CN101572602A - Finite field inversion method and device based on hardware design - Google Patents

Abstract

The invention discloses a finite field inversion method based on hardware design, which is applied to an elliptic curve encryption system and comprises the following steps: will have a finite field GF ^m) An internal element polynomial a is used as an input element a, and an irreducible polynomial f (x) is defined, wherein a ═ a_m－1x^m－1+a_m－2x^m－2+...+a₁x+a₀，f(x)＝x^m+f_m－1x^m－1+...+f₁x+f₀，a_iAnd f_iCoefficients of input element a and irreducible polynomial f (x), respectively; input element a is repeatedly multiplied or divided by x with irreducible polynomial f (x)²And adding, after m cycles, outputting the multiplication inverse a of the input element a^－1. Correspondingly, the invention also provides a finite field GF (2) based on hardware design^m) And (5) an inversion device. Therefore, the invention ensures faster calculation speed, thereby greatly improving inversion operationEfficiency. In addition, the working frequency of the inversion device is close to the working frequency of other operation devices in the encryption system, so that the utilization rate of hardware resources of the inversion device is fully improved.

Description

A method and device for inverting a finite field based on hardware design

technical field

The invention relates to elliptic curve encryption technology, in particular to a method and device for inverting a finite field based on hardware design in an elliptic curve encryption system.

Background technique

Elliptic Curve Cryptography (Elliptic Curve Cryptography, ECC) was proposed by Victor Miller and Neal Koblitz in 1985. Its advantage is that it provides the same security as other cryptosystems and has a smaller key size, so it is currently known It is a public key system that can provide the highest bit strength among all public key cryptosystems in the world. Smaller key size means reduced memory requirements and reduced computing time, especially suitable for low power consumption and high-speed encrypted security applications, such as smart cards, personal computer memory cards, or any other types of handheld or portable devices application. The public key encryption algorithm standard P1363 established by IEEE (Institute of Electrical and Electronics Engineers) is based on the ECC algorithm. The cryptography community generally believes that it will replace the RSA algorithm and become a general-purpose public-key cryptographic algorithm. It has become a promising research direction, and how to efficiently implement ECC basic operations has become one of the research hotspots.

Elliptic curve cryptography mainly studies two types of elliptic curves, GF(p) and GF(p ^m ). Therefore, the basic algebraic operations that need to be performed in a cryptographic processor refer to element-wise addition, subtraction, multiplication and inversion operations on finite fields GF(p) and GF(p ^m ). Among them, the element-wise inversion algorithm, that is, calculating b=a ^-1 mod f, is the most expensive among the basic operations involved.

The general element-wise inversion algorithm is based on Fermat's theorem, and the inverse algorithm is regarded as a combination of elemental multiplication, as follows:

$\mathrm{<span\; class="notranslate">\; a</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>}^{<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; a</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; 2</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span>$

In this way, 2 ^m-1 -1 domain square (or multiplication) operations are required for inversion, so this algorithm has a very large amount of calculation and low efficiency, and is only suitable for simple applications with small base domains.

Another commonly used element inversion method is implemented according to the Extended Euclid algorithm. The basic idea is to calculate the inverse of the finite field through repeated iterations, a and f(x) are repeatedly multiplied or divided by x and added, and 1 and 0 are transformed in the same way. Thus, when a becomes 1, 1 becomes the inverse of a. The algorithm needs 2m cycles to complete an inversion operation on the finite field GF(p ^m ), so the efficiency is high. However, with the increasing development of cryptography applications, in the application of some high-speed and low-power electronic devices, such as smart cards, personal computer memory cards, or any other handheld or portable devices, such algorithms still limit the processing of the entire system. capacity and power consumption.

In summary, the existing finite field inversion schemes applied to elliptic curve encryption systems obviously have inconveniences and defects in actual use, so it is necessary to improve them.

Contents of the invention

In view of the above-mentioned defects, the object of the present invention is to provide a method and device for inverting a finite field based on hardware design, which can reduce the operation cycle and greatly improve the efficiency of inversion operation.

In order to achieve the above object, the present invention provides a method for inverting a finite field based on hardware design, which is applied to an elliptic curve encryption system, and the method includes the following steps:

A. Take an element polynomial a in the finite field GF(p ^m ) as input element a, and define an irreducible polynomial f(x), where a=a _m-1 x ^m-1 +a _m-2 x ^{m- 2} +...+a ₁ x+a ₀ , f(x)＝x ^m +f _m-1 x ^m-1 +...+f ₁ x+f ₀ , a _i and f _i are input elements respectively a and the coefficient of the irreducible polynomial f(x), m is a positive integer, and x is an independent variable of f(x);

B. The input element a and the irreducible polynomial f(x) are repeatedly multiplied or divided by x ² and added, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output.

According to the method for inverting a finite field of the present invention, the step B further includes:

Initialize the polynomial variables S, R, U, and V to f, a, 1, and 0 respectively, and initialize the variable δ to 0; according to the highest two sets of coefficients r _m r _m-1 , s _m s of the variables S and R The value of _m-1 , calculate the intermediate variables q and e; then calculate the four variables S, R, U, V according to the control signals r _m , r _m-1 δ ₀ , δ ₁ , e and i, which are in The calculation is completed within one clock cycle, and the values of the four variables S, R, U, V are updated in the next clock cycle, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output.

According to the method for inverting a finite field of the present invention, the step B further includes:

B1, variables S, R, U, V and δ are initialized to f, a, 1 and 0 respectively; intermediate variables q, e, temp1 and temp2 are initialized to 0 respectively;

B2. For the range of i from 0 to m-1, perform the following steps:

B3. Calculate intermediate variables q=s _m and e=s _m-1 -s _m r _m-1 , wherein s _m and s _m-1 are the highest and second highest coefficients of variable S respectively, and r _m-1 is is the second highest coefficient of variable R;

B4, calculate intermediate variable T=Ss _m R;

B5, calculating the intermediate variable W=Vs _m U;

B6. If the highest bit coefficient r _m of the variable R corresponds to GF(p) element 1, perform the following steps:

B7. If the lowest two bits of variable δ are all 0, and the value of variable e corresponds to element 0 of GF(p), then perform the following sub-steps B7a～B7h:

B7a) replace the value of temp1 with the value of R;

B7b) Calculate x ² T and replace the value of R with the result;

B7c) replace the value of S with the value of temp1;

B7d) replace the value of temp2 with the value of U;

B7e) Calculate xW mod f, and replace the value of W with the result;

B7f) repeat substep B7e, replace the value of U with the value of W;

B7g) replace the value of V with the value of temp2;

B7h) replace δ with δ+2;

B8. If the lowest two bits of the variable δ are all 0, and the value of the variable e corresponds to element 1 of GF(p), then perform the following sub-steps B8a～B8f:

B8a) Calculate xR-x ² eT, and replace the value of temp1 with the result;

B8b) Calculate xT, and replace the value of R with the result;

B8c) replace the value of S with the value of temp1;

B8d) calculate U-e(xW mod f), and replace the value of temp2 with the result;

B8e) replace the value of U with the value of W;

B8f) replace the value of V with the value of temp2;

B9. If the lowest bit and second lowest bit of the variable δ are 1 and 0 respectively, then perform the following sub-steps B9a-B9f:

B9a) replace the value of temp1 with the value of R;

B9b) Calculate x ² Tx(eR), and replace the value of R with the result;

B9c) replace the value of S with the value of temp1;

B9d) calculate U/x mod f, and replace the value of temp2 with the result;

B9e) Calculate x(W-e-temp2) mod f, and replace the value of U with the result;

B9f) replace the value of V with the value of temp2;

B10. If the lowest and second lowest bits of the variable δ are 1 and 1 respectively, then perform the following sub-steps B10a-B10e:

B10a) Calculate x ² Tx(e·R), and replace the value of S with the result;

B10b) calculate U/x mod f, and replace the value of temp1 with the result;

B10c) calculate W-etemp1, and replace the value of V with the result;

B10d) repeating sub-step B10b, replacing the value of U with the value of temp1;

B10e) replace δ with δ-2;

B11. If both the highest coefficient r _m and the second highest coefficient r _m-1 of the variable R correspond to element 0 of GF(p), perform the following sub-steps B11a-B11d:

B11a) Calculate x ² R and substitute the result for the value of R;

B11b) calculate xU mod f, and replace the value of U with the result;

B11c) Repeat sub-step B11b;

B11d) replace δ by δ+2;

B12. If the highest coefficient r _m and the second highest coefficient r _m-1 of the variable R correspond to elements 0 and 1 of GF(p) respectively, perform the following sub-steps B12a-B12d:

B12a) Calculate xR, and substitute the result for the value of R;

B12b) Calculate xT, and replace the value of S with the result;

B12c) calculate xU mod f, and replace the value of temp1 with the result;

B12d) calculate V-q·temp1, and replace the value of V with the result;

B13, the counting i of the loop counter increases by one bit, and when i is less than m-1, return to step B2;

B14. Count m times, that is, when i is equal to m-1, the inversion operation of the finite field GF(p ^m ) ends, and the output value is the multiplicative inverse a ^-1 of the input element a.

According to the finite field inversion method of the present invention, the input element a and the coefficients a _i and f _i of the irreducible polynomial f(x) belong to the finite field GF(p) for the range of i from 0 to m-1.

According to the method for finite field inversion of the present invention, the method realizes the element inversion of finite field GF(2 ^m ) through a hardware inversion device, and the operating frequency of the inversion device is the same as that of other computing devices in the elliptic curve encryption system The working frequency is similar.

According to the finite field inversion method of the present invention, the addition and subtraction of a certain element on the finite field GF(2 ^m ) is the bitwise XOR of the vector; multiplying or dividing a certain element by x is to shift the vector to the left or Shift one bit to the right, fill with zeros; take the modulo f(x) of an element, that is, take the modulus of the element and f(x), to ensure that the result is still within the finite field GF(2 ^m ).

According to the finite field inversion method of the present invention, when the variable U is multiplied by x or divided by x each time, if the highest bit is 1, it needs to be compared with $f\left(x\right)=x^m+\underset{0}{\overset{m-1}{\mathrm{\&Sigma;}}}{f}_i{x}^i$ Bitwise XOR modulo to reduce to ensure that the result is still within the finite field GF(2 ^m ).

The present invention also provides a device for inverting a finite field based on hardware design, which is applied to an elliptic curve encryption system. The finite field is GF(2 ^m ), and the device includes:

Registers R, S, U, V and δ, the registers R, S, U, V are used to store polynomial variables R, S, U and V respectively, the δ register is used to record the value of the variable δ, and the variable δ The change of U reflects the shifting of the U register. When initializing, an element polynomial a in the finite field GF(2 ^m ) is put into the R register as the input element a, and an irreducible polynomial f(x) is defined and put into the R register. The S register, and the U register is set to 1, and the V register and δ register are set to 0;

RS calculation logic module for updating variables R and S;

UV calculation logic module for updating variables U and V;

The control logic module is used to calculate the intermediate variables q and e according to the values of the highest two sets of coefficients r _m r _m-1 and s _m s _m-1 of the S register and the R register, and then according to the control signals r _m , r _m-1 , δ ₀ , δ ₁ , e and i to control the work of the RS calculation logic module and the UV calculation logic module;

The RS calculation logic module and the UV calculation logic module complete the calculation in one clock cycle, and re-input the updated values of the four variables S, R, U, and V into the registers S, R, U, and V in the next clock cycle, and cycle simultaneously Control the update of the counter i, and output the multiplicative inverse a ^-1 of the input element a after m cycles.

According to the finite field inversion device of the present invention, the RS calculation logic module and the UV calculation logic module respectively use hardware to realize basic operations,

The RS calculation logic module is composed of the same and parallel m+1 RS calculation logic units, and the RS calculation logic units work in parallel, and after completing the operation within one clock cycle, the update value is input into the R register and the S register, and then Waiting for the control logic instruction of the control logic module to perform the next round of calculation;

The UV calculation logic module is composed of the same and parallel m UV calculation logic units. The UV calculation logic units work in parallel, and after completing the operation in one clock cycle, the update value is input into the U register and the V register, and then waits for all the UV calculation logic units. The next round of calculation is performed according to the control logic instruction of the above control logic module.

According to the device for finite field inversion of the present invention, the storage capacity of the R register and the S register is both m+1 bits, and the storage capacity of the U register and the V register is m bits; the R register and the S register are mutually Influence, the U register and the V register affect each other, and the operations of these two sets of registers are synchronized.

The present invention takes an element polynomial a in the finite field GF(p ^m ) or GF(2 ^m ) as the input element a, and defines an irreducible polynomial f(x), and then combines the input element a with the irreducible polynomial f( x) Repeatedly multiply or divide by x ² and add, after m cycles, output the multiplicative inverse a ^-1 of the input element a. Thereby, the present invention only needs m clock cycles to complete an inversion operation, which is half of the 2m clock cycles required by the existing Extended Euclid algorithm, ensures faster calculation speed, and thus greatly improves the inversion operation efficiency. In addition, the operating frequency of the inverting device of the present invention is close to that of other computing devices in the elliptic curve encryption system, so as to fully improve the utilization rate of hardware resources of the inverting device, and further improve the computing performance of the entire system.

Description of drawings

Fig. 1 is the application block diagram of the device of finite field inversion in the elliptic curve encryption system of the present invention;

Fig. 2 is the hardware example figure of the device of finite field inversion of the present invention;

Fig. 3 is a hardware example diagram of the RS calculation logic unit of the device for finite field inversion of the present invention;

Fig. 4A is a hardware example diagram of the UV calculation logic unit of the device for finite field inversion of the present invention;

Fig. 4B is a hardware example diagram of the XMOD module and the D_XMOD module in the UV calculation logic unit of the present invention;

Fig. 5 is the method flowchart of the finite field inversion based on hardware design of the present invention;

Fig. 6 is an example flow chart of a preferred method for inverting a finite field in the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The basic idea of the present invention is: take an element polynomial a in the finite field GF(p ^m ) or GF(2 ^m ) as the input element a, and define an irreducible polynomial f(x), and then combine the input element a and The irreducible polynomial f(x) is repeatedly multiplied or divided by x ² and added, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output. Thereby, the present invention can reduce the operation cycle, and further greatly improve the inverse operation efficiency.

Fig. 1 shows the application of the finite field inversion device of the present invention in the elliptic curve encryption system. According to the requirements of the elliptic curve encryption algorithm, the elliptic curve encryption system 100 is modularized, and each module independently completes its own function. According to the control signal, mutual data exchange is realized to realize the encryption function. The elliptic curve encryption system 100 mainly includes a control interface 10, an arithmetic control unit 20, a dual-port RAM 30, an addition device 40, a multiplication device 50, a square device 60 and an inversion device 70, wherein:

The control interface 10 is the main controller in the encryption system 100 , which controls internal and external connections, and transmits instructions to other components inside the encryption system 100 .

The arithmetic control unit 20 is used to manage and organize the operation of each bottom module, and the bottom module includes: an addition device 40 , a multiplication device 50 , a square device 60 and an inversion device 70 .

The dual-port RAM 30 is responsible for data transmission and storage.

The adding device 40 , the multiplying device 50 , the squaring device 60 and the inversion device 70 respectively implement basic operations such as addition, multiplication, squaring and inversion in the finite field GF(p ^m ).

There are mainly two implementation schemes for implementing an elliptic curve encryption system 100, namely software implementation and hardware implementation. The development time required for software implementation is short, but its encryption speed is relatively slow, which hinders the practicability of elliptic curve encryption. Adopting hardware implementation provides a superior speed than software-based methods, and is more suitable for application fields that require encryption speed. The present invention belongs to a hardware implementation solution, which is applied to the elliptic curve encryption system 100 implemented in hardware.

Currently, the multiplication device 50 in the encryption system 100 mostly adopts LSD (Least Significant Digit First, lowest digit first) or MSD (Most Significant Digit First, highest digit first) algorithm. The maximum operating frequency of the hardware module implemented by this algorithm is lower than the maximum operating frequency of the inversion device 70 implemented by the Extended Euclid algorithm. Therefore, although the inverting device 70 implemented by the Extended Euclid algorithm alone can reach a very high operating frequency, it is still limited by the overall operating frequency of the elliptic curve encryption system 100. In each clock cycle, the inverting device 70 has most Time is idle. The operating frequency of the inversion device 70 implemented by the algorithm of the present invention is similar to that of other computing hardware modules, so as to fully improve the utilization rate of hardware resources of the inversion device 70 and further improve the computing performance of the entire encryption system 100 .

Fig. 2 is a hardware example diagram of the finite field inversion device of the present invention. For the convenience of description, this example is a hardware implementation of element inversion on the finite field GF(2 ^m ). According to the operation rule of finite field GF(2 ^m ): its elements are polynomials of order m-1, which can be represented by m-bit binary vectors. Here, the addition and subtraction of an element on the finite field GF(2 ^m ) is the bitwise XOR of the vector; multiplying or dividing an element by x means shifting the vector to the left or right by one bit and padding with zeros; Taking the modulo f(x) of an element is to take the modulus of the element and f(x) bit by bit, so as to ensure that the result is still within the finite field GF(2 ^m ). The hardware implementation of element inversion on the finite field GF(p ^m ) is similar, only need to replace the operands with the elements on GF(p ^m ), and adopt the basic operation rules on GF(p), in this paper The hardware implementation device for element-wise inversion on GF(p ^m ) will not be described in detail in the application.

The finite field inversion device 70 of the present invention is applied to the elliptic curve encryption system 100 shown in FIG. Calculation logic module 76, UV calculation logic module 77 and control logic module 78, wherein:

The R register 71 and the S register 72 are a group of registers R[r _m ...r ₀ ] and S[s _m ...s ₀ ] that influence each other, both of which have m+1 bits in storage, and are used to store the polynomial variable R and S. The U register 73 and the V register 74 are a group of registers U[u _m-1 ...u ₀ ] and V[v _m-1 ...v ₀ ] that influence each other, both of which have m-bit storage capacity and are used to store polynomials respectively Variables U and V. The operation of these two sets of registers is synchronous, and the updated value of the previous cycle is loaded on the rising edge of each clock cycle.

The δ register 75 is used to record the value of the variable δ, and the change of δ reflects the shift of the U register 73. When the U value is multiplied by x ² , the δ register 75 counts 2 bits; when the U value is divided by x ² , at this moment, the delta register 75 counts down by 2 bits.

During initialization, an element polynomial a in the finite field GF(2 ^m ) is put into the R register 71 as an input element a, and an irreducible polynomial f(x) is defined and put into the S register 72, and the U The register 73 is set to 1, the V register 74 and the delta register 75 are set to 0, and then the operation process starts.

a=a _m-1 x ^m-1 +a _m-2 x ^m-2 +...+a ₁ x+a ₀ ;

f(x)=x ^m +f _m-1 x ^m-1 +...+f ₁ x+f ₀ ;

Among them, a _i and f _i are the coefficients of the input element a and the irreducible polynomial f(x) respectively, m is a positive integer, and x belongs to the independent variable of f(x).

The RS calculation logic module 76 is used to update the variables R and S.

The UV calculation logic module 77 is used to update the variables U and V.

The control logic module 78 is used for calculating two intermediate variables q and e according to the values of the highest two groups of coefficients r _m r _m-1 and s _m s _m-1 of the R register 71 and the S register 72, wherein q= s _m and e=s _{m -1} -s _m r _{m -1 ,} and then control _the RS calculation logic module 76 and The UV calculation logic module 77 works.

The RS calculation logic module 76 and the UV calculation logic module 77 perform different addition, subtraction, and modulo operations according to the indication signal of the control logic module 78 . The RS calculation logic module 76 and the UV calculation logic module 77 of the present invention complete the calculation in one clock cycle, and re-input the updated values of the four variables S, R, U, V into the R register 71, the S register 72, the next clock cycle The U register 73 and the V register 74 update the loop control counter i at the same time. After m loops, the output value is the multiplicative inverse element a ^-1 of the input element a in the finite field GF(2 ^m ).

Specifically, the RS calculation logic module 76 and the UV calculation logic module 77 respectively use hardware to implement basic operations:

The RS calculation logic module 76 is composed of the same and parallel m+1 RS calculation logic units. The RS calculation logic units work in parallel, and input the updated value into the R register 71 and the S register 72 after completing the operation within one clock cycle. Then wait for the control logic instruction of the control logic module 78 to perform the next round of calculation.

The UV calculation logic module 77 is made up of the same and parallel m UV calculation logic units. The UV calculation logic units work in parallel, and after completing the operation in one clock cycle, the update value is input to the U register 73 and the V register 74, and then waits for The control logic instruction of the control logic module 78 performs the next round of calculation. Among them, the UV calculation logic is more complicated: the variable U must have a reduction operation every time it is multiplied by x or divided by x, that is, if the highest bit is 1, it needs to be XORed with f in bit order to ensure that the result is still in the finite field. within GF( ^2m ).

FIG. 3 is a hardware example diagram of the RS calculation logic unit of the finite field inversion device of the present invention. The same and parallel m+1 RS calculation logic units can form the RS calculation logic module 76 . The RS calculation logic unit is used to update the coefficients of the polynomials R and S, and the selector control signals include _rm , _rm-1 , δ ₀ , δ ₁ , e and i. The low levels of these control signals respectively indicate that the highest bit coefficient r _m of the R register 71 is 0, the second highest bit coefficient r _m-1 of the R register 71 is 0, the value of the delta register 75 is not 1 but 0, and the delta register The value of 75 is less than 2 and the variable e is equal to 0. In addition, when the low level of i indicates that the R register 71 and the S register 72 are initialized to a _i and f _i , the a _i and f _i are the input element a and the irreducible polynomial f (x) coefficient. The signals q and e are elements in the finite field GF(2), which can be obtained by the equations q=s _m and e=s _m-1 -s _m r _m-1 . The subscript of the variable in the RS calculation logic unit corresponds to a certain bit of the variable, and the output r _o and s _o correspond to the i-th bit of the input variable R and variable S in the next round of calculation, respectively.

It is worth noting that because the multiplication of a variable by x ² is realized by hardware, that is, the variable is shifted to the left by 2 bits and filled with zeros, so when i is less than 2, some subscripts (i-1, i-2) will be less than 0, at this time This input data is 0. These RS calculation logic units work in parallel, and after completing the calculation within one clock cycle, input the update value into the R register 71 and S register 72 of the corresponding bit, and then wait for the control logic instruction of the control logic module 78 to perform the next round of calculation.

FIG. 4A is a hardware example diagram of the UV calculation logic unit of the finite field inversion device of the present invention. The same and parallel m UV calculation logic units can form a UV calculation logic module 77 . Compared with the RS calculation logic unit, the UV calculation logic unit is more complicated, because each time the variable U is multiplied by x or divided by x, such as xU, xW and division operation U/x, if the highest bit coefficient is 1, need to be related to an irreducible polynomial $f\left(x\right)=x^m+\underset{0}{\overset{m-1}{\mathrm{\&Sigma;}}}{f}_i{x}^i$ Bitwise XOR modulo to reduce to ensure that the result is still within the finite field GF(2 ^m ).

The modular unit marked with XMOD in Figure 4A realizes the operation of multiplying or dividing a certain variable by x, and the modular unit marked with D_XMOD realizes the operation of multiplying or dividing a variable twice by x The modulo reduction operation. Among them, the control signal MultU=(r _m =1)&(δ ₁ =1)&(δ ₀ =1): when MultU is at high level, these two modules realize the division function, that is, the two gray units in Fig. 4A .

The specific implementation of the XMOD module and D_XMOD module of the UV calculation logic unit is shown in Figure 4B. The selector marked with * in Figure 4B is controlled by e and _δ1 at the same time, and selects the output signal or u _i input to the XMOD module. When e=1 and δ ₁ =0, when the output u _i is selected, the signal line with * is input to the output signal of the XMOD module; otherwise, when δ ₁ =1 and e=0, the output signal of the input XMOD module is selected , the signal line with * will output u _i . These UV calculation logic units work in parallel, and after completing the calculation in one clock cycle, input the updated value into the U register 73 and the V register 74, and then wait for the control logic instruction of the control logic module 78 to perform the next round of calculation.

From the perspective of improving the utilization rate of hardware resources, the present invention greatly reduces the calculation cycle, only needs half of the execution time of the commonly used Extended Euclid algorithm, and ensures faster realization of calculation.

At the same time, the invention improves the convenience of development. The present invention provides an IPC (Intelligence Property Core, intelligent core) that can be directly applied to hardware system design, including implementing the hardware RTL synthesis code of the present invention in system design. The application of the present invention only needs to create interface matching for specific applications, which greatly reduces the difficulty of system design and reduces the time required for design. Help users improve the efficiency and correctness of system design, improve product quality and accelerate the development process of system products.

Fig. 5 shows the method flow of the finite field GF(p ^m ) inversion based on the hardware design of the present invention, preferably the method for inverting the finite field GF(2 ^m ), which is applied to the elliptic curve encryption system, which can be obtained from Fig. 1 or The realization of the inversion device 70 shown in Fig. 2 mainly includes the following steps:

Step S501, taking an element polynomial a in the finite field GF(p ^m ) as input element a, and defining an irreducible polynomial f(x), where

a=a _m-1 x ^m-1 +a _m-2 x ^m-2 +...+a ₁ x+a ₀ ;

f(x)=x ^m +f _m-1 x ^m-1 +...+f ₁ x+f ₀ ;

a _i and f _i are the input element a and the coefficients of the irreducible polynomial f(x) respectively, m is a positive integer, and x is an independent variable of f(x).

Step S502, the input element a and the irreducible polynomial f(x) are repeatedly multiplied or divided by x ² and added, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output. This step also includes:

1) Initialize the polynomial variables S, R, U, and V to f, a, 1, and 0 respectively, and initialize the variable δ to 0. Specifically, the input element a is placed into the R register 71, the irreducible polynomial f(x) is placed into the S register 72, and the U register 73 is set to 1, the V register 74 and the δ register 75 is set to 0, and then the calculation process begins.

2) According to the values of the highest two sets of coefficients r _m r _m-1 and s _m s _m-1 of the variables S and R, calculate the intermediate variables q and e. Specifically, the control logic module 78 calculates two intermediate variables q and e according to the values of the highest two sets of coefficients r _m r _m-1 and s _m s _m-1 of the R register 71 and the S register 72, wherein q =s _m and e=s _m-1 -s _m r _m-1 .

3) Then calculate the four variables S, R, U, V according to the control signals r _m , r _m-1 , δ ₀ , δ ₁ , e and i, which completes the calculation in one clock cycle, and completes the calculation in the next clock cycle Periodically update the values of the four variables S, R, U, V. Specifically, the RS calculation logic module 76 and the UV calculation logic module 77 perform calculations according to the six control signals _rm , rm _-1 , δ ₀ , δ ₁ , e and i of the control logic module 78, and the RS calculation logic module 76 and UV calculation logic module 77 complete the calculation in one clock cycle, and re-input the updated values of the four variables S, R, U, V into the R register 71, S register 72, U register 73, and V register 74 in the next clock cycle , while the loop control counter i is updated.

4) After m cycles, the output value is the multiplicative inverse a ^-1 of the input element a in the finite field GF(p ^m ).

Fig. 6 is an example flow diagram of a preferred method for inverting a finite field in the present invention, which is applied to an elliptic curve encryption system 100, and can be realized by the inversion device 70 shown in Fig. 1 or Fig. 2 ^. The operations performed on the above implement the following operations:

a ^-1 ＝a mod f(x), a∈GF(p ^m )

The method takes an element polynomial a of a finite field GF(p ^m ) as an input element a, and defines an irreducible polynomial f(x). During the implementation of the method, these two elements are understood as a set of polynomials:

f(x)=x ^m +f _m-1 x ^m-1 +...+f ₁ x+f ₀ ; and

a=a _m-1 x ^m-1 +a _m-2 x ^m-2 +...+a ₁ x+a ₀ .

The input element a and the coefficients a _i and f _i of the irreducible polynomial f(x) are elements of the finite field GF(p) for the range of i from 0 to m-1, so the inversion method described below The basic operation in is the basic operation of elements on GF(p).

The inversion method on the finite field GF(p ^m ) of the present invention may comprise the following steps:

1) Initialize the polynomial variables S, R, U, V and δ to f, a, 1 and 0 respectively; the intermediate variables q, e, temp1 and temp2 are initialized to 0 respectively;

2) For the range of i from 0 to m-1, perform the following steps: specifically, control the RS calculation according to the control signals r _m , r _m-1 , δ ₀ , δ ₁ , e and i of the control logic module 78 Logic module 76 and UV calculation logic module 77 perform the following steps:

3) Calculate intermediate variables q=s _m and e=s _m-1 -s _m r _m-1 , where s _m and s _m-1 are the highest and second highest coefficients of variable S respectively, and r _m-1 is is the second highest coefficient of variable R;

4) Calculate the intermediate variable T=Ss _m R;

5) Calculate the intermediate variable W=Vs _m U;

6) If the highest bit coefficient r _m of the variable R corresponds to element 1 of GF(p), perform the following steps:

7) If the lowest two bits of variable δ are all 0, and the value of variable e corresponds to element 0 of GF(p), then perform the following sub-steps 7a-7h (step S6):

7a) replace the value of temp1 with the value of R;

7b) Calculate x ² T and replace the value of R with the result;

7c) replace the value of S with the value of temp1;

7d) replace the value of temp2 with the value of U;

7e) Calculate xW mod f, and replace the value of W with the result;

7f) repeat sub-step B7e, replace the value of U with the value of W;

7g) replace the value of V with the value of temp2;

7h) replace δ with δ+2;

8) If the lowest two bits of the variable δ are all 0, and the value of the variable e corresponds to element 1 of GF(p), then perform the following sub-steps 8a-8f (step S5):

8a) Calculate xR-x ² eT, and replace the value of temp1 with the result;

8b) Calculate xT, and replace the value of R with the result;

8c) replace the value of S with the value of temp1;

8d) Calculate U-e(xW mod f), and replace the result with the value of temp2;

8e) replace the value of U with the value of W;

8f) replace the value of V with the value of temp2;

9) If the lowest bit and the second lowest bit of the variable δ are 1 and 0 respectively, then perform the following sub-steps 9a-9f (step S2):

9a) replace the value of temp1 with the value of R;

9b) Calculate x ² Tx(eR), and substitute the result for the value of R;

9c) replace the value of S with the value of temp1;

9d) calculate U/x mod f, and replace the value of temp2 with the result;

9e) calculate x(W-e temp2) mod f, and replace the value of U with the result;

9f) Replace the value of V with the value of temp2.

10) If the lowest and second lowest bits of the variable δ are 1 and 1 respectively, then perform the following sub-steps 10a-10e (step S1):

10a) Calculate x ² Tx(e·R), and replace the value of S with the result;

10b) Calculate U/x mod f, and replace the result with the value of temp1;

10c) Calculate W-e·temp1, and replace the value of V with the result;

10d) repeating sub-step B10b, replacing the value of U with the value of temp1;

10e) Replace δ by δ-2.

11) If both the highest coefficient r _m and the second highest coefficient r _m-1 of the variable R correspond to element 0 of GF(p), perform the following sub-steps 11a-11d (step S4):

11a) Calculate x ² R and substitute the result for the value of R;

11b) Calculate xU mod f and replace the result with the value of U;

11c) Repeat sub-step B11b;

11d) Replace δ by δ+2.

12) If the highest bit r _m coefficient and the second highest bit coefficient r _m-1 of the variable R correspond to elements 0 and 1 of GF(p) respectively, perform the following sub-steps 12a-12d (step S3):

12a) Calculate xR, and substitute the result for the value of R;

12b) Calculate xT, and replace the value of S with the result;

12c) calculate xU mod f, and replace the value of temp1 with the result;

12d) Calculate V-q·temp1, and replace the value of V with the result;

13) The count i of the loop counter is increased by one bit, and when i is less than m-1, return to step B2;

14) Count m times, that is, when i is equal to m-1, the inverse operation of the finite field GF(p ^m ) ends, and the output value is the multiplicative inverse element a ^-1 of the input element a.

The present invention also has following characteristics:

1) The clock cycle required for each operation is constant, that is, it will not change with the input data, which is conducive to reducing the difficulty of design and control in large-scale system applications.

2) The required hardware area is proportional to p and m defined by the finite field GF(p ^m ), that is, it does not change with the change of input data or f.

3) It has quite high configurability, such as increasing the number of m-bit registers, it can be applied to an elliptic curve encryption system where the irreducible polynomial f changes.

In summary, the present invention takes an element polynomial a in the finite field GF(p ^m ) or GF(2 ^m ) as the input element a, and defines an irreducible polynomial f(x), and then combines the input element a with the irreducible The approximate polynomial f(x) is repeatedly multiplied or divided by x ² and added, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output. Thereby, the present invention only needs m clock cycles to complete an inversion operation, which is half of the 2m clock cycles required by the existing Extended Euclid algorithm, ensures faster calculation speed, and thus greatly improves the inversion operation efficiency. In addition, the operating frequency of the inverting device of the present invention is close to that of other computing devices in the elliptic curve encryption system, so as to fully improve the utilization rate of hardware resources of the inverting device, and further improve the computing performance of the entire system.

Certainly, the present invention also can have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, but these corresponding Changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (10)

1, a kind of method based on the finite field inversion of hardware design, be applied to elliptic curve encryption system, it is characterized in that, described method comprises steps as follows: A. Take an element polynomial a in the finite field GF(p ^m ) as input element a, and define an irreducible polynomial f(x), where a=a _m-1 x ^m-1 +a _m-2 x ^{m- 2} +...+a ₁ x+a ₀ , f(x)＝x ^m +f _m-1 x ^m-1 +...+f ₁ x+f ₀ , a _i and f _i are input elements respectively a and the coefficient of the irreducible polynomial f(x), m is a positive integer, and x is an independent variable of f(x); B. The input element a and the irreducible polynomial f(x) are repeatedly multiplied or divided by x ² and added, and after m cycles, the multiplicative inverse a ^-1 of the input element a is output. 2. The method according to claim 1, wherein said step B further comprises: Initialize the polynomial variables S, R, U, and V to f, a, 1, and 0 respectively, and initialize the variable δ to 0; according to the highest two sets of coefficients r _m r _m-1 , s _m s of the variables S and R value of _m-1 , calculate the intermediate variables q and e; then calculate the four variables S, R, U, V according to the control signals r _m , r _m-1 , δ ₀ , δ ₁ , e and i, which The calculation is completed in one clock cycle, and the values of the four variables S, R, U, and V are updated in the next clock cycle. After m cycles, the multiplicative inverse a ^-1 of the input element a is output. 3. The method according to claim 2, wherein said step B further comprises: B1, variables S, R, U, V and δ are initialized to f, a, 1 and 0 respectively; intermediate variables q, e, temp1 and temp2 are initialized to 0 respectively; B2. For the range of i from 0 to m-1, perform the following steps: B3. Calculate intermediate variables q=s _m and e=s _m-1 -s _m r _m-1 , wherein s _m and s _m-1 are the highest and second highest coefficients of variable S respectively, and r _m-1 is is the second highest coefficient of variable R; B4, calculate intermediate variable T=Ss _m R; B5, calculating the intermediate variable W=Vs _m U; B6. If the highest bit coefficient r _m of the variable R corresponds to GF(p) element 1, perform the following steps: B7. If the lowest two bits of variable δ are all 0, and the value of variable e corresponds to element 0 of GF(p), then perform the following sub-steps B7a～B7h: B7a) replace the value of temp1 with the value of R; B7b) Calculate x ² T and replace the value of R with the result; B7c) replace the value of S with the value of temp1; B7d) replace the value of temp2 with the value of U; B7e) Calculate xW mod f, and replace the value of W with the result; B7f) repeat substep B7e, replace the value of U with the value of W; B7g) replace the value of V with the value of temp2; B7h) replace δ with δ+2; B8. If the lowest two bits of the variable δ are all 0, and the value of the variable e corresponds to element 1 of GF(p), then perform the following sub-steps B8a～B8f: B8a) Calculate xR-x ² eT, and replace the value of temp1 with the result; B8b) Calculate xT, and replace the value of R with the result; B8c) replace the value of S with the value of temp1; B8d) calculate U-e(xW mod f), and replace the value of temp2 with the result; B8e) replace the value of U with the value of W; B8f) replace the value of V with the value of temp2; B9. If the lowest bit and second lowest bit of the variable δ are 1 and 0 respectively, then perform the following sub-steps B9a-B9f: B9a) replace the value of temp1 with the value of R; B9b) Calculate x ² Tx(eR), and replace the value of R with the result; B9c) replace the value of S with the value of temp1; B9d) calculate U/x mod f, and replace the value of temp2 with the result; B9e) calculate x(W-e temp2) mod f, replace the value of U with the result; B9f) replace the value of V with the value of temp2; B10. If the lowest and second lowest bits of the variable δ are 1 and 1 respectively, then perform the following sub-steps B10a-B10e: B10a) Calculate x ² Tx(e·R), and replace the value of S with the result; B10b) calculate U/x mod f, and replace the value of temp1 with the result; B10c) calculate W-etemp1, and replace the value of V with the result; B10d) repeating sub-step B10b, replacing the value of U with the value of temp1; B10e) replace δ with δ-2; B11. If both the highest coefficient r _m and the second highest coefficient r _m-1 of the variable R correspond to element 0 of GF(p), perform the following sub-steps B11a-B11d: B11a) Calculate x ² R and substitute the result for the value of R; B11b) calculate xU mod f, and replace the value of U with the result; B11c) Repeat sub-step B11b; B11d) replace δ by δ+2; B12. If the highest coefficient r _m and the second highest coefficient r _m-1 of the variable R correspond to elements 0 and 1 of GF(p) respectively, perform the following sub-steps B12a-B12d: B12a) Calculate xR, and substitute the result for the value of R; B12b) Calculate xT, and replace the value of S with the result; B12c) calculate xU mod f, and replace the value of temp1 with the result; B12d) calculate V-q·temp1, and replace the value of V with the result; B13, the counting i of the loop counter increases by one bit, and when i is less than m-1, return to step B2; B14. Count m times, that is, when i is equal to m-1, the inversion operation of the finite field GF(p ^m ) ends, and the output value is the multiplicative inverse a ^-1 of the input element a. 4. The method according to claim 3, characterized in that, the input element a and the coefficients a _i and f _i of the irreducible polynomial f(x) belong to the finite field GF for the range of i from 0 to m-1 (p). 5. The method according to claim 3, characterized in that, the method realizes the element inversion of finite field GF(2 ^m ) through a hardware inversion device, and the working frequency of the inversion device is the same as that of the elliptic curve encryption system The operating frequency of other computing devices in the computer is similar. 6. The method according to claim 5, characterized in that the addition and subtraction of a certain element on the finite field GF(2 ^m ) is the bitwise XOR of the vector; multiplying or dividing a certain element by x is about to The vector is shifted to the left or right by one bit and filled with zeros; to take a certain element modulo f(x), that is, to take the modulo of the element and f(x) bit by bit, to ensure that the result is still in the finite field GF(2 ^m ) Inside. 7. The method according to claim 6, characterized in that, when the variable U is multiplied by x or divided by x each time, if the highest bit is 1, it needs to be compared with $f\left(x\right)=x^m+\underset{0}{\overset{m-1}{\mathrm{\&Sigma;}}}{f}_i{x}^i$ Bitwise XOR modulo to reduce to ensure that the result is still within the finite field GF(2 ^m ). 8. A device for realizing the inversion of a finite field according to any one of claims 1 to 7, which is applied to an elliptic curve encryption system, wherein the finite field is GF(2 ^m ), and the device include: Registers R, S, U, V and δ, the registers R, S, U, V are used to store polynomial variables R, S, U and V respectively, the δ register is used to record the value of the variable δ, and the variable δ The change of U reflects the shifting of the U register. When initializing, an element polynomial a in the finite field GF(2 ^m ) is put into the R register as the input element a, and an irreducible polynomial f(x) is defined and put into the R register. The S register, and the U register is set to 1, and the V register and δ register are set to 0; RS calculation logic module for updating variables R and S; UV calculation logic module for updating variables U and V; The control logic module is used to calculate the intermediate variables q and e according to the values of the highest two sets of coefficients r _m r _m-1 and s _m s _m-1 of the S register and the R register, and then according to the control signals r _m , r _m-1 , δ ₀ , δ ₁ , e and i to control the work of the RS calculation logic module and the UV calculation logic module; The RS calculation logic module and the UV calculation logic module complete the calculation in one clock cycle, and re-input the updated values of the four variables S, R, U, and V into the registers S, R, U, and V in the next clock cycle, and cycle simultaneously Control the update of the counter i, and output the multiplicative inverse a ^-1 of the input element a after m cycles. 9. The device according to claim 8, characterized in that, the RS calculation logic module and the UV calculation logic module respectively use hardware to implement basic operations, The RS calculation logic module is composed of the same and parallel m+1 RS calculation logic units, and the RS calculation logic units work in parallel, and input the update value into the R register and the S register after completing the operation within one clock cycle, and then Waiting for the control logic instruction of the control logic module to perform the next round of calculation; The UV calculation logic module is composed of the same and parallel m UV calculation logic units. The UV calculation logic units work in parallel. After completing the operation in one clock cycle, the update value is input into the U register and the V register, and then waits for the The next round of calculation is performed according to the control logic instruction of the above control logic module. 10. The device according to claim 8, wherein the storage capacity of the R register and the S register is both m+1 bits, and the storage capacity of the U register and the V register is m bits; the R register The register and the S register affect each other, the U register and the V register affect each other, and the operations of these two sets of registers are synchronized.

Images