TW201404108A - Semi-systolic Gaussian normal basis multiplier - Google Patents

Abstract

The present invention discloses a semi-systolic Gaussian normal basis multiplier, which is used for multiplication of an element A and an element B to obtain an element C, wherein the elements A, B and C all belong to the elements in a m-bit finite field GF(2 m ). The finite field GF(2 m ) has a Gaussian normal basis for normal elements of type t respectively as <alpha> end . The multiplier comprises a transform unit for transforming the Gaussian normal basis of type t into a polynomial basis {<gamma> 0,<gamma> 1, …, <gamma> mt }; a multiplication module, which is connected with the transform unit for multiplication of coefficients; and, an inverse transform unit, which is connected with the multiplication module for transforming the element C' with polynomial basis {<gamma> 0,<gamma> 1, …, <gamma> mt } into the element C with the Gaussian normal basis of type t.

Description

Semi-systolic Gaussian regular base multiplier

The present invention relates to a multiplication technique for a public key encryption system, and more particularly to a semi-systolic Gaussian regular base multiplier.

GF(2 ^m ) is one of the limited fields commonly used in public key cryptosystems. It is mostly used in Advanced Encryption Standard (AES), Elliptic Curve Cryptography (ECC), and pairing-based cryptography. The operation of the carry system, where m represents the number of bits used by the finite field GF(2 ^m ). When the finite field GF(2 ^m ) adopts a normal basis, the element to which it belongs can be expressed as a binary polynomial of order less than m. The finite field GF(2 ^m ) of this class is a modulo-2 operation of the coefficients of the same order for the addition, which can be achieved by mutual exclusion or gate. The normal basis applies to the squared operation, which can be implemented by a shift operation. However, multiplication operations are more difficult to implement for regular substrates. To solve this problem, the present invention uses a Gaussian normal basis to construct a better multiplication algorithm.

In view of this, in an aspect of the present invention, an embodiment provides a semi-systolic Gaussian normal matrix multiplier for performing a product operation on an element A and an element B to obtain an element C, wherein the elements a, B and C belong to a m-bit finite field GF (2 ^m) of elements in the finite field GF (2 ^m) elements and regular pattern t (type-t) are Gaussian normal substrate and {α , , ,..., }, the element A can be expressed as , the element B can be expressed as , the element C can be expressed as , wherein each element coefficient a _i , b _i and c _i is equal to 0 or 1, the multiplier comprises: a conversion unit, the type t Gaussian regular basis can be { , , ,..., } converted to a polynomial basis { γ ⁰ , γ ¹ ,..., γ ^mt }, where for 1 i Mt,0 j M-1,0 k For t-1, And τ is a predetermined number; the conversion unit converts the elements A, B into elements A' and B' based on the polynomial base { γ ⁰ , γ ¹ , ..., γ ^mt } , the element A' can be expressed as , the element B' can be expressed as ,among them = =0 and = a _j , = b _j ; the conversion unit and reorganize the elements A' and B' into and , for 1 i M-1 and 0 k t, =0 and , =0 and a product module connected to the conversion unit for 1 i t and 0 j t , receive the A' _i and B' _j and calculate equal And an inverse conversion unit connected to the product module and receiving the By calculation And the element of the polynomial base { γ ⁰ , γ ¹ ,..., γ ^mt } Converted to this type t Gaussian regular basis { , , ,..., Element C.

The product module includes m ² calculation units for calculating the A' _i and B' _j coefficients for each Make equal . Each computing unit includes a gate, a mutex or gate, and two unit cell latches.

The inverse conversion unit includes a mutex or a gate and a cylinder shifter. The mutually exclusive or brake is connected to the barrel shifter, and the barrel shifter receives the And make this The data is moved to the right by m or (m+1) bits.

The features, objects, and functions of the present invention, as well as the technical means for achieving the same, are described in detail with reference to the accompanying drawings. It is understood that the scope and technical means of the invention are not limited thereby. For the convenience of description, each device component in the drawings is represented in a rough, exaggerated, or brief manner, and the dimensions of the constituent elements are not completely the actual size.

First assume that α and { , , ,..., } is the normal element of the finite field GF(2 ^m ) and the Gaussian regular base of the type t, respectively, α GF(2 ^m ) and the element A of the finite field GF(2 ^m ) can be expressed as , element B can be expressed as , wherein each element coefficient a _i and b _i is a binary coefficient, and its value is 0 or 1; that is, for i=0, 1, 2, ..., m-1, a _i , b _i {0,1}. The above-mentioned regular substrate and the elements derived therefrom have the following characteristics: (1) , (2) ( A + B ) ² = A ² + B ² .

If the above m and t are both positive integers and (mt+1) is a non-even prime number, and γ is the indecomposable (mt+1) root of the finite field GF(2 ^mt ), then for any finite field The indecomposable t-th root of GF(2 ^mt+1 ), its elements It can be called the Gaussian period of the pattern (m, t) above GF(2). Thereby, α is a regular element in GF(2 ^m ), and { , , ,..., } is a regular base of GF(2 ^m ). The Gaussian regular substrate of the type t represented by the Gaussian period of the pattern (m, t) has the following characteristics: (1) , (2) τ ^t =1 mod mt+1, (3) γ ^{mt +1} = γ ^{( mt +1) mod ( mt +1)} =1.

When element A is obtained by performing a product operation on element A and element B, the element C can be expressed as It also belongs to the element of the Gaussian normal substrate of the type t, and each element coefficient c _i is a binary coefficient of 0 or 1. The present invention proposes a semi-systolic Gaussian regular base multiplier whose operation will contain a Gaussian regular basis of each element from the form t { , , ,..., } to the transformation of the polynomial base { γ ⁰ , γ ¹ ,..., γ ^mt }, where for 1 i Mt,0 j M-1,0 k For t-1, And τ is a predetermined positive integer; then the elements A, B will be converted into elements A', B' based on the polynomial base { γ ⁰ , γ ¹ , ..., γ ^mt }, It can be expressed as and ,among them = =0 and = a _j , = b _j . After the following calculations: The elements A' and B' can be reorganized into t+1 parts respectively as follows: , , for 1 i M-1 and 0 k t, =0 and , =0 and .

Thereby, the product C ^{' of the} elements A' and B ^' can be calculated as follows: Product coefficient It can be obtained by the following equation: Among them, when 1 k When m-1, And , γ and The product of which can be calculated as follows: And for k w For k + m -1, the coefficient is .

According to the above equation, the calculation of the embodiment of the present invention The product module block diagram can be as shown in FIG. 1. The product module 100 includes m ² U calculation units 110 for calculating the _A'i and _B'j coefficients. Make equal . The circuit diagram of each U computing unit 110 can be as shown in FIG. 2, and includes an AND gate 111, a mutually exclusive or (XOR) gate 112, and two unit cell latches 113 and 114; The gate 111 is used to perform a multiplication operation, the mutex or gate 112 is used to perform an addition operation, and the unit cell latch 113/114 is configured to perform a delay one bit of the data string. The U calculation unit has three input terminals a _in , b _in , c _in and three output terminals a _out , b _out , c _out . After the operation of the U calculation unit 110, a _out still maintains its input value a _in b _out is delayed by one bit for its input value b _in , c _out is the value obtained by multiplying a _in with b _in , and then added with c _in , and then delaying one bit. In the embodiment of FIG. 2, a _in is input from the left side of the U calculation unit 110, and a _out is output from the right side of the U calculation unit 110; b _in is input from the upper left corner of the U calculation unit 110, and b _out Outputted by the lower right corner of the U calculation unit 110; c _in is input by the upper end of the U calculation unit 110, and c _out is output by the lower end of the U calculation unit 110; thus, it is convenient to arrange the plurality of U calculation units 110 into a matrix type. To construct Product module 100.

As for For the product module 100, please refer to FIG. 1. The m ² U calculation units 110 can be arranged in a matrix form, and each U calculation unit is labeled as U _{x, y} , where x represents the column number in which it is located, and y represents its location. The row numbers of the U calculation units 110 are arranged by setting the calculation unit U _i,i on the diagonal and m-1 U calculation units to the right, thus sharing m ² U calculation units 110. In the embodiment of Fig. 1, a' _im ~ a' _{im + m-1 is} input as a _{in of the} diagonal calculation unit U _0,0 ~U _m-1,m-1 , respectively, b' _jm ~b ' _{jm+m-1 is} input as b _{in of} the 0th column calculation unit U _0,0 ~U _0,m-1 , respectively, 2m-1 0 as the 0th column calculation unit U _0,0 ~U _{0,m -1} and the c _in input of the diagonal calculation unit U _0,m-1 ~U _m-1,2m-2 . The product module 100 can be calculated by the matrix arrangement of the U calculation units 110 as shown in FIG. 1 and the connection of the input/output terminals between the adjacent U calculation units 110. The coefficients of each.

And then performing the inverse conversion process of the foregoing substrate conversion, by To calculate And the element of the polynomial base { γ ⁰ , γ ¹ ,..., γ ^mt } Converted to this type t Gaussian regular basis { , , ,..., Element C. The following equation can be derived from the above equation By the feature γ ^{mt +1} =1 of the aforementioned t-gaussian regular substrate, the above formula can be rearranged into Where < x 〉 represents the operation of x mod mt + 1 . Therefore, the conversion from C ^' to C contains the following operations: first by To calculate C ^' , then for 0 j Each j in the m-1 range finds one that satisfies i = 2 ^j τ ^k modmt+1(0 k i of t-1); then the coefficient of C is . 3 is a schematic diagram of a half-systole-type Gaussian normal substrate multiplier for C ^' calculation of the present embodiment, which includes a The product module 100, a mutually exclusive or (XOR) gate 200, and a Barrel shifter 300. The The product module 100 has been used as described above and in FIG. 1. The mutex or gate 200 is used to perform an addition operation, and the cartridge shifter 300 is configured to shift the received data string by m or m+1. The bit and the mutex or gate 200 and the barrel shifter 300 are used to form the inverse conversion unit. The circuit block diagram of the cartridge shifter 300 is shown in FIG. 4, which includes mt+1 unit cell latches 310 and mt+1 2×1 multiplex selectors 320, so that mt+1 input data is used. I ₀ ~I _{mt are} latched and selected to shift the input data I ₀ ~I _{mt by} a specific bit in a clock cycle to obtain an output of O ₀ ~O _mt . The selection signal s of the cartridge shifter can be input to the left or right side of the 2×1 multiplexer 320, which is not limited in the present invention. Therefore, the cartridge shifter 300 can receive the After making this The data is moved to the right by m or (m+1) bits.

Next, the operation of the embodiment of the present invention will be described by taking a 4-bit finite field GF (2 ^m ) and a Gaussian normal substrate of the pattern 3 as an example. In this embodiment, elements A and B can be represented as and And select τ value of 3, then A and B can be derived as follows: among them And .

A' and B' in the above formula can be rearranged as follows: among them, and among them, After the calculation of A ^' × B ^' , you can get C': Among them, for 0 i , j 3, .

According to the above equation, the embodiment The block diagram of the product module 101 can be as shown in FIG. 5. The product module includes (4 ² ) or 16 U calculation units 110 for calculating the A' _i and B' _j coefficients. Each U computing unit 110 is shown in FIG. 2 and will not be described again. The coefficients of each are arranged at positions with corresponding weights, and the results are summarized in Table 1.

The product C ^{' of} A' and B ^' can be expressed as In this way, the coefficients of the γ ^t column in Table 1 can be added to obtain the coefficient of C ^' ,E.g for . Therefore, the coefficient of C can be obtained directly from the coefficient of C ^' : And the final result of C is

The above description includes the features, the steps, the structure, and the like, and is only an embodiment of the present invention, and may be equally modified and modified by those skilled in the art according to the scope of the present invention. The scope of the present invention is not to be construed as limiting the scope of the present invention.

100/101‧‧‧Product Module

110‧‧‧Computation unit

111‧‧‧ and gate

112‧‧‧ Mutual exclusion or gate

113/114‧‧‧Unit Latches

200‧‧‧mutual exclusion or gate

300‧‧‧Canister shifter

310‧‧‧Unit Latch

320‧‧‧Multiplex selector

1 is a calculation in accordance with an embodiment of the present invention A block diagram of the product module.

2 is a circuit diagram of a U calculation unit.

Embodiment 3 FIG embodiment of the present invention, half of the heart contraction substrate Gaussian normal multiplier for computing a schematic C ^'.

Fig. 4 is a circuit diagram of the cartridge shifter of the above embodiment.

Figure 5 is a calculation in accordance with an embodiment of the present invention A block diagram of the product module (m=4, t=3).

100‧‧‧Product Module

200‧‧‧mutual exclusion or gate

300‧‧‧Canister shifter

Claims (8)

A semi-systolic Gaussian regular base multiplier for multiplying an element A and an element B to obtain an element C, wherein the elements A, B and C belong to an m-bit finite field GF ( 2 ^m) of elements in the finite field GF (2 ^m) elements and formal t Gaussian type substrate are regular and {α , , ,..., }, the element A can be expressed as , the element B can be expressed as , the element C can be expressed as , wherein each element coefficient a _i , b _i and c _i is equal to 0 or 1, the multiplier comprises: a conversion unit, the type t Gaussian regular basis can be { , , ,..., } converted to a polynomial basis { γ ⁰ , γ ¹ ,..., γ ^mt }, where for 1 i Mt,0 j M-1,0 k For t-1, And τ is a predetermined number; the conversion unit converts the elements A, B into elements A' and B' based on the polynomial base { γ ⁰ , γ ¹ , ..., γ ^mt } , the element A' can be expressed as , the element B' can be expressed as ,among them = =0 and = a _j , = b _j ; the conversion unit and reorganize the elements A' and B' into and , for 1 i M-1 and 0 k t, =0 and , =0 and a product module connected to the conversion unit for 1 i t and 0 j t , receive the A' _i and B' _j and calculate equal And an inverse conversion unit connected to the product module and receiving the By calculation And the element of the polynomial base { γ ⁰ , γ ¹ ,..., γ ^mt } Converted to this type t Gaussian regular basis { , , ,..., Element C. For example, the systolic Gaussian regular base multiplier of claim 1 of the patent scope, wherein the product module comprises m ² calculation units for calculating the coefficients of each of the _A'i and _B'j Make equal . For example, the systolic Gaussian regular base multiplier of claim 2, wherein each calculation unit comprises a gate, a mutex or a gate and two unitary latches. A half-systolic Gaussian regular substrate multiplier as claimed in claim 1 wherein the inverse conversion unit comprises a mutually exclusive or gate and a barrel shifter. A systolic Gaussian regular substrate multiplier of the fourth aspect of the patent application, wherein the mutually exclusive or gate is connected to the barrel shifter. a systolic Gaussian regular substrate multiplier of claim 5, wherein the cartridge shifter receives the And make this The data is moved to the right by m or (m+1) bits. A half-systolic Gaussian regular substrate multiplier as claimed in claim 1 wherein the τ is a positive integer. The systolic Gaussian normal basal multiplier of claim 1 is wherein the finite field GF(2 ^m ) is a 4-bit finite field, the Gaussian normal substrate is a Gaussian regular substrate of the type t, and τ is 3.