KR100322740B1 - Modular computing apparatus and method thereof - Google Patents

Abstract

The present invention relates to a modular arithmetic unit used in a public key encryption / decryption and digital signature system and a method thereof, and a modular arithmetic unit according to the present invention receives an A value and shifts to a lower bit direction in units of w bits, A memory means for outputting a bit; S memory means and C memory means for storing temporary values; 0, B · 2 ^w , ... , B multiplication means for outputting (2 ^w -1) B 2 ^w ; 0, N, ... , N multiplication means for outputting (2 ^w -1) N; S receives the memory means to the sum of the least significant w bits of the C value memory means and the least significant w bits of the N value, mi generator for generating a m _i; First selecting means for selecting one of the outputs of the B multiplying means by the least significant bit value of the A memory means; second selecting means for selecting one of the outputs of the N multiplying means by the output value of the m _i generator; A first carry storing adder for adding all the output values of the C memory means, the first selecting means, and the second selecting means to output S1 and C1; W + 1 bits of S 2 are transferred to the S memory means, and the upper k + w + 2 bits of C 2 are added to the C memory means And a second carry storing adder for transmitting the second carry storing adder.

According to the present invention, a modulo exponentiation and a modular multiplication operation used for public key encryption / decryption and digital signature can be efficiently performed within a fewer number of clocks by using the Montgomery algorithm, and its configuration is simple and economical have.

Description

Modular computing apparatus and method thereof

The present invention relates to a modular computing apparatus and, more particularly, to a modular computing apparatus and method for use in a public key encryption / decryption and digital signature system.

In 1976 Diffie and Hellman introduced a new concept of modern cryptography by introducing the concept of a public key cryptosystem using mathematically unstable problem solving. In conventional conventional or symmetric cryptosystem, there are disadvantages such as difficulty in key management and difficulty in implementing digital signature since two users to communicate should share the same secret key. In the public key cryptosystem, the public key and the secret key are computed using the unity of the problem which is difficult to solve mathematically. The public key is disclosed to the public and only the private key is kept by each user. Therefore, anyone with the public key of the disclosed party can communicate secretly with the other party.

The most widely used problems in public key cryptosystems are the discrete logarithm problem and the factorization problem. A typical public key cryptosystem is the ElGamal cryptosystem based on the discrete algebra problem and the Revest Shamir Adleman (RSA) cryptosystem based on the factorization problem. The standard adopted by the international standard is ISO (International Organization for Standardization) / IEC (International Electrotechnical Commission) 9796, Elgamese variant of US DSA, Russian GOST, etc. And KC-DSA in Korea.

On the other hand, a digital signature is a technique that allows electronic documents to provide a function of handwritten signature on a conventional paper when electronic information is exchanged.

The public key cryptosystem and the digital signature system is mostly modular exponentiation ^{(modular exponentiation: m e mod N} ) is necessarily requiring calculation, and repeatedly performs a modular multiplication (AB mod N) to the modular exponentiation Do. A classical algorithm, Barret's algorithm, and Montgomery algorithm are proposed for modular multiplication.

The classical algorithm is a method of reducing the modulus by repeating the process of estimating the quotient by one digit as in the case of calculating the remainder by dividing by a pencil. This is the most common modular reduction algorithm that can be applied in any case since there is no restriction on law M and no pre- or post-calculations are required. However, in estimating the quotient (slower than multiplication) division is required and the estimated quotient is not accurate, it is relatively slow because it requires additional addition or subtraction.

The Barrett algorithm estimates the entire quotient at once using the pre-computed values for the fixed method, and performs the modular reduction only by the multiplication. This shows better performance than the classical algorithm in modular exponentiation where the law M is fixed or a large number of modular multiplications are required for the same law.

The Montgomery algorithm is the most widely used public key cryptosystem which requires modular exponentiation because it is faster than other algorithms. In other words, the given numbers are transformed into a multi-modal system which can reduce modularity only by multiplication, modularly reduced there, and then converted back to the original modular system to obtain desired results. Since most of the public key cryptosystems require a modular exponentiation operation, this pre / post computation has little effect on the overall execution speed.

The present invention can efficiently perform a modular exponentiation and a modular multiplication operation used for public key encryption / decryption and digital signature in a small number of clocks using the Montgomery algorithm, The purpose is to provide.

1 is a block diagram showing a configuration of a modular arithmetic unit according to the present invention.

FIG. 2 is a block diagram of the first carry save adder and the second carry save adder shown in FIG. 1. FIG.

In order to achieve the above object, the modular operation A memory means having a storage capacity of k bits and receiving the A value and shifting in the lower bit direction in units of w bits every clock and outputting the lowest w bits; S memory means having a storage capacity of (k + w + 1) bits and outputting a least significant bit w; C memory means having a storage capacity of (k + w + 2) bits and outputting the least significant bit; The B value is input, and 0, B · 2 ^w , ... , B multiplication means for outputting 2 ^w values by calculating (2 ^w -1) · B 2 ^w ; The N value is input, and 0, N, ... , N multiplication means for outputting 2 ^w values by calculating (2 ^w -1) N; Receives a value t _i obtained by adding the least significant w bits of the S memory means and the C memory means and N ₀ which is the least significant bit of the N value for every clock, In mi generator (here, to generate a m _i by, ); The output of the B multiplying means by the lowest w bit value of the A memory means every clock, , (2 ^w -1) 揃 B 揃 r; The output of the N multiplication means by the output value of the m _i generator for every clock, , (2 ^w -1) N; A first carry store adder for adding the output values of the C memory means, the first selecting means, and the second selecting means to output a sum S1 of each bit and a carry C1 of each bit; And the upper k + w + 1 bits of the output S 2 are added to the S memory means S 1 and S 2, respectively, by adding the output of the S memory means and the outputs S 1 and C 1 of the first carry storage adder to output the sum S2 of each bit and the carry C 2 of each bit, A second carry store adder for transferring the upper k + w + 2 bits of the output C2 to the C memory means; A first adder for adding the least significant bit value of the S memory means and the C memory means to the m _i generator; And a second adder for adding the least significant w bit value of the outputs S2 and C2 of the second carry store adder to generate a carry value, wherein the carry value generated by the second adder is delayed by one clock, (K = w? S, where k, w, and s are both integers greater than or equal to 2) as the least significant bit and input to the second carry adder as a carry input.

In order to achieve the above other objects, A · B · 2 ^-k mod N (A) temporary values S and C are initialized to 0, and 0, B · 2 ^w , , (2 ^w -1) · B · 2 ^w is prepared, and a table composed of 0, , (2 ^w -1) N; (b) Assuming that the carry C 1 _ ₀ calculated from the previous clock is an input carry and is a value t _i obtained by adding the lower w bits of S and C, and the least significant bit of N is N ₀ , m _i = t _i N ₀ 'mod 2 ^w, Gt; mi &_lt; / RTI > by &_lt; N ₀ '= -N ₀ mod 2 ^w ); (c) the 0, B, 2 ^w , ..., ^{, (2 w -1) · B} · select the value of one of the table consisting of a 2 ^w, the 0, according to the value m _i, and ... , (2 ^w -1) N; selecting a value of one of the tables; (d) generating a sum S1 of each bit and a carry C1 of each bit by carrying out addition and subtraction of the temporary value C and the two values selected in the step (c); (e) carries out addition and subtraction of both the temporary value S and the S1 and C1 to generate a sum S2 of each bit and a carry C2 of each bit; (f) S2, placing with the generated carry is added when the least significant w bits of the C2 to C1_ _0, a value other than the least significant w bits of the S2, C2 to each of the new S and C; (g) repeating the steps (b) to (f) by (s + 1) times while shifting A by w bits to the lower bit side; And (h) adding S and C to T, and if T is greater than N, subtracting N from T, as a result of modular operation, wherein A, B, and N are k is a value of k bits, k = w s, and w and s are both an integer of 2 or more).

In the present invention,

And to implement A · B mod N efficiently using the Montgomery algorithm. At this time, A, B, and N are (Where k = s 占,, r = 2 ^w ), which is a large number that can be represented by? According to Montgomery's algorithm, T = A · B · R ^-1 mod N can be expressed as follows (where R = r ^s ).

Where m _i is determined by the least significant word value of the i th temporary value, t _i , which can be constructed using a combination circuit. In other words, , (Where N ₀ is the least significant word of N). At this time, as the size of the word increases, the depth of the combinational circuit becomes deeper and the propagation delay time of the signal becomes longer. For example, when a word is composed of two bits, m _i can form a combining circuit based on Table 1 below.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described in detail with reference to the accompanying drawings.

A circuit for calculating T = A 占 · R- ¹ mod N according to Equation 1 can be constructed as shown in Fig.

A memory means (10), B the memory means 12 and the N memory means (14) are implemented each in the form of a register or similar memory in k-bit, A to calculate ^{A · B · 2 -k mod N} , B, and N are stored. The A memory means 10 is a shift register for shifting by one word unit, that is, w bit unit, to the lower bit side every clock (in the case of a memory, the value is read in one word unit).

B multiplier 20 receives B from B memory means 12, , (2 ^w -1) · B · r are calculated and managed in the form of a table. The N multiplier 22 receives N from the N memory means 14, , (2 ^w -1) · N are calculated and managed in the form of a table.

The S memory means 16 and the C memory means 18 are each implemented by a register of k + w + 2 bits or a similar type of memory, and store the latest temporary value generated in the calculation for each clock. 1 _w-1 ... a ₀ , S _w-1 ... S ₀ , C _w-1 ... C ₀ represent the Least Significant Word (LSW) of the A memory means 10, the S memory means 18 and the C memory means 16, respectively.

The mi generator 28 is a combinational circuit that generates m _i by N ₀ and a value obtained by adding the S word memory means 16 and the least significant word value of the C memory means 18 every clock.

The first multiplexer 26 outputs, from the B multiplier 20, 0, ..., , (2 ^w -1) · B · r is selected. The second multiplexer 28 receives 0, ..., N from the N multiplier 22 according to the output value of the m _i generator 24, , (2 ^w -1) · N.

The first carry store adder 30 and the second carry store adder 32 of FIG. 1 receive three inputs, respectively, and output a carry and its sum. In the case of addition of a large number of bits, the propagation time of the carry occurring in the addition becomes a problem. Moreover, in applications such as the RSA exponentiation, many multiplications are successive additions, so fast adders are an important factor. The present invention adopts a carry storage adder having a propagation delay time equal to one full adder by taking the number of arbitrary k bits as input when performing addition.

Referring to FIG. 2, the carry store adder is represented by the following two equations C _{i + 1} = A _i B _i + B _i C _i + C _i A _i , which can be implemented using a full adder as many as the number of input bits. By using this carry storage adder, the propagation delay of the critical path is significantly reduced, thereby increasing the clock speed of the processor and eliminating the need to newly express the input.

3, the C2 output of the second carry adder 32 is k + 2w + 2 bits and the S2 output is k + 2w + 1 bits, the sum of the LSWs of these outputs S2 and C2 is always zero . Therefore, the LSWs of the outputs S2 and C2 of the second carry storing adder 32 are inputted to the input terminals of the S memory means 18 and the C memory means 16 for storing temporary values, respectively, Except that k + w + 1 and k + w + 2 bits are input.

The first adder 34 adds the least significant word value of the S memory means 16 and the C memory means 18 and transfers it to the m _i generator 24. The second adder 36 adds the LSWs of the outputs S2 and C2 of the second carry store adder 32 and outputs the carry value. The carry value is input to the D flip-flop 38, the first adder 34 is 1 clock delay as the least significant bits of S1 being input to the second carry save adder 32, a carry value by the C1_ _0.

Hereinafter, the operation of the present invention will be described with reference to FIG.

The important point in the present invention is to calculate (A · B · 2 ^-k mod N) at s + 1 clocks by receiving k bits A, B and N, respectively. (A · B · 2 ^-k mod N) is described as follows.

a) First, initialize k bits A, B, N in each register or memory. The S memory means 18 for storing the temporary value and the C memory means 16 are initialized to zero.

b) before the clock of the second carry save adder 32, the output of S2, when added to the lower w bits of the C2 produced which carry C1_ ₀ to the input carry to S memory means 18 and the C memory means of calculation (16 ) ≪ / RTI > plus the lower w bits of &_lt; RTI ID = 0.0 >

c) When all the data has been input into each register or memory, the first multiplexer 26 selects a _w-1 ... According to a ₀ value, 0, B · r, ... , (2 ^w -1) B · r, and the second multiplexer 28 selects one of 0, N, ... according to the value of m _i . , And (2 ^w -1) N, respectively.

d) The first carry store adder 30 adds the outputs of the C memory means 16, the first multiplexer 26 and the second multiplexer 28 and adds the outputs S1 and C1 to the inputs of the second carry store adder 32 .

e) The second carry store adder 32 receives the outputs of the S memory means 18 and the outputs S1 and C1 of the first carry store adder 30 and outputs S2 and C2. At this time, the least significant bit of S1 is composed of a carry added by the lower w bits of S2 and C2.

f) stores the values excluding the lower w bits of S2 and C2 in the S memory means 18 and the C memory means 16, respectively.

g) shifting the stored value of the A memory means 10 by one word to the lower bit side during the (s + 1) -th clock, and repeats b) to f).

h) If the value T, which is the sum of the remaining values in the S memory means 18 and the C memory means 16, is greater than N, then a value obtained by subtracting N from T is taken as T value.

In the present invention, all the elements except the memory means such as a resistor are implemented by a simple combination circuit, so that a clock which can sufficiently guarantee the propagation delay time of the connected combination circuit should be provided in order to prevent erroneous operation of the circuit.

The process of calculating the modular multiplication A · B mod N using the modular operation apparatus according to the present invention is as follows.

(1) First, P = 2 ^2k mod N is calculated in advance.

(2) Next, C = A · B · 2 ^-k mod N is calculated using the circuit shown in FIG.

(3) Finally, calculate P · C · 2 ^-k mod N = A · B mod N.

According to the present invention, a modulo exponentiation and a modular multiplication operation used for public key encryption / decryption and digital signature can be efficiently performed within a fewer number of clocks by using the Montgomery algorithm, and its configuration is simple and economical have.

Claims (5)

Modular operation A · B · 2 ^-k mod N The apparatus comprising: an A memory means having a storage capacity of k bits and receiving the A value and shifting in a lower bit direction in units of w bits for every clock and outputting a lowest w bit; S memory means having a storage capacity of (k + w + 1) bits and outputting a least significant bit w; C memory means having a storage capacity of (k + w + 2) bits and outputting the least significant bit; The B value is input, and 0, B · 2 ^w , ... , B multiplication means for outputting 2 ^w values by calculating (2 ^w -1) · B 2 ^w ; The N value is input, and 0, N, ... , N multiplication means for outputting 2 ^w values by calculating (2 ^w -1) N; Receives a value t _i obtained by adding the least significant w bits of the S memory means and the C memory means and N ₀ which is the least significant bit of the N value for every clock, m _i = t _i N ₀ 'mod 2 ^w, In mi generator (here, to generate a m _i by, N ₀ '= -N ₀ mod 2 ^w ); The output of the B multiplying means by the lowest w bit value of the A memory means every clock, , (2 ^w -1) 揃 B 揃 r; The output of the N multiplication means by the output value of the m _i generator for every clock, , (2 ^w -1) N; A first carry store adder for adding all the output values of the C memory means, the first selecting means, and the second selecting means to output a sum S1 of each bit and a carry C1 of each bit; And the upper k + w + 1 bits of the output S 2 are added to the S memory 22, and the sum of the outputs S 1 and C 1 of the first carry storing adder is summed to output the sum S2 of each bit and the carry C 2 of each bit, A second carry store adder for transferring the upper k + w + 2 bits of the output C2 to the C memory means; A first adder for adding the least significant bit value of the S memory means and the C memory means to the m _i generator; And And a second adder for adding the least significant w bit value of the outputs S2 and C2 of the second carry store adder to generate a carry value of the second carry adder, wherein the carry value generated by the second adder is delayed by one clock, Wherein k = w s and k, w, s are all integers greater than or equal to 2, and wherein the first carry adder is provided as a carry input to the second carry adder, ). 2. The apparatus of claim 1, wherein the B multiplying means and the N multiplying means are And a memory means of a table format in which the output values are calculated in advance and stored. 2. The apparatus according to claim 1, wherein the first selecting means and the second selecting means are Multiplexer. The method according to claim 1, And a D flip-flop for delaying the carry value generated by the second adder by one clock. Modular operation A · B · 2 ^-k mod N A method according to claim 1, (a) initialize temporary values S and C to 0, and use 0, B, 2 ^w , ... , (2 ^w -1) · B · 2 ^w is prepared, and a table composed of 0, , (2 ^w -1) N; (b) Assuming that the carry C 1 _ ₀ calculated from the previous clock is an input carry and is a value t _i obtained by adding the lower w bits of S and C, and the least significant bit of N is N ₀ , m _i = t _i N ₀ 'mod 2 ^w, Gt; mi &_lt; / RTI > by &_lt; N ₀ '= -N ₀ mod 2 ^w ); (c) the 0, B, 2 ^w , ..., ^{, (2 w -1) · B} · select the value of one of the table consisting of a 2 ^w, the 0, according to the value m _i, and ... , (2 ^w -1) N; selecting a value of one of the tables; (d) generating a sum S1 of each bit and a carry C1 of each bit by carrying out addition and subtraction of the temporary value C and the two values selected in the step (c); (e) carries out addition and subtraction of both the temporary value S and the S1 and C1 to generate a sum S2 of each bit and a carry C2 of each bit; (f) S2, placing with the generated carry is added when the least significant w bits of the C2 to C1_ _0, a value other than the least significant w bits of the S2, C2 to each of the new S and C; (g) repeating the steps (b) to (f) by (s + 1) times while shifting A by w bits to the lower bit side; And (h) adding S and C to T, and if T is greater than N, subtracting N from T, as a result of the modular arithmetic operation, wherein A, B, N Is a value of k bits, k = w s, and w and s are both an integer of 2 or more).