Hqc hardware accelerator based on post-quantum cryptography and scheduling method thereof

Abstract

The application belongs to the field of integrated circuit design and quantum encryption technology, and provides a HQC hardware accelerator based on post-quantum cryptography and a scheduling method thereof, wherein the method comprises: performing parallel sampling on random numbers to obtain indexes; comparing the indexes with indexes stored in a sparse polynomial index memory in a parallel manner, and storing or discarding the indexes based on a comparison result; and splicing and shifting the indexes of the sparse polynomial index memory after boundary processing and the last address data of a dense polynomial memory to obtain correct initial data. The application has the beneficial effects of reducing logic slice overhead, improving system performance and reducing system delay, and high area efficiency.

Description

Technical Field

[0001] This invention relates to the fields of integrated circuit design and quantum encryption technology, and in particular to an HQC hardware accelerator based on post-quantum cryptography and its scheduling method. Background Technology

[0002] Post-quantum cryptography (PQC) is a key technology for countering the threat of quantum computers. Among them, the Hamming Quasi-Cyclic (HQC) scheme based on error-correcting codes has been selected by NIST as a standardized algorithm. However, implementing HQC on hardware platforms such as FPGAs faces the following challenges: High algorithm operation latency and existing sampling algorithms suffer from two main problems in hardware implementation: reliance on DSP for modular arithmetic leads to high area overhead; and the need for large-capacity BRAM to store intermediate states increases resource consumption, with sampling latency increasing quadratically with the weight ω. These solutions all face challenges in hardware implementation due to either high latency or high area overhead.

[0003] The core module incurs significant resource overhead. The core operation of polynomial multiplication involves the multiplication of sparse and dense polynomials. To achieve parallelism, existing architectures often require copying multiple copies of the dense polynomial memory (BRAM), resulting in substantial BRAM resource consumption. Furthermore, in typical existing designs, polynomial addition and multiplication are performed using separate modules, leading to low hardware reuse.

[0004] Insufficient scheduling between modules: Existing system scheduling mostly adopts strict serial or coarse-grained overlap, with a large number of idle waiting cycles between modules such as sampling, polynomial multiplication and encoding / decoding, failing to fully exploit hardware parallelism, and making it difficult to further reduce the overall system latency. Summary of the Invention

[0005] Aimed at at least in solving one of the technical problems existing in the prior art, the present invention provides a post-quantum cryptography-based HQC hardware accelerator and its scheduling method.

[0006] One aspect of the present invention provides an HQC hardware accelerator based on post-quantum cryptography, comprising: Parallel sampling module, parallel polynomial operation module and sparse polynomial index memory; The parallel sampling module includes a modulo reduction unit and a sampling unit. The modulo reduction unit is used to receive random numbers and perform modulo operations to output an index. The sampling unit is used to receive the index and compare it in parallel with existing indices in the sparse polynomial index memory, and discard or store the index according to the comparison result. The parallel polynomial operation module includes a premultiplication preprocessing control unit, a fill shift unit, and an XOR write-back unit. The premultiplication preprocessing control unit is used for boundary processing, including bit truncation of the index of the sparse polynomial index memory, and also for reading data from the dense polynomial memory. The truncation result and the read DW data are concatenated and shifted through the fill shift unit and the XOR write-back unit to obtain the correct initial data. The pre-multiplication preprocessing control unit is also used to trigger polynomial multiplication in a preset small batch when the sampling unit has not completed sampling.

[0007] According to the HQC hardware accelerator based on post-quantum cryptography, the modulo reduction unit adopts a non-pipelined shift-subtraction structure, which includes a subtractor, a comparator, and a shifter. The modulo reduction unit is used to perform modulo operation on the received 32-bit random number and the modulus for a preset time period to obtain the index after the modulo operation, wherein the modulus is determined by the target security level.

[0008] According to the HQC hardware accelerator based on post-quantum cryptography, the sampling unit is also used to perform a complete detection process in each sampling iteration. The sampling unit consumes a fixed clock cycle regardless of whether the index is repeated. When the sampling unit detects that there is the same historical value in the sparse polynomial index memory, it discards the index and requests a new random number according to the sampling mode, or consumes a fixed clock cycle to maintain constant time characteristics. Otherwise, the index is stored in the sparse polynomial index memory.

[0009] According to the HQC hardware accelerator based on post-quantum cryptography, the parallel sampling module is used to perform parallel sampling through multiple one-to-one corresponding modulo reduction units and sampling units.

[0010] According to the HQC hardware accelerator based on post-quantum cryptography, the premultiplication preprocessing control unit is used to perform bit truncation on the index in the sparse polynomial index memory according to the data width and shift start, to obtain and, is also used to read DW data from the second-to-last and last storage blocks in the dense polynomial memory, and to concatenate and shift the truncation result with the read DW data.

[0011] According to the HQC hardware accelerator based on post-quantum cryptography, the filling shift unit includes a register group consisting of multiple registers and multiple parallel shifters. The register group is connected to the multiple parallel shifters and the dense polynomial memory, respectively. The shifters are connected to the XOR write-back unit. The register group is used to read the truncation result and DW data in parallel and generate a continuous data stream to send to the multiple parallel shifters. The shifters perform shift calculations, and the shift calculation results are accumulated through the XOR write-back unit.

[0012] According to the HQC hardware accelerator based on post-quantum cryptography, the number of dense polynomial memories is set to 1.

[0013] According to the HQC hardware accelerator based on post-quantum cryptography, after the parallel sampling module samples a preset number of indices, it performs polynomial multiplication operations through the parallel polynomial operation module, wherein the preset number is less than the number of indices in the sparse polynomial index memory.

[0014] According to the HQC hardware accelerator based on post-quantum cryptography, index sampling and polynomial multiplication operations are performed synchronously during multiplication.

[0015] Another aspect of the present invention provides a post-quantum cryptography-based HQC hardware accelerator scheduling method, comprising: Random numbers are sampled in parallel to obtain an index, and polynomial multiplication is triggered in preset small batches when sampling is not complete; The index is compared with the index stored in the sparse polynomial index memory in parallel, and the index is stored or discarded based on the comparison result. After boundary processing of the index of the sparse polynomial index memory, it is concatenated and shifted with the end address data of the dense polynomial memory to obtain the correct initial data.

[0016] The beneficial effects of this invention are: extremely high area efficiency; through the lightweight modular arithmetic and unified comparison architecture of PSM, compared with the existing best design, the equivalent logic chip (Equivalent) The overhead of slices (EqS) is reduced by 84.90%~87.28% (equivalent logic slice is a unified metric for FPGA logic resources (LUT+FF+DSP+BRAM)). Through a shared register group design, multi-path parallel multiplication is achieved using only one dense polynomial memory (without multi-port replication), reducing BRAM consumption by 42.86% compared to multiple BRAM replication schemes. Significant system performance improvement is achieved by adopting the FGOES scheduling scheme. Despite the addition of hash operations in the new specification, the total system latency is still reduced by 22.26%~28.19% compared to the previous generation accelerator. In terms of overall performance, the area-time product (ATP) of this invention is improved by 2.42~17.28 times, 2.62 times, and 2.62 times respectively at the three NIST security levels, achieving high area efficiency. High uniformity and configurability are achieved. PSM supports both CWW and FNB sampling modes. PPAM uniformly supports polynomial multiplication and addition. This design is fully compatible with the three security levels of HQC-1 / 3 / 5 without modifying the data path. Attached Figure Description

[0017] Figure 1This is a system architecture diagram of an HQC hardware accelerator based on post-quantum cryptography, according to an embodiment of the present invention.

[0018] Figure 2 This is a hardware architecture diagram of the sampling module (PSM) according to an embodiment of the present invention.

[0019] Figure 3 This is a hardware architecture diagram of the Parallel Polynomial Operation Module (PPAM) according to an embodiment of the present invention.

[0020] Figure 4 This is a hardware architecture diagram of the padding-shift according to an embodiment of the present invention.

[0021] Figure 5 This is a hardware architecture diagram of UPRNG (Uniform Pseudo-random Number Generator) according to an embodiment of the present invention.

[0022] Figure 6 This is a demonstration diagram of the Fine-Grained Overlapping Execution Scheduling Scheme (FGOES) of an embodiment of the present invention.

[0023] Figure 7 This is a schematic diagram of the HQC hardware accelerator scheduling method based on post-quantum cryptography according to an embodiment of the present invention. Detailed Implementation

[0024] The embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings. Throughout the description, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions. In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, "module," "part," or "unit" can be used interchangeably. Terms such as "first," "second," etc., are used only to distinguish technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or implicitly indicating the sequential relationship of the indicated technical features. In the following description, the consecutive reference numerals for method steps are for ease of review and understanding. Adjusting the implementation order of steps, in conjunction with the overall technical solution of the present invention and the logical relationship between the various steps, will not affect the technical effect achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0025] refer to Figure 1 , Figure 1This is a system architecture diagram of a HQC hardware accelerator based on post-quantum cryptography according to an embodiment of the present invention. It includes: a parallel sampling module (PSM), a parallel polynomial operation module (PPAM), and a sparse polynomial index memory. The parallel sampling module includes a modulo reduction unit and a sampling unit. The modulo reduction unit receives random numbers, performs modulo operations, and outputs an index. The sampling unit receives the index and compares it in parallel with existing indices in the sparse polynomial index memory, discarding or storing the index based on the comparison result. The parallel polynomial operation module includes a pre-multiplication preprocessing control unit, a fill-shift unit, and an XOR write-back unit. The pre-multiplication preprocessing control unit performs boundary processing, including bit truncation of the indices in the sparse polynomial index memory, and also reads data from the dense polynomial memory. The truncation result is concatenated and shifted with the read DW data through the fill-shift unit and the XOR write-back unit to obtain the correct initial data. The pre-multiplication preprocessing control unit is also used to trigger polynomial multiplication in preset small batches when sampling is not complete.

[0026] The HQC hardware accelerator system architecture based on post-quantum cryptography in this invention adopts a fine-grained overlapping execution scheduling scheme (FGOES): that is, when the sparse polynomial index sampling is not completed, polynomial multiplication is triggered in a preset small batch to achieve fine-grained overlap between sampling and computation in time.

[0027] For example, the above Figure 1 Also includes: (1) Hardware platform: Xilinx Artix-7 FPGA (xc7a200tfbg484-3) was used as the target device. Verilog HDL was used for RTL level description.

[0028] (2) Top-level architecture: The system is divided into control components (FSM), processing components (PSM, PPAM, UPRNG) and storage components (multiple RAM blocks), among which, such as Figure 5 As shown, UPRNG integrates the Keccak-f

[1600] core, which supports SHA3-256 / 512 and SHAKE256.

[0029] (3) PSM (Parallel Sampling Module) includes: Modulus reduction unit, which takes a 32-bit random number rnd and a modulus n as input (the corresponding primitive modulus n is configured according to the target security level (HQC-1 / 3 / 5)) and implements the modulus operation through a shift-subtraction iterative structure of 17 clock cycles; Sampling unit: The generated index idx is compared in parallel with the existing index in the sparse polynomial index memory (single address stores double values). If idx is equal to any historical value, it is discarded and a new random number is requested. Otherwise, it is stored in the sparse polynomial index memory.

[0030] (4) PPAM (Parallel Polynomial Operation Module) includes: Parameter configuration: data width DW=128, Depth_dpc is n divided by DW (rounded up).

[0031] For boundary handling, when the data width DW=128, the shift start offset shift_old is taken from the lower 7 bits of the sparse polynomial index, i.e., shift_old=sparse_index[6:0]. At the same time, the premultiplication preprocessing unit reads data from the second-to-last and last storage blocks of the dense polynomial memory, concatenates and shifts them to obtain the correct initial data InitData.

[0032] Parallel computation is employed, with four shifters operating in parallel. Each clock cycle, they can simultaneously process the shift and XOR operations corresponding to four sparse indices, completing the multiplication with the corresponding part of the dense polynomial. The results are accumulated through an XOR tree. The entire multiplication process can be performed by sequentially reading MB_spi, eliminating the need for inserting bubbles into the BRAM.

[0033] (5) Implementation details of FGOES: Taking the KeyGen operation y·h as an example: After startup, the control FSM first instructs the PSM to sample the indices of y. The control FSM maintains a counter, incrementing by 1 for each valid index that passes repeated detection. When the count reaches a threshold of 4, a PPAM start signal is generated, and the product of these indices with h is calculated. Simultaneously, the PSM continues to sample the remaining y indices in the background. By the time the PSM sampling is complete, most of the PPAM calculation is nearly finished, thus hiding the sampling delay.

[0034] (6) Verification method: Functional simulation was performed using cocotb and UVM, and the correctness was verified by comparing the KAT (Known Answer Test) vector of the official reference software.

[0035] In some embodiments, the modulo reduction unit adopts a non-pipelined shift-subtraction structure, which includes a subtractor, a comparator, and a shifter. The modulo reduction unit is used to perform modulo operation on the received 32-bit random number and the modulus for a preset time period to obtain the index after modulo operation, wherein the modulus is determined by the target security level.

[0036] In some embodiments, the sampling unit is also configured to perform a complete detection process in each sampling iteration. The sampling unit consumes a fixed clock cycle regardless of whether the index is repeated. When the sampling unit detects that the same historical value exists in the sparse polynomial index memory, it discards the index and requests it again; otherwise, it stores the index in the sparse polynomial index memory.

[0037] In some embodiments, the parallel sampling module is used to perform parallel sampling through a plurality of one-to-one corresponding modulo reduction units and sampling units.

[0038] For example, such as Figure 2 The PSM hardware architecture diagram shown below contains the following structural components: It consists of a modulo reduction unit and a sampling unit. The modulo reduction unit adopts a non-pipelined shift-subtraction structure, consisting only of a subtractor, a comparator, and a shifter, without the need for a DSP. The HQC system architecture integrates a single-address dual sparse index storage structure to store the sampled sparse polynomial index.

[0039] The connection relationship is as follows: the modulo reduction unit receives a 32-bit random number and outputs the index after modulo operation; the sampling unit receives the index and performs a parallel comparison with the historical index stored internally.

[0040] Working process: First, the modulo reduction unit has an operation delay of one modulo operation every 17 clock cycles. Then, the sampling unit performs a complete duplicate detection process in each sampling iteration, consuming a fixed number of clock cycles regardless of whether a duplicate is detected, to ensure constant-time execution and resist timing side-channel attacks. If a duplicate index is detected, the fixed number of clock cycles is still consumed in CWW mode to maintain constant-time characteristics; in FNB mode, the index is discarded and a new random number is requested.

[0041] In some embodiments, the premultiplication preprocessing control unit is configured to perform bit truncation on the index in the sparse polynomial index memory according to the data width and shift start, and to obtain and, further configured to read DW data from the second-to-last and last storage blocks in the dense polynomial memory, and to concatenate and shift the truncation result with the read DW data.

[0042] In some embodiments, the fill shift unit includes a register group consisting of multiple registers and multiple parallel shifters. The register group is connected to the multiple parallel shifters and the dense polynomial memory, respectively. The shifters are connected to the XOR write-back unit. The register group is used to read the truncation result and DW data in parallel and generate a continuous data stream to send to the multiple parallel shifters. The shifters perform shift calculations and accumulate the shift calculation results through the XOR write-back unit.

[0043] For example, refer to Figure 3 The parallel polynomial operation module shown is composed of a unified 4-way parallelism, as detailed below: The structure comprises a premultiplication preprocessing control unit, a fill shift unit, and an XOR write-back unit. The key innovation of this embodiment lies in the design of a shared register group within the fill shift unit, consisting of three DW-bit (DW=128, representing data readability) registers. See [link to documentation] for details. Figure 4The diagram shows the Padding-Shift hardware architecture. The configuration of these three registers is just right to cache two consecutive data blocks of dense polynomial and their concatenation results, thereby providing a continuous, bubble-free data stream for the 4-way parallel shifter while avoiding read-after-write (RAW) conflicts, completely eliminating the need to copy the entire dense polynomial memory.

[0044] The connection relationships are as follows: the output of the dense polynomial memory (only one block is needed) is connected to the shared register set; the register set is connected to four parallel shifters; and the output of the shifters is connected to the XOR write-back unit.

[0045] In the working process, firstly, the pre-multiplication preprocessing control unit handles the boundary alignment problem, splicing the complete DW data from the last two storage blocks of the dense polynomial memory; then, in polynomial multiplication mode, the system sequentially reads the index of the sparse polynomial, uses the shared register set to read the data from the dense polynomial memory at once, drives four shifters to perform parallel calculations, and accumulates the results through the XOR write-back unit; this architecture also supports polynomial addition mode, reusing the same XOR logic.

[0046] In some embodiments, reference Figure 6 The diagram shown illustrates the effect of FGOES (Fine-grained Overlapping Execution Scheduling Scheme), which includes: The scheduling method breaks the traditional serial dependency of "completing all sampling before starting multiplication". Once the PSM samples a preset number (e.g., 4) of sparse indices, the PPAM is immediately triggered to start the polynomial multiplication operation.

[0047] In the working process, when generating operations such as y·h, the sampling index of y and the calculation of y·h overlap in time. Scheme 2 of this embodiment of the invention reduces the PSM sampling delay to approximately 25% of the original scheme, making this fine-grained overlap possible. This effectively hides the sampling delay and reduces pipeline stalls, thus reducing the computation time required compared to Scheme 1.

[0048] In some embodiments, reference Figure 7 The flowchart shown is a schematic diagram of the HQC hardware accelerator scheduling method based on post-quantum cryptography, which includes, but is not limited to, steps S100~S400: S100 performs parallel sampling of random numbers to obtain an index, and triggers polynomial multiplication in a preset small batch when sampling is not completed; S200: The index is compared with the index stored in the sparse polynomial index memory in parallel, and the index is stored or discarded based on the comparison result. S300 performs boundary processing on the index of the sparse polynomial index memory and then concatenates and shifts it with the end address data of the dense polynomial memory to obtain the correct initial data.

[0049] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the described functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, considering the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed in the embodiments of the invention, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0050] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0051] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can include, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0052] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0053] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0054] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0055] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0056] The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A hardware accelerator for HQC based on post-quantum cryptography, characterized in that, include: Parallel sampling module, parallel polynomial operation module, and sparse polynomial index memory; The parallel sampling module includes a modulo reduction unit and a sampling unit. The modulo reduction unit is used to receive random numbers and perform modulo operations to output an index. The sampling unit is used to receive the index and compare it in parallel with existing indices in the sparse polynomial index memory, and discard or store the index according to the comparison result. The parallel polynomial operation module includes a premultiplication preprocessing control unit, a fill shift unit, and an XOR write-back unit. The premultiplication preprocessing control unit is used for boundary processing, including bit truncation of the index of the sparse polynomial index memory, and also for reading data from the dense polynomial memory. The truncation result and the read DW data are concatenated and shifted through the fill shift unit and the XOR write-back unit to obtain the correct initial data. The pre-multiplication preprocessing control unit is also used to trigger polynomial multiplication in a preset small batch when the sampling unit has not completed sampling.

2. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, The modulo reduction unit adopts a non-pipelined shift-subtraction structure, which includes a subtractor, a comparator, and a shifter. The modulo reduction unit is used to perform modulo operation on the received 32-bit random number and the modulus for a preset time period to obtain the index after modulo operation, wherein the modulus is determined by the target security level.

3. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, The sampling unit is also used to execute a complete detection process in each sampling iteration. The sampling unit consumes a fixed clock cycle regardless of whether the index is repeated. When the sampling unit detects that there is the same historical value in the sparse polynomial index memory, it discards the index and requests a new random number according to the sampling mode or consumes a fixed clock cycle to maintain constant time characteristics. Otherwise, the index is stored in the sparse polynomial index memory.

4. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, The parallel sampling module is used to perform parallel sampling through multiple one-to-one corresponding modulo reduction units and sampling units.

5. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, The premultiplication and preprocessing control unit is used to perform bit truncation on the index in the sparse polynomial index memory according to the data width and shift start, and to read DW data from the second-to-last and last storage blocks in the dense polynomial memory, and to concatenate and shift the truncation result with the read DW data.

6. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, The fill shift unit includes a register group consisting of multiple registers and multiple parallel shifters. The register group is connected to the multiple parallel shifters and the dense polynomial memory. The shifters are connected to the XOR write-back unit. The register group is used to read the truncation result and DW data in parallel and generate a continuous data stream to send to the multiple parallel shifters. The shifters perform shift calculations and accumulate the shift calculation results through the XOR write-back unit.

7. The HQC hardware accelerator based on post-quantum cryptography according to claim 6, characterized in that, The number of dense polynomial memories is set to 1.

8. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, After the parallel sampling module samples a preset number of indices, it performs polynomial multiplication operations through the parallel polynomial operation module, wherein the preset number is less than the number of indices in the sparse polynomial index memory.

9. The HQC hardware accelerator based on post-quantum cryptography according to claim 1, characterized in that, It also includes index sampling during multiplication operations and synchronous execution of polynomial multiplication operations.

10. A post-quantum cryptography-based HQC hardware accelerator scheduling method for the accelerator according to any one of claims 1-9, characterized in that, include: Random numbers are sampled in parallel to obtain an index, and polynomial multiplication is triggered in preset small batches when sampling is not complete; The index is compared with the index stored in the sparse polynomial index memory in parallel, and the index is stored or discarded based on the comparison result. After boundary processing of the index of the sparse polynomial index memory, it is concatenated and shifted with the end address data of the dense polynomial memory to obtain the correct initial data.

Images