A method and device for constructing a CRAFT block cipher arithmetic circuit for secure multi-party computation

Abstract

The present disclosure relates to the field of CRAFT block cipher arithmetic circuit, and proposes a CRAFT block cipher arithmetic circuit construction method and device for secure multi-party computation, which comprises the following steps: constructing a linear calculation part arithmetic circuit according to the linear calculation part of the CRAFT block cipher; determining the original polynomial corresponding to the S-box according to the S-box truth table of the CRAFT block cipher; optimizing the original polynomial to reduce the number of multiplications to obtain an optimized polynomial; constructing the arithmetic circuit of the S-box in the CRAFT block cipher according to the optimized polynomial; and cascading the linear calculation part arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number to obtain a complete CRAFT block cipher arithmetic circuit, which is applied to a secure multi-party computation protocol. The present disclosure reduces the communication required for calculation in the secure multi-party computation protocol and improves the execution efficiency of the secure multi-party computation protocol.

Description

Technical Field

[0001] This disclosure relates to the field of CRAFT block cipher arithmetic circuits, and more particularly to a method and apparatus for constructing CRAFT block cipher arithmetic circuits for secure multi-party computation. Background Technology

[0002] CRAFT (Cipher with efficient pRotection Against differential Faultanalysis Techniques) is a lightweight, adjustable block cipher designed for resource-constrained scenarios such as the Internet of Things and embedded systems. It balances minimal hardware footprint with efficient protection against differential fault analysis (DFA) attacks and is one of the 128-bit key lightweight block ciphers that can be implemented in low-cost hardware.

[0003] Secure Multi-Party Computation (MPC) is a cryptographic technique that enables joint computation without revealing the private inputs of each participant. It has significant applications in privacy computing, distributed key management, blockchain, and IoT security. In MPC protocols, symmetric cryptographic algorithms serve as fundamental operators and are typically represented as Boolean circuits or arithmetic circuits. Arithmetic circuits, under certain protocol frameworks, offer advantages such as fewer communication rounds and higher computational efficiency. However, block ciphers in related technologies are often designed for traditional execution environments, and their direct conversion to arithmetic circuits often results in high multiplication complexity and significant communication and computational overhead. CRAFT, as a lightweight block cipher, features a regular structure and fine-grained operation; however, a systematic and universal technical solution for efficiently constructing arithmetic circuits from CRAFT in secure MPC scenarios is lacking. Summary of the Invention

[0004] In view of this, this disclosure proposes a method, apparatus, computer program product, and storage medium for constructing CRAFT block cipher arithmetic circuits for secure multi-party computation. When constructing the CRAFT block cipher arithmetic circuit, the original polynomial corresponding to the S-box is determined based on the truth table of the CRAFT block cipher. With the optimization objective of reducing the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, the original polynomial is optimized to reduce the number of multiplications. This reduces the number of multiplication operations in the arithmetic circuit, thereby directly reducing the number of communication rounds and the amount of communication data required in the online computation phase of the secure multi-party computation protocol, shortening the overall computation latency, and improving the execution efficiency of the secure multi-party computation protocol.

[0005] According to one aspect of this disclosure, a method for constructing CRAFT block cipher arithmetic circuits for secure multi-party computation is provided, the method comprising:

[0006] Construct the arithmetic circuit for the linear computation part based on the linear computation part of the CRAFT block cipher;

[0007] Determine the primitive polynomial corresponding to the S-box based on the truth table of the CRAFT block cipher;

[0008] With the optimization goal of reducing the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, the original polynomial is optimized to reduce the number of multiplications, resulting in the optimized polynomial.

[0009] Based on the optimized polynomial, construct the arithmetic circuit of the S-box in the CRAFT block cipher;

[0010] By cascading the linear computation section's arithmetic circuit with the S-box arithmetic circuit according to the CRAFT round number, a complete CRAFT block cipher arithmetic circuit is obtained.

[0011] The CRAFT block cipher arithmetic circuit is used in secure multi-party computation protocols.

[0012] In one possible implementation, the optimization of the original polynomial to reduce the number of multiplications, with the optimization objective being the multiplication overhead when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, includes:

[0013] With the goal of reducing the number of multiplication operations when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, the original polynomial is decomposed and reconstructed according to the relationship between powers to obtain an optimized polynomial in the composite or product form of sparse subpolynomials.

[0014] In one possible implementation, the structural decomposition and reconstruction of the original polynomial based on the relationship between powers includes:

[0015] By pre-setting basis functions, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions.

[0016] In one possible implementation, the method further includes:

[0017] The non-constant terms in the sparse subpolynomial are decomposed into a linear combination of terms raised to the power of 2 and a product of terms raised to the power of 2.

[0018] In one possible implementation, the optimized polynomial is a linearized polynomial structure containing only terms of powers of 2.

[0019] In one possible implementation, each state unit of the linear computation portion of the CRAFT block cipher includes: column confusion, round constant addition, round handle key addition, and unit permutation.

[0020] The cascading of the linear computation arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number includes:

[0021] The linear calculation section arithmetic circuit and the S-box arithmetic circuit are connected to obtain the round function arithmetic circuit;

[0022] Connect the arithmetic circuits of the three units of the wheel handle key addition, wheel constant addition, and column confusion in the arithmetic circuit of the linear calculation part to obtain the linear wheel function arithmetic circuit;

[0023] The round function arithmetic circuit and the linear round function arithmetic circuit are cascaded according to the number of CRAFT rounds.

[0024] In one possible implementation, the secure multi-party computation protocol is the MASCOT (Faster Malicious Arithmetic Secure Computation with Oblivious Transfer) protocol.

[0025] According to another aspect of this disclosure, a CRAFT block cipher arithmetic circuit construction apparatus for secure multi-party computation is provided, comprising:

[0026] The linear computation arithmetic circuit construction module is used to construct the linear computation part arithmetic circuit based on the linear computation part of the CRAFT block cipher.

[0027] The S-box polynomial determination module is used to determine the primitive polynomial corresponding to the S-box based on the truth table of the S-box in the CRAFT block cipher.

[0028] The polynomial optimization module is used to optimize the original polynomial by reducing the number of multiplications when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, with the goal of reducing the multiplication overhead.

[0029] The S-box arithmetic circuit construction module is used to construct the arithmetic circuit of the S-box in the CRAFT block cipher based on the optimized polynomial.

[0030] The cascade module is used to cascade the linear computation section of the arithmetic circuit with the S-box arithmetic circuit according to the CRAFT round number to obtain the complete CRAFT block cipher arithmetic circuit.

[0031] The CRAFT block cipher arithmetic circuit is used in secure multi-party computation protocols.

[0032] In one possible implementation, the polynomial optimization module is further configured to:

[0033] With the goal of reducing the number of multiplication operations when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, the original polynomial is decomposed and reconstructed according to the relationship between powers to obtain an optimized polynomial in the composite or product form of sparse subpolynomials.

[0034] In one possible implementation, the polynomial optimization module is further configured to:

[0035] By pre-setting basis functions, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions.

[0036] In one possible implementation, the polynomial optimization module is further configured to:

[0037] The non-constant terms in the sparse subpolynomial are decomposed into a linear combination of terms raised to the power of 2 and a product of terms raised to the power of 2.

[0038] In one possible implementation, the optimized polynomial is a linearized polynomial structure containing only terms of powers of 2.

[0039] In one possible implementation, each state unit of the linear computation portion of the CRAFT block cipher includes: column confusion, round constant addition, round handle key addition, and unit permutation.

[0040] In one possible implementation, the S-box arithmetic circuit construction module is further configured to:

[0041] The linear calculation section arithmetic circuit and the S-box arithmetic circuit are connected to obtain the round function arithmetic circuit;

[0042] Connect the arithmetic circuits of the three units of the wheel handle key addition, wheel constant addition, and column confusion in the arithmetic circuit of the linear calculation part to obtain the linear wheel function arithmetic circuit;

[0043] The round function arithmetic circuit and the linear round function arithmetic circuit are cascaded according to the number of CRAFT rounds.

[0044] In one possible implementation, the secure multi-party computation protocol is the MASCOT protocol.

[0045] According to another aspect of this disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-described method.

[0046] According to another aspect of this disclosure, a non-volatile computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described method.

[0047] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0048] In this disclosure, by constructing the arithmetic circuit for the linear computation part of the CRAFT block cipher and determining the polynomial corresponding to the S-box of the CRAFT block cipher, the optimization objective is to reduce the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol. The original polynomial is optimized to reduce the number of multiplications. Based on the optimized polynomial, the arithmetic circuit of the S-box is constructed. Finally, the linear computation part arithmetic circuit and the S-box arithmetic circuit are cascaded according to the number of CRAFT rounds to obtain a complete CRAFT block cipher arithmetic circuit for secure multi-party computation. Determining the polynomial corresponding to the S-box and optimizing it to reduce the number of multiplications reduces the number of multiplication operations in the arithmetic circuit without changing the algorithm's functionality and security attributes. This effectively reduces the computational complexity of the nonlinear layer, thereby reducing the number of communication rounds and the amount of communication data required in the online computation phase of the secure multi-party computation protocol, shortening the overall computation latency, and improving the execution efficiency of the secure multi-party computation protocol. Meanwhile, by mapping the linear and nonlinear layers of the CRAFT block cipher to linear operations and low-multiplication-complexity arithmetic circuits over finite fields, respectively, the structure is clear and highly modular. This facilitates engineering implementation and parameter tuning under different MPC protocols and system architectures, and makes it easy to implement, reuse, and extend across different secure multi-party computation frameworks. Furthermore, the arithmetic circuit construction method proposed in this disclosure reduces the number of multiplication operations in the arithmetic circuit without altering the algorithm's functionality and security attributes, balancing security, efficiency, and engineering feasibility. This provides a stable and feasible technical path for deploying block ciphers in privacy computing, distributed secure computing, and multi-party collaborative encryption applications, thereby expanding the application boundaries of block ciphers in privacy computing scenarios.

[0049] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0050] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0051] Figure 1A flowchart illustrating a method for constructing a CRAFT block cipher arithmetic circuits for secure multi-party computation according to an embodiment of this application is shown.

[0052] Figure 2 This diagram illustrates a structural apparatus for constructing CRAFT block cipher arithmetic circuits for secure multi-party computation according to an embodiment of this application.

[0053] Figure 3 This diagram illustrates a method for constructing a CRAFT block cipher arithmetic circuits for secure multi-party computation according to an embodiment of this application.

[0054] Figure 4 The diagram illustrates an optimization method for reducing the number of multiplications of an original polynomial according to an embodiment of this application.

[0055] Figure 5 This diagram illustrates a use case of a CRAFT block cipher arithmetic circuit for secure multi-party computation according to an embodiment of this application.

[0056] Figure 6 A block diagram of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0057] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0058] As used herein, the terms “comprising,” “including,” “having,” or variations thereof are open-ended and include one or more of the stated features, integrals, elements, steps, components, or functions, but do not exclude the presence or addition of one or more other features, integrals, elements, steps, components, functions, or groups thereof.

[0059] When an element is referred to as “connected,” “coupled,” “responding,” or a variation thereof relative to another element, it may be directly connected, coupled, or responding to another element, or there may be an intermediate element present.

[0060] Although the terms first, second, third, etc., may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another. Therefore, without departing from the teachings of the inventive concept, a first element / operation in some embodiments may be referred to as a second element / operation in other embodiments.

[0061] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0062] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0063] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant regions.

[0064] With the rapid development of information technology and the big data industry, the demand for collaborative computing and value mining of data across institutions, fields, and entities is becoming increasingly urgent. Traditional data processing models typically require the centralized aggregation and unified storage of raw data scattered across different participants before computation and analysis. While this model is easy to implement, it poses serious data security and privacy compliance risks: on the one hand, raw data is highly susceptible to leakage, tampering, or unauthorized use during collection, transmission, and aggregation, making it difficult to meet the requirements of relevant laws and regulations such as personal information protection and data security laws; on the other hand, due to considerations of trade secrets, user privacy, and data asset protection, different data holders often distrust each other and cannot directly share plaintext data, thus forming numerous "data silos" that severely restrict the circulation and value release of data elements. Against this backdrop, privacy-preserving computing technologies that enable data to be usable but not visible have become a key technological path to solve these problems, among which Secure Multi-Party Computation (MPC) is one of the most universal and secure technical solutions.

[0065] Secure multi-party computation (MPC) is a class of cryptographic techniques that enable joint computation without revealing the private inputs of each participant. It has significant applications in privacy computing, distributed key management, blockchain, and IoT security. In MPC protocols, symmetric cryptographic algorithms serve as fundamental operators and typically need to be represented as Boolean circuits or arithmetic circuits. Arithmetic circuits, under certain protocol frameworks, offer advantages such as fewer communication rounds and higher computational efficiency. However, block ciphers in related technologies are often designed for traditional execution environments, and their direct conversion to arithmetic circuits often results in high multiplication complexity and significant communication and computational overhead.

[0066] A finite field (GF) is a fundamental algebraic structure in modern algebra and cryptography. Its core characteristics lie in the finite number of elements within the field, and the fact that operations such as addition, multiplication, and inverses satisfy closure, associativity, commutativity, and distributiveness, providing a rigorous algebraic foundation for secure computation. Based on different characteristics, finite fields can be divided into prime fields GF(p) characterized by prime numbers and binary extended fields GF(2) characterized by 2. k Among them, the binary extended field GF(2) k It is obtained by expanding the binary field GF(2) by k times. The elements in the field can be represented as k-bit binary vectors or polynomials of degree no more than k-1. The addition operation is equivalent to bit-wise XOR, and the multiplication operation is simplified by modulo through irreducible polynomials. It has natural efficiency in circuit implementation and software execution.

[0067] CRAFT, as a lightweight block cipher, performs all its secure computations within GF(2). 4 ) Executed in a finite field. GF(2 4 As a small finite field with a feature of 2 and a field size of only 16, GF(2) has advantages such as simple operational structure, small multiplication table size, lightweight circuit implementation, and compact bit operations, making it very suitable for constructing low-complexity, high-efficiency secure multi-party computation circuits. Compared with GF(2)... 128 GF (2) 64 Unlike traditional MPC protocols that handle large domains, the CRAFT protocol constrains all operations, including numerical representation, addition, multiplication, and nonlinear transformations, to GF(2). 4 The CRAFT protocol is characterized by its regular structure and fine-grained computation, as it is completed within a short period of time. However, there is a lack of systematic and universal technical solutions for constructing efficient arithmetic circuits for CRAFT in secure multi-party computation scenarios.

[0068] This application provides a method for constructing an arithmetic circuit for a CRAFT block cipher oriented towards secure multi-party computation. By constructing the arithmetic circuit for the linear computation part of the CRAFT block cipher, and then determining the polynomial corresponding to the S-box of the CRAFT block cipher, the method aims to reduce the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol. The original polynomial is optimized to reduce the number of multiplications. Based on the optimized polynomial, the arithmetic circuit of the S-box is constructed. Finally, the linear computation part arithmetic circuit and the S-box arithmetic circuit are cascaded according to the number of CRAFT rounds to obtain a complete arithmetic circuit for a CRAFT block cipher oriented towards secure multi-party computation. By determining the polynomial corresponding to the S-box and optimizing it to reduce the number of multiplications, the number of multiplication operations in the arithmetic circuit is reduced without changing the algorithm's functionality and security attributes. This reduces the number of communication rounds and the amount of communication data required in the online computation phase of the secure multi-party computation protocol, shortens the overall computation latency, and improves the execution efficiency of the secure multi-party computation protocol.

[0069] The CRAFT block cipher arithmetic circuit construction method for secure multi-party computation provided in this disclosure can be executed by any electronic device with computing capabilities, such as a server, personal computer, mobile terminal, or dedicated cryptographic computing device. In some possible implementations, the method can be executed by a coordinating node in a secure multi-party computation protocol; in other implementations, the method can be executed separately by each participating party in the secure multi-party computation. The method can be implemented by a processor calling computer-readable instructions stored in memory, or it can be implemented using dedicated hardware circuitry.

[0070] Figure 1 A flowchart illustrating a method for constructing a CRAFT block cipher arithmetic circuits for secure multi-party computation according to an embodiment of this disclosure is shown. Figure 1 As shown, the method includes:

[0071] S101. Based on the linear computation part of the CRAFT block cipher, construct the arithmetic circuit for the linear computation part.

[0072] In the CRAFT block cipher, the linear computation part refers to the set of computational units that do not involve nonlinear substitution operations. According to the design of the CRAFT algorithm, each state unit in the linear computation part of the CRAFT block cipher can include: column confusion, round constant addition, round handle key addition, and unit permutation.

[0073] Column confusion is used to perform a linear transformation on each column of a 4×4 half-byte matrix, and its operation can be represented as the finite field GF(2). 4 Linear combinations on GF(2); Round constant addition is a half-byte XOR operation between the fixed round constant of each round and the state matrix. This operation is on GF(2).4 The first round is equivalent to addition; the second round key addition is a byte-by-byte XOR operation between the round key and the state matrix, which is also a finite field addition; the third round permutation rearranges the half-byte positions in the state matrix, and this permutation process can be implemented through a line connection without involving arithmetic operations. These four units together constitute the linear processing part of each round of the CRAFT block cipher, and their operations can all be implemented through linear operations (addition, constant multiplication, permutation) over a finite field, without requiring multiplication.

[0074] When constructing the arithmetic circuit for the linear computation part, an arithmetic circuit can be constructed separately for each state unit of the linear computation part, and then the arithmetic circuits of all units can be connected in series.

[0075] As an example, the corresponding arithmetic circuit can be constructed based on the function, input, and output of each state unit. For instance, for a column scrambling unit, whose function is to perform a linear transformation on each column of a 4x4 half-byte matrix, with 16 half-bytes (64-bit states) as input and 16 scrambling bytes as output, a circuit containing only GF(2) can be constructed. 4 An addition circuit, that is, a purely linear combinational circuit that only contains XOR.

[0076] In one specific implementation, the column scrambling transformation can be pre-computed as a linear transformation matrix, and the circuit then performs XOR combinations on a byte-by-byte basis according to this matrix. Similarly, the arithmetic circuits for the round constant addition and round handle key addition units can be implemented using finite field adders, i.e., directly XORing the state nibble with the constant or key nibble; the unit permutation circuit can be implemented using cross-wiring, requiring no logic gates, simply mapping the nibble positions at the input to the corresponding positions at the output.

[0077] The remaining units can be constructed using the same method as the column confusion unit. Finally, the arithmetic circuits corresponding to each state unit of the linear computation part are connected in series to obtain the arithmetic circuits for the linear computation part of the CRAFT block cipher.

[0078] S102. Determine the primitive polynomial corresponding to the S-box based on the truth table of the CRAFT block cipher.

[0079] The S-box (Substitution box) is the non-linear computational part of the CRAFT block cipher. Its function is to map a 4-bit input to a 4-bit output, and for any 4-bit input x, S(S(x)) = x, that is, the S-box is the inverse mapping of itself.

[0080] A truth table is a tabular representation of finite mappings. In block cipher algorithms, the truth table of an S-box uniquely and precisely defines the nonlinear transformation relationship between the input and output. It serves as the foundation for algorithm implementation, verification, and security analysis. For the 4-bit incoherent S-box used in the CRAFT algorithm, its truth table is given in hexadecimal form, with each row representing a 4-bit input value and its corresponding 4-bit output value.

[0081] For example, the S-box input can be... (Right now (binary bits) mapped to the finite field GF( The element x in ) can be any irreducible polynomial p(t)∈GF(2)[t] of degree 4, and GF( ) is defined as GF( )=GF(2)[t] / p(t), and select a basis (e.g. The mapping can be written as Similarly, the S-box output... Corresponding field element .

[0082] Here, t is a formal variable in the definition of a finite field.

[0083] For example, the S-box is a result of GF ( ) to GF( The mapping of ) can be represented as a polynomial function over the field: , in, Belonging to coefficient, It can be obtained through Lagrange interpolation over a finite field. Let x be the power of x (calculated in a finite field), i = 0, 1, …, 15.

[0084] As an example, we can assume that the mapping pairs of the S-box are... ,but:

[0085]

[0086] in, Let j be the j-th Lagrange polynomial, and its specific expression is:

[0087] .

[0088] The product ∏ here is performed on all integers m from 0 to 15 and m ≠ j. This represents the domain element after mapping the m-th input value. For any S-box truth table, its corresponding primitive polynomial can be calculated using the above formula.

[0089] S103. With the optimization goal of reducing the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, the original polynomial is optimized to reduce the number of multiplications, resulting in the optimized polynomial.

[0090] In secure multi-party computation, arithmetic circuits are the core form that transforms functions or polynomials into executable logic. The complexity of arithmetic circuits directly determines computational overhead, communication volume, power consumption, and area.

[0091] In polynomial arithmetic, multiplication involves more bit operations and intermediate variables, resulting in higher computational complexity compared to addition, XOR, and constant multiplication. In secure multi-party computation protocols, multiplication typically requires complex cryptographic operations such as interactive rounds, unintended transmissions, and secret sharing and reconstruction, compared to addition. The more multiplications in a circuit, the larger the circuit area and the greater the resource overhead. Therefore, optimizing the polynomial used to construct the circuit to reduce the number of multiplications is essential.

[0092] For specific optimization methods, please refer to the possible implementation methods provided in this disclosure, which will not be elaborated here.

[0093] S104. Based on the optimized polynomial, construct the arithmetic circuit of the S-box in the CRAFT block cipher.

[0094] The optimized polynomial has no or only a few multiplications. The arithmetic circuit of the S-box can be constructed based on the optimized polynomial, which can reduce the circuit area and resource consumption.

[0095] For example, an arithmetic circuit containing addition and / or multiplication can be constructed for each term in the polynomial, and finally the circuits constructed for each term in the polynomial can be added together using an addition circuit.

[0096] As an example, consider the polynomial S(x) = a0 + a1x + a2x 2 A multiplication gate can be constructed for a1x, and for a2x... 2 Construct a multiplication gate, and finally use an addition gate to add a0 to the two multiplication gate circuits to obtain the complete circuit corresponding to the polynomial.

[0097] By constructing an S-box arithmetic circuit based on the optimized polynomial, complex polynomial calculations that originally required multiple multiplications can be transformed into a circuit structure that primarily uses linear operations with only a small number of multiplications. Since linear operations can be performed locally by each participant in secure multi-party computation without interaction, this circuit only consumes a small number of multiplication triplets during the online phase, effectively reducing communication overhead and computational latency. Furthermore, the simplified circuit structure also facilitates hardware implementation, reducing chip area and power consumption.

[0098] S105. Cascade the linear computation section arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number to obtain the complete CRAFT block cipher arithmetic circuit.

[0099] The complete CRAFT algorithm includes both linear and nonlinear computations and requires multiple rounds of computation. Therefore, the complete CRAFT block cipher arithmetic circuit also needs to cascade the linear computation part of the arithmetic circuit and the S-box arithmetic circuit (i.e., nonlinear computation) according to the number of CRAFT rounds to obtain the complete CRAFT block cipher arithmetic circuit.

[0100] For specific cascading methods, please refer to the possible implementation methods provided in this disclosure, which will not be elaborated here.

[0101] In this embodiment, by constructing the arithmetic circuit for the linear computation part of the CRAFT block cipher and determining the polynomial corresponding to the S-box of the CRAFT block cipher, the optimization goal is to reduce the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol. The original polynomial is optimized to reduce the number of multiplications. Based on the optimized polynomial, the arithmetic circuit of the S-box is constructed. Finally, the linear computation part arithmetic circuit and the S-box arithmetic circuit are cascaded according to the number of CRAFT rounds to obtain a complete CRAFT block cipher arithmetic circuit for secure multi-party computation. Determining the polynomial corresponding to the S-box and optimizing it to reduce the number of multiplications reduces the number of multiplication operations in the arithmetic circuit without changing the algorithm's functionality and security attributes. This reduces the number of communication rounds and the amount of communication data required in the online computation phase of the secure multi-party computation protocol, shortens the overall computation latency, and improves the execution efficiency of the secure multi-party computation protocol.

[0102] In one possible implementation, the optimization of the original polynomial to reduce the number of multiplications, with the optimization objective being the multiplication overhead when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, includes:

[0103] With the goal of reducing the number of multiplication operations when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, the original polynomial is decomposed and reconstructed according to the relationship between powers to obtain an optimized polynomial in the composite or product form of sparse subpolynomials.

[0104] It should be noted that the relationship between powers in this disclosure is within the finite field GF(2). n In ), since squaring is a linear operation, any non-2 power term (such as x³, x) will be squared. 5 x 6 x 7 All of these can be represented as several powers of 2 (x¹, x², x...). 4 x 8The product of (etc.). For example, x³ = x·x², x 5 =x·x 4 x 6 =x²·x 4 x 7 =x·x²·x 4 x 9 =x·x 8 x 10 =x²·x 8 x¹¹ = x·x²·x 8 x¹²=x 4 ·x 8 These relationships form the basis for polynomial decomposition using the properties of finite fields.

[0105] Polynomial decomposition is a typical optimization technique for reducing the number of multiplications. By splitting a complex polynomial into multiple sub-polynomials or reorganizing it into an expression with fewer terms, redundant multiplications can be effectively eliminated and common subterms can be merged. This reduces the number of multiplication gates and the circuit depth while maintaining the function's functionality.

[0106] In polynomials and related applications, polynomials are often distinguished as sparse subpolynomials based on the relationship between the number of non-zero terms and their degree. Generally, a polynomial in which most terms have coefficients of 0 is considered a sparse subpolynomial. Specifically, if there exists a fixed positive integer C such that the number of non-zero terms in the polynomial does not exceed C, where C is a constant independent of the polynomial degree, then the polynomial is a sparse subpolynomial. The number of non-zero terms in a sparse subpolynomial is limited by a fixed constant and does not increase with the polynomial degree. This provides significant advantages in storage, computational efficiency, and computational complexity, making it widely used in cryptographic algorithms, secure multi-party computation, data encryption, and other technical fields.

[0107] For example, based on the relationship between powers, one term in the original polynomial can be decomposed into a product of polynomials with powers lower than that term.

[0108] As an example, such as for the original polynomial ,in Because of Square operation ( , Polynomials (e.g., those with powers) can be reconstructed using linear operations without additional multiplication, thus leveraging relationships between powers. For example, relationships between powers can be used to reconstruct polynomials. Then the above polynomial can be rewritten as S(x) = u(x) + v(x)·w(x), where , , .

[0109] In this embodiment of the disclosure, the original polynomial is decomposed and reconstructed into a sub-polynomial based on the relationship between powers, which can reduce the number of multiplications in the polynomial, thereby reducing the number of multiplications in the constructed arithmetic circuit.

[0110] In one possible implementation, the structural decomposition and reconstruction of the original polynomial based on the relationship between powers includes:

[0111] By pre-setting basis functions, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions.

[0112] The core idea of ​​polynomial decomposition is to represent a high-order, complex objective polynomial as a combination of several simple and computationally inexpensive basic functions, which are called basis functions.

[0113] Basis functions generally possess characteristics such as simple regular structure or ease of hardware implementation, such as monomials or pre-selected standard functions. By expanding, reconstructing, and combining the target polynomial using basis functions as basic units, it is possible to reduce the overall number of multiplications, decrease circuit depth, and simplify operational logic while maintaining the computational functionality. This significantly improves the execution efficiency of cryptographic algorithms, secure multi-party computation protocols, and arithmetic circuits, while reducing communication overhead and hardware resource consumption.

[0114] Functional linear combination refers to a method of representing an objective function (polynomial) by assigning corresponding coefficients to a pre-selected set of simple, computationally inexpensive basis functions and performing a weighted sum. This method can fully reuse the calculation results of basis functions, avoid repeated operations and redundant multiplications, and effectively reduce the number of polynomial multiplications, the depth of arithmetic circuits, and the hardware implementation cost while maintaining the function's functionality.

[0115] For example, the original polynomial can be decomposed into the sum of product terms of the basis functions and a linear combination of the basis functions by selecting a set of basis functions.

[0116] As an example, the following primitive polynomial is determined, for instance, by means of the truth table of the S-box:

[0117]

[0118]

[0119] In this context, the character before the 'x', such as "0xC" or "0x2", represents a hexadecimal number. For example, 0xC represents decimal 12, corresponding to GF(2). 4 Field elements in ); powers of x 8 x 9 Equals indicates that in GF(2 4Exponentiation in x. A set of monomials raised to the power of x can be chosen as basis functions, such as {x, x...} 2 , x 3 , x 4 ...}, the original polynomial can be reconstructed into the form S(x) = u(x) + v(x)·w(x), where:

[0120]

[0121]

[0122]

[0123] In the above manner, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions. The power of 2 in the equation has the property of linear operation, which effectively reduces the number of multiplications in the arithmetic circuit, thereby significantly reducing the overall multiplication complexity of the arithmetic circuit.

[0124] In one possible implementation, the method further includes decomposing the non-constant terms in the sparse subpolynomial into a product of a linear combination of powers of 2 and powers of 2.

[0125] because Since the powers of 2 are linear operations, each non-constant term in the sparse subpolynomial obtained in the above embodiment can be further decomposed to obtain a linear combination or product of the powers of 2.

[0126] As an example, x can be... 3 Decomposed into And x 6 It can also be decomposed into x 4 x 2 Therefore, the sparse subpolynomials in the above embodiments can be further decomposed, such as:

[0127]

[0128] It can be broken down into:

[0129]

[0130] Then, in the same manner, further decompose the subpolynomial and other subpolynomials.

[0131] In this embodiment of the disclosure, by decomposing the non-constant terms in the sparse subpolynomial into a linear combination of powers of 2 and a product of powers of 2, the originally complex polynomial calculation is transformed into a combination of a small number of finite field multiplications and a number of linear operations, thereby further reducing the multiplication operations in the polynomial and reducing the multiplication complexity in the arithmetic circuit.

[0132] In one possible implementation, the optimized polynomial is a linearized polynomial structure containing only terms of powers of 2.

[0133] Since powers of 2 are linear operations in finite field multiplication, when the optimized polynomial is a linearized polynomial structure containing only powers of 2, the number of multiplications in the corresponding arithmetic circuit can be reduced to the maximum extent, thereby reducing the communication overhead in the final secure multi-party computation protocol and shortening the computation latency.

[0134] For example, a selection of the form of The linearized polynomial structure containing only terms of power 2. Σ represents the summation operation, summing all terms over the range of k. k is an integer index whose range depends on the degree of the polynomial being processed and the finite field GF(2). 4 The properties of ).

[0135] As an example, the optimized polynomial can be selected This significantly reduces the number of multiplications in the corresponding arithmetic circuit.

[0136] In this way, the number of multiplications in the arithmetic circuit can be significantly reduced, thereby reducing the number of multiplication triples required in secure multi-party computation protocols and reducing communication overhead and computation latency in the online phase.

[0137] In one possible implementation, each state unit of the linear computation portion of the CRAFT block cipher includes: column confusion, round constant addition, round handle key addition, and unit permutation.

[0138] The cascading of the linear computation arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number includes:

[0139] The linear calculation section arithmetic circuit and the S-box arithmetic circuit are connected to obtain the round function arithmetic circuit;

[0140] Connect the arithmetic circuits of the three units of the wheel handle key addition, wheel constant addition, and column confusion in the arithmetic circuit of the linear calculation part to obtain the linear wheel function arithmetic circuit;

[0141] The round function arithmetic circuit and the linear round function arithmetic circuit are cascaded according to the number of CRAFT rounds.

[0142] The complete CRAFT algorithm combines linear and nonlinear computations and performs multiple rounds of computation. Therefore, the arithmetic circuits of the linear computation part and the nonlinear part (S-box) obtained in the above embodiments need to be cascaded according to the number of CRAFT rounds to obtain the complete CRAFT block cipher arithmetic circuit.

[0143] As an example, the linear arithmetic circuit can be connected with the S-box arithmetic circuit to obtain the round function arithmetic circuit; the arithmetic circuits of the three units of key addition, round constant addition, and column confusion in the linear computational arithmetic circuit can be connected to obtain the linear round function arithmetic circuit; the round function arithmetic circuit and the linear round function arithmetic circuit can be cascaded for 32 rounds according to the number of rounds in CRAFT, where the first 31 rounds use the round function arithmetic circuit and the 32nd round uses the linear round function arithmetic circuit, finally obtaining the complete CRAFT block cipher arithmetic circuit.

[0144] In this embodiment, a complete CRAFT block cipher arithmetic circuit is constructed by cascading the linear arithmetic circuit with the optimized S-box arithmetic circuit according to the number of CRAFT rounds. This circuit significantly reduces the number of multiplications in the overall circuit while maintaining the original functionality and security attributes of the CRAFT algorithm. When this circuit is executed in a secure multi-party computation protocol, the nonlinear layer in each round requires only a small amount of interaction, thereby greatly reducing the amount of communication data and computation time in the entire encryption process and improving the execution efficiency of the protocol. Simultaneously, the modular circuit structure facilitates reuse and expansion in different MPC frameworks.

[0145] In one possible implementation, the secure multi-party computation protocol is the MASCOT protocol.

[0146] MASCOT is a high-efficiency, secure multi-party computation protocol designed for malicious security models. It is implemented based on an offline-online separation architecture and an arithmetic inadvertent transfer extension technique. This protocol is primarily used for secure computation of arithmetic circuits over finite fields. By pre-generating multiplication triples in batches offline, it decouples high-overhead cryptographic operations from online computation, significantly improving the efficiency of multi-party collaborative computation.

[0147] The MASCOT protocol can still guarantee input privacy and computational correctness under malicious attacker models. Its core advantage is that it significantly reduces the communication and computation costs of secure multiplication. It is suitable for secure multi-party computation scenarios related to large-scale arithmetic circuits, privacy-preserving machine learning, and cryptographic algorithms. It is one of the representative protocols of high-performance malicious security MPC.

[0148] Applying the lightweight block cipher CRAFT to the MASCOT secure multi-party computation protocol can significantly improve the efficiency of symmetric cryptographic operations in both the preprocessing and online phases. CRAFT itself features lightweight hardware, an involutional structure, a 4-bit S-box, and low gate overhead. Furthermore, based on the optimized circuitry described in the previous embodiments, the number of multiplications in the circuit is further reduced. This significantly reduces computational and communication loads in symmetric cryptographic modules relied upon by MASCOT, such as unintentional transport spread, pseudo-random functions, hash functions, and keystream generation. Simultaneously, CRAFT natively possesses differential fault attack protection capabilities, enhancing the robustness of the MASCOT protocol under malicious security models and reducing verification overhead in the preprocessing phase. The combination of these two features effectively improves the overall protocol's execution efficiency and resource utilization without compromising security.

[0149] In this embodiment, by constructing the arithmetic circuit for the linear computation part of the CRAFT block cipher and determining the polynomial corresponding to the S-box of the CRAFT block cipher, the optimization goal is to reduce the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol. The original polynomial is optimized to reduce the number of multiplications. The arithmetic circuit of the S-box is constructed based on the optimized polynomial. Finally, the linear computation part arithmetic circuit and the S-box arithmetic circuit are cascaded according to the number of CRAFT rounds to obtain a complete CRAFT block cipher arithmetic circuit for secure multi-party computation. Determining the polynomial corresponding to the S-box and optimizing it to reduce the number of multiplications reduces the number of multiplication operations in the arithmetic circuit without changing the algorithm's functionality and security attributes. Since finite field multiplication in secure multi-party computation protocols typically requires interactive protocols, this disclosure directly reduces the number of communication rounds and the amount of communication data required in the online computation phase by reducing the number of multiplication operations in the arithmetic circuit, thereby effectively shortening the overall computation latency and improving protocol execution efficiency.

[0150] In this embodiment, the linear and nonlinear layers of the CRAFT block cipher are mapped to linear operations and low-multiplication-complexity arithmetic circuits over finite fields, respectively. This results in a clear structure and high modularity, facilitating engineering implementation and parameter tuning under different MPC protocols and system architectures. It also enables implementation, reuse, and expansion across various secure multi-party computation frameworks. Furthermore, this method balances security, efficiency, and engineering feasibility, providing a stable and feasible technical path for deploying block ciphers in privacy computing, distributed secure computing, and multi-party collaborative encryption applications, thereby expanding the application boundaries of block ciphers in privacy computing scenarios.

[0151] Those skilled in the art will understand that in the above-described method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic. For example, the construction of the arithmetic circuit of the linear calculation part and the determination of the S-box primitive polynomial can be performed in parallel or sequentially, as long as the cascading of the circuit can be completed in the end.

[0152] Figure 2 This diagram illustrates a structural diagram of a CRAFT block cipher arithmetic circuit construction apparatus for secure multi-party computation according to an embodiment of this application. Figure 2 As shown, the device may include:

[0153] Linear computation arithmetic circuit construction module 201 is used to construct the linear computation part arithmetic circuit based on the linear computation part of the CRAFT block cipher;

[0154] S-box polynomial determination module 202 is used to determine the primitive polynomial corresponding to the S-box based on the S-box truth table of the CRAFT block cipher.

[0155] The polynomial optimization module 203 is used to optimize the original polynomial by reducing the number of multiplications, with the optimization goal of reducing the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, to obtain the optimized polynomial.

[0156] S-box arithmetic circuit construction module 204 is used to construct the arithmetic circuit of the S-box in the CRAFT block cipher based on the optimized polynomial.

[0157] Cascading module 205 is used to cascade the linear computation section arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number to obtain the complete CRAFT block cipher arithmetic circuit.

[0158] The CRAFT block cipher arithmetic circuit is used in secure multi-party computation protocols.

[0159] In one possible implementation, the polynomial optimization module 203 is further configured to:

[0160] By pre-setting basis functions, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions.

[0161] In one possible implementation, the polynomial optimization module 203 is further configured to:

[0162] The non-constant terms in the sparse subpolynomial are decomposed into a linear combination of terms raised to the power of 2 and a product of terms raised to the power of 2.

[0163] In one possible implementation, the optimized polynomial is a linearized polynomial structure containing only terms of powers of 2.

[0164] In one possible implementation, each state unit of the linear computation portion of the CRAFT block cipher includes: column confusion, round constant addition, round handle key addition, and unit permutation.

[0165] In one possible implementation, the S-box arithmetic circuit construction module 204 is further configured to:

[0166] The linear calculation section arithmetic circuit and the S-box arithmetic circuit are connected to obtain the round function arithmetic circuit;

[0167] Connect the arithmetic circuits of the three units of the wheel handle key addition, wheel constant addition, and column confusion in the arithmetic circuit of the linear calculation part to obtain the linear wheel function arithmetic circuit;

[0168] The round function arithmetic circuit and the linear round function arithmetic circuit are cascaded according to the number of CRAFT rounds.

[0169] In one possible implementation, the secure multi-party computation protocol is the MASCOT protocol.

[0170] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0171] This disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0172] This disclosure also provides a non-volatile computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0173] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0174] Figure 3 The diagram illustrates a method for constructing a CRAFT block cipher arithmetic circuits for secure multi-party computation according to an embodiment of this application. Figure 3As shown, a round function is formed by connecting the linear operation part and the S-box (non-linear operation part) through circuits. The round function is cascaded for 31 rounds. In the 32nd round (since the round number in the figure starts from 0, it corresponds to round number 31 in the figure), the linear round function is cascaded again to form a complete CRAFT block cipher arithmetic circuit.

[0175] In actual operation, the circuit performs 32 rounds of calculations on the input data based on the key, corresponding to the aforementioned 32-round cascaded circuit, to obtain the encrypted output data.

[0176] The input data first enters the computation unit for round 0. The round 0 computation unit contains a linear operation module and an S-box (non-linear operation module). In the linear operation module, the input data undergoes linear transformations such as column obfuscation, round constant addition, round key addition, and cell permutation. The data after linear operations enters the S-box module, where the S-box performs non-linear substitution operations on the 4-bit data. After round 0 computation is complete, the output result is passed to the round 1 computation unit.

[0177] The computational unit structure for rounds 1 to 30 is the same as that for round 0, with each round containing a linear operation module and an S-box module. Data is processed sequentially through each round, with linear operations and S-box operations alternating within each round.

[0178] The structure of the computation unit in round 31 (the final round) differs from that of the previous 31 rounds. This round only contains a linear operation module and does not include an S-box module. After the data undergoes linear operations in round 31, the final encrypted result is directly output.

[0179] The initial key is input to the key arrangement algorithm module. The key arrangement algorithm generates the round key required for each round from the initial key according to the key expansion rules of the CRAFT algorithm. The generated round keys are then provided to the corresponding round key addition unit for the round key addition operation.

[0180] Figure 4 A schematic diagram illustrating an optimization method for reducing the number of multiplications of an original polynomial according to an embodiment of this application is shown, such as... Figure 4 As shown, the 4-bit input is mapped to the finite field GF(2). 4 The S-box is determined by taking the field elements in the S-box and using methods such as finite field interpolation based on the truth table of the S-box. This polynomial f(x) fully characterizes the input-output mapping relationship of the S-box, where x is the input field element and f(x) is the output field element.

[0181] Next, we perform a structured decomposition and reconstruction of the polynomial f(x). The goal of the decomposition is to transform the original polynomial into an equivalent form with fewer multiplications. As shown in the figure, f(x) can be decomposed into the following form:

[0182] f(x) = H1(x) · G1(x) + G2(x)

[0183] H1(x), G1(x), and G2(x) are all sparse subpolynomials, meaning they have a small number of non-zero terms. Through this decomposition, the complex multiplication operations in the original polynomial can be concentrated into a single multiplication of H1(x) and G1(x), while the remaining parts (the calculations within G2(x) and H1(x) and G1(x)) can be transformed into linear operations as much as possible.

[0184] During the decomposition process, the finite field GF(2) can be used. 4 The squaring operation in x² is linear. Since in a finite field with characteristic 2, x² and x... 4 x 8 Terms that are powers of 2 can be transformed linearly without multiplication. Therefore, we can express the terms in H1(x), G1(x), and G2(x) as linear combinations of terms that are powers of 2 as much as possible. For example, x³ can be expressed as x·x², x 5 It can be represented as x·x 4 x 6 It can be expressed as x²·x 4 And so on. In this way, the calculations within H1(x), G1(x), and G2(x) can be mainly completed through linear operations, with only the multiplication between H1(x) and G1(x) remaining as a few multiplication operations in the entire S-box calculation.

[0185] After decomposition, a low-multiplication arithmetic circuit is constructed based on the optimized polynomial structure. This circuit directly implements the S-box function in the decomposed form: first, H1(x) and G1(x) are calculated (mainly linear operations), then a multiplication is performed to obtain H1(x)·G1(x), which is then added to G2(x) (the addition is performed in GF(2... 4 The expression in the diagram represents the XOR operation, which is a linear operation. The final output of the circuit is the output of the S-box.

[0186] This low-multiplication arithmetic circuit significantly reduces the number of finite field multiplications while maintaining the same functionality as the original S-box. When executed in a secure multi-party computation protocol, the S-box computation requires only a small number of multiplication triplets, and the remaining linear operations can be performed locally by each participant, thereby effectively reducing communication overhead and computation latency in the online phase.

[0187] Figure 5 This diagram illustrates a use case of a CRAFT block cipher arithmetic circuit for secure multi-party computation according to an embodiment of this application. Figure 5As shown, this scenario involves participants 1 through n jointly engaging in secure multi-party computation. Each participant first shares their private data as input and simultaneously shares the encryption key, splitting the original data and key into multiple shares and distributing them to all participants. Through input and key sharing, each participant only holds a share of the data and key, and cannot individually access the complete information. The entire computation process is implemented based on secure arithmetic circuits, i.e., collaborative computation according to a pre-built CRAFT arithmetic circuit structure.

[0188] After data sharing is complete, each participant sequentially performs linear and nonlinear layer calculations according to the structure of the CRAFT arithmetic circuit. Linear layer calculations can be completed locally by each participant without interaction; nonlinear layer calculations require interaction among participants. After each round of calculation, each participant holds a share of the intermediate results for that round, which serve as input for the next round. The linear and nonlinear layer calculations require multiple iterations according to the CRAFT round number, until all 32 rounds are completed. Finally, each participant holds a share of the encrypted result. Through a result reconstruction mechanism, each participant broadcasts its share to other participants, jointly recovering the complete encrypted output.

[0189] Figure 6 This is a block diagram illustrating a CRAFT block cipher arithmetic circuit construction apparatus for secure multi-party computation, according to an exemplary embodiment. For example, apparatus 1900 can be provided as a server or terminal device. (Refer to...) Figure 6 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0190] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output interface 1958 (I / O interface). Device 1900 can operate on an operating system, such as Windows Server, stored in memory 1932. TM macOS X TM Unix TM Linux TM FreeBSD TM Or similar.

[0191] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0192] Computer-readable storage media can be tangible devices capable of holding and storing programs / instructions used by instruction execution devices. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0193] The computer program (or computer-readable program instructions) described herein can be downloaded from a computer-readable storage medium to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage medium in the respective computing / processing device.

[0194] The computer program (or computer program instructions) used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions to implement various aspects of this disclosure.

[0195] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0196] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0197] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0198] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0199] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for constructing CRAFT block cipher arithmetic circuits for secure multi-party computation, characterized in that, include: Construct the arithmetic circuit for the linear computation part based on the linear computation part of the CRAFT block cipher; Determine the primitive polynomial corresponding to the S-box based on the truth table of the CRAFT block cipher; With the optimization goal of reducing the multiplication overhead when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, the original polynomial is optimized to reduce the number of multiplications, resulting in the optimized polynomial. Based on the optimized polynomial, construct the arithmetic circuit of the S-box in the CRAFT block cipher; By cascading the linear computation section's arithmetic circuit with the S-box arithmetic circuit according to the CRAFT round number, a complete CRAFT block cipher arithmetic circuit is obtained. The CRAFT block cipher arithmetic circuit is used in secure multi-party computation protocols.

2. The method according to claim 1, characterized in that, The optimization of the original polynomial to reduce the multiplication overhead when executing the corresponding arithmetic circuit in a secure multi-party computation protocol includes: With the goal of reducing the number of multiplication operations when executing the corresponding arithmetic circuit in a secure multi-party computation protocol, the original polynomial is decomposed and reconstructed according to the relationship between powers to obtain an optimized polynomial in the composite or product form of sparse subpolynomials.

3. The method according to claim 2, characterized in that, The step of performing structured decomposition and reconstruction of the original polynomial based on the relationship between powers includes: By pre-setting basis functions, the original polynomial is decomposed into the sum of product terms of basis functions and a linear combination of basis functions.

4. The method according to claim 2 or 3, characterized in that, The method further includes: The non-constant terms in the sparse subpolynomial are decomposed into a linear combination of terms raised to the power of 2 and a product of terms raised to the power of 2.

5. The method according to claim 4, characterized in that, The optimized polynomial is a linearized polynomial structure containing only terms of powers of 2.

6. The method according to claim 1, characterized in that, Each state unit in the linear computation part of the CRAFT block cipher includes: column confusion, round constant addition, round handle key addition, and unit permutation; The cascading of the linear computation arithmetic circuit and the S-box arithmetic circuit according to the CRAFT round number includes: The linear calculation section arithmetic circuit and the S-box arithmetic circuit are connected to obtain the round function arithmetic circuit; Connect the arithmetic circuits of the three units of the wheel handle key addition, wheel constant addition, and column confusion in the arithmetic circuit of the linear calculation part to obtain the linear wheel function arithmetic circuit; The round function arithmetic circuit and the linear round function arithmetic circuit are cascaded according to the number of CRAFT rounds.

7. The method according to claim 1, characterized in that: The secure multi-party computation protocol is the MASCOT protocol.

8. A CRAFT block cipher arithmetic circuit construction device for secure multi-party computation, characterized in that, The device includes: The linear computation arithmetic circuit construction module is used to construct the linear computation part arithmetic circuit based on the linear computation part of the CRAFT block cipher. The S-box polynomial determination module is used to determine the primitive polynomial corresponding to the S-box based on the truth table of the S-box in the CRAFT block cipher. The polynomial optimization module is used to optimize the original polynomial by reducing the number of multiplications when executing the corresponding arithmetic circuit in the secure multi-party computation protocol, with the goal of reducing the multiplication overhead. The S-box arithmetic circuit construction module is used to construct the arithmetic circuit of the S-box in the CRAFT block cipher based on the optimized polynomial. The cascade module is used to cascade the linear computation section of the arithmetic circuit with the S-box arithmetic circuit according to the CRAFT round number to obtain the complete CRAFT block cipher arithmetic circuit. The CRAFT block cipher arithmetic circuit is used in secure multi-party computation protocols.

9. According to another aspect of this disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images