A dual-mode reduction operation system and method for lattice-based cryptographic hardware acceleration

Abstract

The application discloses a dual-mode reduction operation system and method for lattice-based cryptography hardware acceleration, and relates to the technical field of cryptography and information security. The system comprises a routing control unit, which is used for receiving intermediate result data generated in a lattice-based cryptography algorithm operation process, and generating corresponding routing control signals according to the operation type of the intermediate result data, and outputting the intermediate result data and the routing control signals to corresponding data output ends; a first modular reduction operation unit, which is used for executing Montgomery reduction operation based on a prime number condition on corresponding intermediate result data when receiving a routing control signal of modular multiplication operation; and a second modular reduction operation unit, which is used for executing Barrett reduction operation with 2 as a base on corresponding intermediate result data when receiving a routing control signal of modular addition operation. The application can optimize the implementation performance of the algorithm without affecting the security, and is suitable for various software and hardware environments.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security technology, and more specifically to a dual-modal reduction operation system and method for hardware acceleration of lattice-based cryptography. Background Technology

[0002] With the rapid development of quantum computing technology and the gradual practical application of quantum algorithms, traditional cryptographic systems based on mathematical problems such as large integer factorization pose a fundamental threat. Developing quantum-resistant post-quantum cryptography has become an urgent need and a research hotspot in the global information security field. Lattice-based cryptography, with its solid mathematical foundation (based on difficult problems such as the shortest and closest vectors on a lattice), excellent resistance to quantum attacks, and ease of software and hardware deployment, has become a core candidate direction for post-quantum cryptography standardization and is widely used in critical security scenarios. Its core operation, NTT / INTT, is crucial for achieving fast polynomial multiplication and directly determines the overall performance of the algorithm. Modular reduction, as a core submodule of NTT / INTT, is responsible for compressing the extremely large intermediate results generated by polynomial multiplication and addition to meet parameter constraints. Its execution efficiency, resource utilization, and stability directly affect the practical application level of lattice-based cryptography algorithms.

[0003] Patent document 1 (Publication No.: CN116094711A, Publication Date: May 9, 2023) discloses a hardware optimization structure for post-quantum lattice cryptography based on an instruction set, including an ARM module and an FPGA module. This solves the problem of insufficient flexibility and scalability in post-quantum lattice cryptographic computation.

[0004] Patent document 2 (Publication No.: CN116318670A, Publication Date: June 23, 2023) discloses an instruction set architecture suitable for the post-quantum cryptography algorithm Kyber. This instruction set architecture, through custom instruction set design, can balance the efficiency of hardware design with the flexibility of programmable design; it can efficiently and conveniently complete the full PKE and KEM processes of the three security levels of the Kyber post-quantum cryptography algorithm, and allow for the custom programming of any individual operation within this process, making it suitable for diverse information security scenarios across various industries in the future quantum computing era.

[0005] Patent document 3 (Publication No.: CN113225185A, Publication Date: August 6, 2021) discloses a hardware-accelerated architecture and method for key generation based on hash-based quantum signatures, designing a high-speed and scalable hardware-accelerated architecture. This architecture is designed to be applicable to all parameter sets of the LMS scheme, and through appropriate parallel design, it can simultaneously achieve low latency and high hardware utilization. Furthermore, the architecture maintains a certain constant power consumption under different parameter implementations, which can help resist power attacks to some extent.

[0006] Analysis of the above literature reveals that current optimizations of post-quantum cryptography focus on hardware structure and instruction set architecture to improve efficiency and security. While post-quantum cryptography can be applied to multiple fields, there is still room for optimization in the fast computation algorithms of its key modules. Therefore, improving computational efficiency while meeting the security requirements of post-quantum cryptography algorithms is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of the above problems, the present invention proposes a dual-mode reduction operation system and method for hardware acceleration of lattice-based cryptography in order to overcome or at least partially solve the above problems.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] In a first aspect, the present invention provides a dual-modal reduction operation system for hardware acceleration of lattice-based cryptography, comprising a routing control unit, a first modular reduction operation unit, and a second modular reduction operation unit; The routing control unit is used to receive intermediate result data generated during the operation of the lattice cryptography algorithm, generate a corresponding routing control signal according to the operation type corresponding to the intermediate result data, and output the intermediate result data and the routing control signal to the corresponding data output terminals respectively. The data input terminal of the first modular reduction unit is connected to the first data output terminal of the routing control unit, and is used to perform Montgomery reduction operation based on prime number conditions on the corresponding intermediate result data when a routing control signal for modular multiplication is received. The data input terminal of the second modulo subtraction operation unit is connected to the second data output terminal of the routing control unit, and is used to perform a base-2 Barrett subtraction operation on the corresponding intermediate result data when a routing control signal for modulo addition operation is received.

[0010] Furthermore, the first modulo-subtraction operation unit includes: The first shift module is used to right-shift the intermediate result data corresponding to the modular multiplication operation by 8 bits to obtain the first temporary variable; The first logic judgment module is used to perform a bitwise AND operation between the first temporary variable and the constant 256 to generate the first judgment parameter; The first calculation module is used to multiply the first judgment parameter by the first preset constant to generate a first product; and to subtract the first product from the first temporary variable to obtain a first difference. The second shift module is used to perform a right shift operation of 8 bits on the first difference to obtain the first modulo reduction result and output it.

[0011] Furthermore, the first modulo-subtraction operation unit further includes a first memory, the first memory comprising: The first input register is used to store intermediate result data corresponding to the modular multiplication operation received from the routing control unit; The first intermediate variable register is used to store the first temporary variable output by the first shift module; The judgment parameter register is used to store the first judgment parameter output by the first logic judgment module; The first result register is used to store the result of the first modulo-subtraction operation.

[0012] Furthermore, the second modulo-subtraction operation unit includes: The third shift module is used to right-shift the intermediate result data corresponding to the modular addition operation by 12 bits to generate a second temporary variable. The second operation module is used to multiply the second temporary variable by the second pre-stored constant to generate a second product; The fourth shift module is used to right-shift the second product by 12 bits to generate a third temporary variable; The third operation module is used to multiply the third temporary variable with the preset modulus of the lattice-based quantum cryptography to generate a third product; and to subtract the third product from the intermediate result data corresponding to the modulus addition operation to output the result of the second modulus reduction operation.

[0013] Furthermore, the second arithmetic module employs a 32-bit multiplier.

[0014] Furthermore, the second modulo-subtraction operation unit further includes a second memory, the second memory comprising: The second input register is used to store intermediate result data corresponding to the modular addition operation received from the routing control unit; The second intermediate variable register is used to store the second temporary variable, the second product, and the third temporary variable; The second result register is used to store the result of the second modulo reduction operation.

[0015] Furthermore, the intermediate result data corresponding to the modular multiplication operation is 32 bits.

[0016] Furthermore, the intermediate result data corresponding to the modulo addition operation is 16 bits.

[0017] Secondly, this invention provides a bimodal reduction operation method for hardware acceleration of lattice-based cryptography, using the aforementioned system, the method comprising: Receive intermediate result data generated during the operation of the lattice cryptography algorithm; Determine the operation type corresponding to the intermediate result data; the operation type includes modular multiplication and modular addition. If the intermediate result data corresponds to a modular multiplication operation, then the intermediate result data is sent to the first modular reduction operation unit to perform Montgomery reduction operation based on prime number conditions; If the intermediate result data corresponds to a modular addition operation, the intermediate result data is sent to the second modular subtraction operation unit to perform a Barrett subtraction operation with base 2.

[0018] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a dual-modal reduction operation system and method for hardware acceleration of lattice-based cryptography, which has the following beneficial effects: This invention accelerates the encryption and decryption speed of the entire algorithm from the hardware architecture level by setting up dedicated first and second modular reduction operation units and having them efficiently process the intermediate results of modular multiplication and modular addition in NTT / INTT under the scheduling of the routing control unit. This makes the post-quantum cryptography algorithm applicable to diverse information security situations in various industries in the future quantum computer era, without affecting the overall security of the encryption and decryption operation and the output results of the original algorithm.

[0019] This invention sets the Barrett reduction operation to base 2 so that it can be transformed into a logical right shift operation that is easily implemented in hardware. Dividers occupy a large area and have high latency, while modulo reduction based on powers of 2 allows division to be directly replaced by simple shifting, thus reducing hardware resource consumption and power consumption. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of a dual-mode reduction operation system framework for hardware acceleration of lattice-based cryptography provided in an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of the first modulo reduction operation unit provided in an embodiment of the present invention.

[0023] Figure 3 This is a schematic diagram of the second modulo reduction operation unit framework provided in an embodiment of the present invention. Detailed Implementation The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The core parameters of the lattice-based post-quantum cryptography algorithm targeted by the system design of this invention include: (1) main modulus. q The modulus q Satisfying Montgomery-friendly prime number form α is a positive integer parameter, and its core requirement is to ensure the modulus. q The final result of the calculation is a prime number. e It is also a positive integer parameter, and its value is related to the bit width and modulo-simplification shift operation of the NTT / INTT operation. Design 2 e The even-power form is to adapt to the mathematical characteristics of the Montgomery reduction algorithm and the hardware operation bit width (such as 32-bit and 16-bit operations in the embodiments of this invention), so that core operations such as modular multiplication and shifting can be executed efficiently in the software and hardware implementation of lattice cryptography.

[0025] (2) Polynomial degree; (3) Cardinality ,in w It includes the bit width for computation; in addition, it also includes the discrete Gaussian distribution parameters and the primitive roots of unity required for number theory transformation (NTT) operations.

[0026] The core concept of this invention lies in designing independently optimized hardware processing units for the two types of modular operations that occur frequently in cryptographic algorithms, and embedding them into the computational process in a targeted manner: (1) Optimization for modular multiplication: The Montgomery reduction operation based on prime number conditions is solidified into an independent dedicated operation unit (i.e., the first modular reduction operation unit below). This unit is applied to the NTT forward transform and INTT inverse transform algorithm flow of lattice-based quantum cryptography, and is specifically used to perform real-time and efficient modular reduction processing on the values ​​generated after each multiplication operation of the rotation factor (or inverse rotation factor) and polynomial coefficients.

[0027] (2) Optimization for modular addition: The base-2 Barrett reduction operation is solidified into another independent dedicated operation unit (i.e., the second modular reduction operation unit below). This unit is specifically used in the INTT inverse transform algorithm process to perform fast modular reduction on the intermediate values ​​generated during the operation and the values ​​after performing modular addition on the polynomial coefficients at the corresponding positions.

[0028] Based on the above division of labor, the first and second modular reduction units constitute a collaborative dual-modular reduction system. The Montgomery algorithm handles large dynamic range data after multiplication and expansion, effectively mitigating the computational complexity of high-bit-width modular multiplication. The improved Barrett algorithm handles small dynamic range data after addition and accumulation, enabling rapid reduction with lower hardware overhead. This division of labor avoids resource waste or performance bottlenecks when a single modular reduction algorithm handles data of different bit widths, thereby improving the overall throughput and resource utilization of the lattice-based cryptography algorithm in both hardware and software environments.

[0029] Specifically, embodiments of the present invention disclose a dual-modal reduction operation system for hardware acceleration of lattice-based cryptography, such as... Figure 1 As shown, it includes a routing control unit, a first modulo reduction operation unit, and a second modulo reduction operation unit; The routing control unit is used to receive intermediate result data generated during the operation of the lattice cryptography algorithm, generate corresponding routing control signals according to the operation type corresponding to the intermediate result data, and output the intermediate result data and routing control signals to the corresponding data output terminals respectively. The data input terminal of the first modular reduction operation unit is connected to the first data output terminal of the routing control unit, and is used to perform Montgomery reduction operation based on prime number conditions on the corresponding intermediate result data when the routing control signal of modular multiplication is received. The data input terminal of the second modulo subtraction operation unit is connected to the second data output terminal of the routing control unit. When a routing control signal for modulo addition is received, the unit performs a base-2 Barrett subtraction operation on the corresponding intermediate result data.

[0030] This invention optimizes the modular reduction operation component used in the NTT / INTT calculation process of the post-quantum cryptography algorithm, thereby improving the implementation performance of the algorithm without affecting security, and is applicable to various software and hardware environments.

[0031] Next, each of the above units will be explained in detail.

[0032] 1. Routing control unit: The routing control unit is connected to the computation pipeline of the lattice cryptography coprocessor. It is used to receive intermediate result data generated during the computation of the lattice cryptography algorithm, and generate corresponding routing control signals according to the operation type corresponding to the intermediate result data. The intermediate result data and routing control signals are output to the corresponding data output terminals respectively. The operation types include modular multiplication and modular addition. When determining the operation type of intermediate result data, it can be done in any of the following ways: (1) identify the identifier of the superior operation unit from which the intermediate result data originates; (2) parse the operation type label accompanying the intermediate result data; (3) make a judgment based on the bit width of the intermediate result data.

[0033] 2. First Modular Subtraction Unit: The first modular reduction unit is used to perform Montgomery reduction operations based on special prime number conditions. It uses the intermediate result data corresponding to the modular multiplication operation (i.e., the intermediate result of the modular multiplication) as the input value for the Montgomery reduction operation, and the intermediate result data corresponding to the modular multiplication operation is 32 bits. (See also...) Figure 2 As shown, the first modulo-subtraction operation unit includes a first shift module, a first logic judgment module, a first arithmetic module, a second shift module, and a first memory; wherein: (1) The first shift module is used to perform a right shift operation of 8 bits on the intermediate result data corresponding to the modular multiplication operation to obtain the first temporary variable; the shift operation is equivalent to dividing the intermediate result of the modular multiplication by 256; (2) The first logic judgment module is used to perform a bitwise AND operation between the first temporary variable and the constant 256 to generate the first judgment parameter; specifically, it judges whether the first temporary variable is greater than or equal to 256. If it is, the value of the first judgment parameter is 256; if not, the value of the first judgment parameter is 0. (3) The first calculation module is used to multiply the first judgment parameter by the first preset constant to generate the first product; and subtract the first product from the first temporary variable to obtain the first difference; in actual operation, the first preset constant can be set to 13; (4) The second shift module is used to perform a right shift operation of 8 bits on the first difference to obtain the first modulo reduction operation result and output it; the first modulo reduction operation result is the final operation result of the Montgomery reduction algorithm based on special prime number conditions.

[0034] The Montgomery reduction algorithm implemented above based on special prime number conditions simplifies the calculation of correction terms through a two-step reduction logic of "two right shifts and difference calculations", and is specifically adapted to real-time reduction processing of intermediate results of 32-bit modular multiplication. (5) A first memory, comprising: The first input register is a 32-bit integer memory used to store intermediate result data corresponding to modular multiplication received from the routing control unit; The first intermediate variable register is a 32-bit integer memory used to store the first temporary variable output by the first shift module; The judgment parameter register is a 32-bit integer memory used to store the first judgment parameter output by the first logic judgment module; The first result register is a 32-bit integer memory used to store the result of the first modulo-subtraction operation.

[0035] 3. Second Modular Reduction Unit: The second modulo-subtraction unit performs a base-2 Barrett subtraction operation, using the intermediate result data of the modulo-add operation (i.e., the intermediate result of the modulo-add operation) as the input value for the improved Barrett subtraction operation. The intermediate result data of the modulo-add operation is 16 bits. (See also...) Figure 3 As shown, the second modulo-subtraction operation unit includes a third shift module, a second operation module, a fourth shift module, a third operation module, and a second memory; wherein: (1) The third shift module is used to perform a right shift operation of 12 bits on the intermediate result data corresponding to the modulo addition operation to generate a second temporary variable; (2) The second operation module is used to multiply the second temporary variable with the second pre-stored constant to generate a 28-bit intermediate operation result, which is recorded as the second product. The second operation module uses a 32-bit multiplier, that is, it uses 32-bit integers for operation processing to avoid the numerical overflow problem caused by multiplication operation. (3) The fourth shift module is used to right-shift the 28-bit second product by 12 bits to generate a third temporary variable; this third temporary variable can be regarded as the updated second temporary variable; (4) The third operation module is used to multiply the third temporary variable with the preset modulus of the quantum cryptography after the lattice base to generate the third product; and subtract the third product from the intermediate result data corresponding to the modulus addition operation to output the result of the second modulus reduction operation; the result of the second modulus reduction operation is the final operation result of the Barrett reduction operation with base 2. The improved Barrett reduction algorithm based on base 2 simplifies intermediate value calculation by "avoiding overflow by right shifting 12 bits and multiplying by 32 bits twice", reducing the number of subtraction iterations and is specifically adapted for efficient reduction processing of 16-bit modulo addition intermediate results. (5) A second memory, comprising: The second input register is a 16-bit integer memory used to store intermediate result data corresponding to the modular addition operation received from the routing control unit; The second intermediate variable register is a 32-bit integer memory used to store the second temporary variable, the second product, and the third temporary variable; The second result register is a 32-bit integer memory used to store the result of the second modulo-subtraction operation.

[0036] Based on the same inventive concept, embodiments of the present invention also provide a bimodal reduction operation method for hardware acceleration of lattice-based cryptography, comprising the following steps: S1. Receive intermediate result data generated during the operation of the lattice cryptography algorithm; S2. Determine the operation type corresponding to the intermediate result data; the operation type includes modular multiplication and modular addition. (1) If the intermediate result data corresponds to a modular multiplication operation, the intermediate result data is sent to the first modular reduction operation unit to perform Montgomery reduction operation based on the prime number condition; (2) If the intermediate result data corresponds to a modular addition operation, the intermediate result data is sent to the second modular subtraction operation unit to perform a Barrett subtraction operation with base 2.

[0037] Since the principle behind this method is similar to that of the aforementioned dual-modal reduction operation system for hardware acceleration of lattice cryptography, the implementation of this method can be found in the implementation of the aforementioned system, and the repetitions will not be repeated.

[0038] The systems and methods described in the above embodiments can be implemented by a computer chip or entity, or by a product with a certain function. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a server, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0039] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0040] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0041] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0042] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 A process or multiple processes and / or a block diagram with steps of the functions specified in one or more blocks.

[0043] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0044] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0045] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A dual-modal reduction arithmetic system for hardware acceleration of lattice-based cryptography, characterized in that, It includes a routing control unit, a first modulo reduction operation unit, and a second modulo reduction operation unit; The routing control unit is used to receive intermediate result data generated during the operation of the lattice cryptography algorithm, generate a corresponding routing control signal according to the operation type corresponding to the intermediate result data, and output the intermediate result data and the routing control signal to the corresponding data output terminals respectively. The data input terminal of the first modular reduction unit is connected to the first data output terminal of the routing control unit, and is used to perform Montgomery reduction operation based on prime number conditions on the corresponding intermediate result data when a routing control signal for modular multiplication is received. The data input terminal of the second modulo subtraction operation unit is connected to the second data output terminal of the routing control unit, and is used to perform a base-2 Barrett subtraction operation on the corresponding intermediate result data when a routing control signal for modulo addition operation is received.

2. The dual-modal reduction computation system for hardware acceleration of lattice-based cryptography as described in claim 1, characterized in that, The first modulo-subtraction operation unit includes: The first shift module is used to right-shift the intermediate result data corresponding to the modular multiplication operation by 8 bits to obtain the first temporary variable; The first logic judgment module is used to perform a bitwise AND operation between the first temporary variable and the constant 256 to generate the first judgment parameter; The first calculation module is used to multiply the first judgment parameter by the first preset constant to generate a first product; and to subtract the first product from the first temporary variable to obtain a first difference. The second shift module is used to perform a right shift operation of 8 bits on the first difference to obtain the first modulo reduction result and output it.

3. The dual-modal reduction operation system for hardware acceleration of lattice-based cryptography as described in claim 2, characterized in that, The first modulo-subtraction operation unit further includes a first memory, the first memory comprising: The first input register is used to store intermediate result data corresponding to the modular multiplication operation received from the routing control unit; The first intermediate variable register is used to store the first temporary variable output by the first shift module; The judgment parameter register is used to store the first judgment parameter output by the first logic judgment module; The first result register is used to store the result of the first modulo-subtraction operation.

4. The dual-modal reduction computation system for hardware acceleration of lattice-based cryptography as described in claim 1, characterized in that, The second modulo-subtraction operation unit includes: The third shift module is used to right-shift the intermediate result data corresponding to the modular addition operation by 12 bits to generate a second temporary variable. The second operation module is used to multiply the second temporary variable by the second pre-stored constant to generate a second product; The fourth shift module is used to right-shift the second product by 12 bits to generate a third temporary variable; The third operation module is used to multiply the third temporary variable with the preset modulus of the lattice-based quantum cryptography to generate a third product; and to subtract the third product from the intermediate result data corresponding to the modulus addition operation to output the result of the second modulus reduction operation.

5. The dual-modal reduction computation system for hardware acceleration of lattice-based cryptography as described in claim 4, characterized in that, The second arithmetic module uses a 32-bit multiplier.

6. The dual-modal reduction computation system for hardware acceleration of lattice-based cryptography as described in claim 4, characterized in that, The second modulo-subtraction unit further includes a second memory, the second memory comprising: The second input register is used to store intermediate result data corresponding to the modular addition operation received from the routing control unit; The second intermediate variable register is used to store the second temporary variable, the second product, and the third temporary variable; The second result register is used to store the result of the second modulo reduction operation.

7. The dual-modal reduction arithmetic system for hardware acceleration of lattice-based cryptography as described in claim 1, characterized in that, The intermediate result data corresponding to the modular multiplication operation is 32 bits.

8. The dual-modal reduction arithmetic system for hardware acceleration of lattice-based cryptography as described in claim 1, characterized in that, The intermediate result data corresponding to the modular addition operation is 16 bits.

9. A bimodal reduction operation method for hardware acceleration of lattice-based cryptography, characterized in that, The method of using the system according to any one of claims 1-8 includes: Receive intermediate result data generated during the operation of the lattice cryptography algorithm; Determine the operation type corresponding to the intermediate result data; the operation type includes modular multiplication and modular addition. If the intermediate result data corresponds to a modular multiplication operation, then the intermediate result data is sent to the first modular reduction operation unit to perform Montgomery reduction operation based on prime number conditions; If the intermediate result data corresponds to a modular addition operation, the intermediate result data is sent to the second modular subtraction operation unit to perform a Barrett subtraction operation with base 2.

Images