Sampling circuit, control method and hardware accelerator applied to lattice cryptography algorithm
By introducing an independent cache module into the sampling circuit, the problem of coupling between the hash operation module and the sampling module is solved, enabling efficient operation of the sampling circuit and improving the calculation speed of the lattice cryptography algorithm.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA RESOURCES MICROELECTRONICS HLDG LTD
- Filing Date
- 2025-01-06
- Publication Date
- 2026-07-07
AI Technical Summary
In related technologies, the sampling circuit is coupled with the hash operation module, resulting in poor acceleration effect of the sampling circuit on the lattice cryptography algorithm.
An independent cache module is introduced into the sampling circuit to store the pseudo-random sequence generated by the hash operation module, so that the hash operation module and the sampling module are independent of each other. The sampling module performs sampling without affecting the hash operation module to perform a new round of operation.
It significantly improves the operating efficiency of the sampling circuit, saves sampling time, and increases the calculation speed of the lattice cryptography algorithm.
Smart Images
Figure CN122348816A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of post-quantum cryptography, and more particularly to a sampling circuit, control method, and hardware accelerator for lattice cryptography algorithms. Background Technology
[0002] Lattice cryptography, or post-quantum cryptography based on the complex problem of lattices, is resistant to attacks from quantum computers. The sampling process for polynomials in lattice cryptography is time-consuming. To accelerate its execution, appropriate sampling circuits can be designed to speed up the sampling process in hardware.
[0003] In related technologies, the sampling circuit and hash operation module are coupled with each other, resulting in poor acceleration effect of the sampling circuit on the lattice cryptography algorithm. Summary of the Invention
[0004] To overcome the problems existing in related technologies, this disclosure provides a sampling circuit, control method and hardware accelerator for lattice cryptography algorithms.
[0005] According to a first aspect of the present disclosure, a sampling circuit applied to a lattice cryptography algorithm is provided, comprising:
[0006] The filling module is used to fill the seed according to the hash filling rules;
[0007] The hash operation module is used to perform hash operations on the filled seed to generate a pseudo-random sequence.
[0008] A cache module is used to store the pseudo-random sequence generated by the hash operation module;
[0009] The sampling module is used to sample the pseudo-random sequence stored in the cache module to obtain the sampling result.
[0010] In some embodiments, the hash operation module includes: a first register and an iterative operator;
[0011] The first register is used to store the filled seed and the operation result of the iterative arithmetic unit;
[0012] The iterative arithmetic unit is used to perform hash operations based on the data stored in the first register.
[0013] In some embodiments, the iterative arithmetic unit includes multiple hash units connected sequentially;
[0014] In the plurality of hash units,
[0015] The first hash unit is used to perform a hash operation based on the data stored in the first register;
[0016] The non-first hash unit is used to perform hash operations based on the result of the operation of the previous hash unit connected to it;
[0017] The result of the last hash unit is stored in the first register.
[0018] In some embodiments, the hash operation module further includes a first multiplexer;
[0019] The first input of the first multiplexer is connected to the output of the filling module, the second input is connected to the output of the iterative arithmetic unit, and the output is connected to the input of the first register.
[0020] In some embodiments, the hash operation module further includes a first multiplexer;
[0021] The input of the first multiplexer is connected to the output of the first register, the first output is connected to the input of the iterative arithmetic unit, and the second output is connected to the input of the cache module.
[0022] In some embodiments, the filling module includes a second register, which has a data input terminal and a parameter input terminal;
[0023] The data input terminal is used to input the seed;
[0024] The parameter input terminal is used to input the filling parameters corresponding to the hash operation type in the hash operation module.
[0025] In some embodiments, the filling parameters include filling type information and seed length information, and the filling module further includes a second multiplexer;
[0026] The first input terminal of the second multiplexer is used to input the fill type information, the second input terminal is used to input the seed length information, and the output terminal is connected to the parameter input terminal.
[0027] In some embodiments, the sampling module includes: a second multiplexer and a plurality of samplers;
[0028] The input of the second multiplexer is connected to the output of the cache module;
[0029] The multiple outputs of the second multiplexer are connected to different samplers.
[0030] According to a second aspect of the present disclosure, a sampling circuit control method is provided, applied to the sampling circuit described in the first aspect, the method comprising:
[0031] The seed is filled according to the hash filling rules;
[0032] Perform a hash operation on the filled seed to generate a pseudo-random sequence;
[0033] The pseudo-random sequence is stored in the cache module;
[0034] The pseudo-random sequence stored in the cache module is sampled to obtain the sampling result.
[0035] According to a third aspect of the present disclosure, a hardware accelerator for lattice cryptography algorithms is provided, comprising: the sampling circuit described in the first aspect.
[0036] The technical solutions provided in this disclosure may have the following beneficial effects:
[0037] The sampling circuit provided in this embodiment includes a filling module, a hash operation module, a cache module, and a sampling module. The filling module fills the seed according to hash filling rules. The hash operation module performs a hash operation on the filled seed to generate a pseudo-random sequence. The cache module stores the pseudo-random sequence generated by the hash operation module. The sampling module samples the pseudo-random sequence stored in the cache module to obtain a sampling result. This embodiment includes a cache module, which provides data for sampling to the sampling module during the sampling process, without relying on the hash operation module. Therefore, the sampling module and hash operation module in this embodiment are independent and can work simultaneously, thereby improving the operating efficiency of the sampling circuit and effectively accelerating the computation process of the lattice cryptography algorithm. Attached Figure Description
[0038] Figure 1 A schematic diagram of the overall architecture of a sampling circuit according to an embodiment of this disclosure is shown.
[0039] Figure 2 A schematic diagram of a sampling circuit according to an embodiment of this disclosure is shown.
[0040] Figure 3 A schematic diagram of the structure of a filling module in an embodiment of this disclosure is shown.
[0041] Figure 4 A schematic diagram of the structure of a sampling module in an embodiment of this disclosure is shown.
[0042] Figure 5 A schematic flowchart of a sampling circuit control method according to an embodiment of this disclosure is shown. Detailed Implementation
[0043] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0044] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.
[0045] Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.
[0046] To facilitate understanding, the following explanations are provided for several terms used in this disclosure:
[0047] A lattice is a linear set of linearly independent vectors with integer coefficients in n-dimensional Euclidean space. Based on lattices, a series of computationally complex problems can be designed, such as the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP). As the lattice dimension increases, these vector problems become increasingly computationally difficult to solve.
[0048] Lattice cryptography, also known as lattice-based post-quantum cryptography, is a new generation of cryptographic algorithms that can resist attacks from quantum computers. The construction and computation of lattice-based cryptography algorithms can ultimately be reduced to a vector problem in an n-dimensional lattice. Since no quantum algorithm can solve complex problems on lattices in polynomial time, post-quantum cryptography based on lattice problems possesses strong resistance to quantum attacks.
[0049] Sampling circuits are one of the core components used to accelerate the operation of post-quantum cryptography algorithms. Post-quantum cryptography algorithms require repeated sampling to generate the necessary pseudo-random information. Accelerating the sampling process through sampling circuits improves sampling efficiency and facilitates the efficient implementation of post-quantum cryptography algorithms. In lattice-based post-quantum cryptography algorithms, sampling algorithms mainly include binomial distribution sampling, rejection-uniform distribution sampling, and non-negative correlation-trivalued sampling.
[0050] The sampling process in lattice cryptography will now be explained using binomial distribution sampling as an example.
[0051] First, a pseudo-random sequence (containing multiple pseudo-random strings) needs to be generated for sampling through hash operations.
[0052] Hash operations can be implemented using the third-generation secure hash function (SHA-3). SHA-3 is based on the Keccak algorithm and is defined by two important parameters: the length of the output data after the operation, and the number of iterations, or "rounds," within the function. During the hash operation, the hash function performs multiple rounds of hash operations based on the padded seed until the number of rounds reaches a predefined number, ultimately generating a fixed-length pseudo-random sequence.
[0053] Next, the pseudo-random sequence generated by the hash operation will be sampled using a binomial distribution to obtain the sampling result. The sampling result is the polynomial coefficient used in the lattice cryptography algorithm to implement polynomial multiplication.
[0054] Binomial sampling can be achieved by calculating the Hamming weights of two uniformly distributed random numbers and then calculating their difference. For example, from a random uniform sequence, take two random numbers of length k bits, calculate their Hamming weights, and then subtract the two Hamming values. Repeating this process with a sufficient number of data sets will yield the binomial distribution coefficients that conform to the standard deviation σ = √k / 2.
[0055] During the execution of the lattice cryptography algorithm, the above sampling process will be executed multiple times. Although the sampling algorithm may be different each time it is called, the sampling process is generally similar.
[0056] In other words, the design of a sampling circuit requires at least two parts: a hash operation module for performing hash operations and a sampling module for performing sampling operations.
[0057] In related technologies, there is a coupling relationship between the hash operation module and the sampling module. The operation of the sampling module depends on the hash operation results stored in the hash operation module. Therefore, when the sampling module is running, the hash operation module can only act as a provider of the data to be sampled, providing the pseudo-random sequence to be sampled to the sampling module, but cannot perform hash operations, which leads to low efficiency of the sampling circuit.
[0058] To address the aforementioned technical issues, this embodiment incorporates an independent cache module into the sampling circuit, storing the pseudo-random sequence generated by the hash operation module within this cache module. This ensures that the hash operation module and the sampling module are independent of each other. When the sampling module samples the pseudo-random sequence generated by the hash operation module, it does not affect the hash operation module from performing a new round of hash operations, thereby significantly improving the operating efficiency of the sampling circuit.
[0059] The following will describe the exemplary implementation method in detail with reference to the accompanying drawings and embodiments.
[0060] Figure 1 This diagram illustrates the overall architecture of a sampling circuit according to an embodiment of the present disclosure, as shown below. Figure 1 As shown, the sampling circuit includes: a filling module 100, a hash operation module 200, a cache module 300, and a sampling module 400.
[0061] Specifically, the filling module 100 is used to fill the seed according to the hash filling rules.
[0062] The hash operation module 200 is used to perform hash operations on the filled seed to generate a pseudo-random sequence.
[0063] The cache module 300 is used to store the pseudo-random sequence generated by the hash operation module 200.
[0064] The sampling module 400 is used to sample the pseudo-random sequence stored in the cache module 300 to obtain the sampling result.
[0065] The seed can be understood as the initial value used for hash operations, and it can be any string.
[0066] The hash padding rule is the padding rule corresponding to the hash operation performed in the hash operation module 200. Those skilled in the art will understand that before performing a hash operation on a string, it needs to be padded to ensure that its format and length meet the requirements of the hash operation for the initial value.
[0067] In some embodiments, the filling module 100, hash operation module 200, cache module 300 and sampling module 400 are connected in sequence, and each of the above modules can be implemented in hardware based on a field-programmable gate array (FPGA).
[0068] This embodiment of the disclosure includes a cache module 300, in which the results of the hash operation module 200 are stored. During the sampling process, the cache module 300 provides data for sampling to the sampling module 400, eliminating the need for the hash operation module 200 to provide data during sampling. Therefore, in the sampling circuit provided by this embodiment, the operation of the sampling module 400 no longer depends on the hash operation module 200 providing data for sampling. When performing sampling, the sampling module 400 can release the hash operation module 200 and perform a new round of hash operations, thereby significantly improving the operating efficiency of the sampling circuit and accelerating the execution of the lattice cryptography algorithm.
[0069] Figure 2 A schematic diagram of a sampling circuit according to an embodiment of this disclosure is shown. Figure 2 As shown, in the sampling circuit, the hash operation module 200 may include a first register and an iterative operation unit.
[0070] The first register is used to store the filled seed and the result of the iterator, and the iterator is used to perform hash operations based on the data stored in the first register.
[0071] For example, the seed filled by the filling module 100 is first stored in the first register. The iterative arithmetic unit can perform a hash operation on the filled seed and store the hash result in the first register. At this time, if the number of hash operations reaches the sampling requirement of the lattice cryptography algorithm, the hash result (i.e., the pseudo-random sequence) stored in the first register will be stored in the cache module 300; otherwise, the iterative arithmetic unit will read the data stored in the first register again, perform a hash operation on it, and store the hash result in the first register.
[0072] In some embodiments, the iterative arithmetic unit includes multiple hash units ( Figure 2 (There are two hash units in the first register). Multiple hash units are connected sequentially. In the multiple hash units, the first hash unit is used to perform a hash operation based on the data stored in the first register; the hash units that are not the first hash unit are used to perform a hash operation based on the operation result of the hash unit connected to it; the operation result of the last hash unit is stored in the first register.
[0073] In this embodiment of the disclosure, the first hash unit represents the "first" hash unit in the data transmission direction, i.e., the input terminal of the iterative operator for receiving external data. Correspondingly, the last hash unit represents the "last hash unit" in the data transmission direction, i.e., the output terminal of the iterative operator for sending data to the outside.
[0074] Understandably, each hash unit is used for one round of hashing. By setting multiple hash units in the iterative operator, the number of rounds of hashing operations in each iteration can be increased, reducing the number of iterations. This allows for obtaining a pseudo-random sequence that meets the sampling requirements of lattice cipher algorithms with fewer iterations, thus improving the sampling efficiency of lattice cipher algorithms.
[0075] For example, suppose the SHA-3 algorithm defines that the seed needs to undergo 24 rounds of hash operations to generate a pseudo-random sequence for use by the sampling module 400. In the solution provided in the embodiments of this disclosure, by setting two hash units in the iterative operator, two rounds of hash operations can be performed in each iteration, that is, a pseudo-random sequence for use by the sampling module 400 can be generated in 12 iterations.
[0076] In some embodiments, the hash operation module 200 further includes a first multiplexer (MUX1). The first input of the first multiplexer is connected to the output of the filling module 100, the second input is connected to the output of the iterative arithmetic unit, and the output is connected to the input of the first register.
[0077] By setting the first multiplexer, the input of the first register can be switched between the output of the filling module 100 and the output of the iterative arithmetic unit, thereby switching the main body used to transfer data into the first register.
[0078] In other words, when the filling module 100 completes filling the seed, the output of the filling module 100 can be made to be connected to the input of the first register, so that the filled seed can be input into the first register. Subsequently, the first multiplexer can be controlled to make the output of the iterative arithmetic unit connected to the input of the first register, thereby ensuring that after each iteration, the iterative arithmetic unit can store the calculation result in the first register.
[0079] In some embodiments, the hash operation module 200 further includes a first multiplexer (DMUX1). The input of the first multiplexer is connected to the output of the first register, the first output is connected to the input of the iterative arithmetic unit, and the second output is connected to the input of the cache module 300.
[0080] By setting the first multiplexer, the output of the first register can be switched between the input of the iterative arithmetic unit and the input of the buffer module 300, thereby switching the transmission direction of data in the first register.
[0081] In other words, if the number of hash operation rounds in the hash operation module 200 does not meet the requirements of the aforementioned SHA-3 algorithm, the output of the first register is connected to the input of the iterative arithmetic unit, thereby starting a new iteration operation. If the number of hash operation rounds meets the requirements of the aforementioned SHA-3 algorithm, the output of the first register is connected to the input of the cache module 300, so that the hash operation result stored in the first register can be transferred to the cache module 300.
[0082] In some embodiments, after the hash operation result stored in the first register is transferred to the cache module 300, the first register no longer needs to be used to store hash operation results. At this time, the first register can be used to store a new, padded seed and input it into the iterative arithmetic unit to start a new round of iterative hash operation. Meanwhile, the sampling module 400 can obtain the data to be sampled (i.e., the pseudo-random sequence) from the cache module 300 in order to perform the sampling operation. Thus, the sampling module 400 and the hash operation module 200 are independent of each other, and new hash operations can be performed simultaneously during the sampling process.
[0083] Please continue to refer to Figure 2 The cache module 300 may include a third register. It is understood that the first register stores the complete hash result, while the third register stores the valid portion of the hash result, i.e., the portion used for sampling. Therefore, the capacity of the third register can be smaller than that of the first register.
[0084] For example, the size of the first register can be 1600 bits, and the size of the third register can be 1344 bits. This configuration allows the first and third registers to hold the data generated by the various hash operations involved in the lattice cryptography algorithm.
[0085] In some embodiments, the sampling circuit further includes a top-level state machine 500. The top-level state machine 500 can acquire the operating state of each module in the sampling circuit and control the operating state of each module through control signals.
[0086] For example, after the filling module 100 completes filling the seed, the top-level state machine 500 can control the first multiplexer to enable the filling module 100 to conduct with the first register, and at the same time control the filling module 100 to input the filled seed into the first register.
[0087] It is understood that the working state of each module and unit in the embodiments of this disclosure can be controlled by the control signals output by the top-level state machine 500, and the timing requirements of each module can be met. This disclosure will not elaborate on this.
[0088] In some embodiments, taking the sampling of the common parameter matrix A in the Dilithium-2 algorithm as an example, sampling it using a sampling circuit in related technologies requires 3280 clock cycles. However, sampling it using the sampling circuit provided in this disclosure requires only 1472 clock cycles.
[0089] As can be seen, the sampling circuit provided in this embodiment can significantly save sampling time, and the sampling speed is increased by 123% under the same conditions.
[0090] Figure 3 A schematic diagram of the structure of a filling module according to an embodiment of this disclosure is shown. Figure 3 As shown, the filling module 100 includes a second register, which has a data input terminal and a parameter input terminal. The data input terminal is used to input the seed, and the parameter input terminal is used to input the filling parameters corresponding to the hash operation type in the hash operation module.
[0091] For example, the filling parameters may include filling type information and seed length information, and the filling module 100 also includes a second multiplexer (MUX2). The first input of the second multiplexer is used to input the filling type information, the second input is used to input the seed length information, and the output is connected to the parameter input.
[0092] In other words, the second multiplexer can be used to control the input of the padding parameters. After the seed is input into the second register, the first input of the second multiplexer can be connected to the second register, thereby inputting a signal indicating the padding type information into the second register. The top-level state machine can then pad the seed stored in the second register according to the padding type information. Next, the second input of the second multiplexer can be connected to the second register, thereby inputting a signal indicating the (unpadded) seed length information into the second register. The top-level state machine can then control the padding cycle according to the seed length information, ensuring that the padded seed length meets the requirements of the hash operation.
[0093] For example, during the filling process, the data in the registers can be controlled at the hardware level through Register Transfer Level (RTL) code to improve the filling efficiency of the seed.
[0094] For example, the first register can also be used as the second register, that is, the seed can be directly filled into the first register and the filled seed can be directly sent into the iterative arithmetic unit for hash operation.
[0095] Figure 4 A schematic diagram of the structure of a sampling module according to an embodiment of this disclosure is shown. Figure 4As shown, the sampling module 400 includes a second multiplexer (DMUX2) and multiple samplers. The input of the second multiplexer is connected to the output of the buffer module, and the multiple outputs of the second multiplexer are respectively connected to different samplers.
[0096] For example, the sampler may include a sampler for implementing Central Binomial Distribution (CBD) sampling, a sampler for implementing Uniform Distribution (UD) sampling, a sampler for implementing Gaussian (GS) sampling, etc. Since multiple sampling algorithms need to be invoked in lattice cryptography algorithms, the sampling module 400 includes all of these types of samplers. The second multiplexer can be used to select the sampler currently used for sampling, that is, the sampling algorithm currently used to sample the pseudo-random sequence (hash operation result).
[0097] Based on the same inventive concept, this disclosure also provides a sampling circuit control method. Figure 5 A flowchart illustrating a sampling circuit control method according to an embodiment of this disclosure is shown, which is applied to the aforementioned sampling circuit. Figure 5 As shown, the method includes the following steps.
[0098] S501, fill the seed according to the hash filling rules.
[0099] The seed can be understood as the initial value used for hash operations, and it can be any string. Before performing a hash operation on the seed, the input seed needs to be padded according to the hash padding rules corresponding to the hash operation to ensure that it meets the requirements of the hash operation for the initial value.
[0100] S502 performs a hash operation on the filled seed to generate a pseudo-random sequence.
[0101] For example, multiple rounds of iterative hashing can be performed on the filled seed to generate a pseudo-random sequence for sampling.
[0102] S503 stores the pseudo-random sequence in the cache module.
[0103] For example, the cache module is a separate memory. In this embodiment of the disclosure, the memory is used only to store the pseudo-random sequence used for sampling, and not to store other data.
[0104] S504 samples the pseudo-random sequence stored in the cache module to obtain the sampling result.
[0105] In this embodiment of the disclosure, the pseudo-random sequence used for sampling is provided by an independent cache module, so the sampling process and the hash operation process will not conflict, which can improve the operating efficiency of the sampling circuit.
[0106] Based on the same inventive concept, this disclosure also provides a hardware accelerator for lattice cryptography algorithms, which includes the above-described sampling circuit.
[0107] The hardware accelerator provided in this disclosure can accelerate the sampling process of lattice cryptography algorithms based on sampling circuits, thereby promoting the efficient implementation of lattice cryptography algorithms.
[0108] The embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.
[0109] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.
Claims
1. A sampling circuit applied to lattice cryptography algorithms, characterized in that, include: The filling module is used to fill the seed according to the hash filling rules; The hash operation module is used to perform hash operations on the filled seed to generate a pseudo-random sequence. A cache module is used to store the pseudo-random sequence generated by the hash operation module; The sampling module is used to sample the pseudo-random sequence stored in the cache module to obtain the sampling result.
2. The sampling circuit according to claim 1, characterized in that, The hash operation module includes: a first register and an iterative operator; The first register is used to store the filled seed and the operation result of the iterative arithmetic unit; The iterative arithmetic unit is used to perform hash operations based on the data stored in the first register.
3. The sampling circuit according to claim 2, characterized in that, The iterative arithmetic unit includes multiple hash units, which are connected sequentially. In the plurality of hash units, The first hash unit is used to perform a hash operation based on the data stored in the first register; The non-first hash unit is used to perform hash operations based on the result of the operation of the previous hash unit connected to it; The result of the last hash unit is stored in the first register.
4. The sampling circuit according to claim 2, characterized in that, The hash operation module also includes a first multiplexer; The first input of the first multiplexer is connected to the output of the filling module, the second input is connected to the output of the iterative arithmetic unit, and the output is connected to the input of the first register.
5. The sampling circuit according to claim 2, characterized in that, The hash operation module also includes a first multiplexer; The input of the first multiplexer is connected to the output of the first register, the first output is connected to the input of the iterative arithmetic unit, and the second output is connected to the input of the cache module.
6. The sampling circuit according to claim 1, characterized in that, The filling module includes a second register, which has a data input terminal and a parameter input terminal; The data input terminal is used to input the seed; The parameter input terminal is used to input the filling parameters corresponding to the hash operation type in the hash operation module.
7. The sampling circuit according to claim 6, characterized in that, The filling parameters include filling type information and seed length information; the filling module also includes a second multiplexer. The first input terminal of the second multiplexer is used to input the fill type information, the second input terminal is used to input the seed length information, and the output terminal is connected to the parameter input terminal.
8. The sampling circuit according to claim 1, characterized in that, The sampling module includes: a second multiplexer and multiple samplers; The input of the second multiplexer is connected to the output of the cache module; The multiple outputs of the second multiplexer are connected to different samplers.
9. A sampling circuit control method, characterized in that, Applied to the sampling circuit as described in any one of claims 1 to 8, the method comprises: The seed is filled according to the hash filling rules; Perform a hash operation on the filled seed to generate a pseudo-random sequence; The pseudo-random sequence is stored in the cache module; The pseudo-random sequence stored in the cache module is sampled to obtain the sampling result.
10. A hardware accelerator for lattice cryptography algorithms, characterized in that, include: The sampling circuit as described in any one of claims 1 to 8.