Polynomial multiplication device, polynomial multiplication method, polynomial multiplication program, polynomial multiplication source code generation device, polynomial multiplication source code generation method, and polynomial multiplication source code generation program

Abstract

This polynomial multiplication device multiplies a square matrix having polynomials that are elements of the polynomial ring as elements and a vector, the device comprising: an NTT structure determination unit that calculates an optimal number of stages of number-theoretic transformation for inputs of the cycle ratio between the number of cycles per remainder calculation function in the polynomial multiplication device and the number of cycles per multiplication, and the degrees of the square matrix and the vector; and an NTT multiplication unit that performs polynomial multiplication of the square matrix and the vector by using number-theoretic transformation using the optimal number of stages of number-theoretic transformation.

Description

[Technical Field]

[0001] The present invention relates to a polynomial multiplication device, a polynomial multiplication method, a polynomial multiplication program, a polynomial multiplication source code generation device, a polynomial multiplication source code generation method, and a polynomial multiplication source code generation program. [Background technology]

[0002] Number Theoretic Transform (NTT) is a technique similar to the Fast Fourier Transform (FFT), specifically referring to the Fast Fourier Transform on a residue ring. Number Theoretic Transform is applied to algorithms for fast calculation of multiplication of polynomials. Polynomial rings are often used in lattice cryptography, a public key cryptosystem whose security is based on the computational difficulty of a mathematical problem called a lattice problem. Fast polynomial multiplication algorithms are important in practice, and number theoretic transforms are often used.

[0003] In polynomial multiplication using number theoretic transformation, each polynomial to be multiplied is subjected to number theoretic transformation, and the polynomials are multiplied in the number theoretic transformed state, and the result is then subjected to inverse number theoretic transformation. This polynomial multiplication using number theoretic transformation results in the desired polynomial multiplication. This number theoretic transformation is a multi-stage transformation, and Non-Patent Document 1 describes a method for reducing the amount of calculation by stopping the multi-stage number theoretic transformation midway and performing an inverse number theoretic transformation. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Chi-Ming Marvin, et al. NTT Multiplication for NTT-unfriendly Rings. Cryptology ePrint Archive, Report 2020 / 1397. Summary of the Invention [Problem to be solved by the invention]

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] In polynomial multiplication using number theoretic transformation, there is a trade-off between stopping the number theoretic transformation halfway and performing the inverse number theoretic transformation. In other words, polynomial multiplication using number theoretic transformation involves "1. Number theoretic transformation," "2. Multiplication," and "3. Inverse number theoretic transformation." If the number theoretic transformation is stopped halfway and the inverse number theoretic transformation is performed, the amount of calculation in "1. Number theoretic transformation" and "3. Inverse number theoretic transformation" can be reduced, but on the other hand, it results in an increase in the amount of calculation in "2. Multiplication." In regard to this point, Non-Patent Document 1 determines the optimal number of stages of number theoretic transformation based on information such as the number of registers of the CPU running the program and the number of cycles of basic instructions.

[0007] However, the optimal number of stages may vary not only depending on the CPU architecture but also on the implementation of the modulo computation function, which is the unit operation of the number theoretic transform. It is considered difficult to implement number theoretic transforms with the optimal number of stages for different CPU architectures and implementations of the modulo computation function.

[0008] In view of the above-mentioned problems, an object of the present invention is to provide a polynomial multiplication device, a polynomial multiplication method, a polynomial multiplication program, a polynomial multiplication source code generation device, a polynomial multiplication source code generation method, and a polynomial multiplication source code generation program that contribute to reducing the amount of calculation in a polynomial multiplication algorithm. [Means for solving the problem]

[0009] In a first aspect of the present invention, there is provided a polynomial multiplication device that multiplies a square matrix, the elements of which are polynomials that are elements of a polynomial ring, by a vector, the polynomial multiplication device comprising: an NTT structure determination unit that calculates an optimal number of stages of number theoretic transformation in response to an input of a cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication in the polynomial multiplication device, and the degrees of the square matrix and the vector; and an NTT multiplication unit that performs polynomial multiplication of the square matrix and the vector using a number theoretic transformation that uses the optimal number of stages of number theoretic transformation.

[0010] In a second aspect of the present invention, there is provided a polynomial multiplication method for using a computer to multiply a square matrix having elements that are polynomials that are elements of a polynomial ring by a vector, the polynomial multiplication method comprising: calculating an optimal number of stages of number theoretic transformation for input of a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the computer, and the degrees of the square matrix and the vector; and performing polynomial multiplication of the square matrix by the vector using the number theoretic transformation using the optimal number of stages of number theoretic transformation.

[0011] In a third aspect of the present invention, there is provided a polynomial multiplication program for causing a computer to multiply a vector by a square matrix having elements that are polynomials that are elements of a polynomial ring, the program comprising: a process for calculating an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one execution of a remainder calculation function and the number of cycles per one multiplication in the computer, and degrees of the square matrix and the vector; and a process for executing polynomial multiplication of the square matrix and the vector using a number theoretic transformation that uses the optimal number of stages of number theoretic transformation; A polynomial multiplication program is provided, including:

[0012] In a fourth aspect of the present invention, there is provided a polynomial multiplication source code generation device including: an input unit that receives input of a file in which source code of a remainder calculation function is written, a cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the degree of a square matrix; a number theoretic transformation stage determination unit that calculates an optimal number of stages of number theoretic transformation from the cycle ratio and the degree; an output constant generation unit that generates and lists twiddle factors, modulo factors, and normalization factors for the number theoretic transformation and inverse number theoretic transformation of the optimal number of stages; a polynomial multiplication source file generation unit that generates a file in which a function for calculating the product of a square matrix of the degree and a vector is implemented by the same program as the source file; and a file output unit that outputs the file and the list.

[0013] In a fifth aspect of the present invention, there is provided a method for generating polynomial multiplication source code, which inputs a file in which source code of a remainder calculation function is written, a cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the degree of a square matrix, calculates an optimal number of stages of number theoretic transform from the cycle ratio and the degree, generates and lists twiddle factors, modulo factors, and normalization factors for number theoretic transform and inverse number theoretic transform of the optimal number of stages, generates a file in which a function for calculating the product of a square matrix of the degree and a vector is implemented by the same program as the source file, and outputs the file and the list.

[0014] In a sixth aspect of the present invention, there is provided a polynomial multiplication source code generation program that causes a computer to execute the following processes: input a file in which source code of a remainder calculation function is written, a cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the degree of a square matrix; calculate an optimal number of stages of number theoretic transform from the cycle ratio and the degree; generate and list number of twiddle factors, modulo factors, and normalization factors for number theoretic transform and inverse number theoretic transform of the optimal number of stages; generate a file in which a function for calculating the product of a square matrix of the degree and a vector is implemented by the same program as the source file; and output the file and the list.

[0015] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0016] According to each aspect of the present invention, it is possible to provide a polynomial multiplication device, a polynomial multiplication method, a polynomial multiplication program, a polynomial multiplication source code generation device, a polynomial multiplication source code generation method, and a polynomial multiplication source code generation program that contribute to reducing the amount of calculation in a polynomial multiplication algorithm. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a diagram showing an example of a binary tree in number theoretic transformation. [Figure 2] FIG. 2 is a block diagram of a polynomial multiplication device according to the first embodiment. [Figure 3] FIG. 3 is a flowchart of the polynomial multiplication method according to the first embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of the hardware configuration of an apparatus used in the embodiment. [Figure 5] FIG. 5 is a graph showing predicted and measured values ​​of the number of stages L of number theoretic transformation and the number of CPU cycles (×10 3 ). [Figure 6] FIG. 6 shows an example of the configuration of a key generation device incorporating a polynomial multiplication device. [Figure 7] FIG. 7 shows an example of the configuration of an encryption device incorporating a polynomial multiplication device. [Figure 8] FIG. 8 is a block diagram showing the configuration of a polynomial multiplication source code generation device. [Figure 9] FIG. 9 is a flowchart showing a method for generating a polynomial multiplication source code. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. In addition, the same or corresponding elements in each drawing are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those in reality. There may also be parts in which the dimensional relationships and ratios differ between the drawings.

[0019] (First embodiment) First, the algorithm for polynomial multiplication using the basic number-theoretic transformation will be explained.

[0020] The integer n is raised to a power of 2 (i.e., n=2 m ), and let F(X) be a degree (n-1) polynomial whose coefficients are elements of the remainder ring R. Also, let z be the primitive n-th root of the identity element of the remainder ring R. Also, let NTT(F) be the number theoretic transformation algorithm for the input of the polynomial F(X), then NTT(F)=(F(z 0 ),F(z 1 ),...,F(z n-1 )).

[0021] F(z i ) can be found by recursively applying the following mapping M: M:R[X] / (X 2n -w 2 )->R[X] / (X n -w)×R[X] / (X n +w)

[0022] That is, as shown in Figure 1, the roots have the polynomial ring R[X] / (X n -1), and construct a binary tree with two polynomials as children obtained by mapping the parent polynomial with a mapping M, a binary tree of height log2(n) is obtained, and n leaves each contain F(z 0 ),...,F(z n-1) is assigned. Hereafter, the height of this binary tree is called the number of stages of the number theoretic transformation.

[0023] On the other hand, we can reverse the sequence of steps by using the inverse of the map M. That is, the F(z 0 ),...,F(z n-1 ) values, we can construct a binary tree backwards and find the polynomial F corresponding to the root. This is called a reciprocal number theoretic transformation, and is inv Therefore, NTT inv (NTT(F))=F holds.

[0024] Using the above number-theoretic transformations, we can find the polynomial ring R[X] / (X n To calculate the product H of F and G, which is an element of ∑ -1), do the following:

[0025] First, NTT(F)=(F(z 0 ),...,F(z n-1 )) and NTT(G)=(G(z 0 ),...,G(z n-1 Next, we calculate NTT(F)×NTT(G)=(F(z 0 )×G(z 0 ),...,F(z n-1 )×G(z n-1 )) and finally perform the reciprocal transformation of this inv (NTT(F)×NTT(G)) is equal to the product H of F and G that we wanted to find.

[0026] By the way, the above polynomial multiplication algorithm is based on the polynomial ring R[X] / (X nNTT(F) performs a number theoretic transformation of F, an element of n (-1), up to the log2(n) stage. However, as mentioned above, it may be possible to reduce the amount of calculation by stopping the number theoretic transformation midway and performing an inverse number theoretic transformation by multiplying polynomials. For example, if the number of stages of the number theoretic transformation is reduced from log2(n) to log2(n)-1, the output of NTT(F) becomes n / 2 first-order polynomials. Therefore, if the inverse number theoretic transformation is performed by multiplying first-order polynomials, it is possible to reduce the amount of calculation in the number theoretic transformation and inverse number theoretic transformation. However, if the number of stages of the number theoretic transformation is reduced from log2(n) to log2(n)-1, the part that would have been multiplied by a zeroth-order polynomial (constant) becomes a first-order polynomial multiplication, which increases the amount of calculation in this part.

[0027] In this trade-off relationship, in the present invention, the optimum number of stages L of the number theoretic transformation is derived from the following equation, and this number of stages L is used to execute the polynomial multiplication algorithm.

[0028]

number

[0029] In the above formula, floor(x) is the largest integer that does not exceed the real number x. Furthermore, the cycle ratio r is the ratio r=a / b of the number of cycles a per one remainder calculation function to the number of cycles b per one multiplication, and for example, an actual measured value can be used for this cycle ratio r. The polynomial multiplication algorithm using number theoretic transformation can be extended to the product As of a k-th order square matrix A having polynomials as elements and a k-th order vector s having polynomials as elements, and k in the above formula is the degree of the square matrix. Note that when k=1, it becomes a normal multiplication of polynomials. Furthermore, m is the remainder ring R[X] / (X n -1), n=2 m That is, m=log2(n).

[0030] 2 is a block diagram of a polynomial multiplication device according to the first embodiment. As shown in FIG. 2, a polynomial multiplication device 100 that implements a polynomial multiplication algorithm according to the first embodiment includes an NTT structure determination unit 110 and an NTT multiplication unit 120. The NTT structure determination unit 110 calculates the optimal number of stages L of the number theoretic transform using the above equation for input of the cycle ratio r and the matrix order k. Meanwhile, the NTT multiplication unit 120 executes a polynomial multiplication algorithm using the number theoretic transform using the optimal number of stages L of the number theoretic transform calculated by the NTT structure determination unit 110.

[0031] More specifically, the NTT multiplication unit 120 includes a first L-stage number theoretic converter 121, a second L-stage number theoretic converter 122, a multiplication unit 123, and an L-stage inverse theoretic converter 124. The first L-stage number theoretic converter 121 converts each element A ij On the other hand, the second L-stage number theoretic transformation unit 122 performs an L-stage number theoretic transformation on the k-th order vector s having polynomials as elements. ij Perform L-stage number theoretic transformation.

[0032] Multiplication unit 123 performs matrix-vector multiplication on the output of first L-stage number theoretic transformation unit 121 and the output of second L-stage number theoretic transformation unit 122. L-stage inverse number theoretic transformation unit 124 performs inverse number theoretic transformation on the result of the multiplication by multiplication unit 123. In this way, NTT multiplication unit 120 receives input of k-th order square matrix A having a polynomial as an element and k-th order vector s having a polynomial as an element, and outputs product As of k-th order square matrix A and k-th order vector s.

[0033] Fig. 3 is a flowchart of the polynomial multiplication method according to the first embodiment. The polynomial multiplication method according to the first embodiment shown in Fig. 3 uses a computer to multiply a vector by a square matrix whose elements are polynomials whose coefficients are elements of a modulo ring.

[0034] As shown in FIG. 3, the polynomial multiplication method according to the first embodiment includes a step (S1) of acquiring a cycle ratio r and a degree k, a step (S2) of calculating an optimal number theoretic transformation stage L, a step (S3) of performing an L-stage number theoretic transformation on each element of a matrix, a step (S4) of performing an L-stage number theoretic transformation on each element of a vector, a step (S5) of multiplying a matrix by a vector, and a step (S6) of performing an L-stage inverse number theoretic transformation.

[0035] In step S1 of acquiring the cycle ratio r and the degree k, the ratio r=a / b of the number of cycles a per one remainder calculation function to the number of cycles b per one multiplication, and the degree k of the matrix and vector to be multiplied are acquired. Note that the cycle ratio r can be, for example, an actual measurement value.

[0036] In step (S2) of calculating the optimum number of stages L of the number theoretic transformation, the optimum number of stages L of the number theoretic transformation is calculated from the cycle ratio r and the degree k using the above-mentioned formula.

[0037] In the step (S3) of performing an L-stage number-theoretic transformation on each element of a matrix and the step (S4) of performing an L-stage number-theoretic transformation on each element of a vector, a number-theoretic transformation of the calculated stage number L is performed on each element of the matrix and vector.

[0038] In the step (S5) of multiplying a matrix by a vector, the matrix whose elements have been number theoretically transformed is multiplied by the vector, and in the step (S6) of performing an L-stage reciprocal number theoretic transformation, the multiplication result is subjected to a reciprocal number theoretic transformation.

[0039] The polynomial multiplication method according to the first embodiment reduces the amount of calculation by performing number theoretic transformation with the optimum number of stages L as described above.

[0040] (Example of hardware configuration) Fig. 4 is a diagram showing an example of the hardware configuration of a device used in the embodiment. That is, the polynomial multiplication device 100 makes it possible to realize each function of the polynomial multiplication device 100 by executing the above-described polynomial multiplication method as a program on an information processing device (computer) employing the hardware configuration shown in Fig. 4. However, the hardware configuration example shown in Fig. 4 is an example of a hardware configuration that realizes each function of the polynomial multiplication device 100, and is not intended to limit the hardware configuration of the polynomial multiplication device 100. The polynomial multiplication device 100 may include hardware not shown in Fig. 4.

[0041] As shown in FIG. 4, the hardware configuration 10 that can be adopted by the polynomial multiplication device 100 includes a CPU (Central Processing Unit) 11, a main memory device 12, an auxiliary memory device 13, and an IF (Interface) unit 14, which are interconnected by, for example, an internal bus.

[0042] The CPU 11 executes each command included in the program executed by the polynomial multiplication device 100. The main storage device 12 is, for example, a RAM (Random Access Memory), and temporarily stores various programs, such as the program executed by the polynomial multiplication device 100, for processing by the CPU 11.

[0043] The auxiliary storage device 13 is, for example, a hard disk drive (HDD), and is capable of storing various programs, such as the program executed by the polynomial multiplication device 100, for a medium to long term. The various programs, such as the program, can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0044] The IF unit 14 provides an interface for input and output of the polynomial multiplication device 100, for example.

[0045] An information processing device employing the above hardware configuration 10 implements, for example, each function of the polynomial multiplication device 100 by executing the above-described polynomial multiplication method as a program.

[0046] (Verification example) Here, the effects of the polynomial multiplication method according to the first embodiment will be described. The environment for the verification experiment is as follows. - Experimental environment Microcomputer board: F103RB (ARM Cortex-M3 32bit / 72MHz) Compiler: gcc Compiler option: -O2

[0047] Figure 5 shows the relationship between the number of stages L of the number theoretic transformation and the number of CPU cycles (×10 3 5 is a graph showing predicted and measured values ​​of . As shown in Fig. 5, in the above environment, the amount of calculation is smallest when the number of stages L is 4.

[0048] On the other hand, when the optimum number of stages L is calculated using the above-mentioned formula (1), with m = 8, k = 1, and the measured value of the cycle ratio r being 5.9 (r = 59 / 10), L = 4 is obtained. In other words, the optimum number of stages L could be calculated using the above-mentioned formula (1).

[0049] (Second embodiment) Next, an embodiment in which the above-described polynomial multiplication algorithm is applied to cryptography will be described.

[0050] Lattice cryptography is a public key cryptography method that is thought to be difficult to decrypt even with a quantum computer. q =(Z / qZ)[X] / (X n +1) is a ring often used in lattice cryptography, and therefore it is practically important to efficiently compute the products of polynomials in this ring. In fact, in SABER, a lattice cryptography method, key generation and encryption involve multiplication of a vector by a square matrix whose elements are polynomials that are elements of a polynomial ring.

[0051] SABER is a public key cryptosystem based on the computational difficulty of the Module Learning with Rounding (MLWR) problem. The SABER algorithm is explained below. The parameters q, p, and T are all powers of 2, and q>p>T is satisfied.

[0052] In the key generation algorithm, we first uniformly randomly select a matrix A∈R q k×k Then, choose s∈R as the private key. q k Each coefficient of s is sampled independently from the binomial distribution. Finally, A T Calculate the following value by scaling and rounding s, and output (A, b) as the public key.

[0053]

number

[0054] In the encryption algorithm, the public key (A, b) and n-bit plaintext m are input. The plaintext m is expressed as a polynomial. That is, for i∈{0, 1,..., N-1}, the coefficient of the ith term of the plaintext corresponds to the ith bit of the plaintext. Next, from the binomial distribution, s'∈R q k and calculate the following values:

[0055]

number

[0056] Finally, v'∈R q ,c m ∈R T is defined as follows, and the ciphertext is (c m ,b') is output.

[0057]

number

[0058] In the decryption algorithm, the secret key s∈R q k and the ciphertext (c m ,b') as input. First, v=b' T (s mod p)∈R q Then, the plaintext can be recovered as follows:

[0059]

number

[0060] In the encryption system described above, the polynomial multiplication method according to the first embodiment can be used as a key generation method and an encryption method.

[0061] 6 shows an example of the configuration of a key generation device incorporating a polynomial multiplication device. As shown in Fig. 6, the key generation device 200 includes a polynomial multiplication device 100, a random matrix generation unit 210, a private key generation unit 220, and a scaling unit 230.

[0062] The random matrix generation unit 210 generates a matrix A∈R uniformly at random. q k×k The private key generation unit 220 selects s∈R as the private key. q k Generate.

[0063] As described in the first embodiment, the polynomial multiplication device 100 calculates the matrix A using the optimal number of stages of number theoretic transformation. T and the secret key s are transformed into a matrix A T and the product A of the private key s T Then, the scaling unit 230 calculates A T Calculate the scaled and rounded value of s and output (A, b) as the public key.

[0064] 7 shows an example of the configuration of an encryption device incorporating a polynomial multiplication device. As shown in Fig. 7, the encryption device 300 includes the polynomial multiplication device 100, a random number generation unit 310, a scaling unit 320, and a conversion unit 330.

[0065] The random number generator 310 then calculates s′∈R from the binomial distribution. q k The polynomial multiplication device 100 multiplies a matrix A, which is part of the input public key (A, b), by a random number s'. Specifically, as described in the first embodiment, the polynomial multiplication device 100 performs a number theoretic transformation on the matrix A and the random number s' using the optimal number of number theoretic transformation stages, and calculates the product As' of the matrix A and the random number s'. Thereafter, the scaling unit 320 scales the product As' of the matrix A and the random number s', and outputs b' as part of the ciphertext.

[0066] On the other hand, the conversion unit 330 converts the vector b, which is a part of the public key (A, b), and the input plaintext m into the vector c, which is a part of the ciphertext as described above. m is generated and output.

[0067] As described above, the polynomial multiplication device 100 can be suitably used in the key generation device 200 and encryption device 300 in lattice cryptography using a polynomial ring. Similarly, the polynomial arithmetic device according to the first embodiment can be suitably used in a key generation method and an encryption method in lattice cryptography using a polynomial ring, and the polynomial arithmetic program can be suitably used in a key generation program and an encryption program in lattice cryptography using a polynomial ring.

[0068] (Third embodiment) Next, an embodiment in which the above-described polynomial multiplication algorithm is applied to the generation of source code will be described.

[0069] 8 is a block diagram showing the configuration of a polynomial multiplication source code generation device. As shown in Fig. 8, polynomial multiplication source code generation device 400 includes an input unit 401, a number theoretic transform round number determination unit 402, a constant generation unit 403, a polynomial multiplication source file generation unit 404, and a file output unit 405. Note that polynomial multiplication source code generation device 400 can be realized using the hardware configuration described with reference to Fig. 4.

[0070] An input unit 401 inputs a file F in which the source code of the remainder calculation function MontgomeryReduction is written. In addition, it inputs a ratio r between the number of CPU cycles required to execute the remainder calculation function once and the number of CPU cycles per multiplication, as well as the order k of the matrix and the word size R. This is realized by a character input device such as a keyboard, for example.

[0071] The number-theoretic transform stage determination unit 402 calculates the optimal number of number-theoretic transform stages L from the cycle ratio r and the matrix order k. The optimal number of number-theoretic transform stages L can be calculated using the same formula (1) as in the first embodiment.

[0072] The constant generation unit 403 generates twiddle factors w, w_inv and modulo w_mul of the number theoretic transformation and inverse number theoretic transformation with a number of stages L, and a normalization factor R2invN, and outputs a list H of these.

[0073] The values ​​of each can be determined as follows. First, for the primitive 2^(L+1)th root a of the identity element of the surplus ring Z / qZ, w[i] = a^bitrev(i+1)*(2^R) (mod q) and w_inv[i] = a^(-bitrev(i+1))*(2^R) (mod q), (i=0,2,...,2^L-2) Here, bitrev(i) represents the inversion bit of L bits of i. Also, w_mul[i] = a^bitrev(2*i+1)*(2^R) (mod q), (i=0,1,...,2^L-1) Finally, we define the normalization factor as R2invN = 2^(2R-L) (mod q).

[0074] The polynomial multiplication source file generation unit 404 outputs a file S in which the functions MatrixVectorMul, L_layer_NTT_forward, base_mul, and L_layer_NTT_inv, which calculate the product t=As of a kth order square matrix A and a kth order vector s, each of which has elements of the polynomial ring (Z / qZ)[X] / (X^(2^N)+1) as its elements, are implemented in the same programming language as the source file F.

[0075] The calculation procedure in the function MatrixVectorMul is as follows. Step 1. Apply L-stage number theoretic transformation to each element A[i,j] (i,j = 1,2,...,k) of the k-th order square matrix A to obtain A'[i,j]. Step 2: Apply L-stage number-theoretic transformation to each element s[i] (i = 1, 2, ..., k) of the k-th order vector s to obtain s'[i]. Step 3. For each j = 1, 2, ..., k Sum of products t'[j] = A'[1,j]*s'[1] + A'[2,j]*s'[2] + ... + A'[k,j]*s'[k] where * denotes element-wise product. Step 4: Apply L-stage reciprocal number theoretic transformation to each element t'[i] (i = 1, 2, ..., k) of the k-th order vector t', and output the resulting t[i].

[0076] The L-stage number theoretic transformation in steps 1 and 2 is implemented by function 1: L_layer_NTT_forward, the product-sum calculation in step 3 is implemented by function 3: base_mul, and the L-stage inverse number theoretic transformation in step 4 is implemented by function 4: L_layer_NTT_inv.

[0077] We will now explain the pseudocode for the sum-of-products calculation in step 3. Note that the output of the L-stage number theoretic transformation of polynomial f is 2^L polynomials, and each polynomial is an element of the polynomial ring (Z / qZ)[X] / (X^(2^(NL))-w_mul[u]) (u=0,...,2^L-1). Therefore, when calculating the sum-of-products t'[j]=A'[1,j]*s'[1] + A'[2,j]*s'[2] + ... + A'[k,j]*s'[k], we are calculating the product and sum of polynomials belonging to the same polynomial ring.

[0078] The functions MatrixVectorMul, L_layer_NTT_forward, base_mul, and L_layer_NTT_inv are expressed, for example, by the pseudocode shown below.

[0079] Function 1: MatrixVectorMul Input: matrix A, vector s, rotation factors w, w_inv, modulo w_mul, number of stages L Output: Product t = As 1: for i=0,1,...,k-1 do 2: for j=0,1,...,k-1 do 3: A'[i,j] = L_layer_NTT_forward(A[i,j],w,L) 4: end for 5: end for 6: for i=0,1,...,k-1 do 7: s'[i] = L_layer_NTT_forward(s[i],w,L) 8: end for 9: t' = base_mul(A',s',w_mul,L) 10:t = L_layer_NTT_inv(t',w_inv,L) 11:return t

[0080] Function 2: L_layer_NTT_forward Input: Polynomial f = (f[0],f[1],...,f[2^N-1]), twiddle factor w = (w[0],w[1],...,w[2^L-2]), number of stages L Output:f 1: cnt = 0 2: for i=0,1,...,L-1 do 3: for j=0,1,...,2^i-1 do 4: for k=0,1,...,2^(Li-1)-1 do 5: for m=0,1,...,2^(8-L)-1 do 6: a = 2^(NL)*(j*2^(Li) + K) + m 7: b = 2^(NL)*(j*2^(Li) + k + 2^(Li-1)) + m 8: f[b] = MontgomeryReduction(f[b]*w[cnt]) 9: tmp = f[a] + f[b] 10: f[b] = f[a] - f[b] 11: f[a] = tmp 12: end for 13: end for 14: cnt = cnt + 1 15: end for 16:end for 17:return f

[0081] Function 3: base_mul Input: matrix A', vector s', modulo w_mul = (w_mul[0],...,w_mul[2^L-1]), number of stages L Output: t'=A's' 1: t'[k][2^N] = {0} 2: for j=0,1,...,k-1 do 3: for u=0,1,...,2^L-1 do 4: c = 2^(NL)*u 5: for i=0,1,...,k-1 do 6: for m = 0, 1, ..., 2^(N - L) - 1 do 7: for n = 1, 2, ..., 2^(N - L) - 1 - m do 8: t'[j][c + m] += A'[i, j][c + n] * s'[i][c + m + 2^(N - L) - n] 9: end for 10: t'[j][c + m] = w_mul[u] * MontgomeryReduction(t'[j][c + m]) 11: for n = 0, 1, ..., m do 12: t'[j][c + m] += A'[i, j][c + n] * s'[i][c + m - n] 13: end for 14: t'[j][c + m] = MontgomeryReduction(t'[j][c + m]) 15: end for 16: end for 17: end for 18: end for 19: return t

[0082] Function 4: L_layer_NTT_inv Input: Polynomial f = (f[0], f[1], ..., f[2^N - 1]), rotation factor w_inv = (w_inv[0], w_inv[1], ..., w_inv[2^L - 2]), number of stages L Output: f 1: cnt = 2^L - 2 2: for i = L - 1, ..., 1, 0 do 3: for j = 2^i - 1, ..., 1, 0 do 4: for k = 2^(L - i - 1), ..., 1, 0 do 5: for m = 0, 1, ..., 2^(N - L) - 1 do 6: a = 2^(N - L) * (j * 2^(L - i) + k) + m 7: b = 2^(N - L) * (j * 2^(L - i) + k + 2^(L - i - 1)) + m 8: tmp = f[a] + f[b] 9: f[b] = MontgomeryReduction((f[a]-f[b])*w_inv[cnt]) 10: f[a] = tmp 11: end for 12: end for 13: cnt = cnt -1 14: end for 15:end for 16:for i=0,1,...,2^N-1 do 17: f[i] = MontgomeryReduction(f[i]*R2invN) 18:end for 19:return f

[0083] The file output unit 405 outputs the file S generated by the polynomial multiplication source file generation unit 404 and the list H of values ​​generated by the constant generation unit 403. List H can be output, for example, by outputting a file S' in which list H is added to file S, or by generating a header file H' in which list H is written.

[0084] Next, the overall operation of this embodiment will be described with reference to the flowchart of Fig. 9. Fig. 9 is a flowchart showing a method for generating polynomial multiplication source code.

[0085] First, the input unit 401 inputs the cycle ratio r, the order k of the matrix, the word size R, and the source file F in which the remainder calculation function MontgomeryReduction is written (S11).

[0086] Next, the number-theoretic transform stage determination unit 402 determines the optimum number of stages L of the number-theoretic transform from the cycle ratio r and the degree k (S12).

[0087] Next, the constant generation unit 403 calculates the twiddle factors w, w_inv and modulo w_mul and the constant R2invN for the word size R and the number of stages L, and generates a list H describing these values ​​(S13).

[0088] Next, the polynomial multiplication source file generation unit 404 generates a source file S in which the functions MatrixVectorMul, L_layer_NTT_forward, L_layer_NTT_inv, and base_mul are written (S14).

[0089] Finally, the file output unit 405 outputs the list H and the source file S (S15).

[0090] As described above, the polynomial multiplication algorithm described in the first embodiment can be applied to the generation of source code.

[0091] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Appendix 1] A polynomial multiplication device that multiplies a vector by a square matrix having elements of a polynomial that is an element of a polynomial ring, an NTT structure determination unit that calculates an optimal number of stages of number theoretic transformation in response to an input of a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the polynomial multiplication device, and the degrees of the square matrix and the vector; an NTT multiplication unit that performs polynomial multiplication of the square matrix and the vector using a number theoretic transformation that uses the optimal number of stages of number theoretic transformation; A polynomial multiplication device comprising: [Appendix 2] The cycle ratio is r and the degree is k, and the polynomial ring R[X] / (X n -1), when m=log2(n), the optimal number of stages L of the number theoretic transformation is calculated by the above-mentioned formula (1). [Appendix 3] 3. The polynomial multiplication device according to claim 1, wherein the polynomial multiplication of the square matrix and the vector is used for lattice cryptography using a polynomial ring. [Appendix 4] 4. The polynomial multiplication device according to claim 3, which is incorporated into a key generation device for lattice cryptography using the polynomial ring. [Appendix 5] 4. The polynomial multiplication device according to claim 3, incorporated into an encryption device in a lattice cryptography using the polynomial ring. [Appendix 6] A polynomial multiplication method for multiplying a vector by a square matrix having elements of a polynomial that is an element of a polynomial ring, using a computer, comprising the steps of: Calculating an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the computer, and the degrees of the square matrix and the vector; A polynomial multiplication method that performs polynomial multiplication of the square matrix and the vector using a number theoretic transformation using the optimal number of stages of number theoretic transformation. [Appendix 7] A polynomial multiplication program that causes a computer to multiply a vector by a square matrix having elements that are polynomials that are elements of a polynomial ring, comprising: a process for calculating an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the computer, and the degrees of the square matrix and the vector; performing a polynomial multiplication of the square matrix and the vector using a number theoretic transform with the optimal number of stages of the number theoretic transform; Polynomial multiplication program including. [Appendix 8] an input unit for inputting a file in which a source code of the remainder calculation function is written, a cycle ratio between the number of cycles per one execution of the remainder calculation function and the number of cycles per one multiplication, and the order of the square matrix; a number theoretic transform stage number determination unit that calculates an optimal number of stages of number theoretic transform based on the cycle ratio and the degree; an output constant generation unit that generates and lists twiddle factors, modulo factors, and normalization factors for the number theoretic transform and the inverse number theoretic transform of the optimum number of stages; a polynomial multiplication source file generation unit that generates a file in which a function for calculating the product of the degree square matrix and the vector is implemented in the same program as the source file; a file output unit that outputs the file and the list; A polynomial multiplication source code generation device comprising: [Appendix 9] Input the file in which the source code of the remainder calculation function is written, the cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the order of the square matrix. calculating an optimal number of stages of number theoretic transformation from the cycle ratio and the degree; Generate and list the twiddle factors, modulo and normalization factors of the number theoretic transform and the inverse number theoretic transform of the optimal number of stages; A file is generated in which a function for calculating the product of the square matrix of the degree and the vector is implemented in the same program as the source file; A polynomial multiplication source code generation method that outputs the file and the list. [Appendix 10] Input the file in which the source code of the remainder calculation function is written, the cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the order of the square matrix. calculating an optimal number of stages of number theoretic transformation from the cycle ratio and the degree; Generate and list the twiddle factors, modulo and normalization factors of the number theoretic transform and the inverse number theoretic transform of the optimal number of stages; A file is generated in which a function for calculating the product of the square matrix of the degree and the vector is implemented in the same program as the source file; outputting the file and the list; A program that generates source code for polynomial multiplication to allow a computer to execute the process.

[0092] The disclosures of the above-cited non-patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, elements of each embodiment or example, and elements of each drawing) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges set forth herein, any numerical value or subrange within that range should be construed as specifically set forth, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application. [Explanation of symbols]

[0093] 100 Polynomial Multiplication Device 110 NTT Structure Determination Department 120 NTT multiplication unit 121 First L-stage number-theoretic transformation 122 Second L-stage number-theoretic transformation 123 Multiplication section 124 L-stage reciprocal number theoretic transform unit 200 Key generator 210 Random matrix generator 220 Private key generation section 230 Scaling section 300 Encryption device 310 Random Number Generation Unit 320 Scaling section 330 Conversion Unit 400 Polynomial multiplication source code generator 401 Input section 402 Number Theoretic Transformation Stage Determination Unit 403 Constant generator 404 Polynomial multiplication source file generator 405 File Output Section

Claims

1. A polynomial multiplication device that multiplies a vector by a square matrix having elements that are polynomials that are elements of a polynomial ring, comprising: an NTT structure determination unit that calculates an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the polynomial multiplication device, and the degrees of the square matrix and the vector; an NTT multiplication unit that performs polynomial multiplication of the square matrix and the vector using a number theoretic transformation that uses the optimal number of stages of number theoretic transformation; A polynomial multiplication device comprising:

2. The cycle ratio is r and the degree is k, and the polynomial ring R[X] / (X ｎ -1), m = log ２ 2. The polynomial multiplication device according to claim 1, wherein when (n), the optimum number of stages L of the number theoretic transformation is calculated by the following formula: [Equation 1]

3. 3. The polynomial multiplication device according to claim 1, wherein the polynomial multiplication of the square matrix and the vector is used in a lattice cryptography using a polynomial ring.

4. The polynomial multiplication device according to claim 3 , which is incorporated into a key generation device in a lattice cryptography using the polynomial ring.

5. 4. The polynomial multiplication device according to claim 3, which is incorporated into an encryption device in a lattice cryptography using the polynomial ring.

6. A polynomial multiplication method for multiplying a vector by a square matrix having elements of a polynomial that is an element of a polynomial ring, using a computer, comprising the steps of: Calculating an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the computer, and the degrees of the square matrix and the vector; A polynomial multiplication method that performs polynomial multiplication of the square matrix and the vector using a number theoretic transformation using the optimal number of stages of number theoretic transformation.

7. A polynomial multiplication program that causes a computer to multiply a vector by a square matrix having elements that are polynomials that are elements of a polynomial ring, comprising: a process for calculating an optimal number of stages of number theoretic transformation for inputting a cycle ratio between the number of cycles per one remainder calculation function and the number of cycles per one multiplication in the computer, and the degrees of the square matrix and the vector; performing a polynomial multiplication of the square matrix and the vector using a number theoretic transform with the optimal number of stages of the number theoretic transform; Polynomial multiplication program including.

8. an input unit for inputting a file in which a source code of the remainder calculation function is written, a cycle ratio between the number of cycles per one execution of the remainder calculation function and the number of cycles per one multiplication, and the order of the square matrix; a number theoretic transform stage number determination unit that calculates an optimal number of stages of number theoretic transform based on the cycle ratio and the degree; an output constant generation unit that generates and lists twiddle factors, modulo factors, and normalization factors for the number theoretic transform and the inverse number theoretic transform of the optimum number of stages; a polynomial multiplication source file generation unit that generates a file in which a function for calculating the product of the degree square matrix and the vector is implemented in the same program as the source file; a file output unit that outputs the file and the list; A polynomial multiplication source code generation device comprising:

9. Input the file in which the source code of the remainder calculation function is written, the cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the order of the square matrix. calculating an optimal number of stages of number theoretic transformation from the cycle ratio and the degree; Generate and list the twiddle factors, modulo and normalization factors of the number theoretic transform and the inverse number theoretic transform of the optimal number of stages; A file is generated in which a function for calculating the product of the square matrix of the degree and the vector is implemented in the same program as the source file; A polynomial multiplication source code generation method that outputs the file and the list.

10. Input the file in which the source code of the remainder calculation function is written, the cycle ratio between the number of cycles per remainder calculation function and the number of cycles per multiplication, and the order of the square matrix. calculating an optimal number of stages of number theoretic transformation from the cycle ratio and the degree; Generate and list the twiddle factors, modulo and normalization factors of the number theoretic transform and the inverse number theoretic transform of the optimal number of stages; A file is generated in which a function for calculating the product of the square matrix of the degree and the vector is implemented in the same program as the source file; outputting the file and the list; A program that generates source code for polynomial multiplication to allow a computer to execute the process.

Images