A post-quantum cryptography method, device and storage medium based on double-prime CRT NTT acceleration

Abstract

This invention belongs to the field of post-quantum cryptography and information security technology, and relates to an NTT acceleration method, device, and storage medium based on a dual-prime CRT in post-quantum cryptography. The method includes: reading preset prime parameters, selecting a first prime and a second prime, and storing them in a readable storage medium; obtaining a first input polynomial and a second input polynomial, reducing them to obtain a reduced polynomial pair; pre-compiling a fusion constant table, then loading the reduced polynomials into a vector register, performing a forward number theory transformation to obtain the frequency domain point values ​​corresponding to the polynomial pair; reading the frequency domain point value representations corresponding to the polynomial pair and performing point-by-point multiplication to obtain a frequency domain product polynomial; performing an inverse number theory transformation to obtain a time domain product polynomial; and performing point-by-point merging and reconstruction of the term coefficient sequence corresponding to the time domain product polynomial to obtain the target product polynomial. This invention solves the technical problems of excessively high computational complexity and limited performance improvement in existing technologies.

Description

Technical Field

[0001] This invention belongs to the field of post-quantum cryptography technology, and in particular relates to an NTT acceleration method, device and storage medium based on a dual prime number CRT in post-quantum cryptography. Background Technology

[0002] The core operation of lattice-based post-quantum cryptography schemes is polynomial multiplication over polynomial rings. The efficiency of this operation directly determines the overall performance of the cryptographic scheme. Number-theoretic transformations (NTTs) are a standard method to accelerate polynomial multiplication, reducing the complexity of naive multiplication from... Reduce to However, number-theoretic transformations require a modulus. Meet specific conditions, namely It is a prime number and satisfies ML-KEM (Kyber, a modular lattice-based key encapsulation mechanism) selects prime numbers. ,because Therefore, it can be directly in Execution However, LWR (Learning with Rounding) based schemes typically use a power of 2 modulus because a power of 2 modulus simplifies rounding to shifting. However, a power of 2 modulus is not NTT friendly and cannot be directly used for NTT.

[0003] In traditional polynomial multiplication, naive multiplication has high computational complexity and poor overall performance. Although Karatsuba divide-and-conquer multiplication can reduce the amount of computation, its performance improvement is limited and its algorithm implementation is complex. Although the Saber scheme uses the Toom-Cook divide-and-conquer algorithm for optimization, it still cannot achieve ideal computational efficiency. Therefore, there is an urgent need for a high-throughput, low-latency underlying polynomial multiplication operation technology to improve the operating efficiency of post-quantum secure communication protocols on the edge and cloud devices. Summary of the Invention

[0004] The purpose of this invention is to provide an NTT acceleration method, device, and storage medium based on the dual prime number CRT in post-quantum cryptography, so as to solve the technical problems of excessively high computational complexity and limited performance improvement in the prior art.

[0005] To solve the above-mentioned technical problems, the technical solution adopted in this invention is an NTT acceleration method based on dual prime CRT in post-quantum cryptography, comprising the following steps: S1: The processor reads the first prime number and the second prime number, and obtains the prime number fields corresponding to the first prime number and the second prime number; S2: The processor obtains the first input polynomial and the second input polynomial, and reduces the first input polynomial and the second input polynomial respectively in the prime field corresponding to the first prime number and the second prime number to obtain the first reduced polynomial pair and the second reduced polynomial pair, and stores them in the readable storage medium. S3: The processor pre-computes the fused zeta table, then loads the first and second reduced polynomial pairs into the vector register, performs a hierarchical grouping fused butterfly forward number theory transformation, and obtains the corresponding frequency domain point value representations of the two. After a single butterfly operation is completed, a fast modular reduction is performed and the data is stored in a readable storage medium. S4: Read the frequency domain point values ​​corresponding to the first and second reduced polynomial pairs from the readable storage medium and perform point-by-point multiplication using the processor to obtain the first and second frequency domain product polynomials, and store them in the readable storage medium. S5: The processor reads the first frequency domain product polynomial and the second frequency domain product polynomial from the readable storage medium respectively, performs hierarchical grouping and fusion butterfly inverse number theory transformation to obtain the first time domain product polynomial and the second time domain product polynomial. After a single butterfly operation is completed, it performs fast modular reduction and stores it in the readable storage medium. S6: The processor performs point-by-point merging and reconstruction on the coefficient sequence of the first time-domain product polynomial and the coefficient sequence of the second time-domain product polynomial to obtain the target product polynomial, and stores it in a readable storage medium.

[0006] Furthermore, the first and second prime numbers in S1 satisfy the following constraints: (1) (2) (3) in: Let be the order of the polynomial, and mod is the modulo operation. It is the first prime number. Q is the second prime number; Q is the modulus.

[0007] Furthermore, the specific process of pre-compiling the fused zeta table in S3 is as follows: traverse all butterfly operation nodes and index each node. Read the root of unity constant After performing a constant multiplication, the lower 16 bits are truncated to obtain the low-order constant. and the root of unity constant Directly used as higher-order constants Then, the obtained lower-order constants and higher-order constants are... Alternating sequential writes are performed into memory to form a pre-computed zeta table stored contiguously.

[0008] Furthermore, in S3, a layered grouping and fusion butterfly-shaped positive number theory transformation is performed. The specific steps are as follows: S3.1: Load the reduced first and second reduced polynomial pairs into the processor's vector register file; S3.2: Divide the 8-layer butterfly operation of the forward number theory transformation into a first group of layers and a second group of layers. The first group of layers includes layers 0 to 3, with the butterfly span decreasing from 128 to 16 layer by layer; The second group of layers includes layers 4 through 7, with the butterfly span decreasing from 8 to 1 layer by layer; S3.3: For each layer of the first group, the processor's vector processing unit completes all butterfly operations of that layer at once inside the vector register. The entire layer interval only performs one read operation to load data from memory and one write operation to write the result back to memory. In each layer of the second group, the processor's vector processing unit divides the processing into blocks based on a preset number of coefficients. For each coefficient block, it sequentially traverses the constant values ​​in the pre-calculated zeta table, completes the butterfly operation within that block, and writes the result back to memory.

[0009] Furthermore, the forward number-theoretical transformation and the inverse number-theoretical transformation share the same pre-computed fusion zeta table, and both adopt the same hierarchical grouping butterfly operation structure.

[0010] Furthermore, the specific steps of S6 are as follows: S6.1: Calculate the difference between the values ​​of the corresponding coefficients of the polynomial in the second prime field and the values ​​in the first prime field; S6.2: Multiply the difference by the multiplicative inverse of the first prime number in the second prime field, and take the modulo of the second prime number to obtain the intermediate adjustment coefficient. ; S6.3: Multiply the intermediate adjustment coefficient by the first prime number, and then add the original coefficient under the first prime number field to reconstruct the value and obtain the reconstructed large integer; S6.4: Use bitmasking to reduce the reconstructed large integer to the target modulus range to obtain the coefficients of the target time-domain product polynomial.

[0011] Another technical solution adopted in this invention is: a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method.

[0012] Another technical solution adopted in this invention is: a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of a method.

[0013] The beneficial effects of this invention are: 1) The NTT acceleration method based on double prime CRT proposed in this application for post-quantum cryptography has significantly better computational complexity than naive multiplication, and can achieve an acceleration of about 32 times when the polynomial order is N=256; 2) In the NTT acceleration method based on biprime CRT proposed in this application, all operations are performed in... Completed within the precision range, it can fully utilize the SIMD parallel capabilities of the AVX2 instruction set, significantly improving the computational throughput; 3) This invention selects two specific NTT-friendly prime numbers, such as 7681 and 10753, such that their product is much larger than the maximum absolute value of the coefficients that polynomial multiplication might produce in the most extreme scenario. Since the secret vector coefficients set in the target post-quantum cryptography scheme are extremely small, this product of two prime numbers provides an extremely ample numerical representation space. This mathematically eliminates the data overflow problem in the merging and reconstruction process of the Chinese Remainder Theorem (CRT), ensuring the absolute accuracy of the polynomial multiplication result and cryptographic security.

[0014] 4) This invention pioneered a multi-layer butterfly register-based fusion scheduling mechanism, locking all butterfly operations from level 0 to level 3 within the processor's vector register. Under the SIMD (Single Instruction, Multiple Data) architecture, the YMM (YMM Register) register is executed in one go, significantly reducing memory access volume at this stage by 75%. Simultaneously, in conjunction with constant table interleaving pre-computation technology, the high and low byte constants that need to be repeatedly calculated within the loop are pre-calculated and aligned offline, eliminating 25% of redundant multiplication instructions in core hot loops and effectively breaking the memory access wall bottleneck.

[0015] 5) This invention designs a progressive three-level hardware implementation architecture. Level A4 is a pure scalar C language reference model that does not depend on any specific instruction set and has extremely high cross-hardware portability and logic verification value. Level A5 is an inline assembly implementation based on modern processor single instruction multiple data (SIMD) and uses vectorized instructions to achieve a significant leap in computing throughput. Level A6 is a deeply customized handwritten assembly implementation for a specific microarchitecture. By performing extremely fine-grained scheduling of the instruction pipeline and registers at the assembly level, the hardware computing power is squeezed to the limit, fully meeting the stringent requirements of cloud servers and high-concurrency edge devices for extremely low latency. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the overall architecture of the biprime factorization in this application; Figure 2 This is a schematic diagram of the layer grouping strategy that integrates butterfly operations in this application; Figure 3 This is a schematic diagram of the data layout of the pre-calculated fusion table in this application; Figure 4 This is a schematic diagram of the pipeline implementation structure of Barrett reduction in this application; Figure 5 This is a comparative diagram of the three-level implementation architecture of this application; Figure 6 This is a comparison chart of experimental results between this application and existing technologies. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] This application primarily addresses the technical problem that, when post-quantum cryptography systems (such as lattice-based cryptographic schemes) are applied to practical network communication and IoT device authentication scenarios, the use of non-NTT-friendly moduli (such as powers of 2 moduli) prevents the direct application of number theory transformations (NTTs) for accelerating polynomial multiplication operations. This results in high computational complexity, low encryption / decryption throughput, and significant system response latency in the underlying hardware / software implementation. This method aims to provide a high-throughput, low-latency underlying polynomial multiplication operation technique to improve the operational efficiency of post-quantum secure communication protocols on both the edge and cloud sides.

[0020] like Figure 1 As shown, the NTT acceleration method based on double prime CRT in post-quantum cryptography proposed in this invention is carried out according to the following steps: S1: The processor reads the preset prime number parameter and selects the first prime number that meets the NTT-friendly conditions. With the second prime number And obtain the first prime number. Second prime number The corresponding prime field, the first prime With the second prime number The following relationship must be satisfied: 1) First prime number With the second prime number All satisfy the congruence conditions shown in equations (1)-(2): (1) in: Let be the order of the polynomial. mod is the modulo operation. It is the first prime number. It is the second prime number.

[0021] (2) Satisfying the congruence conditions in equations (1) and (2) is a mathematical prerequisite (i.e., an NTT-friendly condition) for applying number-theoretic transformations (NTTs) to a polynomial ring, ensuring that congruence exists in a specific prime number field. The original unit root is used to ensure the uniqueness and correctness of the NTT and inverse NTT transformation results.

[0022] 2) Arrange the order of prime numbers so that the first prime number... With the second prime number The product satisfies the functional relationship of equation (3): (3) in: It is the modulus.

[0023] The above conditions are used to ensure that polynomial products do not overflow during CRT reconstruction.

[0024] 3) Limit the first prime number With the second prime number All less than This ensures that 16-bit Montgomery multiplications do not overflow.

[0025] In the specific implementation of the application, the first prime number is specified. With the second prime number All less than The reason is that it can perfectly adapt to the width of 16-bit / 32-bit single instruction multiple data (SIMD, such as AVX2 instruction set) vector registers of modern processors. This means that when performing Montgomery multiplication, the intermediate results will not exceed the register bit width and cause data overflow. This completely eliminates the instruction overhead of high-bit carry processing, so that the underlying parallel computing performance can reach the optimal level.

[0026] 4) The first prime number Set it to 7681, and make the second prime number Set to 10753; The reason for setting the above parameters is, firstly, for the polynomial order commonly found in lattice-based post-quantum cryptosystems. Performing efficient radix-2 number theory transformations (NTTs) requires that the modulus must satisfy certain conditions. (That is, the modulus minus 1 must be divisible by 512), 7681 (equal to) ) and 10753 (equal to) All of them strictly satisfy this mathematical premise, guaranteeing that there exists a prime number in both independent prime fields. The primitive root of unity ensures the correctness of NTT and INTT transformations. Secondly, in modern microarchitectures, Single Instruction Multiple Data (SIMD) is used for 16-bit signed integer (NTT) conversions. The parallel processing throughput is extremely high; parameter 7681 occupies 13 valid data bits, and 10753 occupies 14 valid data bits, both of which are strictly less than... This key design ensures that the absolute value of intermediate results will not exceed the representation range of a 16-bit signed integer (-32768 to 32767) when performing intensive Montgomery multiplication, Barrett reduction, and iterative addition and subtraction operations at each layer of butterfly operations. This completely eliminates the 32-bit type conversion or high-order carry processing instructions that must be introduced in traditional algorithms to prevent data overflow, allowing the algorithm to run at full load with extremely low machine cycles. Finally, the polynomial multiplication architecture based on the double prime CRT (Chinese Remainder Theorem) requires... The product must be greater than the maximum possible absolute value of the coefficients generated by the time-domain convolution operation. The product of 7681 and 10753 is 82,593,793, which provides more than 26 bits of effective data precision and provides ample overflow-free space. Mathematically, this ensures that the final polynomial coefficients obtained by CRT merging and reconstruction after dual-channel transformation have 100% accuracy and reliability.

[0027] S2: The processor obtains the first input polynomial. The second input polynomial , ,in, Modulo integer The remaining class ring, Let be the number of terms in the polynomial. For coefficients in the modulus On the integer ring The set of polynomials of order 1, with the first input polynomial as the first input polynomial. Reduced to the first prime number The corresponding prime field, the second polynomial Reduced to the second prime number The corresponding prime field yields two pairs of reducing polynomials, namely the first pair of reducing polynomials. Second reducing polynomial pair Store it in a readable storage medium.

[0028] First reducing polynomial pair From the first input polynomial First prime number The reducing polynomial obtained by the modulo operation in the first prime field The second input polynomial First prime number The reducing polynomial obtained by the modulo operation in the first prime field composition; The second set of reducing polynomials From the first input polynomial Through the second prime number The reducing polynomial obtained by the modulo operation in the second prime field The second input polynomial Through the second prime number The reducing polynomial obtained by the modulo operation in the second prime field The coefficients of the corresponding reduced polynomial are obtained by composing the polynomials, and their functional relationships are shown in equations (4) to (7): (4) in: For the first input polynomial First prime number The reducing polynomial obtained by the modulo operation in the first prime field. For the coefficient index of the polynomial, , Let be the number of terms in the polynomial. For the reduction polynomial The One coefficient, For the first input polynomial The One coefficient, It is the first prime number.

[0029] (5) in: For the first input polynomial Through the second prime number The reducing polynomial obtained by the modulo operation in the second prime field. For the reduction polynomial The One coefficient, It is the second prime number.

[0030] (6) in: For the second input polynomial First prime number The reducing polynomial obtained by the modulo operation in the first prime field. The reduced polynomial The One coefficient, For the second input polynomial The Each coefficient.

[0031] (7) in: For the second input polynomial Through the second prime number The reducing polynomial obtained by the modulo operation in the second prime field. The reduced polynomial The Each coefficient.

[0032] In summary, the first input polynomial The second input polynomial After reducing to the two prime fields respectively, we obtain two pairs of polynomials in the NTT-friendly prime field, i.e., modulo Polynomial pairs under the domain and and model Polynomial pairs under the domain and .

[0033] Step S2 involves domain mapping and data splitting, due to the system modulus of the original cryptographic scheme. Since powers of 2 are typically not NTT-friendly primes, multiplication cannot be directly accelerated using number-theoretic transformations (NTT). This step uses modulo reduction to map and split the polynomial multiplication task, which could not be directly accelerated, into two independent prime subspaces that satisfy the NTT-friendly condition. This provides the necessary data foundation and mathematical premise for subsequent steps to legally and efficiently call the NTT algorithm.

[0034] S3: The processor pre-computes the fused zeta table, and then pairs the first reducing polynomial with... Second reducing polynomial pair Loaded into a vector register, a layered grouping and fusion butterfly forward number theory transformation is performed to obtain the first reducing polynomial pair. Corresponding frequency domain point values The second reducing polynomial is paired with Corresponding frequency domain point value representation After a single butterfly operation is completed, a fast modular reduction is performed, and the data is stored in a readable storage medium. For the first reducing polynomial pair The functional relationship for the forward NTT transformation is shown in equations (8) to (9): (8) in: For the first input polynomial First prime number The point-valued representation of the reduced polynomial obtained by the modulo operation in the first prime field in the frequency domain; (9) in: For the second input polynomial First prime number The point-valued representation of the reduced polynomial obtained by the modulo operation in the first prime field; For the second reducing polynomial pair The functional relationship for the forward NTT transformation is shown in equations (10) to (11): (10) in: For the first input polynomial Through the second prime number The point-valued representation of the reduced polynomial obtained by the modulo operation in the second prime field; (11) in: For the second input polynomial Through the second prime number The point-valued representation of the reduced polynomial obtained by the modulo operation in the second prime field.

[0035] Step S3 serves to reduce algorithm dimensionality and accelerate hardware-level parallelism. According to the polynomial convolution theorem, after transforming the time-domain polynomial to the NTT frequency domain, the original computational complexity is significantly reduced. The polynomial convolution multiplication has been completely transformed into a process with a time complexity of only By performing point-by-point multiplication in the frequency domain, combined with the underlying microarchitecture optimization of this invention, this transformation process performs layered and fused butterfly operations inside the YMM vector register. This not only accelerates multiplication in mathematical theory, but also transforms high-frequency memory read and write operations into extremely low-latency in-register SIMD (Single Instruction Multiple Data) parallel computation at the hardware execution level, thereby significantly improving the overall throughput of core polynomial multiplication in post-quantum cryptography.

[0036] In traditional NTT implementations, each butterfly operation requires three steps: first, loading the required zeta constant from the zeta table; then, calculating the product of zeta and QINV and dividing by 2. 16 The modulo operation is used to obtain the low-order part of the Montgomery multiplication. Finally, the complete Montgomery multiplication operation is performed. When the traditional NTT algorithm performs butterfly operations, its core Montgomery multiplication needs to calculate constants in real time. For example, it calculates the product of zeta and QINV and takes the modulo to obtain the low-order part. The serious drawback of this approach is that it places the originally fixed constant calculation in the innermost loop (Hot Loop), which causes each butterfly iteration to consume additional arithmetic instructions (such as multiplication, truncation, and bit shifting) to split the high and low orders. This not only increases the data dependency between instructions and pipeline latency, but also wastes valuable vector register resources, thus severely limiting the processor's instruction-level parallelism and computing power throughput limits.

[0037] In the specific embodiments of this application, the specific steps for calculating the pre-computed fusion zeta table are as follows: Iterate through all butterfly operation nodes and index each node. Read the root of unity constant After performing a constant multiplication, the lower 16 bits are truncated to obtain the low-order constant. and the root of unity constant Directly used as higher-order constants Then press Node index The range of values ​​is For example, when hour, The range is arrive The data are written to memory alternately and sequentially to form a pre-computed fusion zeta table stored in contiguous blocks.

[0038] The calculation process is shown in equations (12) to (13): (12) in: It is the root of unity constant. This is the index of the currently executing butterfly operation node during the multi-level NTT transformation process. It is a low-order constant. This is a pre-calculated constant used for fast reduction in Montgomery multiplication.

[0039] The technical meaning of equation (12) is to extract the first... The unit root constant required for each butterfly operation node This is performed by multiplying the product with the Montgomery inverse constant corresponding to the current prime number field, and then truncating the product into binary, retaining only the lower 16 bits of the result. Mathematically, this is equivalent to... The modulo operation is performed, and the final value is stored in the low-order parameter array. middle.

[0040] (13) in: These are high-order constants.

[0041] The technical meaning of equation (13) is to extract the current number of... The original root of unity constant corresponding to each node Instead of performing any additional arithmetic transformations on the constant, its value is directly assigned to the high-order parameter array as a 16-bit signed integer (int16_t) data format. .

[0042] After the above calculation process is completed in the preprocessing stage at program startup, the system will... and The parameters are interleaved and arranged in memory to construct a complete pre-computed fusion zeta table. This layout allows the computation phase to directly load the high and low bit parameters into the vector register through a single table lookup.

[0043] Figure 3 This is a schematic diagram of the data layout for the pre-calculated fusion table. Figure 3 It can be seen that the low-order parameters after offline pre-calculation With high-order parameters Designed to be stored contiguously and alternately in memory, this streamlined data layout allows the underlying system to load aligned parameters directly into the YMM register via a single vector loading instruction when calling the Single Instruction Multiple Data (SIMD) instruction set, completely eliminating the complex shuffle / unpack operations of conventional methods.

[0044] Compared to traditional techniques, the pre-computed fused zeta table proposed in this application shifts the dynamic high-low byte splitting and constant multiplication operations, which were originally repeatedly executed in the inner loop, to offline pre-computation during the system initialization phase. During the core runtime phase, the program only needs a simple memory read instruction (table lookup) to directly obtain the pre-computed paired parameters, completely eliminating the redundant arithmetic processing overhead in each butterfly iteration and significantly compressing the CPU execution clock cycle. Furthermore, the pre-computed fused zeta table features a specially designed interleaved layout in memory. This storage structure allows for the single vector load instruction to load multiple sets of parameters required when calling Single Instruction Multiple Data (SIMD, such as AVX2) instruction sets to perform vectorized operations. Parameters are directly aligned and loaded into registers. This avoids the complex data shuffle / unpacking operations that must be introduced to adapt vector multiplication in conventional table lookup methods, maximizing cache hit rate and memory bandwidth utilization, and providing ultimate performance support for high-concurrency cryptographic operations on both the edge and cloud sides.

[0045] When the traditional NTT algorithm performs butterfly operations layer by layer, each layer of computation requires a complete memory access cycle, from loading data from memory to registers, performing butterfly operations, and writing the result back to memory. For an 8-layer NTT, this means that the polynomial coefficients need to be read and written repeatedly 8 times, which can easily lead to cache misses and cause the processor's computing power to be limited by the memory wall bottleneck.

[0046] like Figure 2 As shown in the specific implementation of this application, the specific method of layered grouping and fusing butterfly-shaped positive number theory transformation in S3 is as follows: S3.1: Load the reduced first and second reduced polynomial pairs into the processor's vector register file, divide the 8-layer butterfly operation in the NTT operation into two groups for layered fusion execution. In the forward NTT transformation, this application optimizes the butterfly operation based on the Cooley-Tukey (CT) architecture.

[0047] S3.2: Divide the 8-layer butterfly operation of the forward number theory transformation into a first group of layers and a second group of layers. The first group of layers includes layers 0 to 3, and the butterfly span decreases from 128 to 16 layer by layer. The second group of layers includes layers 4 through 7, with the butterfly span decreasing from 8 to 1 layer by layer; S3.3: For butterfly operations from layer 0 to layer 3 with a span decreasing from 128 to 16, the processor's vector processing unit completes the fusion in one go within 8 YMM vector registers, and only performs one data loading and one data write-back storage for the entire layer interval; For the butterfly operation from level 4 to level 7, with the span decreasing from 8 to 1, the processor's vector processing unit divides the operation into blocks of 16 coefficients. Each coefficient block sequentially traverses 15 zeta constant values ​​to complete the butterfly iteration.

[0048] from Figure 2 As can be seen, after the input polynomial is split by the modulus module, it enters two acceleration branches in parallel: modulo 7681 (first channel) and modulo 10753 (second channel). Within each branch module, the data passes through the forward NTT transform unit, the frequency domain point-by-point multiplication unit, and the inverse INTT transform unit in sequence. Finally, the time domain results of the two branches are simultaneously fed into the back-end Chinese Remainder Theorem (CRT) reconstruction module, and the final polynomial product is output with accuracy and no data overflow.

[0049] This application integrates the butterfly operations from level 0 to level 3 into eight YMM vector registers in one go, so that these four intensive mathematical iterations only require one memory load and one memory write-back operation. Compared with the traditional method, the memory access overhead at this stage is reduced by about 75%. Secondly, by continuously locking the intermediate results in the CPU's high-speed vector registers, pipeline bubbles caused by frequent memory reads and writes are avoided. This allows the data processing capability of the AVX2 instruction set and the computational throughput of the ALU (Arithmetic Logic Unit) to be fully released, greatly shortening the total computation cycle.

[0050] Figure 4 A schematic diagram of the pipeline implementation structure for Barrett reduction, from Figure 4 As can be seen, the method proposed in this invention constructs a pipeline by connecting low-latency integer multiplier nodes and logical right shift (>>) nodes in series for the core computational body. The modulo operation is implemented by equivalently performing multiplication and shift operations, thereby ensuring the continuous full load and high throughput of the underlying SIMD computation pipeline. The core purpose of this application, which employs Barrett's fast modulo reduction technology, is to completely avoid the high-latency hardware modulo operation and use low-latency integer multiplication and logical right shift operations (such as the shift operation >>) to equivalently implement the modulo operation. This significantly reduces the instruction execution cycle within the core operation loop (Hot Loop), ensuring the continuous full load and high throughput of the SIMD instruction pipeline.

[0051] After a single butterfly operation is completed, Barrett's fast modular reduction is performed. The functional expressions for Barrett's fast modular reduction are shown in equations (14) to (16): (14) in: This is an estimate of the quotient during the reduction process. The input values ​​are the values ​​to be reduced modulo. The Barrett reduction constant is pre-calculated offline.

[0052] (15) (16) in: The system modulus of the independent prime field in which the current operation is performed, i.e., the first prime number determined in the aforementioned steps of this application. or the second prime number .

[0053] Furthermore, in step S3, to balance cross-platform portability and ultimate performance, this application adopts a three-level implementation architecture to perform the forward NTT transformation: A4 level (Scalar C Reference Model): Does not depend on any specific instruction set, used for functional verification and cross-platform benchmarking; A5 level (SIMD intrinsics implementation): Based on vector instruction sets such as AVX2 / NEON, it utilizes YMM vector registers to perform butterfly operations in parallel, significantly improving throughput; A6 level (handwritten assembly implementation): The assembly code is manually optimized for a specific microarchitecture (such as ARM Cortex-M4). By maximizing the scheduling of the instruction pipeline and registers, the hardware computing power is squeezed to the extreme to meet the low latency requirements.

[0054] S4: In the NTT transform domain, the processor performs a process on the first reducing polynomial pair. Corresponding frequency domain point value representation The second reducing polynomial is paired with Corresponding frequency domain point value representation Point-by-point multiplication yields the first frequency domain product polynomial in the first prime field. The second frequency domain product polynomial in the second prime domain The functional relationship is shown in equations (17) to (18): (17) in: Output the product polynomial in the first prime field. The Each result coefficient This is the Montgomery modulus reduction function.

[0055] (18) in: Output the product polynomial in the second prime field The Each result coefficient.

[0056] S5: The processor reads the first frequency domain product polynomial from the readable storage medium. Second frequency domain product polynomial Perform a layered, grouped, fusion, butterfly-shaped inverse number theory transformation, respectively, on the first frequency domain product polynomial under the first prime number field. The second frequency domain product polynomial in the second prime domain Performing the inverse NTT transformation yields the first time-domain product polynomial in the first prime field. Second time-domain product polynomial in the field of second primes After a single butterfly operation is completed, a fast modular reduction is performed, and the data is stored in a readable storage medium. In the inverse NTT transform, due to the symmetry of the algorithm structure, this invention also employs a hierarchical grouping strategy to optimize the inverse butterfly operation based on the Gentleman-Sande (GS) architecture, and addresses the constant multiplication unique to INTT (Inverse Number Theory Transform) (such as multiplication by...). The pre-computed fusion table was adapted in coordination. This bidirectional full-coverage optimization strategy ensures that the entire polynomial multiplication chain can enjoy the acceleration benefits of register fusion and instruction-level parallelism in the end-to-end execution process, thereby achieving an overall performance leap without any bottlenecks.

[0057] S6: The processor utilizes the Chinese Remainder Theorem for double primes to process the first time-domain product polynomial in the first prime field. Corresponding term coefficient sequence For the second time-domain product polynomial in the second prime field Corresponding term coefficient sequence By performing point-by-point merging and reconstruction, the target product polynomial is obtained. And store it in a readable storage medium.

[0058] Steps S1-S6 describe a complete low-level hardware data flow closed-loop interaction process designed to break the memory access wall bottleneck. The main interaction entities are the processor (including its internal vector processing unit and high-speed vector registers) and the readable storage medium (main memory). The specific interaction and connection relationships are as follows: Initial data reading and cross-domain splitting interaction (S1-S2): The processor establishes a connection with the readable storage medium through the system bus and reads the preset prime numbers and original polynomial data from the storage medium. The processor performs modulo reduction calculation, physically splitting the original single data stream into two parallel execution channels (the first prime number domain channel and the second prime number domain channel), and temporarily stores the reduction result back to the storage medium, completing the data initialization flow. Register-level pipeline closed-loop interaction (S3-S5): This is the core interaction link of the system. After the processor loads the data and pre-computation table from the storage medium into its internal high-speed vector register file, in the three consecutive stages of forward NTT (S3), frequency domain multiplication (S4), and reverse INTT (S5), the intermediate data no longer falls back to the slow external storage medium. The output of each layer of butterfly operations directly serves as the input to the next layer, with extremely low latency internal flow between the processor's SIMD arithmetic unit and vector registers, forming a high-speed hardware pipeline closed loop. Dual-channel data convergence and final write-back (S6): After completing the inverse transformation of the two branches, the processor calls the arithmetic unit to execute the Chinese Remainder Theorem (CRT) reconstruction logic, merging the data streams from the two independent channels point by point. Finally, the processor writes the merged, overflow-free target product polynomial back to the readable storage medium, completing the final connection for data interaction in the entire hardware system.

[0059] In a specific embodiment of the present invention, step S6 yields the polynomial ring of the original target system. The final polynomial multiplication result (i.e., the target product polynomial) ), the final polynomial Mathematically, it is strictly equivalent to the first input polynomial. The second input polynomial In the model Direct convolution product on a ring.

[0060] Using the Chinese Remainder Theorem for double primes, the coefficients of corresponding terms in the time-domain product polynomial are reconstructed point by point. The specific calculation method is as follows: S6.1: Calculate the difference between the values ​​of the corresponding coefficients of the polynomial in the second prime field and the values ​​in the first prime field. The calculation process is shown in equation (19). (19) in: This represents the difference between the values ​​of the coefficients of the same polynomial in the second prime field and their values ​​in the first prime field. When a negative value is found, it is corrected to a positive difference by adding the modulus. Let the values ​​of the polynomial coefficients be taken in the first prime number field. Let be the values ​​of the polynomial coefficients in the second prime field.

[0061] S6.2: Multiply the difference by the multiplicative inverse of the first prime number in the second prime field, and take the modulo of the second prime number to obtain the intermediate adjustment coefficient. ; S6.3: Multiply the intermediate adjustment coefficient by the first prime number, and then add the original coefficient under the first prime number field to reconstruct the value and obtain the reconstructed large integer; S6.4: The reconstructed coefficient values ​​are reduced to the target modulus range by bit masking operation to obtain the target product polynomial coefficients. The calculation process is shown in equations (20) to (22).

[0062] (20) in: For the bitmask, due to the final modulus of the target scheme It is usually a power of 2, for Modulo operation does not require an inefficient divider at the hardware level; it is directly equivalent to AND. Perform bitwise AND operations.

[0063] (twenty one) (twenty two) in: For modular inverse, This is the output value.

[0064] Equations (19) to (22) describe the process of quickly merging and reconstructing the results of two prime number fields into the final result using the Chinese Remainder Theorem (CRT) for two prime numbers. The specific calculation method is as follows: First, calculate the difference between the corresponding values ​​of the polynomial coefficients in the second prime number field and the first prime number field (and add the second prime number if necessary to ensure non-negativity). Then, multiply the difference by the multiplicative inverse of the first prime number in the second prime number field, and take the modulus of the second prime number to obtain an intermediate adjustment coefficient (i.e., in the formula). Next, the adjustment coefficient is multiplied by the first prime number and added to the original coefficient of the first prime number field to complete the numerical reconstruction in the real large integer field; finally, through the bit mask operation, the reconstructed large integer is quickly and equivalently reduced to the target modulus (usually a power of 2) of the cryptographic scheme to obtain the final time-domain polynomial coefficients.

[0065] The core inventive points of this invention lie in the following two breakthroughs: The first level is a breakthrough at the level of mathematical algorithms.

[0066] Many efficient post-quantum cryptography schemes (such as those based on the LWR problem) currently use powers of 2 (e.g., 8192 = 2¹³) as the modulus to improve overall rounding efficiency. However, these moduli are not prime numbers and are mathematically unfriendly to NTT (Non-Prime Transformation) algorithms, preventing the direct use of NTT acceleration algorithms that could reduce polynomial multiplication complexity from O(N²) to O(N log N). This invention introduces the Chinese Remainder Theorem (CRT) decomposition for double prime numbers, essentially building a mathematical bridge. It cleverly splits and maps the original problem, which cannot be directly accelerated, into two prime number domains that satisfy the NTT condition for high-speed computation, and then safely merges and reconstructs the results. This theoretically breaks the mathematical deadlock that non-prime moduli cannot be accelerated using NTT.

[0067] The second layer represents a breakthrough at the underlying microarchitecture level.

[0068] No matter how fast the theoretical algorithm is, if a significant amount of CPU time is wasted moving data from memory, the actual running speed will still be limited (i.e., it will be stuck in the memory access wall bottleneck). This invention deeply explores the potential of the SIMD vector registers in modern processors (such as processors supporting AVX2 and NEON instruction sets). On the one hand, it locks all the multi-layered butterfly operations that originally required multiple steps of memory access into the fastest register inside the CPU and performs them all at once, greatly reducing memory access overhead. On the other hand, it pre-calculates constants (such as unit roots) that originally needed to be repeatedly generated in the calculation loop during the program initialization phase and arranges them in an interleaved manner according to the format most easily loaded by the vector register. These two sets of underlying engineering optimizations completely eliminate the bottleneck effect at the hardware execution level, squeezing the hardware's computing performance to the extreme.

[0069] In summary, the core inventive point of this invention lies in the following: at the algorithmic level, it introduces the Chinese Remainder Theorem (CRT) decomposition for double prime numbers, overcoming the mathematical limitation that non-NTT-friendly moduli cannot be directly accelerated in the frequency domain; at the microarchitecture level, it deeply integrates the characteristics of the underlying SIMD vector instruction set, pioneering a multi-layer butterfly register-based fusion scheduling mechanism and constant table interleaving pre-computation technology. This solution not only achieves theoretical dimensionality reduction in computational complexity but also completely eliminates the high-frequency memory access bottleneck at the hardware execution level.

[0070] The present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method.

[0071] A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of a method.

[0072] To verify the effectiveness of the method of the present invention, firstly, this application designed three computational architectures with different complexities and parallelisms to address the performance bottleneck of polynomial multiplication in hardware acceleration, and tested the average CPU clock cycle consumption of a single operation on the same platform.

[0073] Figure 5 Experimental results show that traditional naive multiplication, without any algorithmic optimization, has a computation cycle exceeding 100,000. The classic Karatsuba divide-and-conquer architecture reduces the cycle to approximately 45,000 by decreasing the number of multiplications. In contrast, the proposed dual-prime dual-channel fusion NTT architecture eliminates the memory access bottleneck, requiring only about 1,400 cycles per operation, achieving an acceleration of approximately 32 times compared to naive multiplication. This comparison fully verifies the significant advantages of the proposed architecture in the field of high-performance polynomial multiplication.

[0074] Secondly, benchmark tests were conducted on modern processor platforms that support the AVX2 instruction set, with the test object being polynomial order. Modulus The core module for matrix-vector multiplication.

[0075] Experimental data shows that polynomial multiplication based on the Karatsuba divide-and-conquer method requires an average of approximately 45,000 CPU clock cycles to complete a single operation; while using the dual-prime dual-channel fusion NTT architecture proposed in this invention, the average clock cycle for a single operation is reduced to approximately 1,400 cycles. Figure 6 As can be seen, with the increase of concurrent operation requests, the throughput curve of the present invention maintains good linear growth and does not show the performance inflection point (Cache bottleneck) caused by frequent memory access in traditional solutions. This proves that the present invention maximizes the utilization of the underlying computing hardware through register-based butterfly fusion and branchless instruction scheduling, achieving a computing speedup of about 32 times.

[0076] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for accelerating NTT based on double prime CRT in post-quantum cryptography, characterized in that, Includes the following steps: S1: The processor reads the first prime number and the second prime number, and obtains the prime number fields corresponding to the first prime number and the second prime number; S2: The processor obtains the first input polynomial and the second input polynomial, and reduces the first input polynomial and the second input polynomial respectively in the prime field corresponding to the first prime number and the second prime number to obtain the first reduced polynomial pair and the second reduced polynomial pair, and stores them in the readable storage medium. S3: The processor pre-computes the fused zeta table, then loads the first and second reduced polynomial pairs into the vector register, performs a hierarchical grouping fused butterfly forward number theory transformation, and obtains the corresponding frequency domain point value representations of the two. After a single butterfly operation is completed, a fast modular reduction is performed and the data is stored in a readable storage medium. S4: Read the frequency domain point values ​​corresponding to the first and second reduced polynomial pairs from the readable storage medium, and perform point-by-point multiplication using the processor to obtain the first and second frequency domain product polynomials, and store them in the readable storage medium. S5: The processor reads the first frequency domain product polynomial and the second frequency domain product polynomial from the readable storage medium, performs hierarchical grouping and fusion butterfly inverse number theory transformation, obtains the first time domain product polynomial and the second time domain product polynomial, performs fast modular reduction after a single butterfly operation, and stores it in the readable storage medium. S6: The processor performs point-by-point merging and reconstruction on the coefficient sequence of the first time-domain product polynomial and the coefficient sequence of the second time-domain product polynomial to obtain the target product polynomial, and stores it in a readable storage medium. 2.The NTT acceleration method based on double-prime CRT in a post-quantum cipher according to claim 1, wherein, The first and second prime numbers in S1 satisfy the following constraints: （1） （2） （3） wherein: is the order of the polynomial, mod is the modulo operation, is a first prime number, is a second prime number; Q is the modulus.

3. The NTT acceleration method based on biprime CRT in post-quantum cryptography according to claim 1, characterized in that, The specific process of pre-compiling the fused zeta table in S3 is as follows: traverse all butterfly operation nodes and index each node. Read the root of unity constant After performing a constant multiplication, the lower 16 bits are truncated to obtain the low-order constant. and the root of unity constant Directly used as higher-order constants Then, the obtained lower-order constants and higher-order constants are... Alternating sequential writes are performed into memory to form a pre-computed zeta table stored contiguously.

4. The NTT acceleration method based on biprime CRT in post-quantum cryptography according to claim 1, characterized in that, In S3, a layered grouping and fusion butterfly-shaped positive number theory transformation is performed. The specific steps are as follows: S3.1: Load the reduced first and second reduced polynomial pairs into the processor's vector register file; S3.2: Divide the 8-layer butterfly operation of the forward number theory transformation into a first group of layers and a second group of layers. The first group of layers includes layers 0 to 3, with the butterfly span decreasing from 128 to 16 layer by layer; The second group of layers includes layers 4 through 7, with the butterfly span decreasing from 8 to 1 layer by layer; S3.3: For each layer of the first group, the processor's vector processing unit completes all butterfly operations of that layer at once inside the vector register. The entire layer interval only performs one read operation to load data from memory and one write operation to write the result back to memory. In each layer of the second group, the processor's vector processing unit divides the processing into blocks based on a preset number of coefficients. For each coefficient block, it sequentially traverses the constant values ​​in the pre-calculated zeta table, completes the butterfly operation within that block, and writes the result back to memory.

5. The NTT acceleration method based on biprime CRT in post-quantum cryptography according to claim 1, characterized in that, The forward number theory transformation and the inverse number theory transformation share the same pre-computed fusion zeta table, and both adopt the same hierarchical grouping butterfly operation structure.

6. The NTT acceleration method based on biprime CRT in post-quantum cryptography according to claim 1, characterized in that, The specific steps for S6 are as follows: S6.1: Calculate the difference between the values ​​of the corresponding coefficients of the polynomial in the second prime field and the values ​​in the first prime field; S6.2: Multiply the difference by the multiplicative inverse of the first prime number in the second prime field, and take the modulo of the second prime number to obtain the intermediate adjustment coefficient. ; S6.3: Multiply the intermediate adjustment coefficient by the first prime number, and then add the original coefficient under the first prime number field to reconstruct the value and obtain the reconstructed large integer; S6.4: Use bitmasking to reduce the reconstructed large integer to the target modulus range to obtain the coefficients of the target time-domain product polynomial.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method as claimed in any one of claims 1-6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-6.

Images