WO2001052051A2

WO2001052051A2 - Method and devices for carrying out an inversion in the primary number field

Info

Publication number: WO2001052051A2
Application number: PCT/DE2001/000161
Authority: WO
Inventors: Rainer BLÜMEL
Original assignee: Cv Cryptovision Gmbh
Priority date: 2000-01-16
Filing date: 2001-01-16
Publication date: 2001-07-19
Also published as: AU3721801A; WO2001052051A3; DE10101884A1; DE10190100D2

Abstract

The aim of the invention is to enable to efficiently implement standard algorithms for the cryptography on processors having long number registers and limited computing capacity. Said cryptography is based on elliptic curves. The number field and the elliptic curve can be freely selected in such a way that said field and curve have to be advantageously read in only when a corresponding storage medium is personalised. The invention relates to the use of the extended, euclidian algorithm for detecting an inverse in the prime number field. Two numbers are successively stored in the long number registers of the respective processor. The described algorithm enables to obtain the results of two required operators in one calculating step and as a result calculation is accelerated. Further acceleration is obtained by externally storing the arithmetic unit of the long number arithmetic in the typically used processors. An arithmetic unit is formed by means of a separate register set. Reading in and out the operands into the separated arithmetic unit is time consuming. Half of the load cycles can be dropped by simultaneously processing two operands.

Description

Methods and devices for performing an inversion, in particular in the case of encryption using elliptical curves

Field of the Invention

The invention relates to the field of cryptographic methods and devices, namely methods and devices which make it possible to carry out a special calculation, namely an inversion in the prime number field as e.g. is required for encryption using elliptic curves.

Background of the Invention

Various mathematical methods are known for encrypting and decrypting information of all kinds. Assign information from numbers or letters to numbers and calculate new numbers from these numbers, from which the original information cannot be obtained without knowing a key number, in short a key.

These mathematical methods can be divided into symmetrical methods, in which the same key is used for decryption as for encryption, and asymmetrical methods, in which a different key is used for decryption than for encryption.

If decrypted information is to be decrypted at a location other than the location of the encryption, e.g. information from one computer system (transmitter) to another computer system (receiver) e.g. transmitted over the Internet, the symmetrical method must be the

Recipients also receive the key in some form. As there is a risk that the key will be intercepted during this transmission, the asymmetrical methods are considered to be more secure when transmitting encrypted information. In a group of asymmetric methods also known as public key cryptography, the sender and receiver calculate and exchange a private key G ^s or G ^E for themselves from a public key G, and then exchange a key G for encryption or decryption ^SE is used. Even if a third party would query both G ^s and G ^E, he would not be able to decipher the message encrypted with the key G ^SE due to the so-called "problem of the discrete logarithm".

Asymmetric encryption methods and devices for performing at least partial steps in the encryption and decryption using asymmetrical methods, in particular using elliptical curves, are known from a large number of publications, for example from US 5,159,632, US 5,271,061, US 5,463,690, US 5,581,616. US 5,805,703, US 5,442,707, EP 0 892 520 A2, PCT / DE99 / 00278 and PCT / US99 / 12749, in which also the mathematical foundations of elliptic curves and their application in

Cryptography is described and the entire technical disclosure content is hereby fully made part of this application by citation.

The cited documents also point out the advantages and disadvantages of the encryption techniques based on elliptic curves compared to the currently most widespread type of asymmetric encryption techniques, the so-called RSA method. The RSA method is based on the problem of factoring large numbers. Smart cards currently available use this algorithm

The essential operation in the RSA method is the potentiation of a number m in a number field Z _n , where n is a number resulting from the multiplication of two large prime numbers p and q, which as a binary number typically has a bit length of between 1024 and 2048 bits, (p and q usually have

Bit lengths between 512 and 1024 bits). Implementations of the RSA method on smart cards normally limit n to 1024 bits. In contrast to the RSA method, cryptographic methods based on elliptic curves require divisions in the prime number field. If sufficient resources are available, it is easy to implement such divisions using appropriate computer programs.

Now there is the problem, however, that in many applications, for example in the aforementioned smart cards, the processors available are optimized for the use of the RSA method, which means that so-called long-number registers are available which allow them to be used for a very long time Handle numbers, but with these numbers only a few arithmetic functions can be performed. Divisions in prime number fields are not supported by the known processors for smart cards and the like. Although it is possible to increase the computing power even with smart cards, this increases the chip area and increases the costs.

The previous implementations of encryption techniques based on elliptic curves essentially use the standard instructions of the processor and use the long number registers only in a few places and are therefore not very efficient. All known implementations on processors of smart cards (also called smart card ICs) and the like accelerate this

Computing times by defining the underlying elliptic curve and / or the base body. It is not possible with this, e.g. carry out operations for user groups with different parameter sets with a smart card.

The object of the invention is therefore on the one hand to provide methods and devices which make it possible to efficiently implement standard algorithms for cryptography with elliptic curves on the processors of smart cards (also called Smaraec ICs) with long-number crypto coprocessors.

Another object is to specify methods and devices in which

The number field and elliptic curve can be freely selected and can only be read into the EEPROM of the smart card when a corresponding storage medium, for example a smart card, is personalized. Summary of the invention

Since a general division can be replaced by an inversion (1 / x) and a multiplication, a generally applicable method is sufficient for inversions in the prime number field.

The invention proposes the use of the extended Euclidean algorithm for determining an inverse in the prime number field.

The inverse of an element q in Z _p (denoted by q ^"1 ) is a number so that it holds

qq ^"1 = 1 (mod p).

The background to the new solution is that cryptographic methods based on elliptic curves require fewer bits than RSA methods, so that the registers available in known smart card ICs are more than twice as long as those actually required for calculations on elliptical curves. The essence of the idea is now to store two numbers in a row in the long number registers.

For the programming of encryption algorithms based on elliptic curves (hereinafter referred to as ECC algorithms for short) on smart cards or other processors with a limited scope of functions, the inversion of a number modulo a prime number is necessary, since otherwise more buffers are required than are usually required on these processors

Available.

This inversion is carried out using the extended Euclidean algorithm. For the input of two numbers a, b> 0, the value d = ggT (a.b) (ggT = largest common divisor) and two numbers x and y with d = x * a + y * b are calculated.

The basic structure is as follows: a) Initialize A = a, B = b, x = 0, y = 1 b) As long as B> 0

) Calculate q = A / B i) Calculate r = A mod B ii) Change x and y v) Recalculate A and B

According to the invention, the recalculation of A and the calculation of x are combined by storing the two values in a register (which then must necessarily be at least twice the length).

The advantage of using this approach to summarize the two calculations is not only the acceleration of the computing times. Rather, the processors used to load the registers with the operands sometimes take more time than the actual arithmetic operation. Since a loading cycle is omitted due to the simultaneous processing, the algorithm is therefore significantly faster. In principle, the algorithm looks like this:

Initialize X = P * 2 ^{, + k} + B _P and Y = Q ^* 2 ^{l + k} + B _Q

where X can be written in a long number register as follows P (left-justified), followed by a number of free bits (length k), B _P (right-justified)

Accordingly, another long number register can have the following inscriptions: Q (left-justified), free (length k), B _Q (right-justified)

The actual algorithm then works with the values of X and Y, ie processes P and B _P or Q and B _Q simultaneously.

A sub-step now ensures that (in the case of processing X) P is set to the rest of the division of P / Q and (at the same time) the value in B _P is adjusted accordingly. If Y is processed, the same procedure is followed. These calculations are performed as long as P and Q are greater than zero. If one has reached zero, then B _P or B _{Q contains} the inverse sought. With these methods, essentially half as many twice as long registers are sufficient for efficient implementation of the inversions, and the number of memory bits therefore remains unchanged. This new method works with a long-number accumulator and without substantial support from a host processor, since only elementary commands for the long-number register (add, shift, bit test and a way of comparing, this can also be done by a bit test) are required and the dividers with remainder (P and Q) do not have to be buffered.

The method describes how a certain class of cryptographic on special microprocessors can be implemented efficiently. With the same security requirements, the necessary computing time on commercially available processors can be considerably reduced compared to the known methods.

The algorithm is independent of the special parameters which of the

Underlying the calculation. So it is e.g. When implementing on smart cards, it is possible to load these parameters only when the card is personalized (instead of specifying them when the microprocessor is being manufactured).

On the SLE66CxxS smart card processor from Infineon, which serves as a reference, the creation of a digital signature takes approximately 500 milliseconds to one second when using the RSA algorithm. With the method used here based on elliptic curves, the necessary time amounts to 100 to 200 milliseconds with comparable security. This speed advantage results from two aspects of the process:

On the one hand, the algorithm described here makes it possible to obtain the results of two necessary operators in one calculation step; this definitely means acceleration.

In addition, this results in a further acceleration due to the following fact: Typically in smart card processors, the arithmetic unit for the long number arithmetic (the so-called mathematical coprocessor) is outsourced and forms a computing unit with a separate register set. A calculation therefore takes place in several steps:

a) The registers of the coprocessor are loaded with the operands b) The actual calculation is carried out on the coprocessor c) The main processor reads the results from the registers of the coprocessor

Since the time required for steps a) and c) is relatively large compared to the time for the actual calculation in step b), a further time advantage is given by the simultaneous calculation of more than one value.

The algorithm presented is an optimization in the event that the microprocessor provides arithmetic routines for numbers with a bit length which is really greater than twice the bit length of the numbers to be processed.

Brief description of the drawing

1 shows an elliptical curve apparently consisting of two unrelated pieces in the real number range and three points P, Q and R on this curve.

Description of preferred embodiments

For programming ECC algorithms on smart cards (or more generally on

Microprocessors with limited performance) normally require the inversion of a number modulo a prime number (since an alternative method of calculation requires more buffers than is usually available on these processors). If you have a fast inversion available, the group law for points on elliptic curves is very simple, it is for the

Operation on the curve y ² = x ³ + a * x + b:

P + 0 = 0 + P = for all P e £ (Z _P ).

For P = (x, y) e E (Z _P ) is (x, y) + (x, -y) = O. (The point (x, -y) is denoted with -P and is referred to as the negative of P; note that -P is actually a point on the curve).

For P = (^) e E (Z _P ) and Q = (x ₂ , y ₂ ) e E (Z _P ) with P ≠ -Q, P + Q = (x ₃ , y ₃ ) is calculated by x ₃ = λ ² - x, - x ₂ y ₃ = λ ^ - xa) - ^,

in which

λ = (y ₂ - Yι) ^ (X2 - X1) if P is not Q and λ = (3 ^* x ₁ ² + a) / (2 ^* y ₁ ) if P is Q

Figure 1 graphically illustrates these operations.

The inversion is carried out with the help of the extended Euclidean algorithm, i.e. a procedure which, for the input of 2 numbers a, b> 0, has the value d = ggT (ab) and 2 numbers x and y with d = x * a + y ^* b calculated.

For the application in the inversion this is used as follows: The first argument (a) is set to the prime number modulo which one wants to invert the second argument (b); Since the greatest common divisor of a prime number with any other number (smaller than this prime number) is always 1, one has the following identity:

1 = ggT (a, p) = x * a + y ^* p = x ^* a (mod p)

the last equality applies since y * p mod p is identical to 0. This shows that x = a ^_1 mod p and that x is the inverse of a.

In this case, the exact algorithm is as follows (the first swapping of the roles of a & p only serves to eliminate an additional step that would otherwise have been carried out):

Given a, p in Z with 0 <a <p, p is a prime number We are looking for x in Z, 0 <x <p with x * a = 1 mod p a) Initialize A = p, B = a, x ^ = 1, x ₂ = 0

b) As long as B> 0: q = A / B r = A - q * B x ₀ = x ₂ - q ^* x _n A = BB = rx ₂ = Xi

c) Set x = x ₀

The advantage of the new algorithm is that the recalculation of A and the

Calculation of x can be summarized by storing the two values in a register (which then must necessarily be at least twice the length).

The advantage of using this approach to summarize the two calculations is not only the acceleration of the computing times. Rather, the processors used to load the registers with the operands sometimes take more time than the actual arithmetic operation. Since a loading cycle is omitted due to the simultaneous processing, the algorithm is therefore significantly faster.

The algorithm to be implemented then looks in principle as follows:

Initialize T = A * 2 ^{l + k} + x ₂ and U = B * 2 ^{, + k} + ^

The frames should clarify the register length of the processor used below:

Representation of T: A (left-justified) free (length k) x ₂ (right-justified)

Representation of U:

B (left-justified): free (length k) _:! (Right-justified)

The algorithm then works with the values of T and U, i.e. processes A and B or x ₂ and xi simultaneously. The subtraction V = T - q ^* U then provides the results for r & x ₀ in one step.

As long as B> 0: q = A / BV = T - q ^* U (V = (r, x ₀ )) T = UU = V

If B <0: set x = x ₂

The quotient q is not really calculated in practice. Instead, the maximum possible multiples are successively subtracted (with a power of two). With the subtraction of X ₂ and the respective multiple of X-, the sign bit propagates until the representation of A in the usual binary representation of the operands.

Because the calculations are significantly faster with this formulation, you are able to keep the program code on the card completely independent of the curve parameters and can therefore only enter them into the ^' at a later point in time (e.g. when personalizing the card) ^. Load EEPROM.

Brief description of the Euclidean algorithm

The algorithm calculates the largest common of two elements P and Q Divider D = gcd (P, Q) (gcd = greatest common divisor = ggT = greatest common divisor) and in the extended form two elements A _P and B _Q with

A _P P + B _Q Q = D (1)

The Euclidean algorithm is mainly required to calculate an inverse. Let P be a prime element, so the greatest common divisor is the 1 element, and B _Q is also searched for

B _Q Q = 1 mod P. (2)

The general procedure of the algorithm is first described in a symmetrical form; the reason for this will be added. Two further elements A Q and B P are used, with the Strat the following initializations take place:

P '= P Q' = Q

Ap = B _P = 0 (3)

The algorithm consists of steps of the form

Part a: Determine four elements p _P ,, p _Q , q _Q with gcd (pp P '+ qp Q', p _Q P '+ q _Q Q') = D

Part b: Calculate new intermediate values

Q ': = p _Q P' + q _Q Q 'P': = temp

A _Q : = p _P A _Q + qpAp

A _P : = temp temp: = p _Q Bp + q _Q B _Q

B _Q : = temp (4)

This ensures that the following equations are satisfied:

A _Q P + B _P Q = P 'A _P P + B _Q Q = Q' (5)

The symmetrical wording makes it clear (this is the reason for its use) how intermediate steps can be summarized. applies:

D = gcd (P ', Q')

P ": = p _P P '+ Q _P Q'Q"": = p _Q P '+ q _Q Q' as well

P ^m : = p _P P "+ q'pQ"

Q '": = p' _Q P" + q ' _Q Q "(6) then the two steps can be summarized:

P '"= (p ^, _P Pp + q ^, pPQ) ^' P ' ⁺ (p'pqp ⁺ qVqQ) Q'

PP, <qp.g.

Q "- (p'QP ⁺ q'QPQ) '+ (p ^, Q ^' p ⁺ q ^, Q) Q '

P ^Q , g qo, g

The calculation of the pre-factors can of course be summarized in the same way: Apply

Q '= A _P P + B _Q Q

and will

also applies

P "-A _{Q, g} P + Bp _{, g} Q Q '" = A _Pιg P + B _Qιg Q.

Obviously, the factors (A for P and b for Q) do not influence each other and the steps for their calculation are always completely analogous to those of P 'and Q'.

This means on the one hand that the inverse Q ^" mod P can be calculated independently of A and on the other hand that the steps for updating B _{P are} parallel to those of P ':

P ' _new = p _P P' + q _P Q '

and the calculation of BQ parallel to that of Q '

is.

The algorithm ends because gcd (P, Q) = gcd (P ', Q') if P 'or / and Q' takes the value of the greatest common divisor of P and Q. In this case either the two values P 'and Q' are the same, or one of them is 0; these cases mark the end of the algorithm. 14 -

If P is the prime element, only the values B Q and B P are included in the calculation of the inverses. The algorithm ends when one of the values, P 'or Q', is the 1 element.

The algorithm described can be further generalized, instead of multiplications (with p _P , p _Q , q _P , q _Q ) divisions are also possible.

Basic implementation of the Euclidean algorithm

The usual formulation of the Euclidean algorithm is based on division by remainder. In each sub-step, one of the following two operations is carried out:

P _P = q _Q = 1; p _Q = 0

or p _P = q _Q = 1; q _P = 0

P

where it is elementary to calculate that gcd (P ' _new , Q' _πeu ) = gcd (P ', Q').

The latter obviously also applies somewhat more generally:

gcd (ab) = gcd (a + p ^' b, b) (10)

In the concrete implementation, a real division with long numbers is of course not practical, more efficient procedures are necessary. The exact implementation depends on the concrete representation of the elements on the computer. With the usual binary representation and a consistent order relation, the leading ones are sufficient Bits of P 'and Q' for (possibly approximated) tuning of the factors p and q of the usual Euclidean algorithm. These (mostly "small") factors can be summarized in several steps before you have to multiply by the complete long number.

You can also do without real multiplications by long numbers and only use comparatively cheap shift operations (binary methods). These amount to implicitly performing divisions and multiplications.

Since a concrete representation of the number plays a role in each case, one of the two cases will be discussed below

^' Primary arithmetic

^• Based on polynomial arithmetic (characteristic 2 arithmetic).

Efficient implementation of inversion in the prime number field with long number registers

If registers with more than twice the length of a long number are available, the binary method can be implemented with low hardware requirements. An INversion for prime number arithmetic is described, but the same technique also works for characteristic 2. The implementation is algorithmically equivalent to the usual extended Euclidean algorithm.

The "advanced crypto engine (ACE)" of the Sienens / Infineon "ALE66CX ..." smartcard processor family serves as a concrete model for the underlying hardware.

Principles of the procedure

There are two registers N and Z with a fixed bit length 2.l + k, two binary-coded numbers P (= P ') and Q (= Q'), where P is a prime number and Q <P (= only in the case of

Polynomial arithmetic) and two numbers B _P and B _Q , initialized with B _P = 0 and B _Q = 1, respectively. All numbers are represented with I bits and may have leading zeros. In the implemented Euclidean algorithm, the division with remainder is not carried out directly, but through individual steps of the form P = P-2 ^s Q (if P 2 ^S Q), (11)

where s is counted down to 0. In the end (then P <Q) P is the rest of the division. At the start of the algorithm

N = Q ^' 2 ^{l + k} + B _Q (12)

set; since all numbers are represented with max I bits (of course the number of separating bits must be k> 0), there is no (significant) influence between P and Q on the one hand and B _P and B _Q on the other. The current number of bits n of the representation of P is noted for the execution of the algorithm, and the same procedure is used with Q or m. A sub-step follows the following pattern:

s = n-m; while (s> 0)

{n_temp = n; temp = N; s = s - 1; shift (temp.s); // the most significant bit of Z is 1 larger

Z = Z - temp; // as that of temp; Z = Z - N2 ^Λ s determined n new if (n emp == n)

{

Z = Z temp; // if the bit length of z was unchanged

} // can be subtracted temp afterwards certain n new // now Z is at least 1 bit shorter s = n-m;

} if (Z> N) // Possible if Z and N have the same bit length

{ // to have. This can also be done that way

Z = Z - N; // that the subtraction is carried out // is tested for signs 52051

- 17 -

determine new // will and possibly the subtraction undo

// is done

After each step, Z and N swap roles; the whole thing repeats itself until the inverse of Q is determined. The basic arithmetic operations (+ and -, shift operations and the possibility of testing the leading bit of Z) are sufficient for the algorithm to run.

A concrete implementation

For the concrete implementation, a representation of the numbers in two's complement is required, the leading (negative) bit must be able to be tested; the overflow of an addition is recognized by the set negative bit.

At the start of the algorithm, the leading I> 2 bits of Z are filled with P -P, followed by k-many zero bits and then B _P. In the N register, Q '= Q is analogously stored in the first bits and B _Q in the last bits. Two counting variables m and n indicate the length of P and Q in bits, I>n> m (as well as n> 2) must apply. The starting position is as follows:

)

where 0.1 and the lower case letters p and q represent individual bits.

In a first step, the registers are adjusted:

18 - ii I n bits k bits bits

m bits

the difference between n and m is essential. Specifically, this means that a subtraction (Z = ZN) for P 'and B _{P has the} following meaning:

p, _p, _ ₂ nm _Q ,

it is assumed that n - m - 1> 0. Since only subtractions and additions are carried out in the algorithm apart from shift operations, and that

Shifting essentially only the adjustment of P 'and Q' to the high bits of registers Z and N (no O bits are added, instead the bit length becomes smaller) are (15) the only real arithmetic operations.

In the course of the substep, the leading bit from Z is shifted to 0 by operations of the form (15) and the Z register is shifted to the left by 1 bit; It is not known in advance whether the leading bit of Z is 1. Because of this, the subtraction is in the form

if (negative flag set)

{

Z = Z N;

} if (negative flag set) {

Z = Z - N;

} carried out; as long as the leading bit is set, Z> N is ensured. If the hardware offers a simple mechanism for size comparison, it makes more sense to work with an N shifted to the left. In this case it is a good idea

if (Z> N)

{

Z = Z N;

} on. If you try the same thing without having the operation (Z> N) available, you can use the following code fragment:

if (negative flag set) // If not, then in any case {// Z <N

Z = Z N;

if (negative flag set) / If an overflow has occurred

{// has set the negative flag

Z = Z + N / 2 // and the subtraction must be undone //.

This is equivalent to the first code fragment (where the leading bit of N = 0).

After subtraction, the leading bit is safely deleted, the contents of the registers now look like this:

Z = (u, p p, p, p, 1 1,1,1 b P, b P) n bits k bits I bits

where B _P borrows a 1 from P ', so the bits representation of P' in Z is that of P'-1. In any case, the length of P '(not counting leading O bits) is now at most n-1. Depending on the value in N (more precisely, if n - 1> m):

shiftJeft Z.U; n = n-1;

what to

Z = (p, ..., p, p, p, 1, ..., 1, 1, 1 b _P , b _P ) n _new = n _{a (r} 1 bits k bits I bits

leads (the leading bit of Z can be 0), and the subtraction is repeated. If, however, n = m, Z> N can still apply, so at the end of the substep:

Z = Z N; if (negative flag set) // If an overflow has occurred,

{

Z = Z + N; // undo the subtraction}. If n = m at the very beginning, only the conclusion just described may be carried out. Overall, the following pseudocode results for the sub-step that does the essential work:

Substep // high bit deleted from Z,

// second high bit set by Z; // high bit deleted from N, // second high bit set from N for (s = n-m-1; s> = 0; s = s-1) {shiftjeft Z, 1; n = n-1; if (negative flag set)

{ - 21

Z = Z N;

} if (negative flag set)

{Z = Z-N;

}}

Z = Z N; if (negative flag set) {

Z = Z + N; }

The other sub-steps are unproblematic except for the conclusion.

Adjust__Z while ((negative flag not set) && (n> = 2))

{shiftjβf z.1; n = n-1;

} shift_right Z, 1; n = n + 1;

Tausche_Z_mit_N

Z = Z + N; N = Z-N; Z = Z N; m = m + n; n = m-n; m = m-n;

Initialization // Z = P * 2 ^Λ (l + k) +0 // and N = Q ^* 2 ^Λ (l + k) +1 be Justiere_Z Swap_Z_mit_N Justiere_Z

The overall process is then described by the following pseudocode

inversion routine

Initialization while ((n> 2) && (m> 2))

{

Partial step; adjust Z; Swap_Z_with_N}

Graduation

For the still missing completion it is ensured under reasonable conditions that there are exactly 2 bits of Q 'in the N register, of which this is only 0, so Q' must be <1. There are more than 2 bits in the Z register, the leading bit is also 0 and the following 1, in particular P '> 1. Since it is known that 1 is the greatest common divisor of P and Q, Q -1 must hold. Essentially, the pseudocode substep can therefore be carried out again in order to also bring P 'to 1. Now one of the numbers B _P or B _{Q is} positive, this is the inverse to Q mod P.

Termination // high bit of Z deleted,

// second high bit set by Z; // high bit deleted from N, // second high bit set from N for (s = n-m-1; s> = 0; s = s-1)

{shiftJeft Z, 1; n = n-1; if (negative flag set) Z = ZN;

} if (negative flag set)

{

Z = Z N;

}

} shiftjeft Z, 2; // test separating bit if (negative flag set) // B_P is negative

{

Swap_Z_with_N shift book Z, 2;

} shiftjeft Z, k;

There are still a few things that need to be looked at more closely.

correctness

First, it must be ensured that the algorithm is fed with "reasonable" starts. This means that P> 2 is a prime number and Q> 1 must be.

Since B _P borrows a 1 from P ', the bit representation of P', i.e. the first n bits of the Z register, is actually that of P'-1. However, the difference between P 'and Q' is greater than the largest common divisor, at least 2, until the conclusion. The sign of P'-Q 'or Q'-P' is not affected by this "error".

A second consequence of the "bit borrow" is the bit length of P '. If the correct value were a power of two (2 ^π'1 ), the actual bit representation is 2 ^{n "1} -1, the bit length of the

So the number is shorter by 1. If the number in Q 'is too small by 1, this only means that the for loop of partial step performs one loop pass (the first) more than necessary. If, after the subsequent exchange_Z_mit_N, the number in the Z register reduced by 1, the loop passage is "optimized" in partial step. As expected, the actual calculation is not falsified by the "borrow bit", since it is traced back to the register as a whole:

-, 1 +. , 1 + k l + k.

((P ^, -1) -2 ^{, + κ} + (2 ^{, + κ} - (- B _P )) HQ "2 '^ + B _Q )) ^' 2

= ((P'-Q "2 ^S -1 Y2 ¹ + (2 ^{, + k} - (- B _P ) -B _Q -2 ^s ))

(Q-2 ^{l + k} + B _Q )) - ((P ^, -1) ^' 2 ^{l + k} + (2 ^{l + k} - (- B _P ))) - 2 ^s

= ((Q'-P-2 ^s ) -2 ^{l + k} + (B _Q + (- Bp) -2 ^s ))

where P ', Q', -B _P , B _Q 0.

Overall, it is therefore clear that the bit representation reduced by 1 does not have an incorrect effect on the Euclidean algorithm. It is also clear that B _Q and -B _{P are} always positive.

The last question (at least in principle) is whether one of the numbers B _P B _{Q can be} longer than I bits (more precisely: greater than P). For the Euclidean

However, there is no danger of this algorithm, cf. about "Knuth Vol.2p343".

Instructions for efficient implementation

How the algorithm is to be implemented so that it runs as effectively as possible depends, of course, on the specific hardware used. If loop constructs are relatively expensive, it makes sense to combine the for loop in a sub-step, so that s (if it is large enough) is reduced by a constant value (approximately between 4 and 10) in each pass. This procedure is recommended for the "SLE66CX -" family. EXAMPLES

Problem with ECC algorithms:

A

For the sake of simplicity, the example here is the creation of a so-called digital signature; there are also protocols for encrypting data. This ECDSA

Algorithm (see [ANSI], [IEEE]) for creating digital signatures works in the following way:

Legend:

Domain parameters: q prime number (> 160 bit)

E: y ² = x ³ + ax + b elliptic curve over Fq a coefficient of E (from Fq) b coefficient of E (from Fq)

P ⁼ (* G _> YG): base point on the curve xG coefficient of G (from Fq) yG coefficient of G (from Fq) n order of G

I order of E, is not used h Co-factor (I = nh), is not used

Other elements k random number m message

H hash function H (m) hash value of the message

Key elements d private key

Q = dP public key

Generating signatures: 1) Calculate e = H (m)

2) Generate a random number k with 1 <k <n-1

3) Calculate G = (X1, y1) = kP 4) Set r = X1 mod n

5) Calculate s = k-1 (e + dr)

6) The signature for m is (r, s)

Check signatures:

1) Calculate e = H (m)

2) Calculate s-1 mod n

3) Calculate U1 = e S-1 mod n

4) Calculate U2 = r S-1 mod n 5) Calculate U1P + U2Q = (X1, Y1)

6) Calculate t = X1 mod n

7) Signature is valid if t = r

Mathematical basics

With the help of the Euclidean algorithm, the greatest common divisor d can be calculated for two given numbers a and b; the extended version also provides coefficients x and y so that d can be represented as a linear combination of a and b, i.e. the following applies: d = xa + yb

This can be used for the necessary inversion as follows: The inverse of an element q in Zp (denoted by q-1) is a number so that q q-1 = 1 (mod p) applies. q q-1 = n p applies to any n (aiso is an arbitrary multiple of p).

If you now calculate (with the extended version of the algorithm) the PGD of q and p (and note that this is 1 since p in our case represents a prime number), you get numbers a and b with 1 = d = aq + bp Da after Definition bp = O (mod p) we have aq = 1 (mod p) and the desired result is q-1 = a.

Adaptation of the extended Euclidean algorithm. Extended Euclidean algorithm The extended Euclidean algorithm uses 2 Zahieniripei (P, a, b) and (Q, c, d) that switch roles after each step. A single step essentially consists of an arithmetic operation of the form

P = P-pQ a = a - pc b = b-pd with a relatively small number (a few bits) suitable for breastfeeding p. The fact that the triples swap roles means that in the next step

Q = Q - qP c = c - qa d = d-qb is calculated. The Euclidean algorithm works in that the in each

Numbers p or q to be determined can be chosen so that the

Long numbers P and Q become smaller with each double step. At the start of the algorithm, c and d are set to 1, a and b to 0, Q to the number to be inverted and P to the prime number, modulo which is inverted.

In general, the algorithm uses the largest common divisor T of P and

Calculate Q, the result is cP + bQ = T.

In the case of an inversion with respect to a prime number, the ggT (T = 1) is known and the inverse of Q is b or d; there is no need to calculate c and a. The numbers p and q to be determined successively result from dividing with the remainder of P by Q (p =

P / Q + rest).

Adjustments for long number registers Processors with long number registers have to implement the Euclidean

Algorithm two problems:

1. Divisions with remainder, even those with small numbers, are not easily possible. Therefore, only a power of two for p can be determined in the division. In practice this means that P = P-pQ step by step, first P = Px (n) 2AnQ, then P = Px (n-1) 2A (nl) Q and finally P = Px (0) 2Q (x (i) is always 0 or 1), where n is the difference between the lengths of P and Q in bits; the division of P by Q is therefore carried out implicitly.

2. The grouping of calculation steps, here P = P-pQ and b = b-pd, is not readily possible, ie a similar calculation with new operands can also be performed not only with commands for long number registers (at least not with the existing processors for smart cards). The solution to determine p in the controlling host processor is always possible, but inefficient. The solution is to put P and b, as well as Q and d, each together in a register, separated by a few bits. If the calculation P = P-pQ is now carried out for a power of two p, b = b-pd is also calculated at the same time. As described above, it is therefore sufficient to carry out the calculation of p or P = P-pQ step by step; this can be done efficiently with little effort (e.g. on the SLE chips). One problem is that b and d must not (significantly) influence the numbers P and Q. An analysis shows that p and q are always positive, so d is always positive (and therefore unproblematic) and b is always negative. In the usual binary representation of the long numbers, this means that "b borrows 1 from P", a fact that must be taken into account in the algorithm.

Specific implementation procedure

Determination of an inverse in the prime number field, i.e. opp.: a prime number P a positive number Q less than P a number D, so that DP = 1 mod P. Initialization of the procedure

Let the number of bits in the binary representation of P be n.

Let the number of bits in the binary representation of Q be m (m <= n).

The number of separating O bits between P and b, or Q and d, is x (x> = l).

The length of the long number register is at least 2n + x bits. P and b are loaded into a long number register Z and Q and d into a long number register y and adjusted according to the separating x O bits:

Z = O ... OPPP ... PPPO ... Obbb ... bbb y = O ... OOQQ ... QQQO ... Oddd ... ddd Here b is initialized with 0 and d with 1 and it it is possible that m = n, otherwise characterize letters that can be 0 or 1; the leading O bits are optional.

Depending on the specific hardware architecture, at least the leading bit of P must can be tested, both registers are shifted in parallel to the left until the leading bit of the Z register is set (this is necessary for the implementation on CCP / ACE). The leading bit from P to Z is always set after initialization. Depending on the hardware, it may not be possible to test the physically most significant bit of the Z register. The following is with

"Test the most significant bit of the Z register" means the most significant it of the Z register that can be tested. At the end of the initialization, the most significant bit of the Z register is the most significant set bit of P and Z and y are according to the separating one x O bits adjusted: Z = PPP. , .PPPO. , .Obbb. , .bbb y = OQQ. , .QQQO. , .Oddd. , .ddd. Main loop of the process

1. Calculate the difference u of the leading zeros of y and Z (u equals "number of leading zeros of Y" minus "number of leading zeros of Z"). u is greater than or equal to O.

If 2AUY <Z, set 2 = Z - 2AUY

Set u = u - 1;

If u is negative, end the loop, otherwise go to the line with Z = Z - ...

2. Set = 0 If the leading bit of Z is not set, shift Z to the left by 1, set n = n - 1.

Repeat the previous step if n> 0 and the leading bit of Z is not set.

, 3. Swap y and z and m and n.

4. If m = 0, complete the main loop final calculations of the process

I'm not quite clear yet

The concrete implementation using the example of the SLE66CxxS

This processor has a mathematical coprocessor with a length of 1120 bits (ACE, Advanced Crypto Engine) or 560 bits (CCP, Crypto Coprocessor) and thus fulfills the necessary requirements for the implementation of the proposed algorithm. It is possible to use the maximum parameter sizes provided in standardization efforts (NIST, ANSI 512 bit). For the use of the commonly used parameter sizes (160-256 Bit), it is sufficient to operate the processor in the operating mode with the short register length.

application areas

1) Encrypting data: As the sender of a message, I would like to treat it so that only the intended recipient can read it. For this I take the publicly known key and perform a mathematical transformation with knowledge of the secret key can be undone.

2) Digital signatures: As the sender of a message, I would like to mark the message so that the recipient can be convinced that the message really came from me. Usually you use the secret key to generate additional information so that the recipient can

Can provide security by checking whether there is a certain relationship between the message I received, this additional information and my public key.

The advantages of the algorithm come from the fact that the register length of the processor used is more than twice as long as the numbers to be processed; It has to be clarified whether this advantage could already be usefully used for other purposes and whether protection for this idea had already been applied for in other areas.

The algorithm described can also be used in this form in finite fields with characteristic 2.

Claims

claims

1. A method for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptic curves, an inverse being to be determined, characterized in that the results of two necessary operators are obtained in one calculation step.

2. The method in particular according to claim 1 for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptic curves, an inverse to be determined, characterized in that the extended Euclidean algorithm is used to determine the inverses in the prime number field.

3. The method in particular according to claim 1 or 2 for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptic curves, using a microprocessor, the microprocessor being able to access at least two registers T and U, the register length of which is actually greater than twice the bit length of the numbers to be calculated, the microprocessor having arithmetic routines for such numbers, given a, p in Z with 0 <a <p, p is a prime number, looking for x in Z, 0 <x <p with x ^* a = 1 mod p characterized by the following steps

Initialize A = p, B = a, xi = 1, x ₂ = 0 and

T = A * 2 ^{l + k} + x ₂ and U = B ^* 2 ^{l + k} + x, as long as B> 0: q = A / B

V = T - q ^* U (V = (r, Xo))

T = UU = V If B <0: Set x = x ₂

4. The method according to any one of claims 1 to 3, characterized in that the prime number body and the parameters of the elliptical are chosen freely.

5. A device, in particular a smart card, for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptical curves, an inverse to be determined, characterized in that the device has a microprocessor which is designed such that the results in one computing step two necessary operators can be obtained.

6. The device, in particular a smart card, in particular according to claim 5, for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptical curves, an inverse to be determined, characterized in that the microprocessor is provided with a memory in which commands are stored , which represent the extended Euclidean algorithm by means of which the determination of the inverses in the prime number field is possible.

7. The device, in particular a smart card, in particular according to claim 5 or 6 for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptic curves using a microprocessor, the microprocessor being able to access at least two registers T and U, the register length of which is really greater than twice the bit length of the numbers to be calculated, the microprocessor having arithmetic routines for such numbers, given a, p in Z with 0 <a <p, p is a prime number, looking for x in Z, 0 <x < p with x ^* a = 1 mod p, characterized in that the microprocessor has a memory for automatically executing the following steps: initialize A = p, B = a, x ₁ = 1, x ₂ = 0 and

T = A * 2 ^{l + k} + x ₂ and U = B * 2 ^{l + k} + x. As long as B> 0: q = A / B

V = T - q ^* U (V = (r, x ₀ )) T = U

U = V If B <0: Set x = x ₂

8. The device, in particular a smart card, in particular according to one of claims 5 to 7 for performing an inversion in the prime number field, in particular in the case of encryption by means of elliptic curves using a microprocessor, characterized in that the prime number body and the parameters are only in after the device has been manufactured a memory readable by the microprocessor, in particular an EEPROM, has been read in, in particular when personalizing the device.

9. Use of a method or a device according to one of the preceding claims in digital data transmission, in particular in the

Generation of digital signatures for mobile radio, internet and other digital transmission methods such as GSM, UMTS and DAB.

10. Machine-readable memory containing the commands required for automatically executing a method according to one of claims 1 to 4.