JP2002175178A - Dividing method, dividing circuit and multiplying and dividing circuit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a dividing method, a dividing circuit and a multiplying and dividing circuit capable of executing a division of a large figure at a high speed. SOLUTION: In the dividing circuit, a subtraction processing part 22 for executing a subtraction of a divisor from a dividend repeatedly is constituted of a plurality of subtraction blocks DBi for dividing data of an object of the subtraction into a plurality of data and performing a parallel processing for the data, and a carry to be transmission information to a higher rank block which is generated in each block DBi at the time of the subtraction is processed at the next time subtraction. Namely, because each data of a small bit width are independently processed in each block DBi, transmission time for the carry generated within each block, that is the time required for a subtraction of one time is shortened. A processing for the generated transmission information is performed together at the next time calculation without performing a new and independent calculation and thereby the repeating times of calculations is not increased.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a division method, division circuit, and multiplication / division circuit for performing high-speed division of a large number of digits required for encryption processing of communication data and the like.

[0002]

2. Description of the Related Art Hitherto, in order to prevent leakage or tampering of communication data, authentication for confirming the validity of a communication partner or encryption of communication data has been performed by using encryption technology. I have.

One of the encryption systems used in such a system is a RAS public key encryption system (hereinafter simply referred to as “RA
S method) is known. When performing authentication by the RAS method, assuming that the plaintext is C, the ciphertext is S, the secret key is d, and the public key is e, n (= p × q: where p and q are prime numbers),
At the time of signature creation, the plaintext C is encrypted into the ciphertext S by the formula (1), and at the time of signature verification, the ciphertext S is decrypted into the plaintext C by the formula (2).

S = C ^d mod n (1) C = S ^e mod n (2) For example, when the secret key d and the public key n are set to 1024 bits, 1024 bits × 102
The multiplication of 4 bits and the division of 2048 bits divided by 1024 bits are repeated about 1500 times each.

That is, the secret key d expressed by a binary number is (3)
The d power of C can be expressed by equation (4). _{^{d = Σ {2 i d i}} } ( _{where, d i = 0 or1, Di} = 2 i d i) = 2 1023 d 1023 +2 1022 d 1022 + ... + 2 1 d 1 +2 0 d 0 = D1023 + D1022 + ... + D1 + D0 (3) C d = C D1023 · C D1022 · ... · C D1 · C D0 (4) Further, in the calculation for obtaining a remainder, as shown in (5),
The result is the same whether the remainder is obtained after multiplication or the multiplication is performed after obtaining the remainder.

(A · B) mod C = [(A mod C) · (B mod C)] mod C (5) Therefore, when d ₀ = 1, the remainder X modulo n on C ^D0 when d ₀ = 1. ₀ is C, and hereafter C in the case of d _i = 1
^The remainder X _i modulo n for ^Di (where i = 1 to 10
23) are sequentially calculated by using the remainder X _i−1, and only the remainder of which is actually d _i = 1 is sequentially extracted therefrom.
By repeatedly calculating the product and its remainder, the result of equation (1) can be obtained.

X ₀ = C (= C ^D0 : where d ₀ = 1) X ₁ = C ² mod n (= C ^D1 : where d ₁ = 1) X ₂ = C ⁴ mod n = X ₁ ² mod n (= C ^D2 : when d ₂ = 1) X ₃ = C ⁸ mod n = X ₂ ² mod n (= C ^D3 : where d ₃ = 1) ... X _i = C ⁽² Roh ⁱ th _{^{power) mod n = X i-1}} 2 mod n (= C Di: However, if the d _i = 1) ... ... in other words, the multiplication for calculating the X _i-1 ^2, and n from the multiplication result Divide by about 10 to calculate the remainder
00 times (actually 1023 times) and d ₀ to d ₁₀₂₃ representing the value of each digit of the secret key d expressed in binary
If there are about half of the cases where _i = 1, these are extracted and multiplied by each other, and multiplication and division for obtaining the remainder are executed about 500 times, so that the d of C is eventually obtained. When creating a signature for the remainder of the power,
The multiplication of 4 bits × 1024 bits and the division of 2048 bits ÷ 1024 bits need to be performed about 1500 times.

[0008]

By the way, when performing multi-digit multiplication / division exceeding 1000 bits, conventionally, a CPU (for example, 16 bits or 32 bits) having a smaller data bus size uses software. And the processing takes too much time.

Therefore, it is conceivable that these multiplications and divisions are performed by hardware. However, since the number of digits (bits) of a numerical value to be operated is large, generally, a simple sequential method having a simple structure is used. A circuit for calculating a product or a remainder is used. That is, in the case of multiplication, the product is calculated by repeating the shift and addition processes of the multiplicand according to the value of each digit of the multiplier represented by the binary number, while in the case of division, the shift and subtraction processes of the dividend are performed. By repeating, a well-known multiplication circuit and division circuit for calculating a quotient and a remainder are used.

In each of these multiplication circuits and division circuits, addition or subtraction is repeatedly performed in one multiplication or division. The time required for one addition / subtraction is dominated by the time required for the carry or borrow generated from the least significant bit (LSB) to be transmitted to the most significant bit (MSB). It increases almost in proportion to the data width (number of digits). For example, if the transmission time per bit of carry or borrow is 1 ns and the data width of the multiplicand or divisor is 1024 bits, the time required for one addition / subtraction is 1 μs or more.

In addition, when this sequential method is used, in the above-described 1024-bit × 1024-bit multiplication, as many as 1023 additions at the maximum and 2048 bits ま た 1
In the 024-bit division, as many as 1025 subtractions are performed. In other words, 1 ms for one multiplication or division
(≒ 1 μs × approximately 1000 times) or more, and therefore, when the multiplication and division are repeated about 1500 times as in the case of the above-described signature creation, it takes 3 seconds or more.

As described above, the above-mentioned R
In the case where the AS-type encryption technology is used, there is a problem that the time is consumed in seconds from the mounting of the IC card to the start of the target processing, resulting in poor usability. Note that the multiplication circuit is described in, for example, Japanese Patent Application Laid-Open No.
As disclosed in Japanese Unexamined Patent Publication (Kokai) No. H11-284, proposals have been made to increase the speed.

Accordingly, it is a first object of the present invention to provide a division method, a division circuit, and a multiplication / division circuit capable of performing a division with a large number of digits at a high speed in order to solve the above problems. And In addition, a circuit for performing multi-digit remainder calculation used in encryption technology or the like requires both a multiplication circuit and a division circuit, and has a problem that the circuit scale becomes extremely large.

It is a second object of the present invention to provide a small multiplication / division circuit.

[0015]

According to a first aspect of the present invention, there is provided a method for obtaining a division result by repeatedly executing a subtraction of a divisor from a dividend, the method comprising the steps of: The subtraction is performed for each of the divided blocks, and transmission information (carry when using an adder, borrow when using a subtractor) generated at the time of the subtraction is used for the next subtraction. It is characterized in that it is sometimes processed.

As described above, in the division method of the present invention, independent subtraction is executed for each block set so that the bit width of the data to be processed is smaller than the bit width of the divisor. The transmission time of the transmission information (carry / borrow) generated in each block by the subtraction, and hence the time required for one subtraction, is reduced.
Moreover, the processing of the generated transmission information is not performed by a new independent calculation but is performed together at the next subtraction, so that the number of repetitions of the calculation does not increase.

Therefore, according to the present invention, the processing time required for division can be greatly reduced, and the effect increases as the number of bits of the divisor increases and the number of repetitions of subtraction increases. The present invention can be suitably used for encryption processing in which the remainder calculation of data having a large number of digits is repeatedly executed.

The bit width of data processed by each block is set so that the transmission waiting time of transmission information is constant.
It is desirable that all have the same size. For example, 204
In the case of 8-bit / 1024-bit division, when the 1024-bit divisor is divided into 32 blocks of 32 bits and processed, the borrow transmission time is 1n per bit.
In the conventional method that does not divide into blocks, 1
The time required for one subtraction is about 1 μs, whereas in the present invention, the time required for one subtraction (that is, the transmission time of a borrow in each block) is about 32 ns, that is, about 1 /.
30.

In addition, the conventional method has a single circuit for performing M-bit division in the conventional method, whereas the present invention employs M / N circuits for performing N-bit division, and Except that the number of circuits for processing the transmitted information is slightly increased. However, if the data size N of each block is too small, not only the circuit portion for processing the transmission information becomes large, but also the transmission time of the transmission information in each block accounts for the proportion of the entire subtraction process. It is relatively small, and the effect of reducing the processing time with respect to the increase in the circuit scale is reduced. Therefore, the data size N of each block is desirably 8 bits or more.

Next, in the dividing circuit according to the present invention, a dividend register capable of storing an M-bit dividend and shifting a stored value in bit units, and shifting a stored value of the dividend register to a higher order side Holding means for holding a 1-bit value which overflows when the setting is made, and the subtracting means sets a stored value of the upper N (<M) bits of the dividend register as target data and sets a preset value from the target data. The N-bit divisor is subtracted, and the determination unit determines whether the subtraction is possible or not based on the result of the subtraction by the subtraction unit and the storage content of the holding unit. If it is determined that the subtraction is possible, the data updating unit determines The upper N bits of the dividend register are updated with the result of the subtraction by the subtractor.

The restart control means shifts the stored value of the dividend register to the upper side and restarts the subtraction means by controlling the least significant bit of the dividend initially set in the dividend register to the upper N bits of the dividend register. It repeats until it moves to the position of the least significant bit. As a result, the division result is obtained by repeating the subtraction of the divisor from the target data and the updating and shifting of the stored value of the dividend register. Specifically, the remainder is finally stored in the upper N bits of the dividend register. Will be.

In particular, in the present invention, the subtraction means stores a plurality of subtraction blocks for performing subtraction of R (<N) bits smaller than the data width N of the dividend, and transmission information generated in each of the subtraction blocks. The subtraction block is configured to execute subtraction reflecting transmission information of each subtraction block stored in the transmission information storage unit during the previous subtraction.

The dividing circuit of the present invention configured as described above realizes the above-described dividing method according to claim 1, and therefore, can achieve exactly the same effect. If the division result requires not only the remainder but also the quotient, the quotient output means determines 1 if the determination means determines that the subtraction is possible, and determines that the subtraction is impossible. In such a case, 0 may be output, and the output may be stored in the quotient register sequentially.

Incidentally, the subtraction block may be constituted by a subtractor which performs subtraction with borrow as described in claim 4, or an adder which performs addition with carry as described in claim 5. May be configured. In the case of the former (Claim 4), the determination unit determines whether the storage content of the holding unit is 1 or in a subtraction block located at the highest level (hereinafter, referred to as a “highest level subtraction block”) as transmission information. In the latter case (claim 5), the divisor is converted into a two's complement format and supplied to the subtraction block, and the determination means comprises a holding means. May be determined to be subtractable if the stored content of is 1 or if carry as transmission information occurs in the uppermost subtraction block.

That is, the data to be actually subtracted by the divisor is N + 1-bit data consisting of the stored value of the upper n bits of the dividend register and the storage contents of the holding means. , The result of subtraction with an N-bit divisor always becomes a positive value.
In this case, subtraction can be performed unconditionally.

If no borrow has occurred in the uppermost subtraction block or if a carry has occurred,
In most cases, subtraction is possible. However, the transmission information (borrow / carry) of the uppermost subtraction block can be changed by reflecting the transmission information (borrow / carry) stored in the transmission information storage means depending on the content of the subtraction result of each subtraction block. There is. Therefore, if the storage content of the holding unit is 0 and the transmission information of the uppermost subtraction block may change as described above, the auxiliary operation unit performs an operation for reflecting the transmission information on the subtraction result by each subtraction. The block may be executed, and as a result, when a borrow does not occur (the former case) or when a new carry occurs (the latter case), it may be determined that subtraction is possible.

Next, a multiplication / division circuit according to a sixth aspect of the present invention includes a first register capable of storing an M-bit product or a dividend and shifting a stored value in units of bits, and N (<M).
A second register for storing a bit multiplicand or divisor;
A third register capable of storing an N-bit multiplier or quotient and shifting the stored value in bit units, and holding a 1-bit value overflowing when the stored value of the first register is shifted upward. Means.

The operation means performs an operation on the output of the supply data selection means and the operation target data stored in the upper N bits of the first register. Based on the storage contents of the means and the operation mode, it is determined whether or not the calculation can be performed. As a result, if it is determined that the calculation is possible, the data updating means determines whether or not the calculation is possible by the data updating means. Update the upper N bits.

When the operation mode set from the outside is the multiplication mode, the multiplicand is set in the second register and the multiplier is set in the third register, and the supply data selection means sets the value stored in the third register (multiplier). ) Is supplied to the arithmetic means if the least significant bit is 1 and the stored value (multiplicand) of the second register is 0 if the least significant bit is 0, and the multiplication control means The control for shifting the stored value of the third register by one bit to the lower side and restarting the arithmetic means is performed by controlling the most significant bit of the stored value initialized in the third register to the most significant bit of the third register. Repeat until moving to the lower bit position.

As a result, the addition of the multiplicand corresponding to each bit representing the multiplier is repeated, and the value stored in the first register is sequentially updated based on the addition result, so that the multiplication result is finally added to the first register. The product will be stored. On the other hand, when the operation mode is the division mode, the dividend is set in the first register and the divisor is set in the second register.
The supply data selection means is configured to store the value of the second register (divisor)
Into two's complement form and supply it to the arithmetic means,
The division control means shifts the stored value (dividend) of the first register by one bit to the upper side and restarts the arithmetic means, and controls the least significant bit of the dividend initially set in the second register to the first register. Is repeated until the position moves to the position of the least significant bit in the upper N bits.

As a result, the subtraction of the divisor from the dividend is repeated, and the stored value of the first register is sequentially updated by the intermediate remainder as the result of the subtraction.
The remainder resulting from the division is stored in the register. This operation is the same as that of the division circuit according to the second aspect.

In particular, according to the present invention, the calculating means determines that R is smaller than the data width N of the second register in which the multiplicand and the divisor are stored.
(<N) A plurality of adders for performing addition with carry of bits and carry storage means for storing the carry generated by each of the subtractors, and the adder is stored in the carry storage means at the time of the previous operation. An operation reflecting the contents is performed.

As described above, according to the multiplication / division circuit of the present invention,
Using common first to third registers and common arithmetic means,
Since the configuration is such that both multiplication and division can be performed by switching the operation mode, the scale of a circuit that needs to execute both multiplication and division can be reduced to about half.

In addition, independent arithmetic operations (additions) are performed by using a plurality of adders which are set so that the bit width of the data to be processed is smaller than the bit width of the stored value (multiplicand / divisor) of the second register. ), The transmission time of the carry generated in each block by the calculation and, consequently, the time required for one calculation are reduced. Moreover, the processing of the generated transmission information is not performed by a new independent calculation but is performed together at the next subtraction, so that the number of repetitions of the calculation does not increase.

Therefore, according to the present invention, the processing time required for the operation (multiplication / division) by the operation means can be greatly reduced irrespective of the operation mode, and the remainder calculation of data having a large number of digits can be repeated. It can be suitably used for an encryption process to be executed. By the way, the determination means in the multiplication / division circuit according to the sixth aspect should always determine that the operation can be performed if the operation mode is the multiplication mode, while the operation mode is the division mode. For example, the determination may be made in exactly the same manner as in the case of claim 5 described above. That is, when the storage content of the holding means is 1, or when the carry is generated in the highest-order adder, or when the carry is newly generated by the execution of the auxiliary calculation means, the calculation can be performed. What is necessary is just to judge.

[0036]

Embodiments of the present invention will be described below with reference to the drawings. [First Embodiment] FIG. 1 shows a first embodiment in which a plaintext is encrypted or a ciphertext is decrypted by a known RAS public key cryptosystem.
It is a block diagram showing the composition of the cryptographic processing module of an embodiment.

As shown in FIG. 1, the cryptographic processing module 2 of this embodiment has N bits (N = 102 in this embodiment).
4) Input the multiplicand MX and the multiplier MY in (N bits) ×
A multiplication circuit 4 that performs multiplication of (N bits) and outputs a product MZ of M bits (M = 2048 in this embodiment), a dividend DX of M bits, and a divisor DY of N bits are input.
(M bits) ÷ (N bits) division circuit 6 for outputting N-bit quotient DS and remainder DZ, N-bit input sentence (plaintext / ciphertext) C, and N-bit secret key d, the public key n, the multiplication circuit 4 and the division circuit 6
And a control circuit 8 for executing an operation for encryption / decryption using the. And generating an output text (ciphertext / plaintext) S.

The control circuit 8 realizes the operation shown in the equation (1) by using the method described in the section of the prior art, and the processing is shown in FIG. Description will be given along a flowchart. Note that the secret key d and the public key n are given to the control circuit 8 in advance, and the processing is started by input of the input sentence C.

When this process is started, first, the input sentence C is stored in the lower N bits (hereinafter, referred to as “register RmL”) of the M-bit register Rm, and the counter i is initialized to 0 (S110). Next, it is determined whether or not a value di (here, i = 0) of the i-th digit of the secret key d is 1 (S120),
If di = 1, the lower N bits of the M-bit register Rs (hereinafter referred to as “register R
sL ”) (S130), and if di ≠ 1, the register Rs is initialized to 1 (S140).

Thereafter, the counter i is incremented (S150), and it is determined whether or not the counter i is smaller than the number N of bits of the secret key d (i <N) (S160). If the counter i is smaller than the number N of bits of the public key n, the multiplication circuit 4 is operated by setting the stored values of the register RmL as the multiplicand MX and the multiplier MY, and the product MZ output from the multiplication circuit 4 is stored in the register Rm. It is stored (S170).

Subsequently, a register Rm is set as the dividend DX.
And the public key n is set as the divisor DY to operate the divider 6, and the remainder DZ output from the divider 6 is stored in the register RmL (S180). These S17
As a result of the multiplication and division of 0 and S180, the remainder of C 2 ⁱ raised to the modulus n is stored in the register RmL.

Here, it is determined whether or not the value di of the i-th digit of the secret key is 1 (S190). If di ≠ 1, the process directly returns to S150. The multiplication circuit 4 is operated by setting the value stored in the register RmL as the multiplicand MX and the value stored in the register RsL as the multiplier MY,
The product MZ output from the multiplication circuit 4 is stored in the register Rs (S200).

Subsequently, as the dividend DX, the register Rs
, The public key n is set as the divisor DY, the division circuit 6 is operated, and the remainder DZ output from the division circuit 6 is
After the data is stored in the register RsL (S210), the process returns to S150, and the processes of S150 to S210 are repeatedly executed while i <N. Thus, the register RsL, so that the remainder of the n of dj = 1 and becomes all multiplied value of 2 ^j-th power of the remainder C until i th digit modulo is stored.

At S160, the counter i is set to the public key n.
If the number of bits N is not less than N, the value of N bits stored in the register RsL is output to the outside as an output sentence S (S220), and this processing ends. in this way,
The multiplication and division of S170 and S180 are performed 1023 times,
The multiplication and division in S200 and S210 are repeated by the number of digits where the value of the secret key d is 1.

Next, details of the multiplication circuit 4 and the division circuit 6 will be described. First, as shown in FIG. 3, the multiplication circuit 4 includes a multiplicand register 10 provided for storing a multiplicand MX.
And a multiplier register 11 provided for storing the multiplier MY and having a function of shifting the stored value in bit units. If the least significant bit (LSB) of the stored value of the multiplier register 11 is 1, the storage of the multiplicand register 10 is performed. Output value and LSB is 0
If so, the supply data selection circuit 12 that outputs a zero value
And a value stored in an output register (to be described later) provided therein and data supplied from the supply data selection circuit 12 are sequentially added to obtain a product MZ of the multiplicand MX and the multiplier MY. And a timing control unit 14 for controlling operation timings of the multiplier register 11 and the addition processing unit 13.

Here, as shown in FIG. 4A, the addition processing unit 13 divides the 1024-bit data DI supplied through the supply data selection circuit 12 into 32 equal parts, and generates 32-bit width divided data DI0. To DI31, 32 addition blocks MB0 to MB31 connected in parallel to perform addition processing, and addition blocks MB0 to MB3.
And a result register 15 for storing the lower 1024 bits of the product calculated in 1.

The addition block MBi is shown in FIG.
As shown in the figure, an arithmetic operation unit (ALU) 16 for performing addition with carry between two input data of 32 bits.
A carry register 17 for storing a 2-bit carry generated by the ALU 16, and a 32-bit width output register 18 for storing the operation result of the ALU 16. The divided data DIi and the value DOi stored in the output register 18 are used as input data.

In the output carry of ALU 16 stored in carry register 17, the upper bit is supplied to upper adder block MBi + 1 and the lower bit is the carry supplied from lower adder block MBi-1. At the same time, it is configured to be an input carry to the ALU 16 in the addition block MBi. However, the ALU 16 is configured to add the input carry from the lower addition block MBi-1 to the least significant bit and add the input carry from the same addition block MBi to the most significant bit.

Further, the output register 18 has a function of shifting the stored value to the lower side in bit units, and the least significant bit overflowed by the shift operation is stored in the output register 18 of the lower addition block MBi-1. The least significant bit that is input as the most significant bit and overflows from the output register 18 of the least significant addition block MB0 is connected so as to be input as the most significant bit of the result register 15. However, in the most significant addition block MB31, 0 is input to the most significant bit during the shift operation.

Then, the timing control section 14
Each time the operation is performed at step 16, the process of shifting the values stored in the multiplication register 11, the output register 18 of each of the addition blocks MB0 to MB31, and the result register 15 by 1 bit to the lower side is repeated N times, and the multiplier Register 1
When all the bits stored in 1 are output by the shift operation, finally, the divided data DI0 to DI31 are all set to zero, and the value stored in the output register 18 and the value stored in the carry register 17 are added. Then, the multiplication process ends.

At this time, of the product MZ which is the multiplication result,
The upper 1024 bits correspond to each of the addition blocks MB0 to MB3.
The lower 1024 bits are stored in the result register 15 in the 1 output register 18. These output registers 18 and result registers 15 are also collectively referred to as product registers.

Here, the state of the multiplication process will be specifically described with reference to the explanatory diagram shown in FIG. However, in order to simplify the explanation, the multiplicand MX (1101110111011101) and the multiplier MY
It is assumed that the data width of (1000110011101111) is 16 bits and the data width processed by each addition block MB is 4 bits.

As shown in FIG. 5, each addition block MBi
, The 4-bit stored value DO of the output register 18
The carry of i and the 2-bit carry (however, only the highest-order addition block has 1 bit) are both set to 0.
Therefore, if the least significant bit of the multiplier MY is 1, 1
In the third calculation, the multiplicand MX is output to the output register 18 as it is.
Is stored in As a matter of course, no carry occurs, so the values stored in the carry register 17 are all zero.

Thereafter, the stored value DO of each output register 18 is obtained.
i is shifted by one bit to the lower side, the LSB (here, 1) of the output register 18 of the addition block MB0 located at the lowest order is stored in the result register 15, and the stored value of the multiplier register 11 is shifted to the lower side. It is shifted one bit.

Hereinafter, similarly, the LSB of the multiplier register 11
If multiplied by 1, the multiplicand (see the second to fourth calculations in the figure)
If the LSB is 0, a zero value (see the fifth calculation in the figure) is used as the input data DI, and the input data DI
Stored value DO of output register 18, register 1 for carry
7 and the shift of the output register 18, the result register 15, and the multiplier register 11 are repeatedly executed. Finally, by adding (not shown) only the stored value DO of the output register 18 and the stored value of the carry register 17, the product MZ is stored in the output register 18 and the result register 15. Become.

Next, as shown in FIG. 6, the dividing circuit 6
It has a divisor register 20 provided for storing the divisor DY, a complement conversion circuit 21 for converting the value stored in the divisor register 20 into a two's complement format and outputting the result, and a dividend register (described later) for storing the dividend DX. , A subtraction processing section 22 as a subtraction means for obtaining a division result of dividing the dividend DX by the divisor DY by an operation of the stored value of the dividend register and the output of the complement conversion circuit 21, and a quotient output DSB from the subtraction processing section 22
And a timing control unit 24 that controls the operation timing of the subtraction processing unit 22 and the quotient register 23.

Here, as shown in FIG. 7 (a), the subtraction unit 22 converts the divisor or the dividend DX supplied to the two's complement format supplied through the complement conversion circuit 21 into the highest one.
An input data selection circuit 26 for selecting and outputting any of the 024 bits, and a 1024-bit input data DI selected by the input data selection circuit 26 divided into 32 equal parts,
Corresponding to the bit width divided data DI0 to DI31, 32 subtraction blocks DB0 to DB31 each connected in parallel so as to perform subtraction processing, and the lower 10 of the dividend DX
A lower dividend register 25 provided for storing 24 bits and having a function of shifting the stored value to the upper side in bit units, and stores the most significant bit overflowing from the most significant subtraction block DB31 by a shift operation described later. When at least one of the highest-order register 27 as a holding unit, the value stored in the highest-order register 27, and the transfer signal (carry in this embodiment) from the highest-order subtraction block DB31 is 1, 1 is set. Naru quotient output DS
Based on the OR circuit 28 generated as B, the timing signal from the timing controller 24, the quotient output DSB from the OR circuit 28, and various data supplied from each subtraction block DBi, A calculation execution control unit 29 for controlling the operation of each unit.

The subtraction block DBi is shown in FIG.
As shown in the figure, an arithmetic operation unit (ALU) 30 for performing addition with carry between two input data of 32 bits.
And carry register 3 as transmission information storage means for storing 1-bit carry generated by ALU 30
1, an output register 32 having a width of 32 bits for storing the operation result of the ALU 30, and one of the output DAi of the ALU 30 and the stored value DOi of the output register 32.
And an addition data selection circuit 33 for selecting as an input of 0.

That is, in the subtraction block DBi, the subtraction by the divisor is performed by adding the divisor expressed in a two's complement format. And ALU30
Performs addition of the divided data DIi from the input data selection circuit 26 and the data selected by the addition data selection circuit 33, and outputs the output DAi and the output carry Ci of the ALU 30.
Is supplied to the arithmetic execution control unit 29.

The carry Ci stored in the carry register 31 is supplied to the upper subtraction block DBi + 1, and the carry Ci-1 supplied from the lower subtraction block DBi-1 is used as the input carry to the ALU 30. It is connected to become. However, the ALU 30 is configured to add the input carry not to the least significant bit but to the second least significant bit.

Further, the output register 18 and the lower dividend register 25 of each of the subtraction blocks DB0 to DB31 have a function of shifting the stored value to the upper side in bit units. , Are connected so as to be input as the least significant bit of the output register 32 of the upper subtraction block DBi + 1. However, the most significant bit overflowing from the output register 32 of the most significant subtraction block DB31 is configured to be stored in the most significant register 27 as shown in FIG.

Then, the timing controller 24 controls the lower dividend register 25 and each of the subtraction blocks DB0 to MB
The timing for shifting the output register 32 is generated. In addition, in the arithmetic execution control unit 29, the subtraction processing unit 2
2 starts operation, each of the subtraction blocks DB0 to DB0
After clearing the values stored in the output register 32 of the DB 31 and the carry register 31 to zero, each subtraction block DB
An initialization process for setting the dividend DX in the output register 32 of 0 to DB31 and the lower dividend register 25 is performed. In this initialization process, the input data selection circuit 26
The upper 1024 bits of the dividend DX are set to be output as the input data DI, and the addition data selection circuit 33 in the subtraction block DBi is supplied to the ALU 30 with the value DOi stored in the output register 32 (that is, the zero value here). As a setting, a result of adding zero to the upper 1024 bits of the dividend DX by causing the ALU 30 to execute an operation (that is, the higher 1024 bits of the dividend DX itself)
Is stored in the output register 32, and at the same time, the lower 1024 bits of the dividend DX are stored in the lower dividend register 25. The output register 32 and the lower dividend register 25 are collectively referred to as a dividend register.

After this initialization processing, the operation execution control unit 29
Then, the input data selection circuit 26 is set to output the data obtained by converting the divisor DY into the two's complement format as the input data DI, and every time the ALU 30 performs an operation, the stored value of the uppermost register 27, Based on the operation result DAi and the carry Ci in the block ALU30, it is determined whether or not the operation of the operation result DAi and the carry Ci-1 (hereinafter referred to as "carry operation") is necessary (corresponding to a determination unit). If a carry operation is necessary, the addition data selection circuit 33 is set to supply the operation result DAi of the ALU 30 to the ALU 30. The ALU 30 stores the carry Ci-1 from the lower subtraction block DBi-1 in the DAi. Addition processing is performed, and the operation result DAi and carry Ci
, It is determined again whether the carry calculation is necessary.

On the other hand, when the carry operation is not required, the operation result DAi of ALU 30 is stored in output register 32 (corresponding to data updating means), and then output register 3
The values stored in the 2 and lower dividend registers 25 are each shifted upward by one bit, and the quotient output DSB is stored in the quotient register. Further, the addition data selection circuit 33
Is set to supply the stored value DOi of the output register 32 to the ALU 30 and a similar process is repeatedly executed (corresponding to a restart control unit).

This operation is repeated until the initial storage value of the lower dividend register 25 is input to the lowermost subtraction block DB0 by 1024 shift operations, and finally, the carry operation is performed and the division processing ends. At this time, as a result of the division, the quotient DS is stored in the quotient register 23, and the remainder DZ is stored in the output register 32 of each of the subtraction blocks DB0 to DB31.

Here, a method in which the calculation execution control unit 29 determines whether or not the carry calculation is necessary will be described with reference to the flowchart shown in FIG. First, whether the quotient output DSB generated by the OR circuit 28 is 1, that is, whether the value stored in the uppermost register 27 is 1 or whether the carry C31 is generated in the uppermost subtraction block DB31 (S310), and if DSB ≠ 1, it is determined whether or not carry Ci has been generated in any of the other subtraction blocks DB0 to DB30 (S320).

Then, if DSB = 1 or if no carry Ci has been generated in any of the subtraction blocks DBi, it is determined that the carry operation is unnecessary, and this processing ends. On the other hand, the subtraction block DBi (i = 0-3)
0), the carry Ci is generated, i = 31 (S330), and the subtraction block DBi
It is determined whether or not the operation result DAi is 1023, that is, whether all the bits are 1 (S340), and DAi = 102
If it is 3, it is determined whether the carry Ci-1 is generated in the lower subtraction block DBi-1 (S35).
0).

If carry Ci-1 has not been generated,
i is decremented (S360), and the process returns to S340.
The processing of S340 to S360 is repeated. And S35
0, it is determined that the carry Ci-1 has been generated, that is, the operation result DAj in the subtraction block DBj (j = i to 31) located higher than the subtraction block DBi-1.
Are 1023 (all 1) and carry C
If the carry is generated in the uppermost subtraction block DB31 by adding i-1 and the quotient output DSB changes from 0 to 1, the ALU
30, the operation result DAi stored in the output register 32, the shift operation of the output register 32 and the lower dividend register 25, and the storage of the quotient output DSB in the quotient register 23 are prohibited.
The setting is made to execute the carry operation (S370), and the present process ends.

Further, the subtraction block D located higher than the subtraction block DBi-1 in which the carry Ci-1 is generated.
When any one of the calculation results DAj in Bj (j = i to 31) is smaller than 1023 (S340)
-NO), the value of the quotient output DSB does not change even if the carry operation is executed, and thus the present process is terminated without executing the carry operation.

Here, the method of determining whether or not the carry operation is necessary has been described with reference to a flowchart. However, in practice, the determination result is obtained at high speed by, for example, a combination of logic circuits as shown in FIG. be able to. Here, the state of the division process will be specifically described with reference to the explanatory diagram shown in FIG. However, in order to simplify the explanation, the dividend DX
(1010101010101010) has a data width of 16 bits and a divisor D
It is assumed that the data width of Y (10011000) is 8 bits and the data width processed by each of the addition blocks DB0 to DB31 is 4 bits.

A value (01100111) obtained by converting the divisor DY into a two's complement format is used as input data DI.
The output register 32 of each of the subtraction blocks DB0 to DB31 stores the upper 8 bits (10
101010) is stored, and the values stored in the uppermost register 27 and the carry register 31 of each of the subtraction blocks DB0 to DB31 are cleared to zero.

As shown in FIG. 10, in the first operation, a carry occurs in the uppermost subtraction block, and the quotient output DS
Since B is 1 indicating that subtraction is possible, A
The stored value DO of the output register 32 is updated by the operation result DA in the LU 30, and the updated stored value DO is shifted by one bit to the upper side. At this time, since the most significant bit of DO is 0, 0 is stored in the most significant register 27, and the least significant bit of the output register 32 of the least significant subtraction block is the most significant bit of the least significant dividend register 25. A bit value (1 in this case) will be input.

In the second operation, no carry occurs in the uppermost block, and the value stored in the uppermost register 27 is 0. Therefore, the quotient output DSB is set to 0 indicating that the subtraction cannot be performed. Since the result does not require a carry operation, the output register 3 based on the operation result DA
2 is not updated, and only the shift of the stored value DO of the output register 32 is performed.

In the third and fourth calculations, the same processing as in the second calculation is performed. However, in the fourth operation, since the most significant bit of the stored value DO of the output register 32 is 1, when this stored value DO is shifted, 1 is stored in the most significant register 27. Therefore, in the fifth operation, although no carry occurs in the uppermost block, the value of the uppermost register 27 is 1, so that the quotient output DSB becomes 1, and the ALU 30 performs the same operation as in the first operation. , The stored value DO of the output register 32 is updated based on the calculation result DA, and the updated stored value DO is shifted.

Thereafter, similarly, the processing according to the value of the quotient output DSB is repeated, and the ninth operation in which the least significant bit of the lower dividend register 25 is input to the output register 32 of the subtraction block located at the lowest order is performed. When the processing is completed, finally, the quotient register 23 stores the quotient DS by executing the tenth operation (carry operation) for reflecting the contents of the carry register 31 to the stored value DO of the output register 32.
The remainder DZ is stored in the output register 32 of each subtraction block.

Although not shown in FIG. 10, for example, the quotient output DSB is 0 as a result of adding the storage value DO of the output register 32 and the storage value of the carry register 31 to the input data DI. If the arithmetic result DA of the ALU 30 of the uppermost subtraction block is all 1 (here, 15) and a carry is generated in an adjacent lower subtraction block, the carry is added to the arithmetic result DA. A carry operation to be reflected is inserted, and a result obtained by the operation is used as a value of the quotient output DSB or a value when updating the output register 32.

As described above, in the cryptographic processing module 2 of this embodiment, the multiplying circuit 4 repeatedly performs the addition of the multiplicand, and the division circuit 6 repeatedly performs the subtraction of the divisor from the dividend. The subtraction processing unit 22 is composed of a plurality of addition blocks MBi and a subtraction block DBi that divide data to be added / subtracted into a plurality of pieces and perform parallel processing, and are generated by the blocks MBi and DBi at the time of addition or subtraction. The carry, which is information transmitted to the upper block, is processed at the time of the next addition or subtraction.

That is, in each block MBi, DBi,
Since the data having a small bit width is processed independently, the transmission time of the transmission information (carry) generated in each block and the time required for one operation (addition or subtraction) are reduced. In addition, the processing of the generated transmission information is not performed by a new independent calculation but is performed collectively at the next calculation, so that the number of repetitions of the calculation is not increased.

Therefore, according to the encryption processing module 2 of the present embodiment, the processing time required for multiplication and division can be greatly reduced, and the encryption or decryption processing can be executed in a short time. . In the present embodiment, the division circuit 6 is provided with the quotient register 23. However, when only the remainder DZ is used and the quotient DS is not required, the quotient register 23 may be omitted.

Further, in the present embodiment, the subtraction block DBi in the division circuit 6 is constituted by the ALU 30 executing the addition with carry, but may be constituted by the ALU executing the subtraction with borrow. In this case, the complement conversion circuit 21 is omitted, and the value stored in the highest-order register 27 is 1 instead of the OR circuit 28, or no borrow occurs in the highest-order subtraction block DB31. It is necessary to provide a logic circuit for setting the quotient output DSB to 1. When the quotient output DSB is likely to change by reflecting the borrow, the calculation execution control unit 29 specifically generates a borrow in the subtraction block DBi-1, and All the subtraction blocks DBj (j = i
The carry operation may be executed when the operation results DAj in the steps 31 to 31) are all 0.

In this case, the progress of the division process is as shown in FIG.
Compared with the case where U is used (see FIG. 10), the stored values DO of the output register 32 during the operation are different from each other, but finally, the same operation result (quotient DS,
The remainder DZ) is obtained.

In the present embodiment, when the division circuit 4 determines whether or not a carry operation is necessary, only when the carry of the uppermost subtraction block DB31 changes from 0 to 1 surely, The carry operation is performed. For example, a carry has occurred in any one of the subtraction blocks, and the subtraction block DB3 located at the highest position
If the operation result DA31 in step 1 is 1023, the condition may be relaxed, such as performing a carry operation. In this case, the determination circuit can be simplified, and the time required for the determination can be reduced.

Further, in the present embodiment, the multiplication circuit 4 is configured to repeat addition one digit at a time corresponding to each digit of the multiplier, but it may be configured to add two digits at a time. Good. In this case, as shown in the calculation process in FIG. 12, each time the addition is performed, the stored value DO of the output register 18 is shifted by 2 bits, and each addition block M
The carry generated by Bi is, at the time of the next addition, within the same addition block MBi, the most significant bit and 2 bits from the most significant bit.
What is necessary is just to comprise so that it may be added to the number bit. [Second Embodiment] Next, a second embodiment will be described.

FIG. 2 is a block diagram showing the configuration of the cryptographic processing module of the second embodiment. Note that the cryptographic processing module of the present embodiment performs the same cryptographic processing as in the first embodiment, and includes an independent multiplication circuit 4 and division circuit 6
In that a common multiplication / division circuit 44 is used instead of

As shown in FIG. 2, the cryptographic processing module 42 of this embodiment performs multiplication of (multiplicand MX: N bits) × (multiplier MY: N bits) according to the designation of the operation mode.
Alternatively, a division of (dividend DX: M bits) ÷ (divisor DY: N bits) is executed, and the product MZ or the quotient DS and the remainder D
A multiplication / division circuit 44 that outputs Z, an N-bit input sentence (plaintext / encrypted text) C, and an N-bit secret key d and a public key n are input and encrypted using a multiplication circuit 4 and a division circuit 6. Performs an operation for encryption / decryption, and outputs an output sentence (ciphertext /
(Plaintext) S.

In this embodiment, however, it is assumed that M = 2048 and N = 1024, as in the first embodiment.
When the control circuit 48 causes the multiplication / division circuit 44 to execute multiplication (S170 and S200 in FIG. 2), the operation mode is set to the multiplication mode, and the division is executed (S180 and S210 in FIG. 2). Operates exactly the same as the control circuit 8 of the first embodiment except that the operation mode is set to the division mode, and the description is omitted here.

Next, as shown in FIG. 14, the multiplication / division circuit 44 includes a second multiplication / division DY provided for storing the multiplicand MX or the divisor DY.
A register 50 for storing the multiplier MY or the quotient DS and having a function of shifting the stored value in units of bits;
When the register 51 and the operation mode are the multiplication mode,
If the input control signal is 1, the value stored in the second register 50 is output, and if the control signal is 0, a zero value is output. If the operation mode is the division mode, the control signal does not depend on the control signal. , A supply data selection circuit 52 for converting the storage value of the second register 50 into a two's complement format and outputting the converted value, a storage value of an output register provided therein, and a supply data selection circuit 52.
Processing unit 5 for performing an operation with data supplied from
3 and the third register 5 when the operation mode is the multiplication mode.
The selector 54 supplies the least significant bit of the stored value of 1 to the supply data selection circuit 52 as a control signal, and supplies the quotient output DSB output by the arithmetic processing unit 53 to the third register 51 when the operation mode is the division mode. And the third register 5
1 and a timing control unit 55 for controlling the operation timing of the arithmetic processing unit 53.

Here, the arithmetic processing section 53 has substantially the same configuration as the subtraction processing section 22 shown in FIG. However, the output register 32 and the lower dividend register 25 (collectively referred to as a first register) are shifted to the lower side in the multiplication mode, and shifted to the upper side in the division mode. , The addition data selection circuit 33 is configured to fixedly supply the stored value DOi of the output register 32 to the ALU 30 in the multiplication mode.

The carry register 31 holds a 2-bit carry in the multiplication mode, supplies the upper bits to the upper block DBi + 1, and the lower bits together with the carry from the lower block DBi-1. In the division mode, a 1-bit carry is held and supplied to the upper block DBi + 1.

In the multiplication mode, the ALU 30 adds the carry from the carry register 31 to the most significant bit and the carry from the lower block DBi-1 to the least significant bit. In the division mode, the lower block D
The carry from Bi-1 is added to the second least significant bit.

The multiplication / division circuit 44 configured as described above
When the operation mode is the multiplication mode, the operation is exactly the same as the multiplication circuit 4 in the first embodiment. When the operation mode is the division mode, the operation is exactly the same as the division circuit 6 in the first embodiment. Therefore, according to the cryptographic processing module 42 of the present embodiment, exactly the same effects as those of the cryptographic processing module 2 of the first embodiment can be obtained.

Moreover, according to the cryptographic processing module 42 of the present embodiment, the multiplication / division circuit 44 can perform multiplication processing by adding only a small configuration to the division circuit 6 of the first embodiment. The configuration can be significantly reduced in size.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a cryptographic processing module according to a first embodiment.

FIG. 2 is a flowchart illustrating an outline of a process executed by a control circuit.

FIG. 3 is a block diagram illustrating a configuration of a multiplication circuit.

FIG. 4 is a block diagram illustrating an internal configuration of an addition processing unit and an addition block.

FIG. 5 is an explanatory diagram for understanding the operation of an addition processing unit.

FIG. 6 is a block diagram illustrating a configuration of a multiplication circuit.

FIG. 7 is a block diagram illustrating an internal configuration of a subtraction processing unit and a subtraction block.

FIG. 8 is a flowchart illustrating a method of determining whether or not a carry operation is necessary in an operation execution control unit.

FIG. 9 is a circuit diagram illustrating an example of a configuration in which a determination as to whether a carry operation is necessary is performed by a logic circuit.

FIG. 10 is an explanatory diagram for understanding the operation of a subtraction processing unit.

FIG. 11 is an explanatory diagram illustrating an operation when the subtraction block is configured by an ALU that performs subtraction with borrow.

FIG. 12 is an explanatory diagram illustrating an operation of another configuration example of the addition processing section.

FIG. 13 is a block diagram illustrating a configuration of a cryptographic processing module according to a second embodiment.

FIG. 14 is a block diagram illustrating a configuration of a multiplication / division circuit.

[Explanation of symbols]

2, 42 cryptographic processing module, 4 multiplication circuit, 6 division circuit, 8, 48 control circuit, 10 multiplicand register,
11 Multiplier register, 12, 52 Supply data selection circuit, 13 Addition processing unit, 14, 24, 55 Timing control unit, 15 Result register, 16, 30 Arithmetic operation unit (ALU), 17, 31 ... Register for carry,
18, 32 ... output register, 20 ... divisor register, 21
... Complement conversion circuit, 22 ... Subtraction processing unit, 23 ... Squotient register, 25 ... Lower dividend register, 26 ... Input data selection circuit, 27 ... Top register, 28 ... OR circuit, 29
... Calculation execution control unit, 33 ... added data selection circuit, 44 ...
Multiplication / division circuit, 50: second register, 51: third register, 53: arithmetic processing unit, 54: selector, DB0 to 31
... subtraction block, MB0 to 31 ... addition block

Claims (7)

[Claims] 1. A division method for obtaining a division result by repeatedly executing a subtraction of a divisor from a dividend, wherein the subtraction is executed for each block obtained by dividing the divisor into a plurality of blocks. Wherein the transmission information generated in step (1) is processed at the time of the next subtraction. 2. A dividend register capable of storing an M-bit dividend and shifting a stored value in bit units, and holding a 1-bit value overflowing when the stored value of the dividend register is shifted to a higher order side. Holding means for performing the above operation; subtracting a preset N-bit divisor from the target data using the stored value of the upper N (<M) bits of the dividend register as target data; Determining means for determining whether or not the subtraction is possible based on the result and the contents stored in the holding means; and when the determining means determines that the subtraction is possible, the higher order of the dividend register is determined by the result of the subtraction by the subtracting means. Data updating means for updating N bits, and control for shifting the stored value of the dividend register to the upper side and restarting the subtraction means are initialized in the dividend register. Reoccurrence control means for repeating until the least significant bit of the divisor moves to the position of the least significant bit in the upper N bits of the dividend register.Subtraction of the divisor from the target data and calculation of the stored value of the dividend register A division circuit for obtaining a division result by repeating an update and a shift, wherein the subtraction means includes: a plurality of subtraction blocks for performing subtraction of R (<N) bits; and a transmission generated by each of the subtraction blocks. Transmission information storage means for storing information, wherein the subtraction block performs subtraction reflecting transmission information of each subtraction block stored in the transmission information storage means at the time of previous subtraction. Division circuit. 3. A quotient output means for outputting 1 when the determination means determines that subtraction is possible, and outputting a 0 when it is determined that subtraction is impossible, and a quotient for sequentially storing outputs of the quotient output means. The division circuit according to claim 2, further comprising: a register. 4. The division circuit according to claim 2, wherein the subtraction block includes a subtractor that performs a subtraction with borrow, wherein the storage unit stores 0, In addition, when the transmission information stored in the transmission information storage unit is reflected in the subtraction result in each subtraction block, when the occurrence state of the transmission information in the uppermost subtraction block may change, An operation for reflecting the transmission information in the subtraction result,
In addition to having an auxiliary arithmetic unit to be executed by each subtraction block, if the storage content of the holding unit is 1, or if a borrow as the transmission information does not occur in the uppermost subtraction block, or A division circuit that determines that subtraction is possible when no borrow occurs even by execution of the auxiliary calculation means. 5. The division circuit according to claim 2, wherein the subtraction block includes an adder that performs addition with carry, and the subtraction block converts the divisor into a two's complement format. When the storage content of the holding unit is 0 and the subtraction result in each subtraction block reflects the transmission information stored in the transmission information storage unit, the determination unit is positioned at the highest position. When there is a possibility that the occurrence state of the transmission information in the subtraction block to be changed, an operation of reflecting the transmission information in the subtraction result,
Auxiliary calculation means to be executed by each subtraction block is provided, and if the storage content of the holding means is 1, or if the carry as the transmission information is generated in the topmost subtraction block, or A division circuit for determining that subtraction is possible when a carry is newly generated by execution of the arithmetic means. 6. A first register for storing a product or dividend of M bits and capable of shifting a stored value in bit units, a second register for storing a multiplicand or divisor of N (<M) bits, A third register capable of storing an N-bit multiplier or quotient and shifting the stored value in bit units; and holding a 1-bit value overflowing when the stored value of the first register is shifted upward. In accordance with an operation mode set from the outside, when the operation mode is a multiplication mode, if the least significant bit of the stored value of the third register is 1, the stored value of the second register is
If the least significant bit is 0, an M-bit zero value is output,
On the other hand, when the operation mode is the division mode, supply data selection means for converting the value stored in the second register into a two's complement format and outputting the result, output of the supply data selection means, An operation means for executing an operation with the operation target data stored in the upper N bits; and determining whether or not the operation is possible based on the operation result of the operation means, the storage content of the holding means, and the operation mode. Judging means; data updating means for updating upper N bits of the first register based on the operation result of the operation means when the operation means judges that the operation is possible; and the operation mode is a multiplication mode. In this case, the control of shifting the stored values of the first and third registers by one bit to the lower side and restarting the arithmetic means is performed by the third control.
Multiplication control means for repeating until the most significant bit of the stored value initialized in the register moves to the position of the least significant bit of the third register; and when the operation mode is the division mode, the multiplication control means The control for shifting the stored value by one bit to the upper side and restarting the arithmetic means is performed by setting the least significant bit of the dividend initially set in the second register to the least significant bit in the upper M bits of the first register. A multiplication / division circuit operating in an operation mode set from the outside, comprising: a plurality of division control means for performing an addition with carry of R (<N) bits. An adder; and carry storage means for storing the carry generated by each of the subtractors, wherein the adder is stored in the carry storage means at the time of the previous operation. Multiplication and division circuit and executes the addition processing that reflects the contents were. 7. When the operation mode is the division mode, the determination unit determines that the storage content of the holding unit is 0 and the addition result of each adder is:
When the carry stored in the carry storage means is reflected, if there is a possibility that the occurrence state of the carry in the uppermost adder may change, an operation for reflecting the carry in the addition result is performed by each addition. And if the operation mode is the multiplication mode, it is always determined that the operation is possible. If the operation mode is the division mode, if the storage content of the holding unit is 1, 7. The multiplication / division according to claim 6, wherein if the carry is generated in the uppermost adder, or if the carry is newly generated by the execution of the auxiliary calculation means, it is determined that the calculation can be performed. Arithmetic circuit.