使用AVX512指令集和VPCLMULQDQ指令在$\mathbb{F}_2[X]$上实现快速乘法
Faster multiplication over $\mathbb{F}_2[X]$ using AVX512 instruction set and VPCLMULQDQ instruction
摘要：
基于码的密码学是后量子密码学的主要命题之一，并且已经在NIST平台上提交了几个此类协议。其中，BIKE和HQC是在KEM类别的NIST标准化过程的第三轮中选出的五个候补候选人的一部分。这两种方案利用了在二进制环上的大型多项式的乘法，并且由于多项式的大小（从10，000到60，000位），该操作是密钥生成、封装或解封机制期间最昂贵的操作之一。在这项工作中，我们重新审视现有的不同的常数时间算法的任意多项式乘法。我们探索不同的Karatsuba和Toom-Cook构造，以确定AVX 2和AVX 512指令集的上下文中每个多项式次数范围的最佳组合。这导致在每种情况下不同的内核和结构。特别是，在AVX 512的上下文中，我们使用VPCLMULQDQ指令，这是一个向量化的二进制多项式乘法指令。此指令处理多达四个多项式（次数高达63）乘法，四个结果存储在一个512位字中。与AVX 2指令集实现相比，这允许将操作的退役指令数除以大约3，而处理器时钟周期方面的加速高达39%。这些结果与Drucker（2018年即将推出的向量化vpclmulqdq指令的二进制多项式快速乘法）中估计的结果不同。为了说明新的VPCLMULQDQ指令的好处，我们使用HQC代码来评估我们的方法。当在HQC协议中实现时，对于安全级别128、192和256，我们的方法为密钥对生成提供了高达12%的加速。
英文摘要：
Code-based cryptography is one of the main propositions for the post-quantum cryptographic context, and several protocols of this kind have been submitted on the NIST platform. Among them, BIKE and HQC are part of the five alternate candidates selected in the third round of the NIST standardization process in the KEM category. These two schemes make use of multiplication of large polynomials over binary rings, and due to the polynomial size (from 10,000 to 60,000 bits), this operation is one of the costliest during key generation, encapsulation, or decapsulation mechanisms. In this work, we revisit the different existing constant-time algorithms for arbitrary polynomial multiplication. We explore the different Karatsuba and Toom-Cook constructions in order to determine the best combinations for each polynomial degree range, in the context of AVX2 and AVX512 instruction sets. This leads to different kernels and constructions in each case. In particular, in the context of AVX512, we use the VPCLMULQDQ instruction, which is a vectorized binary polynomial multiplication instruction. This instruction deals with up to four polynomial (of degree up to 63) multiplications, the four results being stored in one single 512-bit word. This allows to divide by roughly 3 the retired instruction number of the operation in comparison with the AVX2 instruction set implementations, while the speedup is up to 39% in terms of processor clock cycles. These results are different than the ones estimated in Drucker (Fast multiplication of binary polynomials with the forthcoming vectorized vpclmulqdq instruction, 2018). To illustrate the benefit of the new VPCLMULQDQ instruction, we used the HQC code to evaluate our approaches. When implemented in the HQC protocol, for the security levels 128, 192, and 256, our approaches provide up to 12% speedup, for key pair generation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
