CN107040380A - A kind of improvement mould of the elliptic curve cryptosystem based on binary field removes method - Google Patents

Abstract

A kind of improvement mould of the elliptic curve cryptosystem based on binary field removes method, is related to domain operation method.A kind of improvement mould for about subtracting the fast elliptic curve cryptosystem based on binary field of efficiency high, arithmetic speed is provided and removes algorithm.According to r (t)=y (t)/x (t) mod F (t), register A, B, U, V are first assigned correspondence initial value by algorithm, again by disposably judging the value of minimum two bit binary data in register, realize correspondence about reducing, it is mould division result r (t) until the numerical value stored in register A is reduced to the numerical value stored in 1, register U.Algorithm is realized by Verilog language and emulated, contrast improved Euclidean algorithm and fermat's little theorem algorithm, the algorithm has advantage in terms of time loss, mould is effectively accelerated except calculating, available in ECC encryption and decryption IP kernels.

Description

An Improved Modulus Method for Elliptic Curve Cryptosystem Based on Binary Field

technical field

The invention relates to a field operation method, in particular to an improved modulo division method of an elliptic curve cryptosystem based on a binary field.

Background technique

With the development of science and technology, our quality of life has been greatly improved. At the same time, the problem of information security has become increasingly serious, threatening our property security and personal privacy all the time. Since different scenarios have different requirements, the encryption systems and encryption algorithms used are also different. The current encryption systems mainly include symmetric encryption and asymmetric encryption.

Since Diffie.W and Hellman.M jointly proposed the public key encryption system in 1976, it has become an important topic in the field of cryptography research and has always played an important role in information security. Different from symmetric encryption, the communication parties of asymmetric encryption have their own public key and private key respectively. At present, the construction of the public key encryption system is based on three major mathematical problems, one is the difficulty of factoring large numbers, the other is the difficulty of discrete logarithms, and the third is the difficulty of discrete logarithms of elliptic curves. The security basis of the elliptic curve cryptosystem is the discrete logarithm incomprehensibility of the elliptic curve, which was developed by Miller ([1] VSMiller, "Use of elliptic curves in cryptography," Advances in Cryptology-CRYPTO'85 Proceedings. Springer, 1986, pp. 417–426) and Koblitz ([2] N. Koblitz, “Elliptic curve cryptosystems,” Mathematics of computation, vol.48, no.177, pp.203–209, 1987). The elliptic curve is generally expressed as y ² +axy+by=x ³ +cx ² +dx+e. This type of curve is called the Weierstrass equation. The curve is composed of all points (x, y) that satisfy the equation. In hardware design , usually adopts its special form y ² +xy=x ³ +ax ² +1, where the value of a is 0 or 1, the curve of this form is called Koblitz elliptic curve.

The elliptic curve cryptosystem is calculated and realized on the finite field. The finite field is divided into binary field GF(2 ^m ) and prime number field GF(p). The binary field is suitable for hardware implementation. The main operation of the elliptic curve cryptosystem is a bit operation and field Operation, point operation consists of dot multiplication and dot addition. Field operations consist of modular addition, modular squaring, modular multiplication, and modular inverse. Among them, the time consumption of the modular inversion is the most, and the current research algorithms of the modular inverse operation have the following types of representatives: one is the extended Euclidean correlation algorithm ([3] JHGuo, CLWang, "Systolic array implementation of Euclid's algorithm for inversion and division in GF(2 ^m )".IEEE Transactions on Computers.1998,47(10):1161-1167), the second is the extended Euclidean improved algorithm ([4]SC Shantz, "From Euclid's GCD to Montgomery multiplication to the great divide, "Tech.Rep.TR-2001-95, Sun Microsystems, 1995), and the third is an inversion algorithm based on Fermat's little theorem ([5] T.Itoh, S.Tsujii, "A Fast Algorithm for Computing Multiplicative Inverses in GF(2 ^m ) Using Normal Bases,"IECE,Japan,1986,pp.31–36Paper of Technical Group,TGIT86-44.), improved Fermat's little theorem algorithm (MJZhi, "Design and Implementation of Elliptic CurveCryptography over GF(2 ^m )”, Dissertation of Shanghai Jiao Tong University, 2007).

Contents of the invention

The purpose of the present invention is to provide verifiable, fast operation speed, by checking the parity of the lowest two bits of data at one time, reducing time consumption, and realizing a binary domain-based domain operation with high reduction efficiency and fast operation speed. Improved Modulus Method for Elliptic Curve Cryptosystem.

One of the improved modulo removal method of the elliptic curve cryptosystem based on the binary field of the present invention comprises the following steps:

1) According to the relevant principles of elliptic curve cryptosystem, in the binary field GF(2 ^m ), two known elements x(t) and y(t) whose order is smaller than the threshold m are used as two input elements respectively, At the same time, according to the Koblitz elliptic curve parameters recommended by NIST (National Institute of Standards and Technology), select a known polynomial F(t) whose order is equal to the threshold m; according to the modulus division formula r(t)=y( t)/x(t)mod F(t), get the modulo division result r(t), or expressed as y(t)≡r(t)x(t)mod F(t); four registers A will be used , B, U, V store the required intermediate data in the algorithm, and reach the modulo division formula r(t)=y(t)/x(t)mod F(t), or y(t)≡r(t) x(t) mod F(t) carries out the purpose of iterative reduction calculation, at first, carry out initialization assignment to described four registers A, B, U, V in turn;

2) After completing the initial assignment of the four registers A, B, U, V, the algorithm starts to iteratively reduce the values stored in the registers A and B. During the reduction process, the four registers A, B, U and V need to always maintain the identity of the two formulas A×y(t)≡U×x(t) mod F(t) and B×y(t)≡V×x(t) mod F(t) , from the two formulas of A×y(t)≡U×x(t)mod F(t) and B×y(t)≡V×x(t)mod F(t), when registers A and B After the value stored in registers U and V changes, the values stored in registers U and V will also change accordingly;

3) The algorithm judges the low-order parity of the intermediate value stored in the register, and uses the shift and XOR in the hardware operation to complete the iteration and reduction calculation;

4) After a certain number of iterations and reduction calculations, the value stored in register A will be reduced to 1, and the entire division operation process will be terminated. Let U at this time be U _A=1 , then the identity at this time will be Become y(t)≡U _A=1 x(t)mod F(t), that is, the value of U _A=1 and the formula r(t)=y(t)/x(t)mod F(t) r(t) is the same, at this time, the value stored in register U is the modulus result r(t).

The present invention is based on the second improved modulus method of the elliptic curve cryptosystem of the binary domain, comprising the following steps:

1) When the lowest two bits of register A are 00, register A will continuously shift left twice; then judge the value of register U, if the lowest two bits of register U are 00, register U will continuously shift left twice; if The lowest two bits of register U are 10, and the value of register U will become the sum of the data of register U shifted left twice and F(t) shifted left once; if the lowest two bits of register U are 01, the value of register U It will become the sum of register U shifted left twice continuously and F(t) shifted left twice; if the lowest two bits of register U are 11, the value of register U will become register U shifted left twice consecutively and F (t) The sum of the data shifted to the left twice and the data of F(t) shifted to the left once;

2) When the lowest two bits of register A are 10, register A will perform a left shift; then judge the value of register U, if register U is even, then register U will perform a left shift; if register U is odd, register U The value of will become half of the sum of register U and F(t);

3) When the lowest two bits of register B are 00, register B will continuously shift left twice; then judge the value of register V, if the lowest two bits of register V are 00, register V will continuously shift left twice; if The lowest two bits of register V are 10, the value of register V will become the sum of the data of register V left shifted twice and F(t) left shifted once; if the lowest two bits of register V are 01, the value of register V It will become the sum of register V left shifted twice and F(t) shifted left twice; if the lowest two bits of register V are 11, the value of register V will become the value of register V shifted left twice and F (t) The sum of the data shifted to the left twice and the data of F(t) shifted to the left once;

4) When the lowest two bits of register B are 10, register B will perform a left shift; then judge the value of register V, if register V is even, then register V will perform a left shift; if register V is odd, register V The value of will become half of the sum of register V and F(t);

5) When the register A is greater than the register B, first complete the A=(A+B)/2 and U=U+V operations; then judge the value of the register U, if the register U is an even number, then the register U will perform a left shift , if the register U is an odd number, then the value of the register U will become half of the sum of the register U and F(t);

6) During all the other cases, first complete the B=(A+B)/2 and V=U+V operations; then judge the value of register V, if register V is an even number, then register V will carry out a left shift, if register V is an odd number, the value of register V will become half of the sum of register V and F(t);

7) Return the value of the register U at last, and the stored value is the modulus result r(t).

A kind of improved modulus division algorithm based on binary domain elliptic curve cryptosystem designed by the present invention improves the shantz modulus division algorithm, and the specific improvement method is that in the process of iterative reduction of the algorithm, each time the judgment The parity of the lowest two digits of the value stored in the register speeds up the calculation process without adding a lot of hardware resources.

The present invention is also designed based on the binary field.

In order to meet the needs of various fields for real-time secure communication, it is necessary to enhance the security of the encryption algorithm and improve the operation speed of the encryption algorithm.

Description of drawings

Fig. 1 is the register A, U operation block diagram of algorithm of the present invention.

Fig. 2 is the operation block diagram of the registers B and V of the algorithm of the present invention.

Fig. 3 is the simulation comparison result of the number of clocks consumed by the algorithm of the present invention and other modular inverse algorithms under the 50MHz clock.

Fig. 4 is the simulation comparison result of the throughput of the algorithm of the present invention and other modular inverse algorithms under the 50MHz clock.

detailed description

The embodiments of the present invention will be further described below in conjunction with the accompanying drawings.

The present invention is a kind of improved modular division algorithm based on the elliptic curve cryptosystem of binary field, utilizes the present invention to carry out the algorithm structural block diagram of modular division operation with reference to Fig. 1 and Fig. 2, and algorithm comprises following process:

1. Initialization parameters: the algorithm design and verification implementation of the present invention is based on the binary field GF(2 ^m ), and the user sets two elements x(t) and y whose order is smaller than the threshold m according to the Koblitz elliptic curve parameters recommended by NIST (t), respectively, as the input numerator and denominator, and then set a reduced polynomial F(t) whose order is equal to the threshold value m.

2. Initialization registers: In the present invention, four registers A, B, U, and V will be used to perform the following initialization assignments respectively: A←x(t), B←F(t), U←y(t), V← 0.

3. Iterative reduction:

After completing the initial assignment, the algorithm starts to iteratively reduce the input. The reduction process completes the corresponding shift and XOR operations by judging the low parity of the values stored in the register, specifically expressed as:

1) When A[1:0]==00, A=A/4. Then judge the value of U, if U[1:0]==00, U=U/4; if U[1:0]==10, U=U/4+F(t)/2; if U[ 1:0]==01, U=U/4+F(t)/4; if U[1:0]==11, U=U/4+F(t)/4+F(t)/ 2.

2) When A[1:0]==10, A=A/2. Then judge the value of U, if U is an even number, U=U/2; if U is an odd number, U=(U+F(t))/2.

3) When B[1:0]==00, B=B/4. Then judge the value of V, if V[1:0]==00, V=V/4; if V[1:0]==10, V=V/4+F(t)/2; if V[ 1:0]==01, V=V/4+F(t)/4; if V[1:0]==11, V=V/4+F(t)/4+F(t)/ 2.

4) When B[1:0]==10, B=B/2. Then judge the value of V, if V is an even number, V=V/2; if V is an odd number, V=(V+F(t))/2.

5) When A>B, A=(A+B)/2 and U=U+V. Then judge the value of U, if U is an even number, then U=U/2, if U is an odd number, U=(U+F(t))/2.

6) In other cases, B=(A+B)/2, V=U+V operation. Then judge the value of V, if V is an even number, then V=V/2, if V is an odd number, V=(V+F(t))/2.

4. Output result: After a certain round of iterative reduction, the value of register A is reduced to 1, and if U is U _A=1 at this time, then y(t)≡U _A=1 x(t)mod F( t), that is, U _A=1 is equal to r(t) in r(t)=y(t)/x(t)mod F(t), so the value stored in register U is the modulus result r(t) . Wherein, the algorithm of the present invention performs related operations on registers A and U to determine the parity of the lowest two digits (the same applies to registers B and V), see Table 1.

Table 1

Table 2

Frequency Area Critical Path Delay Cell 250MHz 0.253mm ² 3.78ns 11864

table 3

Degree(m) 163 233 283 409 Time(ns) 4480 6240 7580 11320 Clock 224 312 379 566

5. Simulation results: with reference to Fig. 3, it can be seen that the algorithm of the present invention consumes clock less than other modular inverse algorithms under the 50MHz clock

Number comparison results. Referring to FIG. 4 , it can be seen that the algorithm of the present invention compares the throughput of other modular inverse algorithms with a clock speed of 50 MHz.

See Table 2 for the comprehensive results of the algorithm of the present invention under the 0.18CMOS process, and see Table 3 for the number of clocks consumed by the algorithm of the present invention at different thresholds under the 50MHz clock. It can be seen that the comprehensive result of the algorithm of the present invention under the 0.18CMOS process. It can be seen that the number of clocks consumed by the algorithm of the present invention is 50MHz clock and different thresholds.

According to the present invention r(t)=y(t)/x(t)mod F(t), the algorithm first assigns the registers A, B, U, and V the corresponding initial values, and then judges the lowest two binary digits in the registers at one time. The value of the data, implements the corresponding reduction operation until the value stored in register A is reduced to 1, and the value stored in register U is the result of modulo division r(t). The algorithm is realized and simulated by Verilog language. Compared with the improved Euclidean algorithm and Fermat's little theorem algorithm, the algorithm has advantages in time consumption, effectively accelerates the modulo division calculation, and can be used in the ECC encryption and decryption IP core.

Claims (2)

1. a kind of improvement mould of the elliptic curve cryptosystem based on binary field removes method, it is characterised in that including following step Suddenly：

1) according to the relative theory of elliptic curve cryptosystem, it is located at binary field GF (2^m) in, it is known that two exponent numbers are less than threshold value M element x (t) and y (t), respectively as two input elements, while according to NIST (National Institute of Standards and Technology) The Koblitz elliptic curve parameters recommended, one known exponent number of selection is equal to threshold value m irreducible polynomial F (t)；According to Mould removes formula r (t)=y (t)/x (t) mod F (t), obtains mould division result r (t), or be expressed as y (t) ≡ r (t) x (t) mod F (t)；By using intermediate data required in four register A, B, U, V storage algorithms, reach and formula r (t)=y is removed to mould (t)/x (t) mod F (t), or y (t) ≡ r (t) x (t) mod F (t) are iterated the purpose for about subtracting calculating, first, successively to institute State four registers A, B, U, V and carry out initialization assignment；

2) after four registers A, B, U, V are completed with initial assignment, algorithm starts the numerical value to being stored in register A, B It is iterated and about subtracts, during about subtracting, four registers A, B, U, V needs to maintain A × y (t) ≡ U × x (t) mod all the time The identity of F (t) and B × y (t) ≡ V × two formula of x (t) mod F (t), from A × y (t) ≡ U × x (t) mod F (t) and B × y (t) ≡ V × formula of x (t) mod F (t) two are observed, it is changed when the numerical value stored in register A, B Afterwards, the numerical value stored in register U, V can also change therewith；

3) algorithm is by the low level parity for the intermediate value for judging to be stored in register, using the displacement in hardware operation and XOR completes iteration and about subtracts calculating；

4) iteration Jing Guo certain round will be reduced to 1, whole division fortune with about subtracting the numerical value stored in calculating, register A The process of calculation is terminated, if U now is U_A=1, then identity now will be changed into y (t) ≡ U_A=1X (t) mod F (t), i.e. U_A=1 Value it is identical with the r (t) in formula r (t)=y (t)/x (t) mod F (t), now, register U storage numerical value for mould except knot Fruit r (t).

2. a kind of improvement mould of the elliptic curve cryptosystem based on binary field removes method, it is characterised in that including following step Suddenly：

1) when minimum two of register A are 00, register A will be carried out continuously and move to left twice；Then register U number is judged Value, if minimum two of register U are 00, register U will be carried out continuously and move to left twice；If minimum two of register U For 10, register U value will be changed into register U and continuously move to left the data sum moved to left twice with F (t) once；If register U Minimum two be 01, register U value will be changed into register U and continuously move to left the data sum moved to left twice with F (t) twice； If minimum two of register U are 11, register U value will be changed into register U and continuously move to left to move to left twice with F (t) twice Data and F (t) move to left data sum once；

2) when minimum two of register A are 10, register A will be moved to left once；Then register U numerical value is judged, such as Fruit register U is even number, then register U will be moved to left once；If register U is odd number, register U value will be changed into Register U and 1/2nd of F (t) sums；

3) when minimum two of register B are 00, register B will be carried out continuously and move to left twice；Then register V number is judged Value, if minimum two of register V are 00, register V will be carried out continuously and move to left twice；If minimum two of register V For 10, register V value will be changed into register V and continuously move to left the data sum moved to left twice with F (t) once；If register V Minimum two be 01, register V value will be changed into register V and continuously move to left the data sum moved to left twice with F (t) twice； If minimum two of register V are 11, register V value will be changed into register V and continuously move to left to move to left twice with F (t) twice Data and F (t) move to left data sum once；

4) when minimum two of register B are 10, register B will be moved to left once；Then register V numerical value is judged, such as Fruit register V is even number, then register V will be moved to left once；If register V is odd number, register V value will be changed into Register V and 1/2nd of F (t) sums；

5) when register A is more than register B, A=(A+B)/2 and U=U+V operations are completed first；Then judge register U's Value, if register U is even number, then register U will be moved to left once, if register U is odd number, then register U Value will be changed into 1/2nd of register U and F (t) sums；

6) during remaining situation, B=(A+B)/2 and V=U+V operations are completed first；Then register V value is judged, if deposit Device V is even number, then register V will be moved to left once, if register V is odd number, register V value will be changed into register V and 1/2nd of F (t) sums；

7) register U value is finally returned to, its value stored is mould division result r (t).