为应对量子计算技术发展对传统公钥密码体系造成的安全性威胁，学术界和工业界正积极推进后量子密码算法标准化，以确保在量子计算时代的信息安全。CRYSTALS-Dilithium 算法因其高效率、相对简单的实现、强大的理论安全基础以及相对深入的安全分析，已经被NIST推荐为优先使用的后量子数字签名标准。然而，算子操作类型多元、算法运算流程复杂成为高性能Dilithium计算实现的技术难题。针对此难题，本论文将从算子硬件优化与计算调度机制等方面开展Dilithium的高性能硬件架构关键技术研究。为解决算子操作类型多元，多项式乘法与哈希函数计算开销大的技术难点，开展高性能算子硬件设计技术研究。首先，提出了基于稀疏处理的多项式乘法实现方法，与NTT直接实现对比，将多项式乘法的位计算复杂度和密钥的存储需求分别降低了85%和68%以上。其次，提出了一种高性能的流水线NTT计算核心架构，与迭代型NTT架构对比，实现了规则有序的输入输出序列，有效避免了地址访问冲突。最后，提出了一种速率匹配的高速哈希采样电路设计方法，采用Keccak核心与参数可配置采样模块的并行工作机制，与直接串行实现对比，将多项式生成所需的时钟周期数减少了64%。为解决算法运算流程复杂，多级数据依赖关系导致的硬件实现延迟高和硬件利用率低的技术难点，开展高性能系统架构设计技术研究。首先，提出了一种基于稀疏和 NTT 混合数据通路的硬件架构，支持Dilithium算法在不同密码原语和安全等级下的并行计算。其次，提出了一种层次化任务调度机制，通过从粗粒度到细粒度的多层次并行执行策略，实现算法执行层的阶段级并行和算子操作层的模块级并行，与串行实现相比，将签名生成所需的时钟周期数减少了67%。为验证上述关键技术，硬件实现采用Verilog HDL描述，在Xilinx Virtex UltraScale+和Artix-7 FPGA平台上进行性能评估。评估结果表明，Dilithium算法的签名生成和验证速度分别达到了9,895次/秒和23,809次/秒。与最新的相关工作相比，速度分别提升了2.0倍和1.4倍，面积延时积改善了1.4~4.3倍。
In response to the security threats posed by the advancement of quantum computing technology to traditional public key cryptography systems, academia and industry are actively promoting the standardization of post-quantum cryptography to ensure information security in the quantum computing era. CRYSTALS-Dilithium was selected as the primary digital signature algorithm to be implemented due to its high efficiency, relatively simple implementation, strong theoretical security basis, and encouraging cryptanalytic history. However, the implementation of high-performance Dilithium computing faces technical challenges due to multiple operator operations and complex algorithm processes. To address these challenges, this paper will focus on researching key technologies in high-performance hardware architecture for CRYSTALS-Dilithium, including high-performance operator hardware optimization and calculation scheduling mechanism.To address the technical challenges posed by multiple operator operations, the high computational overhead of polynomial multiplication and hash functions, this paper conducts research on high-performance operator hardware design technology. Firstly, this paper presents a sparse processing method of polynomial multiplication, which reduces the bit complexity of sparse multiplication and the storage requirements of the secret key by more than 85% and 68% respectively, compared to the conventional NTT method. Secondly, a high-speed pipelined NTT computing core architecture is proposed. Compared to the iterative NTT architecture, it achieves a regular and orderly input and output sequence, effectively avoiding address access conflicts. Thirdly, a rate-matching high-speed hash sampling module design method is proposed, enabling simultaneously running Keccak permutations and parameter-configurable sampling. Compared with direct serial implementation, the clock cycle overhead for polynomial generation is reduced by 64%.To address the technical challenges posed by complex algorithm processes, high hardware delay and low hardware utilization caused by multi-level data dependencies, this paper conducts research on high-performance system architecture design technology. Firstly, this paper presents a hardware architecture based on sparse and NTT hybrid datapaths, supporting parallel computing of different cryptographic primitives and security levels for Dilithium. Secondly, a hierarchical task scheduling mechanism is proposed to achieve stage-level parallelism in the algorithm execution layer and module-level parallelism in the operator operation layer through multi-level parallel execution from coarse-grained to fine-grained. Compared to serial implementation, the clock cycle overhead of the signature generation is reduced by 67%.To verify the aforementioned key technologies, the hardware architecture is described in Verilog HDL, and the results are generated for Xilinx Virtex Ultrascale+ and Artix-7 FPGAs. The signature generation and verification speeds can achieve 9,895 and 23,809 operations per second, respectively. Compared to state-of-the-art implementations on similar platforms, the speed is 2.0× and 1.4× faster, and the area-time-products are 1.4×~4.3× smaller.
