Patent Application
20210377026
This disclosure relates generally to cryptography and more specifically to a method of multiplying polynomials in a processor to perform a cryptographic operation.
The development of quantum computers threatens the security of certain currently widely used public key cryptography algorithms such as the RSA (Rivest-Shamir-Adleman) algorithm. Most recently, advances in quantum computing have accelerated the research into “post-quantum cryptography” schemes, that is, new cryptography schemes that are believed to be secure even when faced with an attacker using a quantum computer. There are various families of problems that are being considered to instantiate these post-quantum cryptographic approaches. One approach is based on the hardness of certain lattice problems. That is, solving these difficult lattice problems compromises the cryptography. When implemented, computationally expensive operations of some proposed lattice-based post-quantum cryptography schemes include arithmetic with polynomials with integer coefficients. Some currently used public-key cryptography algorithms require arithmetic of large integers, where the integers may include hundreds or thousands of bits. In contrast, the coefficients used for polynomial multiplication for lattice-based algorithms may be much smaller, e.g., 32 bits or less. Typically, special purpose processors are implemented in a data processing system to offload the computationally difficult problems from the main processor of the system. However, the special purpose co-processors currently used to implement existing RSA or Elliptic-curve cryptography (ECC) algorithms cannot efficiently and quickly perform the polynomial multiplications required for lattice-based cryptography. Developing new special-purpose co-processors to perform the computations needed by lattice-based post-quantum cryptography efficiently and quickly is expensive and time consuming.
Therefore, a need exists for a method to multiply two polynomials for a cryptographic application efficiently using existing co-processors.
The present invention is illustrated by way of example and is not limited by the accompanying figures, in which like references indicate similar elements. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale.
Lattice-based cryptography supports various commonly used cryptographic functionality such as exchanging secret keys, digital signatures, encryption, and decryption. In addition, lattice-based cryptography supports other cryptographic functionality such as homomorphic encryption, and the like. Lattice-based cryptography has many practical applications such as establishing secure connections over a network (e.g., the internet), guaranteeing the integrity of software (e.g., when updating or booting a device) and performing cryptographic operations on encrypted data in the cloud. When implemented in either hardware or software, many lattice-based constructions work on polynomials that are generated from random user input or publicly known seeds to enhance performance and reduce memory requirements. For example, in various lattice-based cryptographic schemes, such as for example, an asymmetric cryptography scheme using a pair of keys, a user's private key of the key pair includes a vector of polynomials having coefficients that are sampled randomly. A public key of the key pair is a matrix of polynomials having coefficients that are either public or generated from a public seed. The longest arithmetic operations carried out by these implementations are multiplications involving two polynomials, and the operations may be repeated several times. The polynomials typically have a fixed, or finite, number of coefficients, while the coefficients themselves lie in a modular ring, such as the integers modulo prime or a power of two. These are properties of the particular cryptographic scheme and are fixed by parameters of the scheme.
Generally, there is provided, a method for multiplying two or more polynomials to accomplish a cryptographic operation. The method may be performed in a co-processor of a data processing system. In the method, a first polynomial and a second polynomial are received in a processor for executing a cryptographic algorithm, such as for example, a lattice-based cryptography algorithm. The first and second polynomials are evaluated at 2t inputs, where t is greater than or equal to one, and where each input is a fixed power of two multiplied with a different power of a primitive root of unity, thereby creating 2 times 2t integers. The power of two is determined to be at least as large as the largest coefficient of the resulting product of the multiplying of the first and second polynomial. The 2 times 2t integers are then multiplied pairwise, after which a modular reduction is performed to get 2t integers. Finally, a linear combination of the 2t integers multiplied with primitive roots of unity is computed, to get 2t integers whose limbs in the base -bit representation correspond to the coefficients of the product of the first and second polynomial, where
is an integer chosen large enough such that the coefficients of the product of the first and second polynomial are smaller than
.
In accordance with an embodiment, there is provided, a method for multiplying two or more polynomials to perform a cryptographic operation in a data processing system, the method for use in a processor of the data processing system, the method including: receiving a first polynomial and a second polynomial by the processor; evaluating the first polynomial and the second polynomial at 2t inputs, where t is greater than or equal to one, and where each of the 2t inputs is a fixed power of two multiplied with a different one of multiple powers of a primitive root of unity, thereby creating 2 times 2t integers; multiplying the 2 times 2t integers in a pairwise fashion to produce multiplication results; performing a modular reduction on the multiplication results of the 2t integer multiplications; and computing a linear combination of the 2t integers multiplied with primitive roots of unity to get 2t integers with limbs in a base -bit representation, where
is an integer, that correspond to coefficients of the multiplication results. In the method, t and the multiple powers of the primitive root of unity may be precomputed. The fixed power of two may be determined to be at least large enough so that the fixed power of two is larger than every coefficient of the product of the first and second polynomials. The method may be performed in a ring of a form Rq=(
/q
)[X]/(Xn+1) where coefficients of the polynomial are in
/q
and the method is performed in modulo Xn+1. Receiving the first and second polynomials may further include storing the first and second polynomials in a processor of a data processing system. The cryptographic operation may be a lattice-based cryptographic operation.
In another embodiment, there is provided, a method for multiplying two or more polynomials to perform a cryptographic operation in a data processing system, the method for use in a processor of the data processing system, the method including: receiving a first polynomial and a second polynomial in the processor; evaluating the first polynomial and the second polynomial at 2t inputs in the processor, where t is greater than or equal to one, and where each of the 2t inputs is a fixed power of two multiplied with a different one of multiple powers of a primitive root of unity ζ where ζt=−1 mod (−1), where
∈
and where
is a ring of integers, and where
is an integer, thereby creating 2 times 2t integers; multiplying the 2 times 2t integers in a pairwise fashion to produce multiplication results in the processor; performing a modular reduction on the multiplication results of the 2t integer multiplications; and computing a linear combination of the 2t integers multiplied with primitive roots of unity to get 2t integers with limbs in a base
-bit representation that correspond to coefficients of the multiplication results. In the method, t and the roots of unity may be precomputed. The fixed power of two may be determined to be at least large enough so that the fixed power of two is larger than every coefficient of the product of the first and second polynomials. The method may be performed in a ring of a form Rq=(
/q
)[X]/(Xn+1) where coefficients of the polynomial are in
/q
and the method is performed in modulo Xn+1. Receiving the first and second polynomials may further include storing the first and second polynomials in a processor of a data processing system. The cryptographic operation may be a lattice-based cryptographic operation.
In yet another embodiment, there is provided, a data processing system including instructions embodied in a non-transitory computer readable medium, the instructions for multiplying two or more polynomials in a cryptographic operation in a processor, the instructions including: instructions for receiving a first polynomial and a second polynomial; instructions for evaluating the first polynomial and the second polynomial at 2t inputs, where t is greater than or equal to one, and where each of the 2t inputs is a fixed power of two multiplied with a different one of multiples powers of a primitive root of unity, thereby creating 2 times 2t integers; instructions for multiplying the 2 times 2t integers in a pairwise fashion to produce multiplication results; instructions for performing a modular reduction on the multiplication results of the 2t integer multiplications; and instructions for computing a linear combination of the 2t integers multiplied with primitive roots of unity to get 2t integers with limbs in a base -bit representation that correspond to coefficients of the multiplication results. In the data processing system, t and the multiple powers of the primitive root of unity may be precomputed. The fixed power of two may be determined to be at least large enough so that the fixed power of two is larger than every coefficient of the product of the first and second polynomials. The method may be performed in a ring of a form Rq=(
/q
)[X]/(Xn+1) where coefficients of the polynomial are in
/q
and the method is performed in modulo Xn+1. Receiving the first and second polynomials may further include storing the first and second polynomials in a processor of a data processing system. The cryptographic operation is a lattice-based cryptographic operation.
A method to reduce computational problems related to multivariate polynomials to univariate polynomials was proposed by a mathematician named L. Kronecker as set out in “Grundzüge einer arithmetischen theorie der algebraischen grössen, Journal für die reine and angewandte” Mathematik 92 (1882), 1-122. A hundred years later, a similar technique was introduced by Arnold Schönhage in “Schnelle multiplikation von polynomen über körpern der charakteristik 2”, Acta Informatica 7 (1977), 395-398 to reduce polynomial multiplications in [X] to integer multiplication (multiplications in
) (“Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coefficients,” by Arnold Schönhage, Computer Algebra (Jacques Calmet, ed.), Springer Berlin Heidelberg, 1982, pp. 3-15) incorporated herein by reference. This approach is known as the Kronecker substitution method. In the approach, given two polynomials f,g∈
[X] of degree (up to) n−1∈
, the goal is to compute the polynomial multiplication h=f·g. Kronecker's idea is to evaluate the polynomials at a sufficiently high power of two (e.g., f(
) and g(
)) and use the resulting integers as input for a regular integer multiplication by computing h(
)=f(
)·g(
). Finally, the resulting integer h(
) is converted back to its polynomial representation h∈
[X]. The result is correct if the coefficients of the resulting polynomial did not “mix” with each other, i.e. if the parameter
∈
is sufficiently large. An advantage of this approach, computing a polynomial multiplication with an integer multiplication, is that well-studied and fast implementations of asymptotic integer multiplication methods can be used.
The size of the integers multiplied in the Kronecker procedure is strongly related to the size of . Simply put, the larger
, the larger the integers, and the variable
needs to be above a certain threshold in order to avoid “mixing” of the polynomial coefficients and rendering the result incorrect. A mathematician named David Harvey observed in an article entitled “Faster Polynomial Multiplication Via Multipoint Kronecker Substitution” in the Journal of Symbolic Computation 44 (2009), no. 10, 1502-1510, incorporated herein by reference, that the size of
can be reduced by splitting up the polynomial evaluation into two parts. Assuming for simplicity that
is even, and given f,g∈
[X], David Harvey computes
h()=f(
)·g(
),
h(−)=f(−
)·g(−
),
where 2=
/2. David Harvey then observes that
h
(0)()=(h(
2)+h(−
))/2,
h
(1)()=(h(
)−h(−
))/(2·
),
where h(i) denotes the polynomial whose jth coefficient equals the (2j+1i)th coefficient of h. In other words,
h
(0)()=Σj=0n/2 −1h2j
, and h(1)(
)=Σj=0n/2−1
.
The coefficients of h can therefore be recovered as the -bit limbs h(0)(
) and h(1)(
). Denoting by M(b) the cost of multiplying two b-bit integers, this approach changes the cost of the polynomial multiplication in
[X] from M(
·n)+O(
·n) in the case of standard Kronecker, to 2·M(
·n/2)+O(
·n). Here the O terms represent overhead and the cost of packing and unpacking. This has significant advantages whenever the cost of multiplying is more expensive than linear in n. Harvey also considers a second approach to split up the evaluation into four parts by also evaluating at the reciprocal f(
), which gives rise to multiplication with a cost of 4·M(
·n/4)+O(
·n).
Arnold Schönhage provided another algorithm for multiplying polynomials, commonly referred to as the Schönhage-Strassen multiplication, in an article entitled “Schnelle Multiplikation von Polynomen über Körpern der Charakteristik 2, Acta Informatica 7 (1977), 395-398. Given two integers a,b∈, the idea behind the Schönhage-Strassen algorithm is to embed
⊆
/(2N+1) for some integer N that is a power of 2 and such that a·b≤2N+1. Then a·b mod (2N+1) is computed and the result in
is provided by taking the unique representative in the interval [0, . . . , 2N−1]. The main advantage of N being a power of 2 is that it contains many roots of unity. For example, 2 itself is a primitive 2N-th root of unity for N≥1. As a result, standard techniques such as the Fast Fourier Transform (FFT), which employs the roots of unity, can be applied in the ring to decompose a single (large) multiplication into many (small) multiplications using a convolution theorem. Note that the ring of integers
only has 2 roots of unity. By embedding into
/(2N+1), for some chosen N, access to roots of unity is gained.
Recent advances in quantum computing have accelerated the research into post-quantum cryptography schemes, that is, cryptographic algorithms which run on currently available computers but are believed to be still secure even when faced against an adversary with access to a quantum computer. When implemented, the main computationally expensive operation is arithmetic with polynomials with integer coefficients. More precisely, computations are done in a ring Rq=(/q
)[X]/(Xn+1) where the coefficients of the polynomials are in
/q
while the polynomial arithmetic is modulo Xn+1. In contrast to other popular classical public-key cryptography algorithms where arithmetic of large integers is needed (where the large integers may include hundreds or thousands of bits) the value of q is much smaller, for example, less than or equal to 32 bits. This makes the hardware accelerators, or co-processors, developed and deployed for currently used public-key cryptography obsolete since they cannot be used efficiently for polynomial multiplication with small coefficients.
In the disclosed embodiment, Kronecker substitution (including the signed variant and the multi-point evaluation) is used to compute arithmetic in Rq using the existing co-processors. In post-quantum cryptography, the main arithmetic operations include polynomial multiplication in the ring (/q
)[X]/(Xn+1) where typically q<232 and n∈{256, 1024}. This makes it hard to directly apply the existing fast and hardened arithmetic co-processors designed for known public-key cryptography such as ECC and RSA. The described embodiment applies number theoretic transform (NTT) techniques and roots of unity to the Kronecker setting which results in a significantly faster solution on processors designed for RSA and ECC calculations.
In one embodiment, let f,g∈[X] be two polynomials of degree at most n−1, such that the goal is to compute h=f·g. As deg(f·g)≤2n, this is equivalent to computing h≡f g mod (X2n−1) and taking its unique representative of degree strictly less than 2n. Now choose some t such that 2t|
and let
2t=
(2t), such that ζ=
is a primitive 2tth root of unity modulo
−1. This results in the following 2t pairwise multiplications
h(ζi·)=f(ζi·
)g(ζi·
)mod(2
−1),0≤i≤2t−1. (Eqn 1)
Note that ζt≠1 as is a primitive root of unity, thus ζt≡−1 mod (−1). Note that because ζ is a power of two, so are powers of ζ. This has the practical advantage that multiplication by powers of ζ can be implemented by simple bit-shifts. It follows that
To recover h, note that
so that the coefficients of h can be read off as -bit limbs from the appropriate h(i). Each coefficient has a maximum precision of 2t·
2t=
bits. Additionally, Eqn. (1) performs 2t multiplications, each of length
bits. However, f (
),g(
),f(ζt
)=f(−
) g(ζt
)=g(−
) all fit into
2tn bits. Therefore, those multiplications only require a
2tn-bit multiplier.
Denoting by M(b) the cost of multiplying two b-bit integers, the cost of the polynomial multiplication in [X] is generalized from 2M(
·n/2)+O(
·n) to 2M(
·n/(2t))+(2t−2)M(
n/t)+O(
·n). The overhead relating to converting from and to polynomial representation is the O(
·n) term.
This technique can also be applied to polynomial multiplication in a ring [X]/I, if there exist 2tth roots of unity in
[X]/I. In this case, all multiplications can be performed modulo I as opposed to (
−1).
In another embodiment, the case is considered where we are not interested in the polynomials f·g, but only in their product modulo Xn+1. The primitive root of unity ζ is also a primitive 2tth root modulo +1, and all intermediate products can be taken modulo
+1 as opposed to
−1. This reduces the sizes of the integers that are being multiplied by half. For example, compute
h(ζi·)=f(ζi·
)·g(ζi·
)mod(
+1),0≤i≤2t−1,
and note that
To recover h, again observe that
so that the coefficients of h can be read off as -bit limbs from the appropriate h(i). In this case the operation count is easier, as we simply perform 2t multiplications of
2tn bits each. The overhead relating to converting from and to polynomial representation is O(
·n). Note that in practice, the described method for multiplying polynomials may be combined with other computations such as adding a result of the multiplication to another polynomial without impacting the method.
As discussed above, the Kronecker substitution method performs polynomial multiplication by evaluating both polynomials at a carefully chosen input, typically a power of two , where
is an integer chosen such that the biggest coefficient of the resulting product of the multiplying of the first and second polynomial is smaller than
. In this way, a multiplication of two polynomials can be reduced to an integer multiplication where each of the inputs consists of
·n bits, where n is the number of coefficients of both polynomials, with some additional overhead caused by converting from polynomials to integers, and back. The above described embodiment of the invention evaluates both polynomials at smaller powers of two, and furthermore multiplies the inputs by 2t distinct roots of unity. This reduces the polynomial multiplication to 2t integer multiplications, where each of the integers consists of
·n/(2t) bits. On a w-bit computer architecture, the basic Kronecker approach needs (
·n/w)2 multiplication instructions. Using the described embodiment, the number of multiplication instructions can be reduced to (
·n/w)2/(2t). As can be seen, this results in a significant reduction in the number of multiplication instructions. The roots of unity are obtained through properties of the ring (
/q
)[X]/(Xn+1) where n is an integer, q is a prime integer,
is the ring of integers,
/q
is the ring of integers modulo q and (
/q
)[X]/(Xn+1) is the polynomial ring with variable X where coefficients are from (
/q
) and polynomials are reduced modulo Xn+1 as used in lattice-based cryptography.
bits. Note that the values of t and the roots of unity may be precomputed. At step 14, the 2 times 2t integers are then multiplied pairwise to produce multiplication results, after which a modular reduction is performed to get 2t integers at step 15. Finally, at step 16, a linear combination of the 2t integers multiplied with primitive roots of unity is computed, to get 2t integers whose limbs in the base
-bit representation correspond to the coefficients of the product of the first and second polynomial.
Method 10 can be applied directly to the existing fast and hardened arithmetic co-processors designed for known public-key cryptography such as ECC and RSA. As described above, the method applies number theoretic transform (NTT) techniques and roots of unity to the Kronecker setting which results in a faster and more efficient solution on processors designed for RSA and ECC calculations.
Data processing system 20 includes communication bus 22, processor(s) 24, memory 26, and cryptography co-processor 32. Bus 22 may be a conventional bus having a plurality of conductors for communicating address, data, and control information. In other embodiments, bus 22 may be an interconnect structure such as for example, a cross-bar switch or other form of interconnect system. Processor(s) 24 is bi-directionally connected to bus 22. Processor(s) 24 may include one or more of any type of processing element, a processor core, microprocessor, microcontroller, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), digital signal processor, and the like. There can be any number of processors.
Memory 26 is bi-directionally connected to bus 22. Memory 26 can be one or more of any type of volatile or non-volatile memory. Examples of memory types include non-volatile memories such as flash, one-time programmable (OTP), EEPROM (electrically eraseable programmable read only memory), and the like. Volatile memory types include static random-access memory (SRAM) and dynamic random-access memory (DRAM). The memory may be used for storing instructions and/or data.
User interface 28 is bi-directionally connected to bus 22 and may be connected to one or more devices for enabling communication with a user such as an administrator. For example, user interface 28 may be enabled for coupling to a display, a mouse, a keyboard, or other input/output device. User interface 28 may also include a network interface having one or more devices for enabling communication with other hardware devices external to data processing system 20.
Instruction memory 30 may include one or more machine-readable storage media for storing instructions for execution by processor(s) 24. In other embodiments, both memories 26 and 30 may store data upon which processor(s) 24 may operate. Memories 26 and 30 may also store, for example, encryption, decryption, and verification applications. Memories 26 and 30 may be implemented in a secure hardware element and may be tamper resistant.
Co-processor 32 is bi-directionally connected to bus 22. Co-processor 20 may be a special type of a co-processor optimized for running encryption/decryption security software according to the RSA, ECC, or Advanced Encryption Standard (AES) or other type of commonly used encryption algorithm. Accordingly, and in accordance with the described embodiments, co-processor 32 may be used to efficiently execute instructions for performing polynomial multiplications for post-quantum cryptography as discussed above and illustrated in the flowchart of
As used herein, the term “non-transitory machine-readable storage medium” will be understood to exclude a transitory propagation signal but to include all forms of volatile and non-volatile memory. When software is implemented on a processor, the combination of software and processor becomes a single specific machine. Although the various embodiments have been described in detail, it should be understood that the invention is capable of other embodiments and its details are capable of modifications in various obvious respects.
Because the data processing implementing the present invention is, for the most part, composed of electronic components and circuits known to those skilled in the art, circuit details will not be explained in any greater extent than that considered necessary as illustrated above, for the understanding and appreciation of the underlying concepts of the present invention and in order not to obfuscate or distract from the teachings of the present invention.
Although the invention is described herein with reference to specific embodiments, various modifications and changes can be made without departing from the scope of the present invention as set forth in the claims below. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present invention. Any benefits, advantages, or solutions to problems that are described herein with regard to specific embodiments are not intended to be construed as a critical, required, or essential feature or element of any or all the claims.
The term “coupled,” as used herein, is not intended to be limited to a direct coupling or a mechanical coupling.
Furthermore, the terms “a” or “an,” as used herein, are defined as one or more than one. Also, the use of introductory phrases such as “at least one” and “one or more” in the claims should not be construed to imply that the introduction of another claim element by the indefinite articles “a” or “an” limits any particular claim containing such introduced claim element to inventions containing only one such element, even when the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a” or “an.” The same holds true for the use of definite articles.
Unless stated otherwise, terms such as “first” and “second” are used to arbitrarily distinguish between the elements such terms describe. Thus, these terms are not necessarily intended to indicate temporal or other prioritization of such elements.
