Search

Montgomery modular multiplication is widely-used in public key cryptosystems (PKC) and affects the efficiency of upper systems directly. However, modulus is getting larger due to the increasing demand of security, which results in a heavy computing cost. High-performance implementation of Montgomery modular multiplication is urgently required to ensure the highly-efficient operations in PKC. However, existing high-speed implementations still need a large amount redundant computing to simplify the intermediate result. Supports to the redundant representation is extremely limited on Montgomery modular multiplication. In this paper, we propose an efficient parallel variant of iterative Montgomery modular multiplication, called DRMMM, that allows the quotient can be computed in multiple iterations. In this variant, terms in intermediate result and the quotient in each iteration are computed in different radix such that computation of the quotient can be pipelined. Based on proposed variant, we also design high-performance hardware implementation architecture for faster operation. In the architecture, intermediate result in every iteration is denoted as three parts to free from redundant computations. Finally, to support FPGA-based systems, we design operators based on FPGA underlying architecture for better area-time performance. The result of implementation and experiment shows that our method reduces the output latency by 38.3\% than the fastest design on FPGA.

Transformer has been successfully used in practical applications, such as ChatGPT, due to its powerful advantages. However, users' input is leaked to the model provider during the service. With people's attention to privacy, privacy-preserving Transformer inference is on the demand of such services. Secure protocols for non-linear functions are crucial in privacy-preserving Transformer inference, which are not well studied. Thus, designing practical secure protocols for non-linear functions is hard but significant to model performance. In this work, we propose a framework \emph{East} to enable efficient and accurate secure Transformer inference. Firstly, we propose a new oblivious piecewise polynomial evaluation algorithm and apply it to the activation functions, which reduces the runtime and communication of GELU by over 1.5$\times$ and 2.5$\times$, compared to prior arts. Secondly, the secure protocols for softmax and layer normalization are carefully designed to faithfully maintain the desired functionality. Thirdly, several optimizations are conducted in detail to enhance the overall efficiency. We applied \emph{East} to BERT and the results show that the inference accuracy remains consistent with the plaintext inference without fine-tuning. Compared to Iron, we achieve about 1.8$\times$ lower communication within 1.2$\times$ lower runtime.

Permutation polynomials with coefficients 1 over finite fields attract researchers' interests due to their simple algebraic form. In this paper, we first construct four classes of fractional permutation polynomials over the cyclic subgroup of $ \mathbb{F}_{2^{2m}} $. From these permutation polynomials, three new classes of permutation polynomials with coefficients 1 over $ \mathbb{F}_{2^{2m}} $ are constructed, and three more general new classes of permutation polynomials with coefficients 1 over $ \mathbb{F}_{2^{2m}} $ are constructed using a new method we presented recently. Some known permutation polynomials are the special cases of our new permutation polynomials. Furthermore, we prove that, in all new permutation polynomials, there exists a permutation polynomial which is EA-inequivalent to known permutation polynomials for all even positive integer $ m $. This proof shows that EA-inequivalent permutation polynomials over $ \mathbb{F}_{q} $ can be constructed from EA-equivalent permutation polynomials over the cyclic subgroup of $ \mathbb{F}_{q} $. From this proof, it is obvious that, in all new permutation polynomials, there exists a permutation polynomial of which algebraic degree is the maximum algebraic degree of permutation polynomials over $ \mathbb{F}_{2^{2m}} $.

Modular exponentiation and scalar multiplication are important operations of most public key cryptosystems, and their fast calculation is essential to improve the system efficiency. The shortest addition chain is one of the most important mathematical concepts to realize the optimization. However, finding a shortest addition chain of length k is an NP-hard problem, whose time complexity is comparable to O($k!$). This paper proposes some novel methods to generate short addition chains. We firstly present a Simplified Power-tree method by deeply deleting the power-tree, whose time complexity is reduced to O($k^2$) sacrificing some increasing of the addition chain length. Moreover, a Cross Window method and its variant are introduced by improving the Window method. More precisely, the Cross Window method uses the cross correlation to deal with the windows and its pre-computation is optimized by the Addition Sequence algorithm. The theoretical analysis is conducted to show the correctness and effectiveness. Meanwhile, the experiment shows that the new methods can obtain shorter addition chains compared to the existing methods. The Cross Window method with the Addition Sequence algorithm can attain 9.5% reduction of the addition chain length, in the best case, compared to the Window method., Comment: 15 pages

Permutation polynomials over finite fields are an interesting and constantly active research subject of study for many years. They have important applications in areas of mathematics and engineering. In recent years, permutation binomials and permutation trinomials attract people's interests due to their simple algebraic forms. In this paper, by reversely using Tu's method for the characterization of permutation polynomials with exponents of Niho type, we propose a new method to construct permutation trinomials with coefficients 1. Moreover, we give the explicit compositional inverses of a class of permutation trinomials for a special case.

Normal bases and self-dual normal bases over finite fields have been found to be very useful in many fast arithmetic computations. It is well-known that there exists a self-dual normal basis of $\mathbb{F}_{2^n}$ over $\mathbb{F}_2$ if and only if $4\nmid n$. In this paper, we prove there exists a normal element $\alpha$ of $\mathbb{F}_{2^n}$ over $\mathbb{F}_{2}$ corresponding to a prescribed vector $a=(a_0,a_1,...,a_{n-1})\in \mathbb{F}_2^n$ such that $a_i={Tr}_{2^n|2}(\alpha^{1+2^i})$ for $0\leq i\leq n-1$, where $n$ is a 2-power or odd, if and only if the given vector $a$ is symmetric ($a_i=a_{n-i}$ for all $i, 1\leq i\leq n-1$), and one of the following is true. 1) $n=2^s\geq 4$, $a_0=1$, $a_{n/2}=0$, $\sum\limits_{1\leq i\leq n/2-1, (i,2)=1}a_i=1$; 2) $n$ is odd, $(\sum\limits_{0\leq i\leq n-1}a_ix^i,x^n-1)=1$. Furthermore we give an algorithm to obtain normal elements corresponding to prescribed vectors in the above two cases. For a general positive integer $n$ with $4|n$, some necessary conditions for a vector to be the corresponding vector of a normal element of $\mathbb{F}_{2^n}$ over $\mathbb{F}_{2}$ are given. And for all $n$ with $4|n$, we prove that there exists a normal element of $\mathbb{F}_{2^n}$ over $\mathbb{F}_2$ such that the Hamming weight of its corresponding vector is 3, which is the lowest possible Hamming weight.

In this paper, we describe a different approach to the proof of the nonexistence of homogeneous rotation symmetric bent functions. As a result, we obtain some new results which support the conjecture made in this journal, i.e., there are no homogeneous rotation symmetric bent functions of degree >2. Also we characterize homogeneous degree 2 rotation symmetric bent functions by using GCD of polynomials.

Rotation symmetric Boolean functions have important applications in the design of cryptographic algorithms. In this paper, the Conjecture about rotation symmetric Boolean functions (RSBFs) of degree 3 proposed by Cusik and St\u{a}nic\u{a} is proved. As a result, the nonlinearity of such kind of functions is determined.