Coprocessor for implementing lattice-based quantum-resistant cryptographic algorithm, and chip, electronic device, and key generation method

Abstract

The present application relates to a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm, and a chip, an electronic device, and a key generation method. The coprocessor (1) comprises: a processor core (11), the processor core comprising at least two operation cores, and the at least two operation cores being capable of implementing all operations of the lattice-based quantum-resistant cryptographic algorithm; a register (12) configured to store configuration information required to invoke functions in the operation cores; and a memory controller (13) configured to invoke data in a memory on the basis of the configuration information under the control of the at least two operation cores, so as to enable the at least two operation cores to perform operations in parallel with each other.

Description

Coprocessors, chips, electronic devices, and key generation methods for implementing lattice-based quantum-resistant cryptography algorithms.

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on January 6, 2025, application number 202510021411.7, entitled "Coprocessor, chip, electronic device and key generation method for implementing lattice-based quantum-resistant cryptographic algorithms", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of information security technology, and more specifically to a coprocessor, chip, electronic device, and key generation method for implementing a lattice-based quantum-resistant cryptographic algorithm. Background Technology

[0004] The statements herein are provided only as background information in connection with this application and do not necessarily constitute prior art.

[0005] Exemplary lattice-based quantum-resistant cryptographic protocols are implemented using a system architecture that combines hardware and software, which has some problems. Summary of the Invention

[0006] According to various embodiments of this application, a coprocessor, chip, electronic device, and key generation method for implementing lattice-based quantum-resistant cryptography algorithms are provided.

[0007] A coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm, the coprocessor comprising: a processor core, the processor core including at least two computational cores, the at least two computational cores being capable of performing all operations of the lattice-based quantum-resistant cryptographic algorithm; a register for storing configuration information required when functions in the computational cores are called; and a memory controller for, under the control of the at least two computational cores, retrieving data from the memory according to the configuration information, so as to enable the at least two computational cores to perform parallel operations on each other.

[0008] In one embodiment of this application, the processor core includes at least three processing cores, with the same processing core used to implement the same type of operation and different processing cores used to implement different types of operations.

[0009] In one embodiment of this application, the processor core includes three operation cores: a hash operation core, used to implement hash operations and sampling operations in the lattice-based quantum-resistant cryptography algorithm; an arithmetic operation core, used to implement arithmetic operations in the lattice-based quantum-resistant cryptography algorithm; and a format operation core, used to implement format transformation operations in the lattice-based quantum-resistant cryptography algorithm.

[0010] In one embodiment of this application, the hash operation core includes: a hash module for implementing hash operations; a buffer for storing the result data output by the hash module; and a sampling module capable of reading the result data from the buffer for sampling, so as to realize parallel operation between the hash module and the sampling module.

[0011] In one embodiment of this application, the format transformation operations implemented by the format operation core include encoding operations, decoding operations, compression operations, and decompression operations.

[0012] In one embodiment of this application, the memory controller, under the control of the at least two computing cores, calls data from different memories at the same time to enable the at least two computing cores to perform parallel operations on each other.

[0013] In one embodiment of this application, the memory controller is a single-port or dual-port memory controller.

[0014] In one embodiment of this application, the coprocessor can simultaneously implement the key encapsulation algorithm and the digital signature algorithm in the lattice-based quantum-resistant cryptography algorithm.

[0015] According to another aspect of this application, a key generation method is provided, the method being executed by a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm as described in any of the preceding embodiments, the method comprising:

[0016] First step: Generate a byte array based on random number data, and divide the byte array into a first array and a second array, with the second array serving as the first part of the private key;

[0017] The second step: Perform first polynomial vector sampling based on the first array to obtain the first sampling result;

[0018] The third step includes steps A and B performed simultaneously, wherein step A is to perform a number theory transformation on the first sampling result based on preset parameters to obtain a first number theory transformation result, and step B is to perform a second polynomial vector sampling on the first array to obtain a second sampling result;

[0019] The fourth step includes steps C and D performed simultaneously. Step C involves sampling the second array using a first polynomial matrix to obtain a third sampling result. Step D involves performing a number-theoretic transformation on the second sampling result based on the preset parameters to obtain a second number-theoretic transformation result.

[0020] Fifth step: Generate a third polynomial vector based on the third sampling result and the first number theory transformation result;

[0021] The sixth step includes steps E and F, which are performed simultaneously. Step E is to generate a fourth polynomial vector based on the third polynomial vector, and step F is to encode the result of the first number theory transformation to obtain the second part of the private key.

[0022] Step 7: Generate the result to be encoded based on the fourth polynomial vector and the result of the second number theory transformation;

[0023] Step 8: Encode the result to be encoded to obtain the public key.

[0024] In one embodiment of this application, the first step, the second step, step B of the third step, and step C of the fourth step are executed by the hash operation core of the coprocessor; the third step, step D of the fourth step, the fifth step, step E of the sixth step, and the seventh step are executed by the arithmetic operation core of the coprocessor; and the sixth step, step F, and the eighth step are executed by the format operation core of the coprocessor.

[0025] In one embodiment of this application, the random number data and the preset parameters are stored in a first memory; the first array and the second sampling result are stored in a second memory; the second array, the first sampling result, the third sampling result, the third polynomial vector, the fourth polynomial vector, the result to be encoded, and the public key are stored in a third memory; and the first number theory transformation result, the second number theory transformation result, and the second part of the private key are stored in a fourth memory.

[0026] According to another aspect of this application, another key generation method is provided, the method being executed by a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm as described in any of the preceding embodiments, the method comprising:

[0027] Step 1: Obtain first data, which includes first sub-data and second sub-data, with the second sub-data serving as part of the private key;

[0028] Step 2: Perform first polynomial vector sampling based on the first sub-data to obtain the first sampling result;

[0029] Step 3: Perform a number-theory transformation on the first sampling result based on preset parameters to obtain the first number-theory transformation result;

[0030] Step 4: Perform a second polynomial vector sampling based on the first sub-data to obtain the second sampling result;

[0031] Step 5: Perform first polynomial matrix sampling based on the second sub-data to obtain the third sampling result;

[0032] Step 6: Perform a number-theory transformation on the second sampling result based on the preset parameters to obtain the second number-theory transformation result;

[0033] Step 7: Based on the third sampling result and the first number theory transformation result, calculate the third polynomial vector;

[0034] Step 8: Calculate the fourth polynomial vector based on the third polynomial vector;

[0035] Step 9: Encode the result of the first number theory transformation to obtain another part of the private key;

[0036] Step 10: Based on the fourth polynomial vector and the result of the second number theory transformation, calculate the result to be encoded; and

[0037] Step 11: Encode the result to be encoded to obtain the public key.

[0038] In one embodiment of this application, the first data is a byte array generated based on random number data, the first sub-data is a first array, and the second sub-data is a second array.

[0039] In one embodiment of this application, steps 1, 2, 4 and 5 are executed by the hash operation core, steps 3, 6, 7, 8 and 10 are executed by the arithmetic operation core, and steps 9 and 11 are executed by the format operation core.

[0040] In one embodiment of this application, the memory includes a first memory, a second memory, a third memory, and a fourth memory; the random number data and the preset parameters are stored in the first memory; the first array and the second sampling result are stored in the second memory; the second array, the first sampling result, the third sampling result, the third polynomial vector, the fourth polynomial vector, the result to be encoded, and the public key are stored in the third memory; the first number theory transformation result, the second number theory transformation result, and another part of the private key are stored in the fourth memory.

[0041] According to another aspect of this application, a chip is provided, the chip including a memory, a central processing unit and a coprocessor, wherein the coprocessor is the coprocessor for implementing lattice-based quantum-resistant cryptography algorithms as described in any of the foregoing embodiments.

[0042] According to another aspect of this application, an electronic device is provided, the electronic device comprising the above-described chip.

[0043] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features, objects, and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the disclosed drawings without creative effort.

[0045] Figure 1 shows a schematic block diagram of a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application.

[0046] Figure 2 shows an example structure of a processor core in a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application.

[0047] Figure 3 illustrates an example structure of a hash operation core in a processor core of a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application.

[0048] Figure 4 shows another example structure of a hash operation core in a processor core for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application.

[0049] Figure 5 shows a schematic architecture diagram of a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application.

[0050] Figure 6 shows a schematic flowchart of a key generation method according to an embodiment of this application.

[0051] Figure 7 shows a schematic diagram of the execution subject and execution content of different steps in the key generation method according to an embodiment of this application.

[0052] Figure 8 is a flowchart of a key generation method in another embodiment of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] In the exemplary system architecture of the quantum-resistant cryptographic algorithm protocol, although the most time-consuming and complex polynomial and hash operations in the quantum-resistant cryptographic algorithm protocol process are designed in hardware, which initially accelerates the operation of the quantum-resistant cryptographic algorithm process, some other cryptographic operations included in the algorithm process are still time-consuming to implement in software. Therefore, the overall operation performance of the protocol process is still very low.

[0055] Furthermore, the lattice-based quantum-resistant cryptographic algorithm protocol implemented by the above-mentioned system architecture combining software and hardware can only be calculated sequentially according to the algorithm protocol flow during the operation process, thus resulting in very low utilization of system resources and hardware accelerator resources.

[0056] Moreover, due to the low computational performance and resource utilization of the lattice-based quantum-resistant cryptographic algorithm protocol implemented by the system architecture combining hardware and software, the lattice-based quantum-resistant cryptographic algorithm protocol implemented in this way can only be applied to low-end and edge IoT (Internet of Things) devices, which greatly limits its application scope.

[0057] This application proposes an innovative system architecture for implementing lattice-based quantum-resistant cryptographic algorithms.

[0058] Figure 1 shows a schematic block diagram of a coprocessor 1 for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application. As shown in Figure 1, the coprocessor 1 for implementing the lattice-based quantum-resistant cryptographic algorithm includes a processor core 11, a register 12, and a memory controller 13. The processor core 11 includes at least two computational cores capable of performing all operations of the lattice-based quantum-resistant cryptographic algorithm. The register 12 stores configuration information required when functions in the computational cores are called. The memory controller 13, under the control of the at least two computational cores, calls data from external memory of the coprocessor 1 according to the aforementioned configuration information, enabling the at least two computational cores to perform parallel operations. In one embodiment of this application, the memory controller 13 is also used to control data interaction between the coprocessor 1 and the memory.

[0059] In the embodiments of this application, a new system architecture for implementing lattice-based quantum-resistant cryptography algorithms is proposed, namely a coprocessor 1. The processor core 11 included in the coprocessor 1 can implement all operations of the lattice-based quantum-resistant cryptography algorithm. That is, the system architecture can realize the full hardware design of the operation functions (or cryptographic functions) in the lattice-based quantum-resistant cryptography algorithm, eliminating the operation of implementing cryptographic functions in software in the traditional hardware and software combined architecture design. Thus, when the coprocessor 1 executes the lattice-based quantum-resistant cryptography algorithm, the overall computation speed of the algorithm can be greatly improved.

[0060] Furthermore, the processor core 11 contains at least two computational cores, and the memory controller 13 can access data in the memory under the control of the at least two computational cores, enabling the at least two computational cores to perform parallel computations with each other. This allows the coprocessor 1 to execute lattice-based quantum-resistant cryptographic algorithms, and some cryptographic functions in the overall algorithm protocol calculation can be processed in parallel, further improving computational performance while also greatly improving the utilization of system and hardware resources.

[0061] Furthermore, due to the improved computational performance of the algorithm and the increased utilization of system and hardware resources, the lattice-based quantum-resistant cryptographic algorithm implemented by the coprocessor 1 can be applied to mid-to-high-end products with higher computational performance. This breaks the limitation that the lattice-based quantum-resistant cryptographic algorithm implemented by the traditional hardware and software system architecture can only meet the application needs of IoT edge devices with lower computational performance requirements. Therefore, the system architecture of this application has a larger application and market space.

[0062] In embodiments of this application, processor core 11 may further include at least three computational cores. The same computational core is used to perform the same type of operation, while different computational cores are used to perform different types of operations. In this embodiment, the cores are designed according to the operation types in the lattice-based quantum-resistant cryptography algorithm. Each computational core performs the same type of operation, while different computational cores perform different types of operations. This makes it easier to achieve parallel computation of different computational cores under the reasonable partitioning of memory and reasonable scheduling of computational cores by the memory controller 13. In one embodiment of this application, the operation type performed by a computational core may be one of the following three types: hash operation and sampling operation in the lattice-based quantum-resistant cryptography algorithm, arithmetic operation in the lattice-based quantum-resistant cryptography algorithm, and format transformation operation in the lattice-based quantum-resistant cryptography algorithm.

[0063] The following describes an example structure of processor core 11 in a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application, with reference to Figure 2. In the example shown in Figure 2, processor core 11 includes three operation cores: a hash operation core 111, an arithmetic operation core 112, and a format operation core 113. The hash operation core 111 implements hash operations and sampling operations in the lattice-based quantum-resistant cryptographic algorithm, such as hash operations on data within the algorithm protocol and sampling operations on polynomials (e.g., rejection sampling, binary sampling). Since the sampling operation uses the result of the hash operation as input, the hash operation and sampling operation are considered to be of the same type and merged into one operation core. The arithmetic operation core 112 implements arithmetic operations in the lattice-based quantum-resistant cryptographic algorithm, such as multiplication, addition and subtraction operations between polynomials, number-theoretic transform (NTT), INTT, modulo operations, etc. The format operation core 113 implements format transformation operations in the lattice-based quantum-resistant cryptographic algorithm, such as operations that transform the format between polynomial coefficients and arrays, such as encoding operations, decoding operations, compression operations, and decompression operations.

[0064] In the example shown in Figure 2, the processor core includes the three arithmetic cores mentioned above. In other examples, the arithmetic cores can be further divided to create a larger number of arithmetic cores. For example, different arithmetic operations in arithmetic core 112 can be divided into different arithmetic cores, which can operate in parallel, thereby further improving the performance of the algorithm when executing it.

[0065] In embodiments of this application, the hash operation core 111 may further include a hash module, a buffer, and a sampling module. This is described below with reference to FIG3. FIG3 shows an example structure of the hash operation core 111 in a processor core of a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application. As shown in FIG3, the hash operation core 111 includes a hash module 1111, a buffer 1112, and a sampling module 1113. The hash module 1111 is used to implement hash operations. The buffer 1112 is used to store the result data output by the hash module. The sampling module 1113 can read the result data from the buffer 1112 for sampling, thereby enabling parallel operations between the hash module 1111 and the sampling module 1113.

[0066] In this embodiment, by setting a buffer 1112 in the hash operation core 111, the result of each hash operation by the hash module 1111 can be stored in the buffer 1112. The sampling module 1113 can obtain the result data from the buffer 1112 in a timely manner for sampling. At this time, the hash module 1111 can perform other hash operations. Therefore, parallel operation of the hash module 1111 and the sampling module 1113 can be achieved, and real-time sampling by the sampling module 1113 can be realized. Therefore, this implementation method does not need to perform the hash operation first and then the sampling operation as in the traditional method. It not only improves the calculation speed of sampling, but also increases the utilization of hardware resources, thereby further improving the overall computational performance of the lattice-based quantum-resistant cryptographic algorithm, making it applicable to scenarios with higher requirements for encryption and decryption (signature verification) performance.

[0067] Furthermore, the hash operation core 111 may also include a top-level state machine and a filling module, as described below with reference to Figure 4. Figure 4 shows another example structure of the hash operation core 111 in a processor core of a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application. As shown in Figure 4, the hash operation core 111 includes a hash module 1111, a buffer 1112, a sampling module 1113, a top-level state machine 1114, and a filling module 1115.

[0068] The top-level state machine 1114 is responsible for controlling the entire sampling process and transitioning between operational states. The filling module 1115 fills the externally input data, ensuring the filled data block meets the computational requirements of the hash module 1111. The hash module 1111 may include a KECCAK-f (sponge function) kernel, responsible for performing the hash operation and generating pseudo-random data. Specifically, the sponge function kernel may further include an internal state machine, such as a 1600-bit state machine, and a double random number (RND) kernel, where the RND kernel structure improves the efficiency of the hash operation. The buffer 1112 can be a 1344-bit buffer, responsible for storing the data generated by KECCAK-f. The sampling module 1113 is responsible for implementing different types of sampling functions and generating the final output. The specific sampling steps can be as follows:

[0069] Step 1: In the data reading and filling state, the filling module 1115 fills the externally input data and sends the filled data to the 1600-bit state machine in the hash module 1111. Step 2: In the hash calculation stage, the hash module 1111 performs a hash operation on the data in the 1600-bit state machine and sends the calculation result to the 1344-bit buffer 1112. Step 3: In the sampling calculation stage, the sampling module 1113 reads data from the buffer 1112 for sampling and stores the sampling result in the SRAM memory; simultaneously, the hash module 1111 performs a hash calculation to generate the input data required for the next calculation by the sampling module 1113. Step 4: Repeat the operation in Step 3 until sufficient sampling results are generated.

[0070] The example shown in Figure 4 provides a high-performance, high-resource-utilization circuit hardware architecture, enabling faster and more efficient sampling operations. Specifically, it employs hardware auto-fill to replace the software-based input data filling operation in the traditional architecture, improving data filling speed. Furthermore, in the KECCAK-f module, a dual-RND core structure replaces the single-RND core structure in the traditional architecture, reducing the hash operation time for each data block from 24 cycles to 12 cycles. Further, a pipelined architecture design that parallelizes hash and sampling calculations is adopted, improving both overall sampling speed and hardware resource utilization. Taking the sampling of the common parameter matrix A in the Dilithium-II algorithm as an example, sampling it using the traditional architecture requires 3280 clock cycles, while sampling it using the above architecture only requires 1472 clock cycles, resulting in an overall sampling performance improvement of 123%, demonstrating a significant performance enhancement.

[0071] Referring now to Figure 1, in the embodiments of this application, register 12 may include special function registers (SFRs) for function selection, parameter configuration, and operation initiation. These SFRs can access the configuration information required to call functions within the computational core and are also responsible for data interaction between the IP (Intelligent Property) core (i.e., coprocessor 1) and the central processing unit (CPU). The configuration information can be used to select a specific function within the computational core; for example, when the configuration information is a certain value, calling that value represents calling a specific function within the computational core. The memory controller 13 can receive control signals from register 12 and processor core 11 to control data interaction between the IP core and system-level memory (such as static random-access memory, SRAM).

[0072] In embodiments of this application, the external memory of the coprocessor 1 may include multiple memories, such as multiple SRAMs. The memory controller 13, under the control of the processor core 11, can access data in different memories simultaneously, thereby enabling parallel computation by different processing cores. Depending on specific requirements, the memory controller 13 can be a single-port memory controller or a dual-port memory controller.

[0073] The above describes various embodiments of the coprocessor 1 according to the embodiments of this application. The above embodiments can be combined in any way. The following describes a combined embodiment with reference to FIG5.

[0074] Figure 5 shows a schematic architecture diagram of a coprocessor 2 for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application. As shown in Figure 5, the coprocessor 2 may include a special function register (SFR), an algorithm (ALG) core, and an SRAM controller. The ALG core further includes a hash operation core, an arithmetic operation core, and a format operation core. The hash operation core may include a Secure Hash Algorithm 3 (SHA3) module, a 1344-bit buffer, and a sampling module. The SHA3 module includes a KECCAK-f core and a 1600-bit state machine. The sampling module can perform sampling operations such as rejection sampling and binary sampling. Real-time sampling can be achieved through the 1344-bit buffer, as described above. The arithmetic operation core can perform NTT operations, INTT operations, modulo operations, etc. The format operation core can perform encoding operations, decoding operations, compression operations, and decompression operations, etc.

[0075] The system architecture shown in Figure 5 is a novel, high-performance, and resource-efficient lattice-based quantum-resistant cryptographic protocol implementation architecture that integrates all hardware-based computational functions, merges similar operations, and allows parallel computation of different algorithm cores. The lattice-based quantum-resistant cryptographic algorithm implemented by this architecture prioritizes speed while considering both performance and area. It can simultaneously implement the key encapsulation algorithm (Kyber) and the digital signature algorithm (Dilithium) in lattice-based quantum-resistant cryptography, and can be applied to scenarios with higher performance requirements and greater system resource utilization.

[0076] The above exemplifies a coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application. Based on the above description, the coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application implements a fully hardware-based design of the computational functions in the lattice-based quantum-resistant cryptographic algorithm, which can greatly improve the computational speed of the overall algorithm flow. Furthermore, when the coprocessor executes the lattice-based quantum-resistant cryptographic algorithm, some cryptographic functions in the overall algorithm protocol computation can be processed in parallel, further improving computational performance while also greatly improving the utilization of system and hardware resources. Furthermore, due to the improved computational performance and the increased utilization of system and hardware resources, the lattice-based quantum-resistant cryptographic algorithm implemented by this coprocessor can be applied to mid-to-high-end products with higher computational performance requirements.

[0077] The key generation method according to another aspect of this application is described below with reference to Figure 6. It can be executed by the coprocessor described above for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application (here, the key generation method is described as an example; although not shown, the coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm according to an embodiment of this application can also implement all algorithms included in the lattice-based quantum-resistant cryptographic algorithm, such as encryption / decryption and signature verification). As shown in Figure 6, the key generation method may include the following steps:

[0078] Step S1: Generate a byte array based on random number data, and divide the byte array into a first array and a second array. The second array serves as the first part of the private key.

[0079] Step S2: Perform first polynomial vector sampling based on the first array to obtain the first sampling result.

[0080] Step S3: Includes steps A and B performed simultaneously, wherein step A is to perform a number theory transformation on the first sampling result based on preset parameters to obtain a first number theory transformation result, and step B is to perform a second polynomial vector sampling on the first array to obtain a second sampling result.

[0081] Step S4: includes steps C and D performed simultaneously, wherein step C is to perform first polynomial matrix sampling based on the second array to obtain the third sampling result, and step D is to perform number theory transformation on the second sampling result based on preset parameters to obtain the second number theory transformation result.

[0082] Step S5: Generate the third polynomial vector based on the third sampling result and the first number theory transformation result.

[0083] Step S6: This includes steps E and F performed simultaneously, where step E is to generate a fourth polynomial vector based on the third polynomial vector, and step F is to encode the result of the first number theory transformation to obtain the second part of the private key.

[0084] Step S7: Generate the result to be encoded based on the fourth polynomial vector and the result of the second number theory transformation.

[0085] Step S8: Encode the result to be encoded to obtain the public key.

[0086] The key generation method of this application is executed by the coprocessor for implementing the lattice-based quantum-resistant cryptographic algorithm according to the embodiments of this application described above. Since the coprocessor can perform parallel operations on different computational cores, some steps in the key generation method implemented by it include steps performed simultaneously. For example, steps S3, S4 and S6 above each include two steps performed simultaneously. This can improve the performance of the key generation method and the utilization rate of system resources, as described above.

[0087] Taking the example of the coprocessor having three processing cores in the previous embodiment, in the above steps, step B of steps S1, S2, and S3 and step C of step S4 are executed by the hash operation core of the coprocessor; step A of step S3, step D of step S4, step S5, step E of step S6 and step S7 are executed by the arithmetic operation core of the coprocessor; and step F of step S6 and step S8 are executed by the format operation core of the coprocessor.

[0088] Furthermore, the various data in the above methods can be rationally planned and stored in different memories to more conveniently realize the scheduling and parallel operation of different computing cores. In one example, the random number data used in step S1 and the preset parameters (preset parameters for NTT) used in steps S3 and S4 can be stored in the first memory. The first array obtained in step S1 and the second sampling result obtained in step S3 can be stored in the second memory. The second array obtained in step S1, the first sampling result obtained in step S2, the third sampling result obtained in step S4, the third polynomial vector obtained in step S5, the fourth polynomial vector obtained in step S6, the result to be encoded obtained in step S7, and the public key obtained in step S8 are stored in the third memory. The first number theory transformation result obtained in step S3, the second number theory transformation result obtained in step S4, and the second part of the private key obtained in step S6 are stored in the fourth memory.

[0089] The above method is described in more detail below with reference to Figure 7. The first to fourth memories are described as sram0 to sram3, respectively. Data preparation can be performed before the key generation method begins. This data preparation includes placing a 32-byte random number seed generated by the CPU into sram0 and placing the parameter (Zetas) values ​​required for NTT / INTT calculation into sram0. As shown in Figure 7, the above key generation method adopts the KEM.PKE.KeyGen() process in the Kyber algorithm protocol, including the following steps:

[0090] Step 1: Read seed from sram0, call the SHA3_512(seed) function to generate the byte array buf[63:0], and put buf[63:32] into sram1 and buf[31:0] into sram2.

[0091] Step 2: Read σ = buf[63:32] from sram1, sample the polynomial vector s, and put s into sram2.

[0092] Step 3: Step A: Start the NTT module, read parameters from sram0, read s from sram2 to perform NTT operation, and put s' into sram3; Step B: Read σ = buf[63:32] from sram1 to sample the polynomial vector e, and put e into sram1.

[0093] Step 4: Step C: Read ρ = buf[31:0] from sram2 to sample the polynomial matrix A and put A into sram2; Step D: Start the NTT module, read the parameters from sram0, read e from sram1 to perform NTT operation, and put e' into sram3.

[0094] Step 5: Read A from sram2, read s' from sram3, and put the resulting polynomial vector tt' into sram2.

[0095] Step 6: Step E: Read tt' from sram2 and put the result t1' into sram2; simultaneously, Step F: Read s' from sram3 and put the encoded result s'_array into sram3.

[0096] Step 7: Read t1' from sram2, read e' from sram3, and put the result t' into sram2.

[0097] Step 8: Read t' from sram2 and put the encoded result t'_array into sram2.

[0098] Finally, the public key (t'_array) in standard array form can be obtained from sram2, and the private key (s'_array||buf[31:0]) in standard array form can be obtained from sram3 and sram2.

[0099] Based on the above description, the key generation method according to the embodiments of this application is executed by the coprocessor for implementing the lattice-based quantum-resistant cryptographic algorithm described above. Since the coprocessor can perform parallel operations on different computational cores, some steps in the key generation method implemented by it include steps performed simultaneously, which can improve the performance of the key generation method and the utilization of system resources.

[0100] Figure 8 is a flowchart of a key generation method in another embodiment of this application, including the following steps:

[0101] S110, Obtain the first data.

[0102] The first data includes a first sub-data and a second sub-data, with the second sub-data serving as part of the private key. In one embodiment of this application, the first data is a byte array generated based on random number data, the first sub-data is a first array, and the second sub-data is a second array.

[0103] In one embodiment of this application, random number data is read from a first memory, a first array is stored in a second memory, and a second array is stored in a third memory.

[0104] S120, perform first polynomial vector sampling based on the first sub-data to obtain the first sampling result.

[0105] In one embodiment of this application, a first array is read from a second memory to perform a first polynomial vector sampling, and the resulting first sampling result is stored in a third memory.

[0106] S132, perform number theory transformation on the first sampling result based on preset parameters to obtain the first number theory transformation result.

[0107] In one embodiment of this application, preset parameters are read from a first memory, and the resulting first number theory transformation is stored in a fourth memory.

[0108] S134, perform second polynomial vector sampling based on the first sub-data to obtain the second sampling result.

[0109] In one embodiment of this application, a first array is read from a second memory, a second polynomial vector sampling is performed, and the resulting second sampling result is stored in the second memory. Step S134 can be performed synchronously with step S132.

[0110] S142, perform the first polynomial matrix sampling based on the second sub-data to obtain the third sampling result.

[0111] In one embodiment of this application, a second array is read from a third memory to perform a first polynomial matrix sampling, and the resulting third sampling result is stored in the third memory.

[0112] S144, Perform a number theory transformation on the second sampling result based on preset parameters to obtain the second number theory transformation result.

[0113] In one embodiment of this application, preset parameters are read from a first memory, a second sampling result is read from a second memory and subjected to number-theoretical transformation, and the resulting second number-theoretical transformation result is stored in a fourth memory. Step S144 can be performed synchronously with step S142.

[0114] S150, based on the third sampling result and the first number theory transformation result, calculates the third polynomial vector.

[0115] In one embodiment of this application, a third sampling result is read from a third memory, a first number theory transformation result is read from a fourth memory, and the calculated third polynomial vector is stored in the third memory.

[0116] S162, based on the third polynomial vector, calculates the fourth polynomial vector.

[0117] In one embodiment of this application, a third polynomial vector is read from a third memory, and the calculated fourth polynomial vector is stored in the third memory.

[0118] S164 encodes the result of the first number theory transformation.

[0119] In one embodiment of this application, the result of the first number theory transformation is read from the fourth memory, and the encoded result is stored in the fourth memory as another part of the private key. Step S164 can be performed synchronously with step S162.

[0120] S170, based on the fourth polynomial vector and the second number theory transformation results, calculates the result to be encoded.

[0121] The fourth polynomial vector is read from the third memory, the second number theory transformation result is read from the fourth memory, and the result to be encoded is stored in the third memory.

[0122] S180: Encode the result to be encoded to obtain the public key.

[0123] Read the result to be encoded from the third memory, and store the encoded public key in the third memory.

[0124] In one embodiment of this application, steps S110, S120, S134 and S142 are executed by a hash operation core, steps S132, S144, S150, S162 and S170 are executed by an arithmetic operation core, and steps S164 and S180 are executed by a format operation core.

[0125] Table 1 shows a comparison of the computational performance of the lattice-based quantum-resistant cryptographic algorithm implemented by the coprocessor according to the embodiments of this application and the lattice-based quantum-resistant cryptographic algorithms implemented by two conventional system architectures.

[0126] Table 1

[0127] The comparison chart clearly shows that, compared to traditional system architectures, the coprocessor for implementing lattice-based quantum-resistant cryptography algorithms according to the embodiments of this application does not require a small critical dimension (CD) in terms of process technology, making it more process-friendly and cost-effective. In addition, the coprocessor operates at a higher frequency (clock frequency) and has a higher throughput (number of times it runs per second).

[0128] According to another aspect of this application, a chip is also provided, which may include a memory, a central processing unit, and a coprocessor, wherein the coprocessor is the coprocessor for implementing lattice-based quantum-resistant cryptography algorithms as described above according to embodiments of this application. According to yet another aspect of this application, an electronic device is also provided, including the aforementioned chip. Since the coprocessor for implementing lattice-based quantum-resistant cryptography algorithms according to embodiments of this application has been described in detail above, those skilled in the art can understand the structure of the chip and the electronic device in conjunction with the foregoing description; for the sake of brevity, further details are omitted here.

[0129] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of this application. Various changes and modifications can be made therein by those skilled in the art without departing from the scope of this application. All such changes and modifications are intended to be included within the scope of this application as claimed in the appended claims.

[0130] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0132] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0133] Similarly, it should be understood that, in order to streamline this application and aid in understanding one or more of the various inventive aspects, features of this application may sometimes be grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of this application. However, this approach should not be construed as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as reflected in the corresponding claims, its inventive point lies in solving the corresponding technical problem with features fewer than all features of a single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0134] Those skilled in the art will understand that, apart from the mutual exclusion of features, all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or apparatus so disclosed can be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0135] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0136] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules according to the embodiments of this application. This application can also be implemented as a patch program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0137] It should be noted that the above embodiments are illustrative of this application and not limiting of it, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several outlets, several of these outlets may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0138] The above description is merely a specific embodiment or illustration of the embodiments of this application. The scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. The scope of protection of this application shall be determined by the scope of the claims.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A coprocessor for implementing a lattice-based quantum-resistant cryptographic algorithm, the coprocessor (1) comprising: The processor core (11) includes at least two operation cores, which are capable of performing all operations of the lattice-based quantum-resistant cryptographic algorithm. Register (12), which is used to store configuration information required when a function in the computing core is called; as well as The memory controller (13) is used to call data in the memory according to the configuration information under the control of the at least two computing cores, so as to enable the at least two computing cores to perform parallel operations on each other.

2. The coprocessor according to claim 1, characterized in that, The processor core (11) includes at least three arithmetic cores. The same arithmetic core is used to perform the same type of operation, and different arithmetic cores are used to perform different types of operations.

3. The coprocessor according to claim 2, characterized in that, The processor core (11) includes three arithmetic cores, namely: A hash operation kernel (111) is used to implement the hash operation and sampling operation in the lattice-based quantum-resistant cryptographic algorithm; Arithmetic operation kernel (112), used to implement arithmetic operations in the lattice-based quantum-resistant cryptographic algorithm; and The format operation kernel (113) is used to implement the format transformation operation in the lattice-based quantum-resistant cryptography algorithm.

4. The coprocessor according to claim 3, characterized in that, The hash operation core (111) includes: The hash module (1111) is used to implement hash operations; A buffer (1112) is used to store the result data output by the hash module (1111); The sampling module (1113) can read the result data from the buffer (1112) for sampling, so as to realize parallel operation between the hash module (1111) and the sampling module (1113).

5. The coprocessor according to claim 3, characterized in that, The format transformation operations implemented by the format operation core include one or more of the following: encoding operation, decoding operation, compression operation, and decompression operation.

6. The coprocessor according to claim 1, characterized in that, Under the control of the at least two computing cores, the memory controller (13) calls data in different memories at the same time to enable the at least two computing cores to perform parallel operations on each other.

7. A key generation method, executed by the coprocessor for implementing the lattice-based quantum-resistant cryptographic algorithm as described in claim 1, the method comprising: First step: Generate a byte array based on random number data, and divide the byte array into a first array and a second array, with the second array serving as the first part of the private key; The second step: Perform first polynomial vector sampling based on the first array to obtain the first sampling result; The third step includes steps A and B performed simultaneously, wherein step A is to perform a number theory transformation on the first sampling result based on preset parameters to obtain a first number theory transformation result, and step B is to perform a second polynomial vector sampling on the first array to obtain a second sampling result; The fourth step includes steps C and D performed simultaneously. Step C involves sampling the second array using a first polynomial matrix to obtain a third sampling result. Step D involves performing a number-theoretic transformation on the second sampling result based on the preset parameters to obtain a second number-theoretic transformation result. Fifth step: Generate a third polynomial vector based on the third sampling result and the first number theory transformation result; The sixth step includes steps E and F, which are performed simultaneously. Step E is to generate a fourth polynomial vector based on the third polynomial vector, and step F is to encode the result of the first number theory transformation to obtain the second part of the private key. Step 7: Generate the result to be encoded based on the fourth polynomial vector and the result of the second number theory transformation; Step 8: Encode the result to be encoded to obtain the public key.

8. The method according to claim 7, characterized in that, The first step, the second step, step B of the third step, and step C of the fourth step are executed by the hash operation core of the coprocessor; Step A of the third step, step D of the fourth step, the fifth step, step E of the sixth step, and the seventh step are executed by the arithmetic core of the coprocessor; Step F of the sixth step and the eighth step are executed by the format operation core of the coprocessor.

9. The method according to claim 7, characterized in that, The random number data and the preset parameters are stored in the first memory; The first array and the second sampling result are stored in the second memory. The second array, the first sampling result, the third sampling result, the third polynomial vector, the fourth polynomial vector, the result to be encoded, and the public key are stored in the third memory; The first number theory transformation result, the second number theory transformation result, and the second part of the private key are stored in the fourth memory.

10. A key generation method, executed by the coprocessor of claim 1, the method comprising: Step 1: Obtain first data, which includes first sub-data and second sub-data, with the second sub-data being part of the private key; Step 2: Perform first polynomial vector sampling based on the first sub-data to obtain the first sampling result; Step 3: Perform a number-theory transformation on the first sampling result based on preset parameters to obtain the first number-theory transformation result; Step 4: Perform a second polynomial vector sampling based on the first sub-data to obtain the second sampling result; Step 5: Perform first polynomial matrix sampling based on the second sub-data to obtain the third sampling result; Step 6: Perform a number-theory transformation on the second sampling result based on the preset parameters to obtain the second number-theory transformation result; Step 7: Based on the third sampling result and the first number theory transformation result, calculate the third polynomial vector; Step 8: Calculate the fourth polynomial vector based on the third polynomial vector; Step 9: Encode the result of the first number theory transformation to obtain another part of the private key; Step 10: Based on the fourth polynomial vector and the result of the second number theory transformation, calculate the result to be encoded; as well as Step 11: Encode the result to be encoded to obtain the public key.

11. The key generation method according to claim 10, characterized in that, The first data is a byte array generated based on random number data, the first sub-data is a first array, and the second sub-data is a second array.

12. The key generation method according to claim 10, characterized in that, The processor core includes: A hash operation kernel is used to implement hash operations and sampling operations in the lattice-based quantum-resistant cryptographic algorithm. An arithmetic kernel is used to implement arithmetic operations in the lattice-based quantum-resistant cryptographic algorithm; and A format operation kernel is used to implement the format transformation operation in the lattice-based quantum-resistant cryptographic algorithm; Steps 1, 2, 4 and 5 are executed by the hash operation core, steps 3, 6, 7, 8 and 10 are executed by the arithmetic operation core, and steps 9 and 11 are executed by the format operation core.

13. The key generation method according to claim 11, characterized in that, The memory includes a first memory, a second memory, a third memory, and a fourth memory; The random number data and the preset parameters are stored in the first memory; The first array and the second sampling result are stored in the second memory. The second array, the first sampling result, the third sampling result, the third polynomial vector, the fourth polynomial vector, the result to be encoded, and the public key are stored in the third memory; The first number theory transformation result, the second number theory transformation result, and another part of the private key are stored in the fourth memory.

14. A chip, characterized in that, The chip includes a memory, a central processing unit, and a coprocessor (1), wherein the coprocessor (1) is the coprocessor for implementing the lattice-based quantum-resistant cryptographic algorithm as described in claim 1.

15. An electronic device comprising the chip of claim 14.

Images