Apparatus and Method for ML-KEM Post-Quantum Cryptography Operation Based on a Reconfigurable NTT Module

Abstract

The present invention relates to an apparatus and method for ML-KEM quantum-resistant cryptography based on a high-performance reconfigurable NTT module. The apparatus according to the present invention includes a main controller that controls operation according to security strength, a hash module, a sampler, and an integrated NTT and compression module. In particular, the computation element (PE) within the integrated module is designed based on a Vedic multiplier and is reconfigured to share hardware resources not only during NTT and INTT operations but also during compression operations in the encapsulation process. This provides the effect of increasing computation speed while minimizing the total hardware area and flexibly responding to various security strengths.

Description

Technology Field

[0001] The present invention relates to Post-Quantum Cryptography (PQC) technology, and specifically to a computing device and method for implementing the Module-Lattice Key Encapsulation Mechanism (ML-KEM) algorithm, which is a standard of the National Institute of Standards and Technology (NIST), in hardware. In particular, the present invention relates to a reconfigurable quantum-resistant cryptography hardware architecture that shares hardware resources between a Number Theoretic Transform (NTT) computing module and a ciphertext compression (Compress) computing module, and utilizes a Vedic multiplier to increase computing speed while minimizing hardware area. Background Technology

[0002] Due to the rapid advancement of information and communication technologies such as the Internet of Things (IoT), artificial intelligence (AI), and cloud computing, the importance of data security in the digital environment is being emphasized more than ever. Public-key cryptographic systems, such as RSA (Rivest-Shamir-Adleman) and Elliptic Curve Cryptography (ECC), which form the basis of current internet security, rely on the computational complexity of large number prime factorization or discrete logarithm problems.

[0003] However, as quantum computer technology advances rapidly, the threat that existing public-key cryptographic systems can be decrypted in polynomial time using Shor's Algorithm and the like is becoming a reality. To address this, the National Institute of Standards and Technology (NIST) has been conducting a standardization project for quantum-resistant cryptography (PQC), a new cryptographic standard that is secure against quantum computer attacks, and has selected ML-KEM (formerly CRYSTALS-Kyber), a lattice-based cryptography, as the standard in the field of key encapsulation mechanisms (KEM).

[0004] The ML-KEM algorithm is based on the Module Learning With Errors (Module-LWE) problem and performs matrix operations on a polynomial ring. The part with the highest computational complexity in this process is polynomial multiplication, and the Number Theoretic Transform (NTT) is generally used to process this at high speed. In addition, ML-KEM frequently uses SHA3 (Secure Hash Algorithm 3) based hash functions and XOF (Extendable Output Function) during the key generation, encapsulation, and decapsulation processes, and performs compression and decompression operations to reduce the size of the ciphertext according to the security strength.

[0005] Conventional ML-KEM hardware implementation technologies have tended to design NTT and compression processors as separate hardware modules to improve performance. However, this approach increases the overall hardware area and has limitations in application, particularly in resource-constrained embedded environments or IoT devices. Additionally, there were issues such as the need to modify the hardware structure whenever parameters changed according to the security levels (Levels 1, 3, and 5) defined by NIST, or the inability to efficiently support all security levels on a single hardware due to a lack of flexibility.

[0006] Therefore, a new hardware architecture is required that supports all NIST security levels within limited hardware resources while efficiently sharing common computational resources between NTT operations and compression operations to reduce area and maximize processing speed. The problem to be solved

[0007] The present invention was devised to solve the problems of the prior art as described above. The objective of the present invention is to provide a reconfigurable quantum-resistant cryptographic computing device and method that minimizes hardware area and maximizes resource efficiency by designing the hardware implementation of the ML-KEM algorithm, which is the NIST quantum-resistant cryptographic standard, to share common computing resources between the Number Theoretic Transform (NTT) operation and the Compress operation of the encapsulation process.

[0008] In addition, another objective of the present invention is to provide a flexible hardware architecture that increases the processing speed of polynomial multiplication and modular reduction operations by applying a pipeline structure based on a Vedic multiplier, and can variably support NIST security levels 1, 3, and 5 on a single hardware platform by only changing control signals. means of solving the problem

[0009] A hardware computing device for performing an ML-KEM (Module-Lattice Key Encapsulation Mechanism) quantum-resistant cryptographic algorithm according to one aspect of the present invention for achieving the above-mentioned purpose is configured to include a plurality of internal submodules.

[0010] The plurality of internal sub-modules above include a hash module that generates pseudo-random numbers by performing a SHA3 (Secure Hash Algorithm 3)-based hash operation on a public seed or input data, a sampler module that generates a polynomial matrix, secret vector, and error vector required for the ML-KEM algorithm using the pseudo-random numbers, a point-wise multiplier that performs polynomial multiplication in the NTT (Number Theoretic Transform) domain, and an integrated NTT and compression module that performs NTT operations, INTT (Inverse NTT) operations, and ciphertext compression operations of the encapsulation process in an integrated manner. In particular, the integrated NTT and compression module comprises a plurality of processing elements within a pipeline structure, wherein among the plurality of processing elements, the 0th processing element (PE0) comprises a 12x12 Vedic multiplier and the 1st processing element (PE1) comprises a 12x23 Vedic multiplier, and the Vedic multiplier is characterized by having its resources shared to perform modular multiplication for NTT or INTT operations according to a control signal, or to perform Multiplication by Reciprocal operations for compression operations after reconfiguration.

[0012] Specifically, the Vedic multiplier included in the first processing element (PE1) is composed of a 12x23 Vedic multiplier that processes 12-bit input and 23-bit input, and this 12x23 Vedic multiplier is used to compress and encode the size of the ciphertext by performing inverse multiplication on the input data when performing the compression operation.

[0014] In addition, the integrated NTT and compression module has a 7-stage pipeline structure, and in addition to the first processing element (PE1), a zero processing element (PE0) including a 12x12 Vedic multiplier that processes a 12-bit input is placed in the pipeline structure, so that PE0 and PE1 work together to perform NTT and INTT operations. The Vedic multiplier used at this time applies a divide-and-conquer method that divides the input bit sequence into smaller bit units and processes them in parallel to generate partial products, and uses a method to derive the operation result by summing them.

[0016] The above hash module is designed based on the sponge structure of the Keccak algorithm and is integratedly implemented to selectively perform SHA3-256, SHA3-512, SHAKE128, and SHAKE256 functions within a single module according to a control signal. The above sampler module receives the pseudo-random number as input and a public matrix following a uniform distribution It includes a rejection sampler that generates and performs validation, and a binomial sampler that receives the pseudo-random number and generates a secret vector and an error vector following a Centered Binomial Distribution (CBD).

[0018] The above point-wise multiplier is composed of a plurality of Vedic-based modular multipliers, modular adders, and FIFO (First-In, First-Out) memory, and performs an accumulation operation variably according to the amount of computation determined by the selected security level. In addition, the device of the present invention further includes a main controller that reconfigures the plurality of internal submodules and generates control signals according to the security level selected among NIST security grades 1, 3, and 5, and the main controller controls the number of computation repetitions and data processing paths of the integrated NTT and compression module according to a parameter (k) corresponding to the selected security level. Furthermore, when performing a decapsulation operation, a verification logic is executed to compare the generated re-ciphertext (c') with the input original ciphertext (c) after performing a re-encapsulation process using the decrypted message, and return an implicit rejection value if the two values ​​do not match.

[0020] A method for performing ML-KEM quantum-resistant cryptography operations using a hardware system comprising a main controller and an integrated NTT / compression module according to another aspect of the present invention comprises the steps of: selecting one security strength among a plurality of security strengths and setting an internal sub-module according to the selected security strength; and performing key generation, encapsulation, or decapsulation operations using the internal sub-module. The step of performing the operations includes performing NTT or INTT operations using a Vedic multiplier placed in a pipeline structure within the integrated NTT / compression module, and, if ciphertext compression is required during the encapsulation operation, reconfiguring the same Vedic multiplier to use for multiplication by reciprocal operations for compression operations, and including a resource sharing step.

[0022] The above resource sharing step is performed on a 12x23 Vedic multiplier placed at the 6th or 7th stage of the pipeline structure, and controls the data path of the 12x23 Vedic multiplier according to an external control signal to perform an inverse multiplication operation for compression instead of an NTT / INTT operation. Finally, the step of performing the decapsulation operation includes the steps of decompressing and NTT-converting the input ciphertext through the integrated NTT / compression module, restoring the message by performing operations with the secret key, and performing a recapsulation process using the restored message and the public key to prepare for a chosen ciphertext attack (CCA) and verifying integrity by comparing the result with the input ciphertext. Effects of the invention

[0023] According to the present invention, the Number Theoretic Transform (NTT) computation module and the Compress computation module of the encapsulation process are designed to share the Vedic multiplier, which is a core computational resource, thereby drastically reducing hardware area and maximizing resource efficiency through the reconfiguration of existing resources without adding a separate dedicated hardware block. This contributes significantly to minimizing hardware overhead in resource-constrained IoT device or embedded system environments.

[0024] In addition, by optimizing and arranging multiple processing elements based on Vedic multipliers applying the Divide-and-Conquer method into a 7-stage pipeline structure, it is possible to minimize latency during NTT / INTT operations and significantly improve the clock frequency and the data throughput of the entire system.

[0025] In addition, the present invention can variably support security levels 1, 3, and 5 defined by NIST simply by changing the control signal of the main controller within a single hardware platform, thereby providing versatility that can flexibly respond to various application fields with different security requirements.

[0026] Furthermore, by embedding a SHA3-based hash module and a sampler module, the entire operation of ML-KEM can be performed independently, and strong security against Chosen Ciphertext Attacks (CCA) can be secured by processing the re-encryption and comparison verification logic in hardware during the decapsulation process. Brief explanation of the drawing

[0027] FIG. 1 is a block diagram schematically showing the overall hardware architecture of a system for a high-performance reconfigurable NTT-based ML-KEM quantum-resistant cryptography standard according to one embodiment of the present invention. Figure 2 shows the detailed structure of Processing Element 0 (PE0) included inside the integrated NTT and compression module illustrated in Figure 1. Figure 3 shows the detailed structure of Processing Element 1 (PE1) included inside the integrated NTT and compression module shown in Figure 1. Figure 4 shows the detailed structure of a Vedic multiplier applied inside the PE shown in Figures 2 and 3. Figure 5 shows a detailed data flow diagram of a Compress operation using PE1 illustrated in Figure 3. Figure 6 shows the internal structure of a hash module that performs the Keccak operation of the ML-KEM algorithm. The hash module supports various modes such as SHA3-256, SHA3-512, SHAKE-128, and SHAKE-256. Figure 7 shows the structure of the Rejection Sampler module. Figure 8 shows the structure of the Binomial Sampler module for generating secret vectors and error vectors. Figure 9 is a diagram showing the timing and data flow of the key generation operation performed in the proposed system. Figure 10 is a diagram showing the timing and data flow of encapsulation operations performed in the proposed system. Figure 11 is a diagram showing the timing and data flow of the decapsulation operation performed in the proposed system. Specific details for implementing the invention

[0028] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims.

[0029] The terms used herein are for describing the embodiments and are not intended to limit the invention. In this specification, the singular form includes the plural form unless specifically stated otherwise in the text. As used herein, "comprises" and / or "comprising" do not exclude the presence or addition of one or more other components, steps, actions, and / or elements to the mentioned components, steps, actions, and / or elements.

[0030] Unless otherwise defined, all terms used in this specification (including technical and scientific terms) may be used in a meaning commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise.

[0031] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings. Identical components in the drawings are denoted by the same reference numerals, and redundant descriptions of identical components are omitted.

[0032] The present invention relates to an apparatus and method for efficiently implementing a lattice-based cryptographic algorithm, ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), in hardware to respond to the situation where existing public-key cryptographic systems (RSA, ECC, etc.) are threatened by the emergence of quantum computers. In particular, the present invention proposes a reconfigurable hardware architecture that complies with the FIPS 203 standard of the National Institute of Standards and Technology (NIST) and can flexibly respond to environments ranging from limited resource environments, such as IoT devices, to high-performance server environments.

[0033] FIG. 1 is a block diagram schematically showing the overall hardware architecture of a system for a high-performance reconfigurable NTT-based ML-KEM quantum-resistant cryptography standard according to one embodiment of the present invention.

[0034] Referring to FIG. 1, the ML-KEM computing device according to the present invention is largely composed of a main controller that communicates with the outside and controls the overall operation, a hash module that performs hash operations essential in the encryption and decryption process, an integrated NTT and compression module for processing polynomial multiplication at high speed, and a sampler responsible for generating random numbers and sampling.

[0035] The hardware system for the high-performance reconstructible NTT-based ML-KEM quantum-resistant cryptography standard proposed in this invention utilizes a lattice-based KEM key encapsulation method. Lattice-based cryptographic algorithms are NP-hard algorithms, which are difficult to find a specific vector within a lattice existing in an n-dimensional space, and employ the Ring-LWE method. LWE (Learning With Error) is a public-key cryptographic technique based on the SVP problem in polynomials; it involves injecting small errors during the encryption process. This results in different encrypted values ​​even when the same key is used repeatedly, thereby providing the ciphertext with higher security compared to conventional methods. However, Ring-LWE has high time complexity because it uses large keys and performs convolution operations, which are polynomial multiplications.

[0036] (Equation 1-1)

[0037] Ring LWE is a polynomial ring for encryption. Performed within. The denominator f(x) is f(x)=x N It takes the form of +1, where q is the modulus value representing the maximum value of the polynomial coefficients, as in (Equation 1-1). The parameter N value is N=2 m It can be expressed in the form of a power of 2 as shown. Ring-LWE, a public-key encryption method, consists of a public key used for encryption and a private key used for decryption. Ring-LWE is as shown in (Equation 1-2) and generates a public key and a private key using a public matrix a, which is a random value, a secret key s, and an error value e with a Gaussian distribution.

[0038] (Equation 1-2)

[0039] Encryption is performed as shown in (Equation 1-3) using the generated public and private keys, and the message m is encrypted using the public key (a, b) to output the ciphertext (c1, c2). At this time, since additional error values ​​e1, e2, and e3 are used during the encryption process, different values ​​are obtained even when using the same public key (a, b), thus providing high security.

[0040] (Equation 1-3)

[0041] Decryption outputs message m from the ciphertext (c1, c2) using a secret key s associated with the public key (a, b) used for encryption. Decryption is as shown in (Equation 1-4).

[0042] (Equation 1-4)

[0043] As such, the core operations of Ring-LWE are polynomial multiplication and addition, and since polynomial multiplication performs convolution operations, it has high time complexity. To address this, the NTT algorithm, which applies the Fast Fourier Transform (FFT) to a finite field ring for convolution operations, is used. Module-LWE, a type of Ring-LWE, is based on Ring-LWE and uses a polynomial ring It is defined as such. Therefore, to increase the security level, the length N of the polynomial or the magnitude of the modulus q must be transformed. Such changes to the polynomial ring necessitate modifications to the configuration of internal arithmetic units, such as the NTT algorithm for performing polynomial multiplication or modular reduction for modulus operations. Consequently, Ring-LWE lacks flexibility regarding security levels because it requires changes to the internal computational structure according to the security level. To address this, Module-LWE is configured as shown in (Equation 1-5).

[0044] (Equation 1-5)

[0045] Unlike Ring-LWE, Module-LWE consists of k vectors for the public key (a, b), secret key s, and error value e. This approach allows for various security levels to be met using the same internal operator by adjusting the parameter k, which represents the number of polynomials and the size of matrices and vectors, without changing the polynomial ring.

[0046] The main controller manages the finite state machine (FSM) throughout the system and receives commands and reports status through an external interface (e.g., AXI4-Lite). The main controller sets parameters (matrix size k, etc.) according to the selected security strength among the multiple security strengths supported by ML-KEM (e.g., ML-KEM-512, ML-KEM-768, ML-KEM-1024), and controls the operation sequence and data flow of internal submodules according to each operation mode of key generation, encapsulation, and decapsulation.

[0047] The above hash module performs Keccak-based operations such as SHA3-256, SHA3-512, SHAKE-128, and SHAKE-256 required by the ML-KEM algorithm. This is used for generating random number seeds, message hashing, and generating shared secret keys.

[0048] The hash module according to an embodiment of the present invention is implemented based on the SHA-3 hash algorithm standardized by the National Institute of Standards and Technology (NIST), and includes a shared secret key K and a matrix It is used to generate pseudo-random numbers required for the ML-KEM algorithm, such as polynomial vectors s, e1, r, and error polynomial e2.

[0049] The above sampler receives a pseudo-random number stream generated from a hash module and plays the role of generating coefficients of a polynomial or an error vector. In this embodiment, the sampler includes a rejection sampler for a uniform distribution and a binomial sampler for a centered binomial distribution.

[0050] The binomial sampler module according to an embodiment of the present invention is used to sample the error vector and error polynomials s, e, and r required for the ML-KEM algorithm using pseudo-random numbers in a sampling method utilizing the principle of binomial distribution.

[0051] The rejection sampler module according to an embodiment of the present invention uses pseudo-random numbers in a sampling method utilizing the uniform distribution principle to provide the public matrix required for the ML-KEM algorithm. It is used to make.

[0052] A key encoder according to an embodiment of the present invention is used to convert a key polynomial vector, which is the result of an operation, into a byte string.

[0053] A key decoder according to an embodiment of the present invention is used to convert an input key byte string into a polynomial vector.

[0054] A message encoder according to an embodiment of the present invention is used to convert a restored plaintext polynomial vector, which is an intermediate result of a decapsulation operation, into a byte string.

[0055] A message decoder according to an embodiment of the present invention is used to convert an input plaintext byte string into a polynomial vector.

[0056] The decompress according to an embodiment of the present invention is used to convert an input ciphertext byte string into a polynomial vector.

[0057] A point-wise multiplier according to an embodiment of the present invention performs bow-tie multiplication and addition operations variably according to the security level using a plurality of multipliers, adders, and FIFOs.

[0058] The aforementioned Integrated NTT & Compress Module is a core component of the present invention and processes polynomial multiplication, which accounts for the main computational load of grid-based cryptography, at high speed through Number Theoretic Transform (NTT). Unlike conventional technologies that implemented hardware for NTT, Inverse NTT, and Compress operations individually or simply arranged them in parallel, the present invention features an integrated structure that allows these operations to share hardware resources (particularly multipliers). This enables high computational performance to be maintained while minimizing hardware area.

[0059] As such, the architecture illustrated in FIG. 1 can flexibly reconfigure its internal computational structure according to security strength, thereby providing a quantum-resistant cryptographic solution optimized for various application environments.

[0060] Next, the detailed structure of the integrated NTT and compression module responsible for the core computational load of the present invention, its internal components, and the hash and sampler modules will be described.

[0062] Figure 2 shows the detailed structure of Processing Element 0 (PE0) included inside the integrated NTT and compression module illustrated in Figure 1.

[0063] Referring to FIG. 2, the integrated NTT and compression module has a multi-stage pipeline structure, wherein PE0 can be configured to handle the initial stages (e.g., Stages 1–5) of the NTT / INTT operation. PE0 includes a 12x12 bit Vedic multiplier to perform the modular multiplication required for Cooley-Tukey or Gentleman-Sand butterfly operations. This has a bit width optimized for operating on input data at modular q (q=3329) and ensures high processing speed.

[0065] Figure 3 shows the detailed structure of Processing Element 1 (PE1) included inside the integrated NTT and compression module shown in Figure 1.

[0066] Referring to FIG. 3, PE1 is designed to process the later stages (e.g., Stages 6 and 7) of the NTT / INTT operation while simultaneously performing internal reciprocal multiplication operations for the compression operation of the encryption process. To this end, unlike PE0, PE1 is configured based on a 12x23 bit Vedic multiplier. Of particular note is that the present invention shares the multiplier resources of PE1, taking into account that the reciprocal multiplication process required for compression operations and the modular multiplication process required for NTT operations require similar multiplication operations. That is, PE1 is reconfigured to function as an NTT / INTT module and a compression module during encapsulation operations, and as an NTT operation unit during key generation or decapsulation operations, thereby maximizing overall area efficiency without adding separate dedicated compression hardware.

[0068] Figure 4 shows the detailed structure of a Vedic multiplier applied inside the PE shown in Figures 2 and 3.

[0069] Referring to FIG. 4, the Vedic multiplier applied in this embodiment uses the Urdhva-Tiryakbhyam algorithm based on ancient Indian mathematical principles. This method divides input bits into smaller bit units to generate partial products in parallel and sums them. This structure can increase the operating frequency by reducing critical path delay compared to a general multiplier and has the effect of reducing power consumption.

[0070] The Divide-and-Conquer principle is applied to the multiplication of two 12-bit inputs (a and b) by dividing them into small 6x6-bit units for parallel processing. The 12x12 multiplication result is derived by simultaneously generating and summing a total of four partial products p0~p3 through combinations of the upper 6 bits [11:6] and lower 6 bits [5:0] of inputs a and b, and each 6x6-bit multiplication is efficiently performed through the Vmul module.

[0072] Figure 5 shows a detailed data flow diagram of a Compress operation using PE1 illustrated in Figure 3.

[0073] Referring to Fig. 5, quantization processing is performed on the input values ​​through Precompute and Round operations, and a final compressed output (Comp out) is generated by selectively using a Vec_encoder or a Poly_encoder according to the control signal after the 12x23 Vedic multiplier of PE1 and Concatenation & Right Shift.

[0074] Compression is a process that reduces the amount of transmitted data by decreasing the number of bits in polynomial coefficients. The number of bits (d) to be compressed varies depending on the security strength, and Precompute and Round flexibly perform operations by applying the corresponding parameters according to control signals. The input coefficients are output in a compressed form after undergoing appropriate scaling and rounding processing through the shared multiplier resources within PE1.

[0076] Figure 6 shows the internal structure of a hash module that performs the Keccak operation of the ML-KEM algorithm. The hash module supports various modes such as SHA3-256, SHA3-512, SHAKE-128, and SHAKE-256.

[0077] Internally, it includes a Padder that divides input data into blocks and performs padding, and an F-Permutation block that executes the Keccak-f

[1600] function. Based on a sponge structure, this module generates variable-length random sequences or hash values ​​through absorbing and squeezing stages.

[0079] Figure 7 shows the structure of the Rejection Sampler module.

[0080] Referring to FIG. 7, the Rejection Sampler receives a random number stream generated from the Hash module (SHAKE-128) as input and a public matrix It generates coefficients. A uniform distribution is guaranteed by performing logic that checks whether the generated coefficients fall within the range of the finite field q (3329); if valid, they are stored in a buffer, and otherwise, they are discarded (Rejected). This module receives the result of the hash module's SHAKE-128 as input, validates the matrix to ensure that only coefficients satisfying specific conditions required by the ML-KEM standard are output. It generates. In particular, it is configured to process a 48-bit input random number stream simultaneously through four parallelized paths.

[0082] Figure 8 shows the structure of the Binomial Sampler module for generating secret vectors and error vectors.

[0083] Referring to Fig. 8, the Binomial Sampler generates random numbers following a Central Binomial Distribution (CBD). The random number sequence is converted into CBD random numbers through a Hamming Weight calculation process and a Bit Count process, and is implemented by dividing the input random number bit sequence into fixed chunks and calculating the difference in Hamming Weights for each chunk. This is used to generate the secret key and error term that determine the security of the ML-KEM algorithm.

[0084] Figure 9 is a diagram showing the timing and data flow of the key generation operation performed in the proposed system.

[0085] Referring to Fig. 9, the key generation process begins with the generation of random numbers and proceeds to the generation of a public key and a secret key. First, the hash module receives a seed and a security strength (k) as input and generates a random value, which is an extended seed. A portion of the generated seed is passed to a rejection sampler, and the public matrix It is used to generate, and some of the others are passed to the Binomial Sampler to generate the secret vector s and the error vector e.

[0086] According to one embodiment of the present invention, first, a seed and a security strength (k) are input, and a random value is obtained through a hash module. Generates. Then, using the rejection sampler and binomial sampler, the public matrix It generates the secret vector value s and the error vector value e. Since matrices must be generated based on the security level, the binomial sampler performs iterative operations based on the value of N for the security level, and the rejection sampler generates a matrix corresponding to the square of the security level k. It generates . The s and e generated from the binomial sampler undergo NTT operations in the integrated NTT and compression module to obtain values ​​in the NTT domain, and It is converted and stored in RAM for use in subsequent computation processes. Generated by the rejection sampler After storing it in RAM, later , It is used together with. Afterwards and After first performing Point-wise Multiplication (PWM) on it Performs polynomial addition with. Then, in the adder module The result of the calculation and what was stored in RAM Used to construct encapsulated key values ​​using values Calculate the value. Then, a random value and It generates an encapsulation key by encoding the value. , , A decapsulation key is generated by encoding , H(ek), and z. Subsequently, the encapsulation key is used in the encapsulation process, and the decapsulation key is used in the decapsulation process.

[0087] In this case, the rejection sampler is a matrix corresponding to the square of the security level k. It generates, and the binomial sampler performs iterative operations based on the value of N for the security level. The generated s and e are input into the integrated NTT and compression module, where they are converted from time domain to NTT domain values ​​through NTT operations and stored in RAM. The matrix generated by the rejection sampler. It is also stored in RAM.

[0088] Subsequently, the PEs within the integrated NTT module first perform an operation to convert vectors s and e into the NTT domain, and the converted vector and matrix Perform point-wise multiplication (PWM) on and the vector on the result Performs polynomial addition of . The result calculated by the adder module and the value stored in RAM An encapsulation key is constructed using [this], and the final encapsulation key and decapsulation key are generated by encoding it through a hash module.

[0090] Figure 10 is a diagram showing the timing and data flow of encapsulation operations performed in the proposed system.

[0091] Referring to Fig. 10, the encapsulation process is a step of generating a shared secret key and ciphertext using the other party's public key. First, the input encapsulation key is hashed by the SHA3-256 operation of the hash module, and hashed together with a random message value m by the SHA3-512 operation to obtain a secret shared key K and a random value r.

[0092] According to one embodiment of the present invention, H(ek) is obtained by hashing the first input encapsulation key using the SHA3-256 operation of the hash module. Subsequently, a random message value m and H(ek) are hashed using the SHA3-512 operation of the hash module to obtain a secret shared key K and a random value r. From the encapsulation key After extracting, hash using the SHAKE-128 operation of the hash module, and utilize a rejection sampler ...is obtained. Additionally, the random value r is hashed using the SHAKE-256 operation of the hash module, and then sampled with a binomial sampler to obtain the values ​​y, e1, and e2. The values ​​thus obtained , y, e1, and e2 are stored in RAM and used for Ring-LWE calculations. Among these, the generated y value undergoes NTT calculations in the integrated NTT and compression module to obtain a value in the NTT Domain. It is used to obtain the value of, and that value and the one stored in RAM Polynomial multiplication is performed by conducting Point-wise Multiplication (PWM) operations using [this]. The result of the PWM operation is converted back to the original domain through INTT operations in the integrated NTT and compression module. Subsequently, the converted value and the error value e1 are added to obtain the vector result. Obtains. At this time, obtained The value is compressed in the integrated NTT and compression module to form the value of ciphertext c1. To obtain the remaining c2 value constituting the ciphertext, the input plaintext undergoes decoding and decompression processes in the decoder module. Obtain the value. Subsequently, the polynomial vector value of the encapsulation key initially input and After performing polynomial multiplication by conducting PWM (Point-wise Multiplication) operations on the values, the result is converted back to the original domain value through INTT operations. Subsequently, the converted value and e2, The values ​​are added to obtain the value v. The obtained value v undergoes a compression process and is used in c2. Then, c1 and c2 are combined to output the ciphertext value c.

[0094] Figure 11 is a diagram showing the timing and data flow of the decapsulation operation performed in the proposed system.

[0095] Referring to Fig. 11, the decapsulation process is a step of recovering the shared secret key using the received ciphertext c and one's own private key. The input ciphertext c is separated into c1 and c2 and undergoes a decompression process in the Decompress module, and the decapsulation key is also decoded to obtain a polynomial vector.

[0096] According to one embodiment of the present invention, the input ciphertext c is separated into c1 and c2, and the values ​​u' and v' are obtained through a decompression process in a decompress module, and the input decapsulation key is decoded to obtain a polynomial vector Obtains the u' value, performs the NTT operation, and then Point-wise Multiplication (PWM) operations are performed with the value. The generated value is subjected to polynomial subtraction with the value v' to obtain the value w. The value w obtained in this way undergoes a message encoding process in the integrated message encoder module to obtain a random message value m'.

[0097] The random message m' obtained in this way and h derived from the decapsulation key are hashed using the SHA3-512 operation of the hash module to obtain the secret key K' and the random value r'. To protect against chosen ciphertext attacks, the encapsulation process is performed using the derived random value r' and the encapsulation key obtained from the decapsulation key as input. The encryption process is performed in the same manner as described in the encapsulation section, and it is determined whether the ciphertext c' output from the encapsulation process is identical to the input c value. If the values ​​are identical, the derived K' is returned as the result; if they are not identical, the implicit rejection result is Returns.

[0098] In summary, the decompressed value is subjected to NTT operations, followed by pointwise multiplication (PWM) operations with the private key, and the message value is restored through polynomial subtraction. The restored value undergoes a message encoding process to obtain a random message m'. Using the obtained m' and the hash value of the decapsulation key, the secret key K' and the random value r' are derived.

[0099] To protect against Chosen Ciphertext Attacks (CCA), this system performs a re-encapsulation process using the recovered message and key. This re-encryption process is executed in the same manner as the previously described encapsulation operation, and the resulting generated ciphertext c' is compared with the originally received ciphertext c. If the two values ​​are identical, a valid secret key K' is returned; otherwise, security is ensured by returning a random value for implicit rejection.

[0100] As described above, the ML-KEM computing device according to the present invention efficiently performs all processes of key generation, encapsulation, and decapsulation through the reconfiguration of modules on a single integrated hardware platform, and in particular, significantly improves performance relative to area through the sharing of computing resources using PE1.

[0101] Although the embodiments have been described above with reference to limited examples and drawings, those skilled in the art can make various modifications and variations from the description above. For example, suitable results can be achieved even if the described techniques are performed in a different order than described, and / or the components of the described system, structure, device, circuit, etc. are combined or assembled in a form different from described, or replaced or substituted by other components or equivalents.

[0102] Therefore, other implementations, other embodiments, and equivalents to the claims also fall within the scope of the claims set forth below.

Claims

Claim 1 A hardware computing device for executing a quantum-resistant ML-KEM (Module-Lattice Key Encapsulation Mechanism) cryptographic algorithm comprises a plurality of internal sub-modules, wherein the plurality of internal sub-modules include: a hash module that generates pseudo-random numbers by performing a SHA3 (Secure Hash Algorithm 3)-based hash operation on a public seed or input data; a sampler module that generates a polynomial matrix, a secret vector, and an error vector required for the ML-KEM algorithm using the pseudo-random numbers; and a point-wise multiplier that performs polynomial multiplication in the NTT (Number Theoretic Transform) domain. The integrated NTT and compression module includes an integrated NTT operation, an INTT (Inverse NTT) operation, and a ciphertext compression operation of the encapsulation process, wherein the integrated NTT and compression module includes a plurality of processing elements within a pipeline structure, wherein among the plurality of processing elements, the 0th processing element (PE0) includes a 12x12 Vedic multiplier and the 1st processing element (PE1) includes a 12x23 Vedic multiplier, and the 12x12 Vedic multiplier and the 12x23 Vedic multiplier share resources to perform modular multiplication for NTT or INTT operations according to a control signal, or are reconfigured to perform inverse multiplication operations for the compression operation, and the integrated NTT and compression module has a 7-stage pipeline structure, and in addition to the 1st processing element (PE1), the pipeline structure includes a 12x12 Vedic multiplier that processes a 12-bit input An ML-KEM quantum-resistant cryptographic computing device characterized by having a zero processing element (PE0) included therein arranged so that the PE0 and PE1 perform NTT and INTT operations in conjunction. Claim 2 An ML-KEM quantum-resistant cryptographic operation device according to claim 1, wherein the Vedic multiplier included in the first processing element (PE1) is composed of a 12x23 Vedic multiplier that processes 12-bit input and 23-bit input, and the 12x23 Vedic multiplier is used to compress and encode the size of the ciphertext by performing an inverse multiplication operation on the input data when performing the compression operation. Claim 3 delete Claim 4 A hardware computing device for executing a quantum-resistant ML-KEM (Module-Lattice Key Encapsulation Mechanism) cryptographic algorithm comprises a plurality of internal sub-modules, wherein the plurality of internal sub-modules include: a hash module that generates pseudo-random numbers by performing a SHA3 (Secure Hash Algorithm 3)-based hash operation on a public seed or input data; a sampler module that generates a polynomial matrix, a secret vector, and an error vector required for the ML-KEM algorithm using the pseudo-random numbers; and a point-wise multiplier that performs polynomial multiplication in the NTT (Number Theoretic Transform) domain. The integrated NTT and compression module comprises: an integrated NTT and compression module that performs NTT operations, INTT (Inverse NTT) operations, and ciphertext compression operations of the encapsulation process; wherein the integrated NTT and compression module comprises a plurality of processing elements within a pipeline structure, wherein among the plurality of processing elements, the 0th processing element (PE0) includes a 12x12 Vedic multiplier and the 1st processing element (PE1) includes a 12x23 Vedic multiplier; wherein the 12x12 Vedic multiplier and the 12x23 Vedic multiplier share resources to perform modular multiplication for NTT or INTT operations according to a control signal, or are reconfigured to perform inverse multiplication operations for the compression operation; and the 12x12 Vedic multiplier and the 12x23 Vedic multiplier apply a Divide-and-Conquer method that divides the input bit sequence into smaller bit units and processes them in parallel to perform partial multiplication. ML-KEM quantum-resistant cryptographic computing device characterized by generating a Product and summing them to derive a computation result. Claim 5 ML-KEM quantum-resistant cryptographic computing device according to claim 1, wherein the hash module is designed based on the sponge structure of the Keccak algorithm and is integratedly implemented to selectively perform SHA3-256, SHA3-512, SHAKE128, and SHAKE256 functions according to a control signal within a single module. Claim 6 In claim 1, the sampler module receives the pseudo-random number as input and has a public matrix following a uniform distribution. An ML-KEM quantum-resistant cryptographic computing device characterized by comprising: a rejection sampler that generates and performs validation; and a binomial sampler that receives the pseudo-random number as input and generates a secret vector and an error vector following a centered binomial distribution. Claim 7 ML-KEM quantum-resistant cryptographic computing device according to claim 1, wherein the point-wise multiplier is composed of a plurality of Vedic-based modular multipliers, modular adders, and FIFO (First-In, First-Out) memory, and is characterized by variably performing an accumulation operation according to the amount of computation determined by a selected security level. Claim 8 The ML-KEM quantum-resistant cryptographic computing device according to claim 1 further comprises a main controller that reconfigures the plurality of internal submodules and generates control signals according to a security strength selected among NIST security levels 1, 3, and 5, wherein the main controller controls the number of computation iterations and data processing paths of the integrated NTT and compression module according to a parameter (k) corresponding to the selected security strength. Claim 9 ML-KEM quantum-resistant cryptographic computing device according to claim 1, characterized in that, when performing a decapsulation operation, the device performs a verification logic that compares the generated re-ciphertext (c') with the input original ciphertext (c) after performing a re-encapsulation process using the decrypted message, and returns an implicit rejection value if the two values ​​do not match. Claim 10 A method for performing ML-KEM quantum-resistant cryptography operations using a hardware system comprising a main controller and an integrated NTT / compression module, comprising: a step of selecting one security strength among a plurality of security strengths and configuring an internal sub-module according to the selected security strength; and a step of performing key generation, encapsulation, or decapsulation operations using the internal sub-module; wherein the step of performing the operations comprises: a step of performing NTT (Number Theoretic Transform) or INTT (Inverse NTT) operations using a Vedic multiplier placed in a pipeline structure within the integrated NTT / compression module. The ML-KEM quantum-resistant cryptographic operation method includes a resource sharing step in which, if ciphertext compression is required during the encapsulation operation, the same Vedic multiplier is reconfigured and used for an inverse multiplication operation for compression, wherein the resource sharing step is performed on a 12x23 Vedic multiplier placed at the 6th or 7th stage of the pipeline structure, and the data path of the 12x23 Vedic multiplier is changed according to an external control signal to perform an inverse multiplication operation for compression instead of a polynomial multiplication operation. Claim 11 delete Claim 12 In claim 10, the step of performing the decapsulation operation comprises: a step of decompressing the input ciphertext and performing NTT conversion through the integrated NTT / compression module; a step of restoring the message by performing operations with the secret key; and a step of performing a recapsulation process using the restored message and the public key to prepare for a chosen ciphertext attack (CCA), and verifying integrity by comparing the result with the input ciphertext.

Images