How to design a device for cryptographic applications

Abstract

The present invention relates to a method for designing a device for performing polynomial multiplication in cryptographic applications, the method comprising dividing the execution of the polynomial multiplication into at least two data processing stages of the device, at least one data processing stage configured to receive input operands for performing the multiplication and at least one data processing stage configured to provide an output signal of the multiplication, defining for each data processing stage one or more parameters related to a representation of data processed in that data processing stage and one or more constraints on the output signal, determining individually for each data processing stage values ​​of the one or more parameters at which the one or more constraints are taken into account, and applying the determined values ​​of the one or more parameters in each of the data processing stages in the device to perform the polynomial multiplication in cryptographic applications.

Description

[Technical Field]

[0001] The present invention relates generally to the field of cryptography, and more particularly to a method for designing a device for use in cryptographic applications. [Background technology]

[0002] For example, in a cloud computing context, users take certain risks when uploading raw data to untrusted cloud servers. Therefore, sufficient security must be provided to protect users' data. A new and promising technique emerging in the field of data security is fully homomorphic encryption (FHE), which allows homomorphic computations to be performed on encrypted data (ciphertext) without learning any further information about the data. In other words, there is no need to decrypt the data first. Methods for performing FHE have been improved over the years to become practical.

[0003] FHE algorithms are often run on cloud computing servers. However, they are computationally slow. The execution of FHE schemes is typically hampered by multiplication operations. The ciphertext data on which computations are performed in FHE schemes is a large polynomial (length N) in a polynomial ring that depends on the particular scheme. Typical operations on these polynomials include addition and multiplication. Addition is linear in the length of the polynomial (O(N) operations), but multiplication is quadratic in cost (O(N)) using the common and straightforward technique also known as textbook multiplication. 2 ) operation).

[0004] One of the main challenges in the practical application of FHE is computational overhead. One of the most costly operations in FHE schemes is multiplication, and speeding up polynomial multiplication can significantly reduce the computational overhead. This can be achieved by exploiting certain properties of polynomials. There are various well-studied algorithms available to speed up such multiplication, including number-theoretic transforms (NTTs), Toom-Cook multiplication, or Karatsuba multiplication. Multiplication using NTTs is generally the most efficient of these algorithms, but imposes the strictest requirements on the polynomial ring used. Therefore, it cannot be used for all FHE schemes.

[0005] FHE schemes typically use NTT for fast polynomial multiplication when the underlying ring structure allows it. Two notable exceptions, where NTT does not apply, are the FHEW scheme disclosed in the paper “FHEW: Bootstrapping Homomorphic Encryption in Less Than a Second” (L. Ducas et al., Eurocrypt, pp. 617–640, 2015) and the TFHE scheme described in “TFHE: Fast Fully Homomorphic Encryption Over the Torus” (I. Chillotti et al., J. Cryptol. 33, 34–91, 2020). Both of these schemes have ring structures that prohibit the use of NTT. Instead, these schemes can use Toom-Cook multiplication, Karatsuba multiplication, or the fast Fourier transform (FFT) for fast polynomial multiplication, with the FFT usually being the fastest option. The latter transform is similar to the NTT transform but imposes less stringent conditions on the polynomial ring. Both FHEW and TFHE, apart from isomorphic addition and multiplication, allow the use of isomorphic Boolean algebra, for example NAND, XOR, and XNOR logic gates.

[0006] FHE ciphertexts incorporate noise into the encryption for security purposes. Furthermore, each FHE operation increases the noise present in the ciphertext. Additional FFT quantization noise can be tolerated to a certain extent. Quantization noise can result from the fact that FFTs operate on real numbers and are approximated with floating-point or fixed-point representations. FHE tolerates this noise as long as it does not exceed a certain threshold noise level. Therefore, FHE schemes must periodically invoke a bootstrap operation to reduce the amount of noise in the ciphertext and maintain it below the threshold noise level. However, using FFTs requires very careful handling, as too much noise will cause the bootstrap to fail.

[0007] Schemes such as TFHE and FHEW perform bootstrap after every encryption gate. Compared to previous generation FHE schemes, they feature a significantly faster bootstrap algorithm that can additionally be programmed with an arbitrary function to be applied to the ciphertext. The encryption gate computations (encrypted NAND, XOR, XNOR, ...) are dominated by the expensive (programmable) bootstrap ((P)BS) computation. Therefore, it is necessary to apply hardware acceleration to the bootstrap.

[0008] PBS involves successive multiplications of ciphertext data in so-called "outer products." This outer product defines the multiplication of a generic LWE ciphertext with a generic GSW ciphertext. Both generic Learning With Errors (LWE) and generic GSW (Gentry, Sahai, and Waters) are completely homomorphic encryptions. Conceptually, a generic LWE ciphertext is a vector of k+1 polynomials, and a generic GSW ciphertext is a matrix of (k+1)l × (k+1) polynomials. In TFHE, these polynomials are defined over a real torus, i.e., their coefficients lie in the interval [0,1]. In FHEW, these polynomials have integer coefficients.

[0009] The first step of the "outer product" is to decompose each polynomial in the universal LWE ciphertext into l polynomials. In the decomposed format, the outer product can be expressed as a vector-matrix multiplication of the polynomials. The output is again the universal LWE ciphertext.

number

[0010] As mentioned above, a key feature of FHE applications is the inherent crypto-mathematical noise present in the ciphertext data. When the ciphertext data is decrypted, the noise is filtered out and the exact result is obtained. Similarly, the GLWE output ciphertext of the outer product, c(X) = (c0(X),c1(X),...,c k c(X)) contains cryptographic mathematical noise. Polynomial multiplication is efficiently calculated using the Fast Fourier Transform (FFT). In this case, additional FFT quantization noise can be tolerated in c(X), even in cryptographic settings, due to the inherent mathematical noise. The amount of noise tolerated depends on the cryptographic parameter set. For example, in the paper by I. Chillotti mentioned above, a noise formula is derived for the cryptographic noise present in c(X).

[0011] Real numbers can be represented with finite precision in various ways. In CPUs, a typical method is to use single- or double-precision floating-point numbers. Precision is defined by the size of the mantissa, and the dynamic range is defined by the size of the exponent. This approach is efficient due to the integration of floating-point units (FPUs) in CPUs, making it the representation generally preferred by software designers. Because single-precision FFTs have been found to introduce excessive noise, implementations of the TFHE and FHEW schemes described above are limited to double-precision floating-point FFTs. Double-precision floating-point FFTs have been found to keep the amount of noise introduced sufficiently small. Fixed-point representations are determined by the number of bits in the representation and the scaling factor. In fixed-point representations, the mantissa has a fixed number of bits.

[0012] In hardware, double precision arithmetic is expensive to implement and is therefore preferably avoided unless absolutely necessary. A significantly cheaper alternative is fixed-point arithmetic. In state-of-the-art solutions, a single representation is chosen and used throughout the architecture. Furthermore, the specific characteristics of input data and specific requirements regarding noise in the output in a cryptographic setting have not been exploited so far.

[0013] Also, in the paper “MATCHA: A Fast and Energy-Efficient Accelerator for Fully Homomorphic Encryption over the Torus” (L. Jiang et al., 2015) thAt the Annual Design Automation Conference 2022, July '22, prepublished on the Internet on February 17, 2022, a hardware accelerator for processing TFHE gates is presented that is more efficient than accelerators that frequently invoke expensive double-precision floating-point FFT and IFFT kernels. To fully utilize the error-tolerant capabilities of TFHE, polynomial multiplications are accelerated using approximate multiply-free integer FFTs and IFFTs, which require only additions and binary shifts. Although the approximate FFTs and IFFTs introduce errors into each ciphertext, the errors can be rounded off along with noise during decryption, allowing the ciphertext to be decrypted accurately. The integer representation can be viewed as a version of the fixed-point representation scaled to remove the decimal point.

[0014] Furthermore, in the "MATCHA" approach, a single representation is chosen for the FFT and IFFT. Validation that the noise remains sufficiently small is performed by testing for decoding failures across multiple trials. However, the use of a single representation in the sequence of steps that make up the polynomial multiplication ignores the fact that each operation contributes differently to the output noise, depending on the data being processed. Furthermore, matching the FFT noise to the mathematical outer product noise allows for much more sophisticated noise control and optimization than simply testing for decoding failures.

[0015] Thus, there is room for improvements in how devices are designed for use in cryptographic applications. Summary of the Invention

[0016] It is an object of the present invention to provide a method for designing a device for performing polynomial multiplication in cryptographic applications that takes into account the specificities of the data in the cryptographic application and has a degree of built-in flexibility.

[0017] The above object is achieved by the solution according to the invention.

[0018] A first aspect of the present invention relates to a method for designing a device for performing polynomial multiplication in cryptographic applications, the method comprising first dividing the execution of the polynomial multiplication into at least two data processing stages, at least one data processing stage configured to receive input operands for performing the multiplication, and at least one data processing stage configured to provide an output signal of the multiplication. defining, for each data processing stage, one or more parameters related to a representation of the data to be processed in that data processing stage; defining one or more constraints on the output signal of the multiplication; - determining, for each data processing stage separately, values ​​of one or more parameters in which said one or more constraints are taken into account; applying the determined values ​​of one or more parameters at each of the data processing stages within the device to perform polynomial multiplication in a cryptographic application; Equipped with.

[0019] The proposed solution indeed makes it possible to design the various data processing stages of a device for performing polynomial multiplication so that each stage has its own suitably optimized parameter set, which, given the type of representation (for example fixed-point or floating-point), makes it possible to represent the variables used in performing the multiplication in an optimal way such that one or more constraints are satisfied.

[0020] Preferably, the input operand is a vector of polynomials. The second input operand is a matrix of polynomials, which may be pre-computed in the FFT domain.

[0021] In a preferred embodiment, the one or more parameters comprise one or more of {bit width, dynamic range, integer part size, fractional part size, decimal point position}.

[0022] Advantageously, the device is reconfigurable.

[0023] In one embodiment, a method for designing a device comprises dividing polynomial multiplication into a number of subtasks, with each data processing stage performing at least one subtask.

[0024] In an embodiment of the method, the division into at least two data processing stages depends on the hardware implementation of the device. In an advantageous embodiment, the device has an architecture with multiple successive stages forming a pipeline. The device can be applied in a field programmable gate array.

[0025] In a preferred embodiment, the maximum noise level is considered as one of the constraints.

[0026] Advantageously, the polynomial multiplication is part of a fully homomorphic encryption scheme.

[0027] In some embodiments, the step of determining parameter values ​​for each data processing stage individually is performed by simulation.

[0028] In an embodiment of the method, the step of determining a value for each data processing stage individually is performed by determining one or more characteristics of the data to be processed based on a model of a noise source and / or at least one characteristic of the input to a subtask of the data processing stage affecting one or more constraints on the one or more characteristics.

[0029] In one embodiment, one noise source may come from the removal of bits at the least significant side of the input of a subtask of a data processing stage. One noise source may come from the exclusion of bits at the most significant side of the input of a subtask of a data processing stage.

[0030] In some embodiments, polynomial multiplication is performed using negative circular convolution.

[0031] In a preferred embodiment, the representation of the data is a fixed-point representation.

[0032] Certain objects and advantages of the present invention have been described above for the purpose of summarizing the invention and the advantages achieved over the prior art. Of course, it is understood that not necessarily all such objects or advantages may be achieved in accordance with any particular embodiment of the invention. Thus, for example, one skilled in the art will recognize that the present invention may be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages taught herein, without necessarily achieving other objects or advantages that may be taught or presented herein.

[0033] These and other aspects of the invention will be apparent from and elucidated with reference to the embodiment(s) described hereinafter.

[0034] The invention will now be further described, by way of example only, with reference to the accompanying drawings, in which like reference numerals refer to like elements in the various views, and in which: [Brief explanation of the drawings]

[0035] [Figure 1] 1 shows a block scheme of an accelerator structure to which the method of the invention can be applied; [Figure 2] 1 shows an unfolded version of the block scheme of FIG. [Figure 3] 1 shows a butterfly structure as commonly used in FFT implementations. [Figure 4] 10 shows additional building blocks for the division into subtasks and intermediate variables in the third example. [Figure 5] A three-step method for performing multiplication is shown. [Figure 6] 1 illustrates possible alternative architectures for the device. DETAILED DESCRIPTION OF THE INVENTION

[0036] The present invention will be described with respect to particular embodiments and with reference to certain drawings but the present invention is not limited thereto but only by the claims.

[0037] Furthermore, terms such as first, second, etc. in this specification and claims are used to distinguish between similar elements and do not necessarily describe an order in time, space, hierarchy, or in any other way. Terms so used are interchangeable under appropriate circumstances, and it should be understood that the embodiments of the invention described herein are capable of operation in orders other than those described or illustrated herein.

[0038] It should be noted that the term "comprising" used in the claims should not be interpreted as being limited to the means listed thereafter, nor as excluding other elements or steps. Thus, the term "comprising" specifies the presence of the so-mentioned mentioned features, integers, steps, or components, but is not interpreted as excluding the presence or addition of one or more other features, integers, steps, or components, or groups thereof. Thus, the scope of the expression "a device comprising means A and B" should not be limited to a device consisting only of components A and B. The above means that, in the context of the present invention, the relevant components of the device are only A and B.

[0039] Throughout this specification, a reference to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of the invention. Thus, the appearances of the phrase "in one embodiment" or "an embodiment" in various places throughout this specification do not necessarily all refer to the same embodiment, although they may. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner, as would be apparent to one of ordinary skill in the art from this disclosure, in one or more embodiments.

[0040] Similarly, in describing exemplary embodiments of the invention, it should be understood that various features of the invention may be grouped together in a single embodiment, figure, or description for the purpose of streamlining the disclosure and aiding in understanding one or more of the various inventive aspects. However, this method of disclosure is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Accordingly, the claims that follow this specification are expressly incorporated herein, with each claim standing on its own as a separate embodiment of this invention.

[0041] Furthermore, although some embodiments described herein may include some features and not include some features included in other embodiments, combinations of features from different embodiments are intended to form different embodiments within the scope of the present invention, as will be understood by those skilled in the art. For example, in the following claims, any of the claimed embodiments may be used in any combination.

[0042] It should be noted that the use of a particular term when describing a particular feature or aspect of the present invention is not to be taken as suggesting that the term is redefined herein to be limited to including any particular characteristic of the relevant feature or aspect of the present invention.

[0043] In the description provided herein, numerous specific details are set forth. However, it will be understood that embodiments of the present invention may be practiced without these specific details. In other instances, well-known methods, structures, and techniques have not been shown in detail in order not to obscure an understanding of this specification.

[0044] The present invention discloses a novel method for designing a device for performing polynomial multiplication in cryptographic applications.

[0045] To achieve an efficient implementation of polynomial multiplication using FFT operations, we can take advantage of the aforementioned feature that FHE schemes introduce a certain amount of noise into the ciphertext required for security. Therefore, these schemes can tolerate approximate calculations, including quantization noise. Furthermore, we note that cryptography deals with uniformly random values, limiting the dynamic range of the calculated coefficients. This makes it easier to predict the bit representation range, i.e., word length, required to represent the coefficients. The noise tolerated by FFTs in cryptographic applications depends not on the application constraints but on the cryptographic parameter set. The cryptographic parameter set can be selected to tolerate more or less noise. The inventors realized that these observations provide an opportunity to perform multiplications such that the intermediate variables applied in performing the operations have optimized representations.

[0046] Specifically, the present invention presents a method for designing a device for performing polynomial multiplication in cryptographic applications. In this method, the multiplication is first divided into at least two data processing stages implemented with optimized data representations. One or more parameters are then established that determine how to represent the variables used in the data processing stages when performing the multiplication in cryptographic applications. While mathematical descriptions of algorithms that perform such operations assume infinite precision for the variables, hardware implementations (as well as software implementations) must determine the specific representation type of the variables, e.g., fixed-point, floating-point, block-floating-point, etc., and the precision of the selected representation. This choice affects implementation cost and accuracy.

[0047] Once the representation type for each variable has been selected, the exact parameters of this representation must be determined. For example, in the case of a fixed-point representation, the least significant bit (LSB) and most significant bit (MSB) to be represented must be determined. Floating-point representations are parameterized by the minimum and maximum values ​​(and therefore the bit size (word length)) of both the mantissa and the exponent. For example, the MSB value characterizes whether overflow can occur or not.

[0048] As an example, the parameterization of MSB and LSB is shown below. Assume a value a with 8 integer bits and 16 fractional bits and a value b with 4 integer bits and 8 fractional bits. Then the full precision result c=a×b has 8+4=12 integer bits and 16+8=24 fractional bits. In this case, we say that the MSB of c is at position 12 and the LSB is at position -24. In the implementation, the parameterization is done for the variables c:MSBc and LSBc. By truncating the bits at the MSB, i.e. by rescaling (for example by choosing MSBc=11), we can achieve a certain overflow probability P overflow This value depends on the distribution of the values ​​a and b, and in practice it is best to have all MSBs equal to, say, P overflow <2 -64By truncating the bits on the LSB side, some noise due to quantization is introduced, which adds to the output noise, although any form of rounding could be considered instead of truncation.

[0049] Importantly, the representation of the variables affects the implementation cost, with a larger range of possible values ​​resulting in a more accurate implementation at the expense of higher computational costs. In a typical implementation, there are design constraints on the precision of the output variable(s). These constraints are known a priori and may, for example, be the maximum noise variance introduced or the maximum probability of having a variable overflow (e.g., 2 -20 or 2 -40 ) The goal is to determine parameters that allow for an efficient implementation while satisfying the above design constraint(s) on the output signal.

[0050] A general overview of the proposed approach is provided, as applied to an algorithm implemented in a device for performing polynomial multiplication on input operands in cryptographic applications. The polynomial multiplication operation is divided into multiple subtasks. The device according to the present invention comprises at least two interconnected data processing stages. Each data processing stage performs at least one subtask. At least one data processing stage is configured to receive input operands for performing the multiplication. At least one data processing stage is configured to provide an output signal representing the result of the polynomial multiplication. Any subtask that does not produce an output of the multiplication operation generates a variable, referred to herein as an intermediate variable. Any intermediate variable is then used as input to one or more subsequent subtasks. The input operands may include either or both (all) of the variables being multiplied. For example, when multiplying two variables, the two variables may form the input operands. In an advantageous embodiment, the input operands are vectors of polynomials. One or more constraints are imposed on certain characteristics of the output resulting from the operation (e.g., a maximum value for the variance of the introduced noise). The goal is to determine efficient parameters for the representation of intermediate and output variables in the implementation.

[0051] At a high level, the design method of the present invention comprises the following main steps: For each data processing stage of the device, one or more parameters are defined regarding the way in which the data (i.e., intermediate variables) processed at that stage are represented. Also, one or more constraints that the output of the polynomial multiplication operation must satisfy are defined. In the next step, for each data processing stage, specific values ​​are determined for each parameter of the representation individually, such that all constraints are satisfied. Preferably, the values ​​of these parameters are determined in an optimal manner, i.e., according to an appropriate optimization function. The parameter values ​​are then used in each of the data processing stages of the device to implement the polynomial multiplication in the device.

[0052] A preferred method for determining parameter values ​​for each data processing stage is as follows: one or more characteristics of a variable output by one of the subtasks of the data processing stage under consideration are determined. These characteristics of the variable may be based on a model of noise source(s) affecting the characteristics of the signal output by that one subtask and / or one or more constraints on at least one characteristic of the input to said one subtask. The model is constructed as a function of the parameters of the determined representation(s). This is repeated for all intermediate variables of all data processing stages as well as for the output variables. For each data processing stage, a specific value is determined for each parameter of the representation such that the one or more characteristics satisfy all constraints. The determined parameter values ​​are then used in the respective data processing stage in a device for performing polynomial multiplication.

[0053] Building a model of a noise source can be done as follows: The algorithm performing the multiplication is divided into various subtasks and intermediate variables are identified. For each subtask, a characteristic input-output behavior is determined subject to constraints (e.g., noise to be introduced, scaling coefficients from input to output, ...). For each of these variables, a type of representation (i.e., fixed-point, floating-point, ...) is selected. The parameters of this representation (e.g., highest representable value, lowest representable value, ...) are left undetermined and initially remain symbolic, i.e., variables that do not yet have specific values.

[0054] To analyze the execution of the algorithm, an extra building block is introduced into the multiplication scheme at each intermediate variable. This building block represents the effect of the limited precision of the variable's representation, but does not affect the algorithm itself. To achieve this, the extra building block has an input-output behavior that links the symbolic parameters to the imposed constraints.

[0055] The algorithm is passed from input to output, and a model is built for each constraint. To do this, one or more relevant characteristics (e.g., noise variance, input variance, maximum possible value, ...) at the input of a subtask or input operand are determined, and these characteristics are then propagated to the output. For each subtask, the input-output behavior is used to convert the input characteristics into the corresponding output characteristics. As a result, for each constraint, a model of the characteristics of the constrained variable as a function of the symbolic parameters is obtained.

[0056] In the next step of the method, values ​​are determined for each of the symbolic parameters such that the constraints are satisfied. Preferably, these values ​​are selected so that the implementation cost is as low as possible. One way to achieve this is to select, for each symbolic parameter, a cost function that models the implementation cost for a given value of this parameter. The solution can then be found by solving an optimization problem to determine values ​​that reduce, preferably minimize, the overall cost function while respecting all constraints.

[0057] Finally, the selected values ​​of the determined parameters are applied to instantiate the design of each data processing stage of the device for a cryptographic application.

[0058] In other embodiments, adjusting the data representation may be performed by simulation. In these embodiments, it is assumed that each computational stage contributes independently to the output noise. First, each computational stage is implemented with very high precision, resulting in negligible output noise. Next, one stage is fine-tuned (e.g., the bit width of the fixed-point representation is reduced), and the resulting output noise is measured and compared to the high-precision case. At a particular threshold bit width, the output noise from the fine-tuned stage approaches the allowable output noise (e.g., within X bits). This threshold bit width is then considered the "optimal" bit width for this particular stage. This is repeated until a threshold bit width is determined for each particular stage. Finally, each stage is implemented with its threshold bit width, and the total output noise of all stages is measured together. If this output noise exceeds the allowable output noise, the entire process is repeated for a larger threshold bit width (i.e., the allowable X bits is increased).

[0059] In another embodiment, the adjustment of data representations is performed in a similar manner, except that a cost function is assigned to each adjusted stage. Computationally expensive stages are first adjusted to their minimum bit-width. Subsequent stages are then adjusted, while maintaining the expensive stages at their adjusted bit-width. In this way, the expensive stages are implemented to the absolute minimum precision, at the expense of other stages being implemented to high precision.

[0060] Here we present an example that demonstrates the proposed approach to design hardware that accelerates the vector-matrix multiplication given by equation (1) above. The architecture utilizes an FFT block to accelerate polynomial multiplication.

[0061] A block diagram of an advantageous accelerator structure is presented in Figure 1. This architecture has clear similarities with streaming DSP processors, with large, fully pipelined, directly cascaded computation stages and significantly simplified control logic. The accelerator is conceived to achieve maximum throughput / area by maximizing the number of computational units and eliminating control logic and hard-coded routing paths.

[0062] Speeding up polynomial multiplication is achieved by the convolution theorem c=a×b=IFFT(FFT(a)·FFT(B)) (2) This can be realized by repeating equation (1) as follows:

number

[0063] FFT-based multiplication operates on complex numbers, where both the real and imaginary parts are real, while other multiplication algorithms use integers. When finite precision is used to represent real numbers, the multiplication calculation is not always exact and may contain noise, i.e., a small error δ may be introduced. FFT -1 (FFT(a).FFT(b))=c+δ As mentioned above, a certain level of noise introduced by the FFT can be tolerated in FHE, apart from the (mathematical) noise already present in the formula for security reasons. This means that the magnitude of the noise δ must be considered very carefully. FHE implementations impose strict limits on the noise introduced. If the noise introduced by the FFT into the polynomial multiplication is excessively large, the calculation will fail and produce incorrect results.

[0064] Figure 2 shows an expanded version of a typical accelerator hardware architecture with the pipeline structure shown in Figure 1. Such an architecture is advantageously applied in a field programmable gate array (FPGA). The matrix input B in Eq. i,j can be pre-computed in the FFT domain. Also, as can be seen from Figures 1 and 2, the input B i,j is available in the FFT domain. The FFT component (12) computes the FFT of vector a applied to the input of the structure. The multiply-accumulate (MAC) component (13) accumulates the components of the operation at each point in the FFT domain. An inverse FFT component (14) is provided to return the output vector from the FFT domain. Since there are (k+1)l forward FFTs and (k+1) inverse FFTs in Equation 1, these blocks require different throughputs. All blocks are connected as a pipeline, as described above.

[0065] As can be seen from Figures 1 and 2, the architecture can be divided into multiple stages (functional blocks). There is an FFT block, a MAC block, and an inverse FFT block. Within each of these blocks, there may be multiple stages as well. The MAC has a multiplication stage and an addition stage. The multiplication itself is a complex multiplier (out = (a + bj) (c + dj)), which also has stages. Each stage has specific data representation parameters (e.g., fixed point, floating point, number of bits, rounding mode) that affect the noise present in the output c (c = c0, c1). The FFT block has Log2(N) stage "butterfly" units. These butterfly units perform the butterfly operations, which are an essential part of the FFT transform. Figure 3 shows a diagram of the butterfly operations. In the implementation of FFT algorithms, butterfly operations with two inputs and two outputs are well known, and generally involve recursively decomposing a discrete Fourier transform of composite size N=rm into r smaller transforms of size m, where r is the base of the transform. These smaller DFTs are then combined via a butterfly of size r, which is itself a DFT of size r pre-multiplied by a power of 1 known as a twiddle factor (performed m times on the corresponding output of the sub-transform).

[0066] Because FHE applications have inherent cryptographic mathematical noise present in the polynomial c, different data representations are possible at each stage in the architecture of Figure 2, provided that some extra FFT-based rounding noise can be tolerated. Having some room for extra noise allows for the use of different bit widths, rounding modes, fixed-point formats, etc. This is true for each stage within this architecture.

[0067] Various methods are available for determining the data representation of each stage. Each of these methods starts from the characteristics of the output signal (vector c(X) = c(0(X), c1(X)), e.g., the maximum acceptable level of noise, derived from a mathematical formulation of the noise present in the FHE scheme considered. Apart from the maximum noise level, other constraints may be imposed, e.g., related to overflow. In practice, the maximum acceptable level of noise is always one of the constraints.

[0068] Therefore, the variables in the Fast Fourier Transform and the variables in the butterfly operation are complex numbers. However, it is usually possible to assume that the distribution and properties of the real and imaginary parts are the same. In such a scenario, the analysis can focus on the properties of the real part only.

[0069] In the example considered here, only the maximum noise variance constraint is imposed on each butterfly structure. The goal is, for example, to select the value of the least significant bit (LSB) position of each intermediate variable. The LSB and variance of the noise and signal are considered as related properties. After dividing the algorithm into subtasks, the intermediate variables v at , v c , v d Additional building blocks are added to the scheme for

[0000] . These blocks model the imprecision due to the limited representation range. The model is built on the noise introduced by truncating the least significant bits, for example, by assuming that the truncated LSB bits are independent and uniformly distributed.

[0070] The multiplication subtask in the butterfly computation can be simplified by exploiting knowledge of the rotation input properties. real and the imaginary part t imag An interesting property of any twiddle factor t with t real 2 +t imag 2= 1. Given a number x with real and imaginary parts of the same variance, multiplying x by a twiddle factor t does not change the variance, i.e., var(xt) = var(x). This can be easily derived as follows: var(real((x real +i·x imag )·(t real +i·t imag ))) =var(x real ·t real -x imag ·t imag ) =t 2 real var(x real )+t 2 imag var(x imag ) =var(x real ) Therefore, for multiplication, the input-output behavior is xt =LSB x +LSB t and σ 2 noise,out =σ 2 noise,x +σ 2 x σ 2 noise,t (based on the assumption that the inputs have zero mean). The input-output behavior of the addition block when variables in1 and in2 are added can be written as: LSB out =min(LSB in1 ,LSB in2 ) and σ 2 noise,out =σ 2 noise,in1 +σ 2 x σ 2 noise,in2 is calculated by

[0071] The model can then be calculated starting from the rotated inputs, which are reduced in precision by the finite representation (except for rotations 1 and -1, and i and -i). Symbolic parameters are written in bold to distinguish them from other parameters or properties. LSB=LSB t σ 2 =1 σ 2 noise =2 2LSBt / 12

[0072] Therefore, the intermediate variable v at After an additional building block on the real part of the product is obtained. LSB=LSB at σ 2 =σ 2 a σ 2 noise =σ 2 noise,a +2 2LSBt / 12 * σ 2 a +ramp(2 2LSBat -2 2(LSBa) ) / 12 A similar formula is obtained for the imaginary part. The ramp() function returns 0 for negative input values ​​and returns the input value for positive input values. The reason for having this function is that the additional noise is v <LSB in This is because it only exists if the associated bit is discarded, which happens when

[0073] intermediate variable v c After additional building blocks for , we can write: LSB out =LSB c σ 2 c =σ 2 a +σ 2 b σ 2noise,out =σ 2 noise,c =σ 2 noise,a +2 2LSBt / 12 * σ 2 a +σ 2 noise,b +ramp(2 2LSBat -2 2(LSBa) ) / 12+ramp(2 2LSBc -2 2min(LSBat、LSBb) ) / 12

[0074] Next, the values ​​of the symbolic parameters are determined. At this point, the parameters are determined by the constraints σ 2 noise,out ≦σ 2 maxnoise Each must be fixed to a value such that ≡ ...

[0075] Note that the model-based approach outlined above can also be applied to simple calculations, such as additions performed in the MAC stage. Again, the input-output behavior is described first. Once that is done, the model can be run through to determine the properties associated with constraints in functions of the symbolic parameters. The intermediate calculations at the various nodes can then be noted. The values ​​of the symbolic parameters are then determined. The constraint function σ 2 noise,out ≦σ 2 maxnoise The parameters are each fixed to a value such that this constraint is satisfied.

[0076] The polynomial multiplication using FFT described in the example above can also be viewed as computing the dot product of the input (a vector of polynomials) and the bootstrap key (also a vector of polynomials). To efficiently process such multiplication, a three-step procedure can be used: FFT, coefficient-wise multiplication and accumulation, and inverse FFT. Such a procedure is shown in Figure 5. However, unlike typical FFT-based multiplication, in the figure the second multiplication term (i.e., the bootstrap key) does not undergo an explicit FFT operation. This is because the input is known in advance (as already shown for matrix b in equation (1) above), so the FFT can be precomputed to very high accuracy, meaning this particular FFT does not need to be considered.

[0077] First, the multiply-accumulate operation is considered. Because this operation is performed coefficient-by-coefficient, it can be modeled using multiplication and addition operations similar to those described in the above example. As mentioned above, FFT and inverse FFT operations are primarily composed of several layers of butterfly operations. Therefore, by applying the analysis of the above example to these butterflies, a model of the FFT and IFFT operations is obtained. In some embodiments of polynomial multiplication, the implementation may use different types of butterfly operations (radix-2, radix-4, ...), but the analysis of these butterflies can be performed in a similar manner to the analysis of the above example. By combining the building blocks described above, a noise model based on a full FFT-based polynomial multiplication can be constructed.

[0078] One challenge is that the substantial number of operations leads to a substantial number of parameters that need to be determined. To reduce the number of parameters in the model, similar parameters may be grouped together. In this example, there is a high degree of parallelism and structure that can be used to do this. For example, one may combine similar parameters for variables that are in the same "layer" of the FFT (i.e., variables that have undergone the same number of butterfly operations) or variables after multiplication operations in a multiply-accumulate. This reduces the number of parameters from approximately O((V+1)N / 2log2(N / 2)), where V is the vector length and N is the number of coefficients in the polynomial, to approximately (2log2(N / 2)), which is close to the number of layers in the proposed algorithm.

[0079] Furthermore, it should be noted that typical cryptographic applications, such as FHE, require the implementation of negative circular convolution rather than traditional circular convolution. In circular convolution (with N coefficients), out-of-bounds coefficients (at positions i>N) are rotated up to the first coefficient (at position iN). In contrast, in negative circular convolution, these coefficients are not only rotated but also nullified. To achieve this, many implementations of cryptographic applications include so-called twist-and-fold steps at the beginning and end of the algorithm that take into account the negative convolution behavior. These steps are shown in Figures 1 and 2 and are represented by pre-FFT and post-IFFT multiplications, respectively. This twist-and-fold step involves an additional compression of the input and multiplication with a complex number (twiddle factor). The compression takes two integers a and b and combines them to form the complex number a + b. This operation is typically noise-free. The additional multiplication operation can be modeled using the approach described above. Post-IFFT post-processing is the inverse operation. The negative circular convolution may be performed in a separate data processing stage.

[0080] As already mentioned above, it is necessary to select the representation type of the variables. In the FFT scheme for performing polynomial multiplication as considered in the present invention, a fixed-point representation is advantageously selected. The above-mentioned approach can then be applied to determine the parameters of the fixed-point representation of the variables that will occur when the device performs the operation while satisfying the imposed constraints.

[0081] Given the optimal parameters obtained as described, a device, e.g., a hardware circuit, can be constructed with fixed-point calculations on these parameters. In practice, it may be advantageous to have a library of parameterized hardware circuit implementations where the fixed-point bit-width is a generic parameter. The circuit can be selected to match the input type, and these parameters are set at "circuit synthesis time" to match the required output noise δ.

[0082] As already mentioned above, an alternative way to determine the parameter values ​​is by running a simulation. Specifically, as follows: As in the above example, first the computation is divided into a set of processing stages, with parameters determining the data representation. For example, the data processing stages can be selected as high-order operations, such as forward FFT, MAC, and reverse FFT. The parameters follow the stage selection, e.g. a=forward FFT bitwidth, b=MAC bitwidth, c=reverse FFT bitwidth. Initially, the architecture is designed to have negligible output noise variance σ 2 noise,out <<σ 2 maxnoiseThe output noise is then simulated with very large bit widths for a, b, and c, resulting in σ. A cost function is then assigned to the parameters "a," "b," and "c." Here, a simple cost function can be applied, and a higher cost is assigned to "a" than to "b" because there are more forward FFTs than inverse FFTs (Figure 1). Furthermore, a higher cost is assigned to "c" than to "b" because the inverse FFT operation is more expensive than the MAC operation. The output noise is then simulated by sweeping the most expensive parameter "a" first. σ 2 noise,out ≒σ 2 maxnoise This is considered the minimum value for "a". A small margin is taken into account, for example, an "a" that is one bit greater than the minimum is chosen, and so on with the next parameter "b". This process is repeated until all parameters have been found.

[0083] Given the optimal parameters, a device (e.g., a hardware circuit) can be simulated with the resulting parameter set. The output noise δ can be measured and compared to a floating-point reference implementation. The output noise can be verified to meet the noise bounds (e.g., 2 standard deviations) determined above. An FPGA bitstream can be created for the circuit with the optimal fixed-point parameter set determined in the manner described above. The FPGA bitstream can accelerate the FHE bootstrapping procedure, which involves many (thousands) of iterations of polynomial-vector multiplication.

[0084] In a first preferred embodiment, the architecture is implemented as shown in FIG. 1. Similar to a streaming DSP processor, this architecture has directly cascaded, fully pipelined units. Data is streamed from one processing stage to the next. The objective of the present invention is to implement each data processing stage with a different, optimized data representation. Advantageously, in a streaming architecture, conversions between data representations can be incorporated into dedicated connections between streaming processing stages. Furthermore, this architecture has simplified control logic. For maximum throughput / area, it is envisioned to eliminate control logic and hard-coded routing paths with a maximally deployed computing unit.

[0085] Another example of a possible architecture is shown in Figure 6 (based on Matcha). In this embodiment, the architecture resembles a more classical CPU, with a central memory file and connected to the arithmetic processing units. In the structure of Figure 6, the computational components (FFT, MAC, inverse FFT) may be connected to the memory file by a crossbar. As with the previous example, an appropriate data representation must be determined for each stage of the structure, i.e., the FFT block, the various MAC blocks, and the inverse FFT. Furthermore, the central memory may be considered as an independent write-back stage, and its implementation and data representation may be optimized as well.

[0086] While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description are illustrative or exemplary and not restrictive. The foregoing description details particular embodiments of the invention. However, even though the foregoing is set forth in detail below in this document, it will be understood that the invention can be practiced in many ways. The invention is not limited to the disclosed embodiments.

[0087] Other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a study of the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the indefinite articles "a" or "an" do not exclude a plurality. A single processor or other unit may fulfill the functions of several items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. A computer program may be stored / distributed on a suitable medium, such as, for example, an optical storage medium or a solid-state medium, provided together with or as part of other hardware, or may be distributed in other forms, such as, for example, via the Internet or other wired or wireless communication systems. Any reference signs in the claims should not be construed as limiting the scope.

Claims

1. A method for designing a device for performing polynomial multiplication in cryptographic applications, The method involves dividing the execution of the polynomial multiplication into at least two data processing stages of the device, wherein at least one data processing stage is configured to receive input operands for performing the multiplication, and at least one data processing stage is configured to provide an output signal for the multiplication. For each data processing stage, define one or more parameters related to the representation of the data processed in that stage, Define one or more constraints on the output signal, For each data processing stage, the values ​​of the one or more parameters are individually determined, taking into account the one or more constraints. In the cryptographic application, in order to perform the polynomial multiplication, the determined values ​​of the one or more parameters are applied in each of the data processing stages within the device. A method for providing this.

2. A method for designing the device according to claim 1, wherein the input operand is a vector of polynomials.

3. A method for designing the device according to claim 1 or 2, wherein the one or more parameters comprise one or more of {bit width, dynamic range, integer part size, fractional part size, decimal point position}.

4. A method for designing the device according to claim 1 or 2, wherein the device is reconfigurable.

5. A method for designing the device according to claim 1 or 2, comprising the step of dividing the multiplication into a plurality of subtasks, wherein each data processing stage performs at least one subtask.

6. A method for designing the device according to claim 1 or 2, wherein the device has an architecture comprising a plurality of sequential stages forming a pipeline.

7. The device is a method for designing the device according to claim 6, which is applied in a field-programmable gate array.

8. A method for designing the device according to claim 1 or 2, wherein the maximum noise level is considered one of the constraints.

9. A method for designing the device according to claim 1 or 2, wherein the multiplication of the aforementioned polynomials is part of a fully isomorphic encryption scheme.

10. A method for designing a device according to claim 1 or 2, wherein the step of individually determining the values ​​of the one or more parameters for each of the data processing stages is performed by simulation.

11. A method for designing a device according to claim 1 or 2, wherein the step of individually determining the values ​​for each of the data processing stages is performed by determining the one or more characteristics of the data to be processed based on a model of a noise source affecting the one or more constraints on one or more characteristics and / or at least one characteristic of the input to the subtask of the data processing stage.

12. A method for designing the device according to claim 11, wherein one noise source originates from the removal of bits on the least significant bit side of the input of the subtask of the data processing stage.

13. A method for designing the device according to claim 11, wherein one noise source originates from the exclusion of bits on the most significant bit side of the input of the subtask of the data processing stage.

14. A method for designing the device according to claim 1 or 2, wherein the multiplication of the polynomials is performed using negative cyclic convolution.

15. A method for designing the device according to claim 1 or 2, wherein the representation of the data is in fixed-point representation.

Images