Computation device, computation method, and program

Abstract

The purpose of the present disclosure is to improve the performance of an entire round computation (low delay, low power consumption, etc. in processing) in loop architecture implementation of an optical circuit. The present disclosure provides a computation device that performs computation of data in loop architecture implementation of an optical circuit, said computation device comprising a composite conversion unit that converts optical signal data of one-hot representation, which is a result of computation using a non-linear function, to electric signal data of bit representation, and stores, in a storage unit, the data after conversion.

Description

Arithmetic device, arithmetic method, and program

[0001] The present disclosure relates to computing with optical circuits.

[0002] In electrical circuits, arithmetic processing is implemented as a combinational circuit. This applies not only to electrical signal circuits but also to optical signal circuits. However, when performing calculations that repeatedly apply combinational circuits, such as the Advanced Encryption Standard (AES) or block ciphers, attenuation and scattering within the optical waveguide can occur as the optical signal passes through the waveguide, resulting in insufficient light and making the output calculation result unrecognizable. In such cases, photoelectric conversion, which converts the optical signal into an electrical signal (or vice versa), must be performed during the calculation to amplify the optical signal and perform the next round of calculation or obtain the correct calculation result in the final round (Non-Patent Document 1). In this case, a special conversion method, such as that disclosed in Non-Patent Document 2, must be used for the photoelectric conversion.

[0003] Here, referring to Fig. 11, a description will be given of a conventional arithmetic device 101 according to Non-Patent Document 1, which utilizes Non-Patent Document 2. Fig. 11 is a configuration diagram of a conventional arithmetic device. Note that "64" in Fig. 11 indicates the number of bits of output data.

[0004] The conventional calculation device 101 has, in processing order, an exclusive OR calculation unit 110 with a key, a nonlinear function calculation unit 130, a linear function calculation unit 170, an OE (Optical signal / Electrical signal) conversion unit 240, a register 250, and an EO (Electrical signal / Optical signal) conversion unit 260.

[0005] The exclusive OR operation unit 110 with the key, the nonlinear function operation unit 130, and the linear function operation unit 170 perform operations using AddRoundKey, which is an exclusive OR function, sBoxLayer (S-box), which is a nonlinear function, and pLayer, which is a linear function, respectively. All of these operations can be performed using optical signals expressed in bits.

[0006] Furthermore, round operations for block ciphers such as AES and PRESENT (described later) generally consist of three types of functions: exclusive OR with a key, a nonlinear function, and a linear function. Therefore, optical-to-electrical conversion is performed after the linear function operation. Therefore, the OE converter 240 converts the data into an electrical signal represented as bits and stores it in the register 250. The EO converter 260 then reads the data stored in the register 250 in accordance with the timing of a clock signal, converts it into an optical signal represented as bits, and uses the intermediate value as the input value for the next round, thereby realizing repeated operations in an optical circuit.

[0007] When implementing repetitive calculations using optical circuits, a combinational circuit for one round is implemented as a loop, just like an electrical circuit. As shown in the prior art, the output of one round must be optical-to-electrical (OE) conversion (EO conversion) because attenuation of the optical signal makes it impossible to perform the calculation correctly.

[0008] Furthermore, as of 2023, registers capable of storing optical signals with bit lengths such as 8 bits and 16 bits have not yet been realized, so it is necessary to convert the output of one round of calculation into an electrical signal and store the intermediate value in an electrical circuit. Due to these constraints, as shown in Fig. 11, the calculation device 101 needs to convert the optical signal into an electrical signal after one round of calculation (or before the round calculation), store the data in the register 250, and then convert the electrical signal back into an optical signal.

[0009] Junko Takahashi, Koji Senda, Kimihiro Yamakoshi, Shota Kita, Akihiko Shinya, NTT Technical Journal, November 2021, pp. 59-63 Kengo Nozaki, Shinji Matsuo, Takuro Fujii, Koji Takeda, Akihiko Shinya, Eiichi Kuramochi, and Masaya Notomi, ``Femto-farad optoelectronic integration demonstrating energy-saving signal conversion and nonlinear functions", Nature Photonics, vol. 13, pp. 454-459 (2019)

[0010] However, in the conventional technology, there is a problem that the performance of the entire round operation (reduction of processing delay, reduction of power consumption, etc.) does not improve due to the overhead caused by the photoelectric conversion process.

[0011] The present invention has been made in view of the above points, and has as its object to improve the overall performance of round operations when an optical circuit is implemented in a loop architecture.

[0012] In order to solve the above problem, the invention of claim 1 is an arithmetic device that performs data calculations in a loop architecture implementation of an optical circuit, and has a composite conversion unit that converts optical signal data in one-hot representation, which is the result of calculations using a nonlinear function, into electrical signal data in bit representation, and stores the converted data in a memory unit.

[0013] As described above, according to the present invention, when an optical circuit is implemented in a loop architecture, the overall performance of the calculation can be improved.

[0014] FIG. 1 is a configuration diagram of a calculation device according to an embodiment. FIG. 1 is a diagram showing the configuration of an exclusive OR calculation unit with a key when dual rail logic is used. FIG. 2 is a conceptual diagram showing processing example 1 of the exclusive OR calculation unit with a key. FIG. 3 is a conceptual diagram showing processing example 2 of the exclusive OR calculation unit with a key. FIG. 4 is a diagram showing detailed configurations of a coding conversion unit and a nonlinear function calculation unit. FIG. 5 is a diagram showing processing example 1 of the coding conversion unit 20 and the nonlinear function calculation unit 30. FIG. 6 is a diagram showing processing example 2 of the coding conversion unit 20 and the nonlinear function calculation unit 30. FIG. 7 is a diagram showing a detailed configuration of a composite conversion unit 40. FIG. 8 is a diagram showing a detailed configuration of a linear function calculation unit. FIG. 9 is a flowchart showing processing or operation of a calculation device according to an embodiment. FIG. 10 is a configuration diagram of a conventional calculation device.

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0016] [Outline of the arithmetic device] First, an outline of the arithmetic device 1 will be described with reference to Fig. 1. Fig. 1 is a configuration diagram of the arithmetic device of this embodiment.

[0017] 1 is composed of one or more computers. When the computing device 1 is composed of multiple computers, it may be referred to as a "computing device" or a "computing system."

[0018] When implementing an encryption method using an optical circuit in the arithmetic unit 1, constraints such as "implementation using a loop architecture," "changing the data encoding representation depending on the content of the arithmetic function," and "storing the register as an electrical signal" are imposed. To reduce overhead such as delay, data encoding and conversion to an electrical signal are simultaneously performed. The arithmetic unit 1 converts the optical signal into an electrical signal by positioning the register 50 midway through one round of the encryption calculation, and then encodes and stores the electrical signal in the register 50. The encoding method may also use conversion from a bit representation in an electrical circuit to a one-hot representation. One-hot representation is a calculation technique in which, among the possible values ​​during the calculation process, the value with the largest optical amplitude is determined to be the correct value. Since one-hot representation essentially enables calculations using only optical wiring (optical waveguides), and optical waveguides do not have the concept of wiring resistance, calculations with lower delay and power consumption than electrical circuits are possible.

[0019] The arithmetic device 1 has a register 50 placed before a linear function operation in a common key cryptosystem, and a composite conversion unit 40 performs photoelectric conversion and encoding simultaneously.

[0020] PRESENT (Reference 1) consists of an operation unit that performs linear function operations (an exclusive OR operation unit with a key (AddRoundKey) and wiring swapping (pLayer)), and a nonlinear function operation unit (sBoxLayer) that performs nonlinear function operations.

[0021] (Reference 1) A. Bogdanov, LR Knudsen, G. Leander, C. Paar, A. Poschmann, MJB Robshaw, Y. Seurin and C. Vikkelsoe, PRESENT: An Ultra-Lightweight Block Cipher, Cryptographic Hardware and Embedded Systems - CHES 2007, LNSC, vol. 4727, pp. 450-466. Because this calculation is performed repeatedly depending on the key length, a loop architecture implementation is used in hardware implementations, as shown in Figure 1. Note that this implementation method is not limited to PRESENT, and can also be applied to other block ciphers and ciphers that use a loop architecture implementation.

[0022] [Configuration of the Arithmetic Device] As shown in FIG. 1, the arithmetic device 1 includes, in processing order, an exclusive OR operation unit 10 with a key, an encoding conversion unit 20 that performs address conversion, a nonlinear function operation unit 30, a composite conversion unit 40 that performs bit conversion, an EO (Electrical signal / Optical signal) conversion unit 60, and a linear function operation unit 70. These are realized by an optical circuit such as an optical accelerator. The arithmetic device 1 also includes a register 50 that is realized by a RAM 103 (described later) or the like. Note that "64" and "128" in FIG. 1 indicate the number of bits of output data, and "256" indicates the number of wirings for output data.

[0023] <Key Exclusive OR Calculation Unit 10> The key exclusive OR calculation unit 10 performs an exclusive OR calculation between a round key generated from a secret key and plaintext data. In this embodiment, a dual rail logic system is used. That is, since it is composed of a non-inverted signal and an inverted signal, 128 bits of wiring (data length 64 bits × 2) is required. The key exclusive OR calculation unit 10 can perform calculations using a Mach-Zehnder interferometer switch (MZI). While FIG. 1 illustrates 128 bits of wiring, if the same circuit is used with four wavelength multiplexing, for example, the number of wirings can be reduced to 32 bits.

[0024] Here, the exclusive OR operation unit 10 with the key will be described in detail with reference to FIGS.

[0025] (Detailed configuration of the key and exclusive OR calculation unit 10) Fig. 2 is a diagram showing the configuration of the key and exclusive OR calculation unit when dual rail logic is used. The key and exclusive OR calculation unit 10 has an MZI 11 and phase conversion units 12a and 12b. Fig. 2 shows a 4-bit exclusive OR (XOR). Since PRESENT's AddRoundKey is an exclusive OR (XOR) calculation of a total of 64 bits, 64 units of the configuration shown in Fig. 2 may be used, or in the case of 16-wavelength multiplexing, for example, four units of the key and exclusive OR calculation unit 10 may be used for calculation.

[0026] In Figure 2, y = (x XOR k) is calculated (y, x, and k are 1 bit). MZI 11 is a switch that switches the path of an optical signal depending on whether or not voltage or current is applied. When no voltage is applied (the control signal (electrical) is 0), the optical path crosses and is output. For example, light input from the upper left side of MZI 11 is output from the path on the lower right side. When voltage is applied (the control signal (electrical) is 1), the optical path travels straight. In this case, when k is 1 (i.e., the control signal is 0), the phase difference is shifted by π / 2 (or -π / 2) compared to the input light when the light crosses. Therefore, phase converters 12a and 12b installed before the output rotate the light by -π / 2 (π / 2) to align the phase difference with the input light.

[0027] Here, data (plain text or intermediate value) is set as input to the calculation device 1, and a round key (a key used for each round of PRESENT) is set as a control signal. The MZI 11 encodes the input optical bit signal to "1" when the amplitude value of the light wave is large, and encodes the input optical bit signal to "0" when no light wave is detected. If the switching speed of the MZI 11 is high, low-latency calculations are possible.

[0028] Next, two processing examples will be described below.

[0029] (Processing Example 1) Fig. 3 is a conceptual diagram showing processing example 1 of the exclusive OR operation unit with the key. As shown in Fig. 3, for example, when the key value k is 1 ("0" by negation) and the data value x of the input optical bit is "1", the control signal is 0, which is the complement of 1, so the light input from the lower left side is output from the path on the upper right side, and the complement of y is 1. In other words, y is 0, and (1 XOR 1) = 0 is established.

[0030] (Processing Example 2) Fig. 4 is a conceptual diagram showing processing example 2 of the exclusive OR operation unit with the key. As shown in Fig. 4, when the key value k is 0 ("1" by negation) and the data value x of the input optical bit is "1", the control signal becomes 1, the complement of 0, so the light input from the lower left side travels straight and is output from the path on the lower right side, and y becomes 1. In other words, (1 XOR 0) = 1 is established.

[0031] <Encoding conversion unit 20> The encoding conversion unit 20 converts a bit representation (optical signal) according to a dual rail logic method into a one-hot representation (optical signal). Note that a detailed configuration of the encoding conversion unit 20 will be described later together with a detailed configuration of the nonlinear function operation unit 30.

[0032] <Nonlinear Function Calculation Unit 30> The nonlinear function calculation unit 30 calculates a nonlinear function using sBoxLayer. The nonlinear function calculation unit 30 rearranges the wiring by table conversion using sBoxLayer. The nonlinear function calculation unit 30 inputs a one-hot representation (optical signal) and outputs the one-hot representation (optical signal) as is.

[0033] (Detailed Configuration of the Coding Conversion Unit 20 and the Nonlinear Function Calculation Unit 30) Here, we will explain the detailed configuration of the coding conversion unit 20 and the nonlinear function calculation unit 30. Note that here, we will show an example in which the configurations of the coding conversion unit 20 and the nonlinear function calculation unit 30 shown in Fig. 1 have been made more efficient.

[0034] The PRESENT sBoxLayer is composed of 16 4-bit SBoxLayers. Here, we describe how to calculate a 4-bit SBoxLayer. As shown in Figure 1, SBoxLayer is more efficient when calculated using one-hot algorithms, so conversion from bit representation to one-hot representation (or vice versa) is performed before and after the SBoxLayer. Figure 5 shows how a 4-bit SBoxLayer is calculated by converting from bit representation to one-hot representation. In this implementation, conversion using the SBoxLayer table substitution table (sBoxLayer table, page 4 of Reference 1) is built into the wiring.

[0035] 5, the arithmetic unit 1 of this embodiment converts a 4-bit value from bit representation to one-hot representation using three stages of Y branch groups 21, 22, and 23 and two stages of Ψ gate groups (used as "AND gates" shown in Reference 2) 25 and 26. The Y branch group 23 is also called a Y gate group.

[0036] (Reference 2) S. Kita, K. Nozaki, K. Takata, A. Shinya, and M. Notomi, "Ultrashort low-loss Ψ gates for linear optical logic on Si photonics platform," Communications Physics, vol. 3. Springer Nature, pp. 1-8, 2020. Specifically, the encoding conversion unit 20 has a Y branch group 21, a Ψ gate group 25, a Y branch group 22, a Y branch group 23, and a Ψ gate group 26, in this order.

[0037] The Ψ gate groups 25 and 26 are optical elements with a total of three inputs: two input lights and a bias light, which is a control light, and one output. Here, the Ψ gate groups 25 and 26 adjust the bias light so that a logical product (AND) operation is performed (FIG. 5 shows only the two input lights, and the bias light is omitted). The second-stage Y branch group 22 and the third-stage Y branch group 23 convert this into a 4-bit value. Here, the Y branch groups 21, 22, and 23 are elements that split the light. In FIG. 5, the least significant bit of the 4 bits is represented as x3.

[0038] (Processing Example 1) FIG. 6 is a diagram showing processing example 1 of the encoding conversion unit 20 and the nonlinear function operation unit 30. As shown in FIG.

[0039] As an example of processing example 1, as shown in FIG. 6, when the input value to the encoding conversion unit 20 is 0xF in hexadecimal ((x0, x1, x2, x3) = (1, 1, 1, 1)), the output of the second-stage Ψ gate group 26 has the strongest light intensity at the third position from the top (corresponding to 0x2). Therefore, when the input value to the encoding conversion unit 20 and the nonlinear function operation unit 30 is 0xF, the output is 0x2. In FIG. 6, the light path (the path with the strongest light intensity) is indicated by a thick line.

[0040] (Processing Example 2) FIG. 7 is a diagram showing processing example 2 of the encoding conversion unit 20 and the nonlinear function operation unit 30. In FIG.

[0041] As a processing example 2, for example, as shown in FIG. 7 , an example is shown in which the input value to the encoding conversion unit 20 is 0x7 ((x0, x1, x2, x3) = (0, 1, 1, 1)). In this case, the output of the second-stage Ψ gate group 26 has the strongest light intensity at the 15th position from the top (corresponding to 0xD). Therefore, when the input value to the encoding conversion unit 20 and the nonlinear function operation unit 30 is 0x7, the output is 0xD.

[0042] As described above, the calculation device 1 can perform calculations using only optical signals, without using electrical signals, using the Y branch groups 21, 22, and 23 and the Ψ gate groups 25 and 26, thereby achieving lower delay and power consumption than conventional technology.

[0043] Although FIG. 5 shows one circuit for nonlinear function calculation, a total of 16 circuits are actually implemented. Therefore, 16 of these circuits may be used in parallel, or wavelength multiplexing may be used to reduce the number of circuits for calculation. In this embodiment, branching is performed using a Y-branch group (a two-branch optical element), but branching may also be achieved using a four-branch or eight-branch optical element. Furthermore, while this embodiment uses a Y-branch group and a Ψ-gate group, conversion between bit representation and one-hot representation may also be performed using an MZI.

[0044] In this embodiment, for example, as shown in FIG. 5, a method is used in which a Y branch and a Ψ gate are used to convert only optical signals into one-hot representations. At this time, since the input bit length of the SBoxLayer constituting the nonlinear function operation is converted into a 4-bit one-hot representation, the number of wirings per SBoxLayer is 16 (=2 4 In this embodiment, in order to configure an optical circuit for 16 SBoxLayers, the input of the composite conversion unit 40 is made up of 256 wires. However, for example, if the same circuit is used using four-wavelength multiplexing, the number of wires may be reduced to 64.

[0045] <Composite Conversion Unit 40> Because the output from the nonlinear function calculation unit 30 is in one-hot representation (e.g., 16 different wirings), the composite conversion unit 40 performs a composite conversion that performs both OE conversion and encoding conversion, converting the one-hot optical signal into a bit-represented electrical signal, and temporarily storing the result in the register 50. Note that when the calculation device 1 performs 31-round loop processing, since processing on each wiring does not end simultaneously for each round, the register 50 temporarily stores the processing results for each wiring until processing on all wirings is completed for each round, and then compiles the processing results for input to the next round. Here, the composite conversion unit 40 will be described in detail using Figure 8.

[0046] (Detailed Configuration of Composite Conversion Unit 40) Fig. 8 is a diagram showing the detailed configuration of the composite conversion unit 40. As shown in Fig. 8, the composite conversion unit 40 has an OE (Optical signal / Electrical signal) conversion unit 41 and a plurality of OR circuits 42a to 42d. Note that Fig. 8 shows conversion to 4 bits, and the composite conversion unit 40 is implemented for 64 bits by having 16 of the configurations shown in Fig. 8, but due to drawing constraints, Fig. 8 shows only one configuration for conversion to 4 bits.

[0047] The OE converter 41 receives an optical signal and then converts it into an electrical signal, using a conversion method such as that described in Non-Patent Document 1. In FIG. 8, a typical decoding circuit (a conversion circuit based on a truth table) is used to convert from one-hot representation (16 ways) to a 4-bit representation. As shown in FIG. 8, the conversion from one-hot representation to bit representation is possible with a single OR operation with eight inputs and one output in each of the OR circuits 42a to 42d, allowing conversion to bit representation with only a delay of one stage. The composite converter 40 stores the electrical signal converted to this bit representation in a register 50.

[0048] In FIG. 8, for example, when the one-hot representation is 0xB, after OE conversion, x0, x1, and x3 correspond to "1", so the 4-bit value becomes (y0, y1, y2, y3) = (1, 0, 1, 1) and is stored in the register 50.

[0049] 8, the composite conversion unit 40 converts the optical signal into an electrical signal, converts the one-hot representation into a bit representation, and then stores the value in the register 50. However, this is not limited to this. For example, by arranging the register 50 immediately after the processing of the OE conversion unit 41, the electrical signal converted from the optical signal can be stored in the register 50, and the one-hot representation electrical signal read from the register 50 can then be input to each of the OR circuits 42a to 42d, thereby converting the one-hot representation into a bit representation.

[0050] <EO Conversion Unit 60> After the 16 outputs shown in FIG. 8 have been stored in the register 50, the EO conversion unit 60 reads out all 16 bit-represented electrical signals from the register 50 at the timing of the next clock. The EO conversion unit 60 then converts the read bit-represented electrical signals into bit-represented optical signals. At this time, the EO conversion unit 60 performs the EO conversion using, for example, the method described in Non-Patent Document 2. When performing OE conversion, the EO conversion unit 60 generates an inverted signal and inputs two input signals, a non-inverted signal and an inverted signal, to the linear function calculation unit 70.

[0051] <Linear Function Calculation Unit 70> The linear function calculation unit 70 calculates a linear function using pLayer. The linear function calculation unit 70 inputs a 128-bit bit representation (optical signal) and outputs the same 128-bit bit representation (optical signal). The intermediate value, which is the output value of the linear function calculation unit 70, is used as the input value for the next round. Note that although the circuit of the calculation device 1 remains fixed in the next round, switching by the MZI 11 is required for each round because the round key changes for each round.

[0052] The number of rounds in PRESENT is 31, and the output of the linear function operation unit 70 after the 31st round is output as the ciphertext.

[0053] (Detailed configuration of the linear function calculation unit 70) Fig. 9 is a diagram showing the detailed configuration of the linear function calculation unit. Since pLayer is wired by bits, in this embodiment, calculations are performed using two wires, one for a non-inverted signal and one for an inverted signal, using a dual rail logic method. Therefore, the number of wires required is 128 (= 64 bits x 2). At this time, the light waves are divided into two pairs (x i , bar x i ) (i=0,...,63) passes through one of them. This implementation can be realized using only wiring, and light can travel through the waveguide at the speed of light, making it possible to achieve low latency. In addition, optical wiring does not have the concept of resistance, making it possible to achieve low power consumption. In this implementation, the calculations for 128 wirings can be implemented using one wavelength, or multiple wavelengths can be used.

[0054] Furthermore, since the linear function calculation unit 70 performs calculations using the dual rail logic method, it can output the result directly to the exclusive OR calculation unit 10 with the key, allowing the next round to be calculated quickly.

[0055] [Processing or Operation of the Embodiment] Next, processing or operation of the present embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing processing or operation of the arithmetic device according to the embodiment.

[0056] S11: The exclusive OR operation unit 10 with the key inputs the round key generated from the private key and plaintext data (bit representation (optical signal)), and employs a dual rail logic method to perform an exclusive OR function operation with the key, thereby outputting a bit representation (optical signal) using the dual rail logic method.

[0057] S12: The encoding conversion unit 20 converts the bit representation (optical signal) according to the dual rail logic method into one-hot representation (optical signal).

[0058] S13: The nonlinear function calculation unit 30 receives the one-hot representation (optical signal) as input, performs calculation of the nonlinear function, and outputs the one-hot representation (optical signal).

[0059] S14: The composite conversion unit 40 converts the one-hot representation (optical signal) into a bit representation (electrical signal) and temporarily stores it in the register 50. In this case, unlike the prior art, the composite conversion unit 40 performs OE conversion and encoding conversion as a set.

[0060] S15: The EO conversion unit 60 reads out all 16 types of bit representations (electrical signals) stored in the register 50, and converts the bit representations (electrical signals) into bit representations (optical signals).

[0061] S16: The linear function operation unit 70 receives data in bit representation (optical signal) and performs a linear function operation on this data, thereby outputting a bit representation (optical signal).

[0062] S17: The linear function operation unit 70 determines whether the above processes S11 to S16 have been completed for 31 rounds through a determination process. If not completed (NO), the process returns to process S11, and the intermediate value, which is the output value of the linear function operation unit 70, is used as the input value for the next round. On the other hand, if completed (YES), the linear function operation unit 70 outputs the ciphertext from the operation device 1. The above determination process may be performed by the linear function operation unit 70, or may be performed by a determination unit that the operation device 1 has.

[0063] [Major Effects of the Embodiments] As described above, according to the embodiments, the register 50 is positioned midway through the cryptographic calculation, and the composite conversion unit 40 simultaneously performs conversion between one-hot representation and bit representation and OE conversion, thereby making it possible to improve the efficiency of the entire cryptographic calculation. That is, when an optical circuit is implemented using a loop architecture, the overall performance of the calculation can be improved (low processing delay, low power consumption, etc.) by devising the placement of the register 50 and simultaneously performing the data representation encoding method and the photoelectric conversion. Specifically, when implementing a block cipher in a circuit, a loop architecture is an essential implementation method for reducing the circuit area, and therefore the present embodiment can be used generally when implementing a block cipher in an optical circuit.

[0064] In addition, the arithmetic device 1 of this embodiment simultaneously performs conversion from one-hot representation to bit representation and OE conversion, and stores the electrical signal in the register 50, but depending on the configuration of the cryptographic function, conversion from bit representation to one-hot representation and OE conversion may also be implemented simultaneously.

[0065] [Supplementary Information] (1) The key schedule part of PRESENT (see Appendix II (page 16) of Reference 1) is calculated from the exclusive OR of a 4-bit SBoxLayer, a fixed value (round_counter), and the key value. Therefore, when implementing the key schedule part using optical calculations, calculations are possible using sBoxLayer and AddRoundKey. The exclusive OR of the round_counter and the key can be calculated by setting the round_counter to an electrical signal and using MZI in the same way as AddRoundKey.

[0066] (2) In the above embodiment, a cryptographic circuit is assumed, but the present invention is not limited to a cryptographic circuit as long as the circuit combines linear and nonlinear operations. For example, the present invention can be applied to a deep learning circuit configured with a linear first-order function and a nonlinear activation function.

[0067] (3) The arithmetic device 1 can be realized by a computer and a program, but this program can also be recorded on a (non-transitory) recording medium or provided via a communication network such as the Internet.

[0068] REFERENCE SIGNS LIST 1 Calculation device 10 Key exclusive OR calculation unit 20 Encoding conversion unit (an example of an encoding conversion unit for address conversion) 30 Nonlinear function calculation unit 40 Compound conversion unit 41 OE conversion unit 42a, 42b, 42c, 42d OR circuit 50 Register (an example of a storage unit) 60 EO conversion unit (an example of an opto-electrical conversion unit) 70 Linear function calculation unit

Claims

1. A calculation device that performs data calculations in a loop architecture implementation of an optical circuit, the calculation device having a composite conversion unit that converts one-hot optical signal data, which is the result of calculations using a nonlinear function, into bit-represented electrical signal data and stores the converted data in a memory unit.

2. An arithmetic device according to claim 1, comprising: an opto-electrical conversion unit that reads out data stored in the memory unit and performs opto-electrical conversion from an electrical signal represented by bits to an optical signal represented by bits; and a linear function calculation unit that performs a linear function calculation on the opto-electrically converted data and outputs the data as an input value for the next round in the implementation of the loop architecture or outputs the data as a ciphertext from the arithmetic device.

3. An arithmetic device according to claim 1 or 2, comprising: an exclusive-OR operation unit with a key that outputs optical signal data in bit representation by performing an exclusive-OR function operation between a round key generated from a secret key and plaintext data; a coding conversion unit that converts the optical signal data in bit representation output from the exclusive-OR operation unit with the key into optical signal data in one-hot representation; and a nonlinear function operation unit that performs the nonlinear function operation on the optical signal data in one-hot representation output from the coding conversion unit, and outputs the optical signal data in one-hot representation to the composite conversion unit.

4. A calculation method executed by a calculation device that performs data calculations in a loop architecture implementation of an optical circuit, wherein the calculation device performs a composite conversion process to convert one-hot optical signal data, which is the result of a calculation using a nonlinear function, into bit-represented electrical signal data and store the converted data in a memory unit.

5. A program for causing a computer to execute the method according to claim 4.