一种高性能RLWE加密处理器的设计与实现

Design and Implement of a High-Performance RLWE Cryptoprocessor

RLWE加密方案是后量子时代格密码系统中最有潜力的候选方案之一。针对RLWE加密处理器存在的高延迟、低吞吐率的问题,文中提出了一种高性能RLWE加密处理器硬件架构。该结构采用了两个NTT模块和4个蝶形模块的并行结构。在预计算和后计算过程中,利用4个蝶形模块中的乘法器进行并行计算。在加密过程中,NTT运算与密文计算并行处理。在NTT以及INTT运算的处理过程中,将数据的读写过程及计算过程进行乒乓操作,从而隐藏数据的读写周期,降低RLWE加密处理器的延迟,提高了RLWE加密处理器的吞吐率。设计资源复用的硬件架构,在加密、解密过程复用蝶形模块中的乘法器和加法器,INTT复用NTT的电路结构,从而降低加密处理器硬件资源消耗。在Spartan-6 FPGA开发平台上实现了参数为n=256,q=65537的加密处理器。实验结果表明,文中提出的加密时间仅为12.18μs,吞吐率为21.01 Mbit·s^(-1),解密时间仅为8.65μs,吞吐率为29.60 Mbit·s^(-1)。与其他加密处理器的对比实验表明,文中所提出的加密处理器的延迟和吞吐率均得到了改善。

The RLWE encryption scheme is one of the most potential candidates in the lattice cryptosystem in the post-quantum era.In view of the problem of high latency and low throughput in RLWE cryptoprocessor,this study proposes a high-performance RLWE cryptoprocessor hardware architecture.The parallel circuit structure of two NTT modules and four butterfly modules are adopted in the proposed architecture.In the pre-calculation and post-calculation process,the multipliers in the four butterfly modules are used for parallel calculation.In the encryption process,NTT calculation and ciphertext calculation are performed in parallel.In the processing of NTT and INTT operations,the data read and write process and calculation process are ping-pong operations,thereby hiding the data read and write cycle,reducing the delay of the RLWE encryption processor,and improving the throughput of the RLWE encryption processor.A hardware architecture is designed for resource reuse,the multiplier and adder are reused in the butterfly module during the encryption and decryption process,and the circuit structure of NTT is reused by INTT,thereby reducing the hardware resource consumption of the encryption processor.The cryptoprocessor with parameters of n=256 and q=65537 is implemented on the Spartan-6 FPGA development platform.The results indicate that the encryption time is only 12.18μs,the throughput is 21.01 Mbit·s^(-1),the decryption time is only 8.65μs,and the throughput is 29.60 Mbit·s^(-1).Compared with other cryptoprocessor,the proposed design has improved the delay and throughput of the cryptoprocessor.