategy is adopted for intermediate results, and the results are aligned to the target modulus space only after the last level is reorganized and accumulated, so as to eliminate the high-frequency clock flip power consumption and routing delay caused by the traditional pure recursive tree.

[0017] Furthermore, in step S4, the underlying physical data encoding of the fault-tolerant restoration operation depends on a preset error correction coding algorithm or threshold alignment standard; the first communication node uses a built-in hardware decoding logic circuit to perform a threshold decision on the physical level offset carried in the received ciphertext, accurately mapping and restoring the physical level offset to the original plaintext message sequence, so as to eliminate bit flipping caused by the implicit security error and physical channel noise.

[0018] Furthermore, it also includes dynamic polynomial matrix rank scheduling: the adaptive dynamic polynomial matrix rank scheduling engine monitors the network concurrency load of the current communication node and the total amount of physical memory that can be allocated on the underlying silicon chip in real time, and dynamically adjusts the rank K of the polynomial matrix A according to the monitoring results, while keeping the dimension of the underlying algebraic polynomial ring constant at N=256 and the modulus Q and P unchanged. The rank adjustment is fed back to the matrix generation in step S1 and the algebraic divide-and-conquer multiplier in step S3 in real time, so as to achieve security level scaling from the edge terminal level to the strategic defense level under limited hardware resources.

[0019] Furthermore, the adaptive dynamic polynomial matrix rank scheduling engine increases the rank K to construct a larger-dimensional polynomial matrix, thereby improving the security protection level; the value of the rank K is 2 to 8.

[0020] A physical-grade quantum-resistant key encapsulation device includes:

[0021] Hardware-expandable output module for generating pseudo-random byte streams;

[0022] The physical mask truncation module is used to truncate the byte stream to a preset first modulus Q and generate a polynomial matrix A;

[0023] A physical shift register array performs compression and implicit error generation operations without division instructions, and outputs a public key vector;

[0024] The logic gate of the algebraic divide-and-conquer multiplier is based on algebraic divide-and-conquer to remove NTT encapsulation, and the plaintext information is superimposed on the public key vector to generate ciphertext;

[0025] The side-channel isolation module uses the borrow underflow physical characteristics generated by the arithmetic logic unit in unsigned integer operations to directly drive the underlying multiplexer to generate a mask, and completes the output of either the real session key or the random noise key within a constant physical clock cycle that completely blocks timing prediction.

[0026] Furthermore, it also includes a dynamic polynomial matrix rank scheduling engine, which dynamically adjusts the rank K of the polynomial matrix A based on the current network concurrency load of the communication node and the total amount of physical memory that can be allocated on the underlying silicon chip.

[0027] The beneficial effects of this invention are:

[0028] 1. The underlying architecture of this invention is based on the mathematical foundation of Module-LWR (Module-Learning by Module), and is equipped with a physical shift register array containing arithmetic right shift logic. It implicitly introduces safety errors through low-level pure shift operations, completely abandoning the traditional NTT butterfly network and Gaussian random sampler. This eliminates the dependence on complex hardware dividers and the large-scale data routing circuits required by NTT, achieving extreme hardware lightweighting and side-channel immunity, and significantly reducing the consumption of logic gates and memory blocks (BRAM) in ASIC / FPGA.

[0029] 2. In the encrypted decapsulation stage, the device of this invention enables a hardware side-channel isolation module. It utilizes the physical characteristic of the unsigned integer of the arithmetic logic unit being decremented by 1 to trigger underflow, directly driving the underlying multiplexer to generate a mask. Within a constant physical clock cycle that completely blocks timing prediction, the security key is selected and output, thus cutting off the bypass information leakage path at the hardware level.

[0030] 3. This invention has an embedded dynamic scaling engine that can switch between configuration polynomial matrix ranks (K=2 to K=8) in real time according to network status. It particularly supports extreme hardware configurations of K=8 level without memory explosion effect and provides a quantum security threshold equivalent to AES-512.

[0031] 4. This invention is applicable to low-power computing nodes lacking hardware divider circuits and strategic networks where future quantum computing power overflows. Low-power computing nodes include micro-sensors and passive or low-power medical implants, which cannot support complex NTT calculations; strategic networks where future quantum computing power overflows include high-risk electromagnetic / timing eavesdropping scenarios, including financial-grade HSM encryption machine bases, national-level strategic defense communication nodes, and situations facing the threat of physical close-range side-channel attacks. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic diagram of the overall hardware architecture and data flow of the physical-grade quantum key encapsulation device provided in this embodiment of the invention.

[0034] Figure 2 This is a schematic diagram of the underlying logic gate level for implementing displacement compression and implicit error generation using a physical shift register array in an embodiment of the present invention.

[0035] Figure 3 This is a hardware data path distribution diagram for NTT polynomial operations based on algebraic divide-and-conquer multiplier logic gates in an embodiment of the present invention.

[0036] Figure 4 This is the physical circuit timing diagram of the hardware side-channel isolation module in this embodiment of the invention forcibly triggering the unsigned integer underflow of the arithmetic logic unit to generate a multiplexer mask.

[0037] Figure 5 This is a flowchart illustrating the resource scheduling logic of the adaptive dynamic polynomial matrix rank scheduling engine under different network concurrent loads in this embodiment of the invention. Detailed Implementation

[0038] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0039] Example 1,

[0040] A physical-level quantum-resistant key encapsulation method establishes a secure shared session key between a first communication node and a second communication node. The first communication node is typically located on the side of a high-concurrency financial gateway, while the second communication node is a restricted edge terminal. Figure 1 As shown, the following physical level signal conversion steps are specifically performed:

[0041] Step S1: Physical mask extraction and matrix generation;

[0042] The hardware-expandable output module generates a pseudo-random byte stream signal, and the device directly applies bitmasking logic operations to this signal. Within a constant physical clock cycle without loop wait, a portion of the generated signal is extracted and compared to a preset first modulus Q=8192 (i.e., 2^32). 13 The level signal of the corresponding polynomial matrix A is obtained by forcibly increasing the modulus space to an integer power of 2 and using a simple bit mask to replace the complex modulo operation. This eliminates loop waiting and ensures completion within a single physical clock cycle, thus avoiding timing-side channel risks from the source.

[0043] Step S2: Physical displacement compression and implicit error generation;

[0044] The device calculates the level of the inner product of matrix A and private key vector s, and sends the result to a physical shift register array. The array does not invoke any division instructions, but directly executes the logical combination of shifting and bitwise AND operations of terms with constant bias. By physically discarding low-level signals, it compresses the first modulus Q (e.g., 8192) into the space of the second modulus P (e.g., 1024 or 2048) (the numerical space is reduced by a corresponding factor, e.g., 8 times or 4 times). This physical rounding truncation process implicitly introduces a security error resistant to quantum attacks, generating the public key vector.

[0045] like Figure 2 As shown, the equivalent digital circuit behavior of the logic combination includes adding a preset constant bias to the input signal, performing an arithmetic right shift operation, and performing a bitwise AND logic operation with the mask word of the corresponding second modulus P space; the addition bias, right shift, and bitwise AND logic operation are completed by the underlying pure combinational logic circuit in a single physical clock cycle without waiting, so as to avoid the side channel leakage risk and additional computation delay caused by multi-cycle cyclic subtraction or software lookup table method from the physical timing level.

[0046] The equivalent calculation formula for the logic combination is: ((x+2)>>2)&(P-1) or ((x+4)>>3)&(P-1). The constant bias here (e.g., +2 or +4) is for rounding in the physical level shift... because the first modulus space is compressed to the second modulus space by a factor of 4 or 8, shifting right by 2 bits (>>2) or 3 bits (>>3) is equivalent to dividing by 4 or 8. Adding before dividing by 4... This ensures that the truncated value is as close as possible to the true continuous mathematical value, resulting in a zero-mean distribution of rounding errors. If other values ​​are used (e.g., 0), it degenerates into rounding down, causing a systematic shift in the error distribution and significantly increasing the decryption failure rate (DFR) during encryption and decryption, thus weakening cryptographic security. The bias constant must be strictly equal to... (That is, half the scaling ratio). Indicates the number of displacements.

[0047] The underlying security principle of this invention is based on "Module-LWR" (Module-Low Rounding Learning), a mathematically proven quantum-resistant problem. In traditional LWE problems, security relies on manually sampled random Gaussian or binomial noise (i.e.,...). In this embodiment of the invention, the low-level bits are directly discarded via a physical shift register (from the high-precision module). Truncation to low precision model This data loss due to bit width truncation is equivalent to artificially injected pseudo-random noise in information theory and statistics. Even if an attacker intercepts the public key (i.e., the truncated result), because the low-order information has been physically and permanently erased, they still need to solve the polynomial-time problem of superlattice reduction.

[0048] Step S3: NTT de-encapsulation based on algebraic divide and conquer;

[0049] After receiving the public key vector, the second communication node reconstructs the system state using its own temporary private key. Through the algebraic divide-and-conquer multiplier logic gate, the plaintext message is superimposed on the inner product result in the modulo P space in the form of a physical level offset, generating an encrypted ciphertext buffer sequence.

[0050] like Figure 3 As shown, the plaintext message and public key vector are recombined and accumulated based on the hierarchical combinational logic network of Karatsuba / Toom-Cook. When dealing with the cross-multiplication of polynomial coefficients, the hierarchical combinational logic network adopts a physical-level bit width truncation and delay modulus reduction strategy to address the boundary overflow problem of intermediate results. That is, the full-precision extended bit width is retained in the intermediate level of the divide-and-conquer recursion, and only after the last level of polynomial recombination and accumulation is it directly aligned to the target modulus space through a hardware truncation circuit, thereby completely eliminating the delay of the modulus extraction circuit in the intermediate calculation level.

[0051] The embodiments of this invention employ an algebraic divide-and-conquer strategy, performing hardware truncation and modular reduction only at the last stage, while retaining full precision in the intermediate layers. This avoids memory and wiring congestion caused by the number-theoretic transformation NTT butterfly cross-routing, thereby making it possible to extend the matrix rank on limited hardware, laying the foundation for subsequent high security levels.

[0052] Step S4: Hardware-level tamper-proof underflow mask selection;

[0053] After the first communication node receives the ciphertext and performs fault-tolerant restoration and re-encryption operations, it activates the hardware side-channel isolation module.

[0054] like Figure 4As shown, this module accumulates the bit level difference signal (diff) between the original received ciphertext buffer and the re-encrypted ciphertext buffer through the underlying bit XOR gate, and inputs the signal into the physical subtraction logic gate to perform a decrement operation.

[0055] This operation forcibly triggers the borrow underflow physical characteristic of unsigned integers in the arithmetic logic unit (ALU), or extracts the inverted logic of the carry flag in the underlying arithmetic status register, and combines it with a single-cycle shift bus or bit extension logic to directly generate a mask level that is all 1s (0xFF) or all 0s (0x00). This mask level is directly used as the control signal of the multiplexer circuit, and performs a deterministic output between the real session key line and the random rejection key line, thereby blocking the leakage of timing side channel information from the physical instruction pipeline level.

[0056] The fault-tolerant restoration operation performed by the first communication node relies on a preset error correction coding algorithm or threshold alignment standard for its underlying physical data encoding. The device uses a built-in hardware decoding logic circuit to make a threshold judgment on the physical level offset carried in the received ciphertext, accurately map it, and restore it to the original plaintext message sequence to eliminate bit flips caused by the implicit security error and physical channel noise.

[0057] The logic for generating the mask level (all 1s (0xFF) or all 0s (0x00)) is implemented using branchless pure physical combinational operations. Specifically, for the bit level difference signal diff (diff=0 when the ciphertext is completely identical, and diff>0 when any difference exists), the hardware arithmetic logic unit performs a subtraction operation of (diff - 1). When diff=0, the subtraction operation triggers an underflow of the unsigned integer, resulting in a machine code of all 1s (e.g., 0xFFFFFFFF). This is then used to generate an all-1 mask (0xFF) through arithmetic right shift or direct physical truncation to drive the multiplexer to select the real shared key. When diff>0 (its value range is limited by a finite bit width), the subtraction operation does not trigger an underflow, the highest bit remains 0, and after truncation, an all-0 mask (0x00) is generated, thus silently switching to the pseudo-random rejection key. The entire process does not contain any comparator logic or instruction jump branches, ensuring completion within a strictly constant physical clock cycle.

[0058] If verification fails (even a one-bit difference exists in the underlying ciphertext buffer comparison), the side-channel isolation module will silently switch the output to a random rejection key via a mask within a constant time period, without triggering any system interruption or alarm. Subsequent symmetric communication between the communicating parties (such as TLS / MAC verification) will fail due to the key mismatch, ultimately requiring the upper-layer network protocol (TCP / IP application layer) to re-initiate the handshake request. The miniature encryption device itself is solely responsible for "silent rejection," preventing any possible side-channel leakage in erroneous states.

[0059] Example 2,

[0060] Based on the physical-level quantum-resistant key encapsulation method in Example 1, it also includes dynamic polynomial matrix rank scheduling:

[0061] like Figure 5 As shown, the adaptive dynamic polynomial matrix rank scheduling engine monitors the network concurrency load of the current communication node and the total amount of physical memory that can be allocated on the underlying silicon chip in real time. The load and resources are jointly determined. Under the condition that the dimension of the underlying algebraic polynomial ring is constant at N=256 and the modulus Q and P remain unchanged, the rank K of the polynomial matrix A is dynamically adjusted according to the monitoring results. The rank adjustment is fed back to the matrix generation in step S1 and the algebraic divide-and-conquer multiplier in step S3 in real time, so as to achieve security level scaling from edge terminal level to strategic defense level under limited hardware resources.

[0062] If the communication node is a high-concurrency gateway or an edge memory-constrained terminal, a degradation configuration signal is generated, allocating a smaller rank K (2 or 3), where K=2 provides basic quantum security protection equivalent to AES-128, and K=3 or K=4 corresponds to AES-192 and AES-256 security levels, respectively. If facing deep space long-distance anti-jamming communication or a national-level strategic data permanent storage network architecture, an upgrade configuration signal is generated, and the matrix dimension is expanded to K=8, constructing an 8×8 polynomial matrix structure. Since the algebraic divide-and-conquer multiplier logic gates of this embodiment completely abandon number theory transformation (NTT), this extension operation only causes a linear and gradual increase in logic unit consumption in the finite hardware array of the micro-encryption device, thereby achieving an extremely high security protection level equivalent to AES-512 (256-bit quantum security threshold) at the physical level, completely immune to future quantum bit computing power overflow attacks that explode exponentially.

[0063] The rank K of a matrix is ​​dynamically changing, and the total time consumed by matrix multiplication and inner product operations varies with K. The essence of side-channel timing attacks is that the attacker uses the same private key (a fixed key)... Under a secure configuration, subtle differences in processing time are observed by continuously sending different ciphertexts. This is influenced by the network environment. At that time, regardless of whether the input ciphertext is correct or malicious, the processing time is constant. That's all; when upgraded to At that time, the processing time for all ciphertexts is constant. Dynamic scheduling This pertains to macro-level lifecycle reconfiguration, while step S4 ensures that... Under these conditions, the instruction execution paths for legitimate and illegitimate ciphertexts are of absolutely equal length in a single decryption micro-lifecycle.

[0064] Example 3,

[0065] A physical-grade quantum-resistant key encapsulation device includes:

[0066] Hardware-expandable output module for generating pseudo-random byte streams;

[0067] The physical mask truncation module is used to truncate the byte stream to a preset first modulus Q and generate a polynomial matrix A;

[0068] A physical shift register array performs compression and implicit error generation operations without division instructions, and outputs a public key vector;

[0069] The logic gate of the algebraic divide-and-conquer multiplier is based on algebraic divide-and-conquer to remove NTT encapsulation, and the plaintext information is superimposed on the public key vector to generate ciphertext;

[0070] The side-channel isolation module uses the borrow underflow physical characteristics generated by the arithmetic logic unit in unsigned integer operations to directly drive the underlying multiplexer to generate a mask, and completes the output of either the real session key or the random noise key within a constant physical clock cycle that completely blocks timing prediction.

[0071] The dynamic polynomial matrix rank scheduling engine monitors the network concurrency load of the current communication node and the total amount of physical memory that can be allocated on the underlying silicon chip in real time. With the dimension of the underlying algebraic polynomial ring constant at N=256 and the modulus Q and P remaining unchanged, the rank K of the common polynomial matrix is ​​adjusted by dynamically configuring signals.

[0072] This invention actively forgoes NTT acceleration, which is considered essential by the mainstream community, through Physical Truncation Tolerance (LWR) and algebraic divide-and-conquer. Achieving this requires overcoming numerous technical difficulties, such as controlling polynomial recombination overflow without NTT and aligning moduli through delay truncation. This application not only solves these difficulties but also provides immunity to branch-time-based side-channel attacks, further enhancing security.

[0073] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A physical-grade quantum-resistant key encapsulation method, characterized in that, Includes the following steps: S1. Receive a random seed, generate a pseudo-random byte stream through a hardware expandable output module, and use bit masking operations to truncate the byte stream to a preset first modulus Q, thereby generating a polynomial matrix A within a constant physical clock cycle; S2. Calculate the inner product of the polynomial matrix A and the private key vector s to obtain the intermediate value x. Perform a logical combination operation of shift and bitwise AND with a constant bias term on the intermediate value x to compress the numerical space from the first modulus Q to the second modulus P. The combinational logic operation implicitly introduces a security error resistant to quantum attacks by discarding low-level signals through physical shift without calling the hardware division instruction, and generates the public key vector. S3. After receiving the public key vector, the second communication node reconstructs the system state using the temporary private key, performs NTT de-encapsulation based on algebraic divide and conquer, superimposes the plaintext information onto the public key vector, and outputs the ciphertext. S4. The first communication node receives the ciphertext and performs fault-tolerant restoration and re-encryption operations. It calculates the difference between the original ciphertext and the re-encrypted ciphertext, decrements the difference by 1, and directly drives the underlying multiplexer to generate a mask by leveraging the borrow underflow physical characteristics generated by the arithmetic logic unit in unsigned integer operations. It then selects between the real session key and the random noise key for output within a constant physical clock cycle that completely blocks timing prediction.

2. The physical-grade quantum-resistant key encapsulation method according to claim 1, characterized in that, In step S2, the first modulus Q is an integer power of 2, the second modulus P is an integer power of 2, and P < Q.

3. The physical-grade quantum-resistant key encapsulation method according to claim 1, characterized in that, In step S2, the logical combinational operation is as follows: after applying a preset constant additive bias to the input signal, an arithmetic right shift operation is performed, followed by a bitwise AND operation with the mask word in the second modulus P space; the additive bias, right shift, and bitwise AND operation are all completed by the underlying pure combinational logic circuit in a single physical clock cycle without waiting; the bias constant is equal to , Indicates the number of displacements.

4. The physical-grade quantum-resistant key encapsulation method according to claim 1, characterized in that, In step S3, the second communication node uses an algebraic divide-and-conquer multiplier to superimpose plaintext information onto the public key vector in the form of a level offset to generate ciphertext. The multiplication process decomposes polynomial multiplication into multiple low-dimensional sub-multiplication operations. The intermediate layer retains the full-precision extended bit width. Only after the last level of polynomial recombination and accumulation is the data directly aligned to the target modulus space through a hardware truncation circuit, thereby eliminating the delay of the modulus extraction circuit in the intermediate calculation layer.

5. The physical-grade quantum-resistant key encapsulation method according to claim 4, characterized in that, The algebraic divide-and-conquer multiplier constructs a hierarchical combinational logic network based on the Karatsuba algorithm or the Toom-Cook algorithm. When processing the cross-multiplication of polynomial coefficients, a delayed modulus reduction strategy is adopted for intermediate results. The results are aligned to the target modulus space only after the last level is reorganized and accumulated, so as to eliminate the high-frequency clock flip power consumption and routing delay caused by the traditional pure recursive tree.

6. The physical-grade quantum-resistant key encapsulation method according to claim 1, characterized in that, In step S4, the underlying physical data encoding of the fault-tolerant restoration operation depends on a preset error correction coding algorithm or threshold alignment standard; the first communication node uses the built-in hardware decoding logic circuit to perform threshold judgment on the physical level offset carried in the received ciphertext, accurately map the physical level offset and restore it to the original plaintext message sequence, so as to eliminate bit flipping caused by the implicit security error and physical channel noise.

7. The physical-grade quantum-resistant key encapsulation method according to claim 1, characterized in that, It also includes dynamic polynomial matrix rank scheduling: the adaptive dynamic polynomial matrix rank scheduling engine monitors the network concurrency load of the current communication node and the total amount of physical memory that can be allocated on the underlying silicon chip in real time. With the dimension of the underlying algebraic polynomial ring constant at N=256 and the modulus Q and P remaining unchanged, the rank K of the polynomial matrix A is dynamically adjusted according to the monitoring results. The adjustment of the rank is fed back to the matrix generation in step S1 and the algebraic divide-and-conquer multiplier in step S3 in real time, so as to achieve security level scaling from the edge terminal level to the strategic defense level under limited hardware resources.

8. The physical-grade quantum-resistant key encapsulation method according to claim 7, characterized in that, The adaptive dynamic polynomial matrix rank scheduling engine increases the rank K to construct a larger-dimensional polynomial matrix, thereby improving the security protection level; the value of the rank K is 2 to 8.

9. A physical-grade quantum-resistant key encapsulation device, used to implement the physical-grade quantum-resistant key encapsulation method as described in claim 1, characterized in that, include: Hardware-expandable output module for generating pseudo-random byte streams; The physical mask truncation module is used to truncate the byte stream to a preset first modulus Q and generate a polynomial matrix A; A physical shift register array performs compression and implicit error generation operations without division instructions, and outputs a public key vector; The logic gate of the algebraic divide-and-conquer multiplier is based on algebraic divide-and-conquer to remove NTT encapsulation, and the plaintext information is superimposed on the public key vector to generate ciphertext; The side-channel isolation module uses the borrow underflow physical characteristics generated by the arithmetic logic unit in unsigned integer operations to directly drive the underlying multiplexer to generate a mask, and completes the output of either the real session key or the random noise key within a constant physical clock cycle that completely blocks timing prediction.

10. The physical-grade quantum-resistant key encapsulation device according to claim 9, characterized in that, It also includes a dynamic polynomial matrix rank scheduling engine, which dynamically adjusts the rank K of the polynomial matrix A based on the network concurrency load of the current communication node and the total amount of physical memory that can be allocated on the underlying silicon chip.

Images