JP2001066988A - Arithmetic unit - Google Patents

Abstract

PROBLEM TO BE SOLVED: To speed up arithmetic processing itself and also reduce a circuit scale of an arithmetic circuit, by providing an arithmetic unit with plural vector data input parts, a vector data output part, plural vector multiplying parts, and a vector adding part, and configuring the unit so as to eliminate the need for divisions and remainders calculation using polynominals. SOLUTION: An arithmetic unit 100 comprises 1st to 3rd vector data input parts 101-103, a vector output part 104, 1st and 2nd vector multiplying parts 105, 106, and a vector adding part 107. 1st input to the vector adding part 107 corresponds to upper m-pieces of components in vector data having (m+n) components inputted from the 3rd vector data input part 103, and the 2nd input is an vector data output having m-pieces of components outputted by the 2nd vector multiplying part 106. Moreover, the vector data output part 104 outputs the vector data having m-pieces of components outputted from the vector adding part 107. This configuration eliminates the need for divisions and remainder calculations by polynominals.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an arithmetic device,
More specifically, the present invention relates to a security technology for realizing encryption and decryption, and an arithmetic device for realizing a numerical operation used in an encoder and a decoder such as an error correction code.

[0002]

2. Description of the Related Art In recent years, various services have been provided by digitization of information, and a comfortable living environment has been improved. For example, with the spread of the Internet,
You can benefit from the services provided by servers all over the world connected to the network. With the widespread use of digital mobile phones, it is possible to immediately communicate when needed, and additional services other than telephone calls can be used. Credit cards and prepaid cards eliminate the hassle of exchanging cash. The digitization of information offers us convenience, but has the disadvantage of being susceptible to unauthorized use. This includes invasion of privacy due to eavesdropping, leakage of personal information, and unauthorized use of the system due to copying, falsification, and impersonation. Cryptographic techniques have attracted attention as a solution to these problems. Above all, research and development of cryptographic techniques using algebraic operations such as rings and fields have been actively conducted. The exact definitions and properties of rings / fields are described in detail in general algebra reference books, and thus will not be described in detail, and will be described only in the minimum necessary for the present invention. A set of integers age, It is assumed that a normal integer operation is defined for. At this time Is called a rational integer ring. 2 integers on a rational integer ring For n as a positive integer, A and b are said to be congruent to each other modulo n, It expresses. Also, an original set that contains a and is congruent with a, ie, To And called a coset containing a. Addition + and multiplication are defined for cosets as follows. A set with the above addition and multiplication To of Called the remainder ring.

[0003] Remainder ring In the usual calculation at, the element Is often represented by the remainder r obtained by dividing a by n. That is, Consider In this case, the remainder ring The addition + and the multiplication in the above binary a and b are realized as follows. here, Means that the remainder of dividing a by n is calculated. Remainder ring , When n is a prime number p, the remainder ring Is the prime field GF (p). As mentioned above, the remainder ring To execute an operation (including the prime field GF (p)), a remainder operation by n Must be performed. Generally, the remainder operation has a complicated hardware structure as compared with the multiplication, and the operation speed is several times slower. Therefore, some methods for replacing the remainder operation by multiplication or shift operation have been proposed. One of them is Montgomery Reduction.

[0004] Montgomery reduction defines a base R (> n) that is relatively prime to N, For T Is a method of calculating. Where R ^-1 is Is a positive integer that satisfies This method is effective when division and remainder calculation by R are easy and can be performed at relatively high speed. For more information, see a paper by Peter L. Montgomery, "Modular Multiplication Without Trial Divi
sion, "Mathematics of Computation Vol.44, No.170, p
p.519-521, 1985. According to the Montgomery paper, the algorithm REDC for calculating Montgomery reduction is as follows. function REDC (T) Note that N ′ in the above algorithm is Is a positive integer. As suggested by Montgomery, if R is selected to be the word size of the processor or its power, the division and remainder by R can be performed by simply extracting words, so the above algorithm does not require division, Can be calculated efficiently. Remainder ring using Montgomery reduction The above operation may be performed as follows. First, the remainder ring A Montgomery operation area is introduced for the operation area (FIG. 5). Remainder ring The upper element is associated with the element of the Montgomery operation area, and the actual operation is calculated in the Montgomery operation area. Remainder ring Montgomery transformation for the operation of associating the above element with the element of the Montgomery operation area, and the remainder ring for the element of the Montgomery operation area The operation of associating with the above element is called Montgomery inverse transformation. Then the remainder ring In order to perform the above series of operations, a series of operations in the Montgomery transform Montgomery operation area is performed by the procedure of inverse Montgomery transformation.

[0005] The Montgomery transformation is The upper element is associated with the element A in the Montgomery operation area as follows (assuming n = N). The Montgomery transformation is By calculating in advance, using Montgomery reduction, Can be realized by: On the other hand, the Montgomery inverse transformation is based on The above element a is associated as follows. The Montgomery inverse transformation uses Montgomery reduction, Can be realized by: Also, the remainder ring If the elements of the Montgomery operation area corresponding to the above elements a and b are A and B, respectively, Multiplication on, Is in the Montgomery arithmetic domain, Can be calculated. Addition on Is in the Montgomery arithmetic domain, Can be calculated. the above Can be realized by reducing N at most once, so that there is no need to perform a remainder operation. For example, The procedure for calculating is as follows. As mentioned above, the remainder ring The above operation can be performed without performing division and remainder operations by N.

[0006]

However, the above-mentioned Montgomery reduction uses a remainder ring with a positive integer n. And efficiently computes operations on the prime field GF (p), such as a polynomial with a finite commutative ring R as a coefficient, and a Galois field G
F (q) And a calculation on GF (q ^m ) cannot be realized. Therefore, a polynomial having a finite commutative ring R as a coefficient, a Galois field GF (q) In order to realize a polynomial with a coefficient of and a calculation on GF (q ^m ), division and remainder calculation are required. Therefore, the number of steps of the calculation process is increased, which requires a large calculation time, and There is a problem that the speed is reduced and the circuit scale of the division circuit is increased. The present invention has been made in order to solve the above-mentioned conventional problems, and has been made to solve the above-mentioned problems, and to provide a polynomial having a finite commutative ring R as a coefficient, a Galois field GF (q) It is an object of the present invention to provide a polynomial using a coefficient as a coefficient and an arithmetic device capable of reducing the amount of operation on GF (q ^m ) to speed up the arithmetic processing itself and to reduce the circuit scale of the arithmetic circuit. .

[0007]

In order to achieve the above object, according to the first aspect of the present invention, there is provided a first method for inputting vector data of m + 1 elements, each element being an element of a finite commutative ring R.
A second vector data input unit for inputting vector data of n elements, each element of which is an element of the finite commutative ring R in a positive integer n of m-1 or more, M + n whose elements are elements of the finite commutative ring R
A third vector data input unit for inputting vector data of the number of elements, a vector data output unit for outputting vector data of m elements in which each element is an element of the finite commutative ring R, Inputs and multiplies the vector data of two n elements, which are the elements of the finite commutative ring R,
A first vector multiplication unit that outputs the lower n elements of the multiplication result as vector data, and each element is a finite commutative ring R
A second vector multiplication unit that inputs and multiplies the vector data of the number of n elements and the vector data of the number of m + 1 elements, which are the elements of the above, and outputs the upper m elements of the multiplication result as vector data; A vector adder that inputs two pieces of vector data of m elements, which are elements of the finite commutative ring R, adds and outputs vector data of m elements as an addition result, The first input of the first vector multiplication unit is the lower n elements in the vector data of m + n elements input from the third vector data input unit.
The first input is n-element vector data input from the second vector data input unit, and the first input of the second vector multiplier is the first input of the first vector multiplier. The second input of the second vector multiplication unit is the vector data of the number of m + 1 elements input from the first vector data input unit. The first input of the addition unit is the upper m elements in the vector data of m + n elements input from the third vector data input unit, and the second input of the vector addition unit is 2 is a vector data output of m elements output by the vector multiplication unit of 2, and from the vector data output unit,
The m-element vector data output by the vector adder is output. The invention of claim 2 is
The claim 1 wherein the finite-friendly commutative rings R on the multiplicative unit element according denoted as 1, the finite-friendly commutative rings R of order n defined on monic monomial x ⁿ and the finite-friendly commutative rings R such that disjoint The above m-order monic polynomial is And a polynomial of degree less than n on the finite commutative ring R And the polynomial g ^* (x) on the finite commutative ring R on the finite commutative ring R: 2. The vector data of m + 1 elements having a coefficient at f (x) as an element in the first vector data input unit according to claim 1, wherein U ₀ is the lowest element, u ₁ is the second lowest element,
..., type u _m as a top-level element, the f ^* n number of elements of the vector data to the coefficient elements in (x) in the second vector data input unit according to claim 1, wherein A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 are input as the top element.

According to a third aspect of the present invention, each element is a Galois field GF
In a first vector data input unit for inputting vector data of m + 1 elements, which is an element of (q), and in a positive integer n of m-1 or more, each element is an element of the GF (q). A second vector data input unit for inputting vector data of the number of elements, and a third vector data input unit for inputting vector data of m + n elements each of which is an element of the GF (q). , Each element is the GF (q)
And a vector data output unit for outputting vector data of m elements, which is an element of GF (q), and a vector data output unit for outputting vector data of two n elements, each element being an element of the GF (q). A first vector multiplication unit that outputs the lower n elements of the result as vector data,
A second vector multiplication unit that inputs and multiplies the vector data of the number of n elements and the vector data of the number of m + 1 elements, which are elements of (q), and outputs the upper m elements of the multiplication result as vector data; A vector adder that inputs and adds two m-element vector data, each element being an element of the GF (q), and outputs m-element vector data as an addition result; , The first input of the first vector multiplication unit is the lower n elements in the vector data of m + n elements input from the third vector data input unit, and the first input of the first vector multiplication unit is The second input is n-element vector data input from the second vector data input unit. The first input of the second vector multiplication unit is the first vector multiplication unit. Output That n is an element number vector data output, the second input of the second vector multiplication section,
M + 1 input from the first vector data input unit
The first input of the vector addition unit is the upper m elements in the vector data of m + n elements input from the third vector data input unit, and the first input of the vector addition unit is Is a vector data output of the number of m elements output from the second vector multiplication unit. The vector data output unit outputs vector data of the number of m elements output from the vector addition unit. It is output. According to a fourth aspect of the present invention, the multiplicative unit on the Galois field GF (q) according to the third aspect is expressed as 1, and n defined on the GF (q)
The above G which is relatively prime to the following monic monomial ^xn
M-order monic polynomial on F (q) And a polynomial of degree less than n on the GF (q) And the polynomial g ^* (x) on the GF (q)
On F (q), 4. The vector data of the number of (m + 1) elements having a coefficient at f (x) as an element in the first vector data input unit according to claim 3, wherein U ₀ is the lowest element, u ₁ is the second lowest element,
· The u _m input as top-level elements, the f ^* n number of elements of the vector data to the coefficient elements in (x) in the second vector data input unit according to claim 3, wherein A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 are input as the top element.

According to a fifth aspect of the present invention, there is provided the electronic device according to the third aspect.
The multiplicative identity on the lower field GF (q) is expressed as 1, and the above G
M-order irreducible polynomial on F (q)And a polynomial of degree less than n on the GF (q)And the polynomial g on the GF (q)^*(X)
On F (q),In the case where it is determined that
A first vector data input unit is provided with a function of f (x).
Vector data of m + 1 elements with numbers as elementsU₀Is the lowest element, u₁Is the second element from the bottom,
・ ・ 、 U_mIs input as a top-level element.
The f is input to the second vector data input unit.^*(X)
Data of n number of elements with the coefficientV₀Is the lowest element, v₁Is the second element from the bottom,
.., v_n-1Is input as the top element.
I do. According to a sixth aspect of the present invention, a vector represented by m + 1 bits
First vector data input for inputting torque data
And n bits in a positive integer n equal to or greater than m-1
Vector data for inputting vector data
Data input section and vector data represented by m + n bits
A third vector data input unit for inputting
Vector for outputting vector data expressed in bits
Data output unit and two n-bit vector data
Input, multiply, and output lower n bits of multiplication result
A first vector multiplication unit, and n-bit vector data
multiply by inputting m + 1 bit vector data to each other
And a second vector that outputs the upper m bits of the multiplication result
Multiplier and two m-bit vector data
, Add, and add m-bit vector
A vector adder that outputs data.
The first input of the vector multiplier is the third vector
M + n-bit vector data input from the data input unit
Lower n bits in the first vector
The second input of the multiplication unit is from the second data input unit
The input n-bit vector data,
The first input of the vector multiplication unit is the first vector
N-bit vector data output from the
The second input of the second vector multiplication unit is
M + 1 bits input from the first vector data input unit
Vector data, and one of the vector adders
Eye input is from the third vector data input unit
The upper m bits in the resulting m + n bit vector
And the second input of the vector adder is the second input
M-bit vector data output by the vector multiplication unit
Output from the vector data output unit.
M-bit vector output by the vector adder is output
An arithmetic unit characterized by the following. According to a seventh aspect of the present invention,
A multiplicative identity on the field GF (2) is expressed as 1, and the above GF
(2) n-th order monomial expression x defined aboveⁿIs relatively prime with
M-degree polynomial on GF (2)And a polynomial of degree less than n on GF (2)And the polynomial g on GF (2)^*(X) is replaced by GF (2)
In the above,In the case where it is determined so that
A first vector data input unit is provided with a function of f (x).
M + 1-bit vector data with numbers as elementsU₀Is the least significant bit, u₁To the second lowest bit
U, u_mAs the most significant bit
6. The f vector is input to the second vector data input unit described in 6.
^*N-bit vector whose elements are the coefficients in (x)
data V₀Is the least significant bit, v₁To the second lowest bit
G, ..., v_n-1As the most significant bit
It is characterized by.

[0010] The invention according to claim 8 is based on the Galois body GF (2).
Is expressed as 1 and the m-th order element on GF (2)
About polynomialAnd a polynomial of degree less than n on GF (2)And the polynomial g on GF (2)^*(X) is replaced by GF (2)
In the above,In the case where it is determined so that
A first vector data input unit is provided with a function of f (x).
M + 1-bit vector data with numbers as elementsU₀Is the least significant bit, u₁To the second lowest bit
U, u_mAs the most significant bit
6. The f vector is input to the second vector data input unit described in 6.
^*N-bit vector whose elements are the coefficients in (x)
data V₀Is the least significant bit, v₁To the second lowest bit
G, ..., v_n-1As the most significant bit
It is characterized by. Prior to the above invention, we
Principle of Polynomial Montgomery Reduction
Was found. Therefore, below, first, Polynomial Mon
The tgomeryReduction will be described. On a finite commutative ring R
Define a monic polynomial f (x) and cosets by f (x)
think of. Also, on R, a monitor that is disjoint from f (x)
G polynomial g (x)G^*(X), f^*(X)To satisfy. here, Denotes the order of f (x) with respect to x. Also, multiplication on R
The unit element is expressed as 1.Then, from the above three equations,Can be said. Polynomial Montgomery Reduction isFor a polynomial h (x) on RIs calculated. here, IsIs divided by f (x).

An algorithm for calculating Polynomial Montgomery Reduction is shown below as POLYREDC. The grounds on which the above algorithm operates normally are shown below.
First, Therefore, in step 2 Is divisible by g (x). Also, Thus, t (x) output in step 3 is It is. further, Than, It is. Therefore, the degree of the polynomial output by POLYREDC is Is less than. In addition, Is the product of the polynomials output by POLYREDC again.
It has been added to enable input to POLYREDC. The present invention provides the algorithm POLYREDC, Is a device that calculates as This gives the division / g
(X) and remainder operation Are replaced by cutout and shift operations, so that division and remainder operations are unnecessary. That is, it is possible to reduce the amount of calculation on the polynomial using the finite commutative ring R as a coefficient to speed up the calculation processing itself and to reduce the circuit scale of the calculation circuit.

In the above description, a polynomial having a finite commutative ring R as a coefficient is used for explanation. However, the data in the arithmetic unit in the present invention is not used as the polynomial itself. Take out and treat each element as vector data based on the finite commutative ring R. At this time, the coefficient of the higher-order term of the polynomial is called the upper element of the vector, and the coefficient of the lower-order term is called the lower element of the vector. The above-described method of expressing using a polynomial and the method of expressing using a vector represent the same element, although the expression method is different. A method of expressing an element using a polynomial is called an original polynomial expression, and a method of expressing an element using a vector is called an original vector expression. As will be described in detail in Embodiment 3 of the present invention, if the present invention is used, the operation of the remainder class by the polynomial f (x) using the finite commutative ring R as a coefficient is calculated as the remainder by f (x). It can be realized without. Here, if the finite commutative ring R is limited to a Galois field GF (q), and if f (x) is an irreducible polynomial, the remainder class is a Galois field GF where f (x) is a generator polynomial. (Q ^m ). At this time, the vector data in the arithmetic device according to the present invention is GF (q ^m )
Is expressed using a polynomial basis. In this case, the Galois field GF
The arithmetic unit on (q ^m ) can be configured. Therefore, the arithmetic unit according to claim 1 and claim 2 according to the present invention is an arithmetic unit effective for an operation on a polynomial using the finite commutative ring R as a coefficient, and according to claims 3 and 4. Is a case where the finite commutative ring R is limited to a Galois field GF (q), and is an operation device effective for an operation on a polynomial using GF (q) as a coefficient. The arithmetic device described above is a case where the finite commutative ring R is limited to a Galois field GF (q), and the m-th order polynomial f (x) on the GF (q) is irreducible. The arithmetic unit is effective for an operation on GF (q ^m ). The arithmetic unit according to claim 6 or claim 7 is a case where the finite commutative ring R is limited to a Galois field GF (2). , GF (2) is an effective arithmetic unit for operations on polynomials with coefficients,
The arithmetic unit according to claim 8, wherein the finite commutative ring R is limited to a Galois field GF (2), and the m-th order polynomial f (x) on the GF (2) is irreducible. , An effective arithmetic unit for operations on the Galois field GF (2 ^m ).
As described above, in the present invention, since division and remainder calculation by a polynomial are not required, the amount of calculation can be reduced, the calculation processing itself can be sped up, and the circuit scale of the calculation circuit can be reduced. .

[0013]

Embodiments of the present invention will be described below. (Embodiment 1) In Embodiment 1, an example of the configuration of an arithmetic unit according to the present invention will be described. The arithmetic device 100 shown in FIG. 1 includes a first vector data input unit 10 for inputting vector data of m + 1 elements, each element being an element of a finite commutative ring R.
1 and a second vector data input unit 102 for inputting vector data of n elements, each element of which is an element of the finite commutative ring R, in a positive integer n of m-1 or more; A third vector data input unit 10 for inputting vector data of m + n elements, which is an element of the finite commutative ring R
3 and a vector data output unit 10 for outputting vector data of m elements in which each element is an element of the finite commutative ring R.
4 and a first vector multiplication unit that inputs and multiplies vector data of two n elements, each element being an element of the finite commutative ring R, and outputs lower n elements of the multiplication result as vector data 105, and n-element vector data and m + 1-element vector data, each element of which is an element of the finite commutative ring R, are input to each other, multiplied, and the upper m elements of the multiplication result are output as vector data. A second vector multiplication unit 106 and two m's each element of which is an element of the finite commutative ring R
It comprises a vector adder 107 that inputs and adds vector data of the number of elements to each other and outputs vector data of the number of m elements as a result of the addition. The first input of the first vector multiplication unit 105 is the lower n elements in the vector data of m + n elements input from the third vector data input unit 103, and the second input is The first input of the second vector multiplication unit 106 is the number of n-elements output from the first vector multiplication unit 105, which is n-element vector data input from the second vector data input unit 102. The second input is vector data of m + 1 elements input from the first vector data input unit 101.
The third input is the upper m in the vector data of m + n elements input from the third vector data input unit 103.
The second input is a second vector multiplication unit
This is vector data output of m elements output by 106,
The vector data output unit 104 outputs vector data of m elements output from the vector addition unit 107.

[0014] The computing device 100, the finite-friendly commutative rings R on the multiplicative identity element is denoted by 1, said such that relatively prime to the defined order n monic monomial x ⁿ on the finite-friendly commutative rings R M-order monic polynomial on a finite commutative ring R And a polynomial of degree less than n on the finite commutative ring R And the polynomial g ^* (x) on the finite commutative ring R on the finite commutative ring R: In the case where is determined to be, the first vector data input unit 101 inputs the vector data of m + 1 elements having the coefficient of f (x) as an element. U ₀ is the lowest element, u ₁ is the second lowest element,
.., U _m are input as the most significant element, and the second vector data input unit 102 has n elements of vector data with the coefficient at f ^* (x) as the element. A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 are input as the most significant element, and a polynomial of degree m + n or less on the finite commutative ring R is input to the third vector data input unit 103 Data of m + n number of elements with the coefficient of Is h ₀ , the lowest element, h ₁ is the second lowest element,
.. When hm _{+ n-1} is input as the top-level element, the vector data output unit 104 Vector data with t ₀ being the lowest element, t ₁ being the second lowest element,..., T _m-1 being the highest element Is output. Here, two vector data in which each element is an element of the finite commutative ring R Is to add the result of Then It is to be. Here, the above equation indicates that a _i and b _i are added on the finite commutative ring R to obtain c _i . Therefore,
As described above, the vector addition unit 107 in the arithmetic unit 100 is a unit for adding vector data, and an example thereof is shown as a vector adder 200 in FIG. That is, the vector adder 200 determines that each element is an element of the finite commutative ring R
Two vector data input units A and B for inputting vector data of the number of elements, a vector data output unit C for outputting vector data of the number of N elements which are elements of the finite commutative ring R, and N Equipped with an adder on the finite commutative ring R, adds the vector data of the number of N elements input from the vector data input units A and B on R for each element, and converts the resulting vector data of the number of N elements into vector data. Output to output section C.
When the vector adder 107 is configured using the vector adder, the vector adder 107 adds two vector data consisting of m elements and outputs vector data consisting of m elements.
In particular, when N> m, Nm elements of the vector data input unit and the output unit need not be used. Also,
If N <m, the required number of vector adders 200 may be arranged in parallel to form a vector adder.

Further, vector data consisting of the number of N elements in which each element is an element of a finite commutative ring R And vector data consisting of M elements Multiplying is the result of multiplying Then It is to be. Here, the above equation shows that the a _i and b _j multiplied on the finite-friendly commutative rings R, all the multiplication results together to meet the i + j = k by adding on the finite-friendly commutative rings R, and d _k . Therefore, the vector multipliers 105 and 106 in the arithmetic unit 100 are composed of the vector multipliers for multiplying the vector data as described above, and an example of the vector multiplier is shown in FIG. That is, the vector multiplier 300 shown in FIG. 3 includes a vector data input unit A for inputting vector data of N elements in which each element is an element of the finite commutative ring R, and each element is an element of the finite commutative ring R. is there
A vector data input unit B for inputting vector data of M elements, and M + N where each element is an element of a finite commutative ring R
A vector data output unit C for outputting vector data of −1 elements, multipliers on MN finite commutative rings R,
(M-1) (N-1) adders on the finite commutative ring R. Therefore, the first vector multiplier 105 in the arithmetic unit 100 may configure the vector multiplier 300 as M = N = n and output n elements from the lower order of the vector data output unit C. Further, the arithmetic unit 100
In the second vector multiplication unit 106, the vector multiplier may be configured as M = m + 1, N = n, and may output m elements from the upper part of the vector data output unit C. In particular, if the number of elements of the input vector data is M or N
, The zero element on R may be input to the upper element of the vector data input unit A or B. If the number of elements of the input vector data exceeds M or N, the vector multiplier 300 and the vector adder 200
Can be combined to implement the vector multiplication units 105 and 106.

(Embodiment 2) In Embodiment 2, each element of the vector data processed by the arithmetic unit 100 is G
F (2), that is, the finite commutative ring R is GF
An example of a circuit configuration of the vector multiplier 300 and the vector adder 200 in the case of limiting to (2) will be described. The vector multiplier 400 shown in FIG. 4 multiplies data of M bits and N bits, and outputs data of M + N-1 bits. GF
(2) Since the above adder circuit can be realized by an exclusive OR circuit and the multiplier circuit can be realized by an AND circuit, the finite commutative ring R is represented by G
The present vector multiplier 400 when limited to F (2) can be obtained by using a multiplier in the vector multiplier 300 as an AND circuit and an adder as an exclusive OR circuit. When the finite commutative ring R is limited to GF (2), the adder in the vector adder 200 may be an exclusive OR circuit.

(Embodiment 3) In Embodiment 3, an example of an operation performed using the arithmetic unit 100 shown in Embodiment 1 will be described in detail using actual numerical values. First, like the introduction of the Montgomery arithmetic domain to Montgomery reduction, the basic principle of the present invention, Polynomi
An extended Montgomery calculation area is defined and introduced for al Montgomery Reduction (Fig. 6). The element of the coset by the polynomial f (x) having the finite commutative ring R as a coefficient is associated with the element of the extended Montgomery operation area, and the actual operation is calculated in the extended Montgomery operation area. The operation of associating the coset by f (x), that is, the element of the f (x) coset with the element of the extended Montgomery operation area is an extended Montgomery transformation, and the element of the extended Montgomery operation area is set to the element of the f (x) coset. The associating operation is called an extended Montgomery inverse transformation. Then, in order to perform a series of operations in the f (x) residue system, a series of operations in the extended Montgomery transformation extended Montgomery operation area is performed by the procedure of the extended Montgomery inverse transformation. First, a monic polynomial g (x) which is relatively prime to the monic polynomial f (x) on the finite commutative ring R is G ^* (x) and f ^* (x) are defined as To satisfy. The extended Montgomery transform is f (x)
The element a (x) of the remainder system is replaced with the element A of the extended Montgomery operation area.
(X) is associated as follows. The extended Montgomery transformation is By calculating in advance, the Polynomial Montgomer
Using the POLYREDC algorithm to calculate y Reduction, Can be realized by:

On the other hand, the extended Montgomery inverse transformation associates the element A (x) of the extended Montgomery operation area with the element a (x) of the coset by f (x) as follows. The extended Montgomery inverse transform uses POLYREDC, Can be realized by: Also, the element of the f (x) remainder system, a
For (x) and b (x), if the elements of the corresponding extended Montgomery operation area are A (x) and B (x), respectively, f
(X) multiplication in the remainder system, Is in the extended Montgomery domain, Can be calculated. Addition in f (x) remainder system Is in the extended Montgomery domain, Can be calculated. Here, A (x) and B (x) are f
Since the order is lower than (x), the above operation can be performed without performing the remainder operation.

When ready, the irreducible polynomial on GF (5) Consider the case of calculating the operation on GF (5) generated by Since f (x) is irreducible on GF (5), Become Against F ^* (x) and g ^* (x) always exist. In particular,
If n = 4, Becomes Now, the element on GF (5 ⁵ ) Against Here is an example of calculating. Here, a (x), b (x), and c (x) denote a, b, and c as polynomial expressions, respectively. It is. First, Then, an element A in the extended Montgomery operation area obtained by performing extended Montgomery transformation on a (x), b (x), and c (x) respectively
(X), B (x), C (x) Is calculated by The POLYLREDC is calculated by the arithmetic unit 100. First, a process of calculating A (x) by the arithmetic device 100 will be described. On GF (5), Therefore, in the third vector data input unit 103 of the arithmetic unit 100, m + n = 5 + 4 = 9 elements H =
The vector data (0, 3, 3, 0, 0, 2, 2, 0, 0) is input. A first vector data input unit;
A vector data U = (1,1,1,1,1,4) of six elements having the coefficient of f (x) as an element is input to 101, and a second vector data input unit 102 , Said f
Vector data V of 4 elements, with coefficients of (x) as elements
= (4, 2, 1, 1). The first vector data input to the first vector multiplication unit 105 is the vector data H = (0, 3, 3, 0, 0, 2, 2, 2) input from the third vector data input unit 103. 0, 0), and the second vector data is the vector data V = (4, 2, 1) input from the second vector data input unit 102. , 1). GF
Vector data of the number of M elements and the number of N elements where each element is the element of (p) The output of the vector multiplier that calculates the product of Then Thus, the first vector multiplication unit 105 calculates (3,
2,4,0,0)
The vector data (4, 2, 0, 0) including the elements is output.

The first vector data input to the second vector multiplication unit 106 is vector data (4, 2, 0, 0) composed of the above four elements, and the second vector data is , The vector data U = (1,1,1,1,1,1,
4), the second vector multiplication unit calculates (4, 4)
Vector data (4,1,1,1) consisting of the upper five elements of the vector data of 1,1,1,1,3,3,0,0)
1, 1) is output. Therefore, the vector data input to the vector addition unit 107 includes the vector data (4, 1, 1, 1, 1) composed of the above five elements and the vector data H =
Vector data (0,3,3,0,0) consisting of the upper five elements of (0,3,3,0,0,2,2,0,0). Vector data of two N elements with each element being the element of GF (p) The output of the vector adder that calculates the sum of Then Therefore, the vector adding unit 107 outputs vector data (4, 4, 4, 1, 1) composed of five elements. Therefore, the arithmetic unit 100 outputs the vector data (4, 4, 4,
4, 1, 1) is output. Therefore, the arithmetic unit 100 Is calculated. Similarly, Therefore, the vector data H = (0,4,0,3,4,1,3,0,0) having the coefficients of the polynomial as elements are input to the third vector data input unit 103 of the arithmetic device 100.
Is input to the first vector data input unit 101.
6-element vector data U having coefficients of (x) as elements
= (1,1,1,1,1,4) to enter, the second vector data input unit 102, the f ^* (x) the number of four elements that coefficient elements of the vector data V = (4 , 2, 1, 1) and (4, 1, 1) from the vector data output unit 104.
2,0,1). Therefore, Becomes Similarly, Thus, the vector data H = (0, 2, 1, 1, 1, 1, 1, 4, 0, 0) having the coefficients of the polynomial as elements are input to the third vector data input unit 103 of the arithmetic device 100.
Is input to the first vector data input unit 101.
6-element vector data U having coefficients of (x) as elements
= (1,1,1,1,1,4) to enter, the second vector data input unit 102, the f ^* (x) the number of four elements that coefficient elements of the vector data V = (4 , 2, 1, 1) and (0, 1, 1) from the vector data output unit 104.
0,0,0). Therefore, Becomes

In order to calculate the above z = (ab + c) ² with GF (5 ⁵ ), in the extended Montgomery region, Will be calculated. The above formula is It can be calculated by the following procedure.

As already calculated, So, in step1, Becomes Therefore, the POLYREDC in step 2 is input to the third vector data input unit 103 of the arithmetic device 100 by using the vector data H = (1,
0, 3, 1, 2, 2, 1, 1, 1) is input to the first vector data input unit 101, and vector data U = (6 elements) having the coefficient of f (x) as an element 1,1,1,
1, 1, 4) and the second vector data input unit 10
If the vector data V = (4,2,1,1) of four elements having the coefficient of f ^* (x) as an element is input to 2, the vector data output unit 104 outputs (0,3,3). , 2,3) Is calculated. In step 3, Z (x) is added to C (x) = x ³ which has already been calculated, Is obtained. In step 4, the above W (x) is squared, Is obtained. Therefore, POLYREDC in step 5 is input to the third vector data input unit 103 in the arithmetic device 100.
Vector data H =
(0,0,1,4,0,1,2,2,4) is input to the first vector data input unit 101, the vector data of 6 elements having the coefficient of f (x) as an element. U = (1,1,
1, 1, 1, 4), and input to the second vector data input unit 102, the vector data V = (4,2,1,1) of four elements having the coefficient of f ^* (x) as an element. ),
From the vector data output unit 104, (3, 0, 2, 4,
0) Is calculated. An arithmetic result can be obtained by performing the extended Montgomery inverse transform on the Z (x). That is, the third vector data input unit 103 in the arithmetic device 100
Vector data H =
(0,0,0,0,3,0,2,4,0) is input to the first vector data input unit 101, the vector data of 6 elements having the coefficient of f (x) as an element. U = (1,1,
1, 1, 1, 4), and input to the second vector data input unit 102, the vector data V = (4,2,1,1) of four elements having the coefficient of f ^* (x) as an element. ),
From the vector data output unit 104, (0, 1, 0, 0, 3) which is the operation result of z = (ab + c) ² is obtained. If the above operation result is represented by a polynomial expression, x ³ +3 is obtained. And when Matches.

In the third embodiment, the finite commutative ring R has been described as GF (5). However, the present invention is not limited to the finite commutative ring R but GF (5). You may. In the third embodiment, GF
(5 ⁵⁾ has been described a specific example of operations on, in the present invention can be implemented whatever the operation to be replaced by a calculation of the polynomial coefficient finite friendly commutative rings R. In addition,
In this specification, there are a part in which mathematical formulas and symbols are written in italic (italic) and a part in block form, but the meanings are the same.

[0024]

As described above, according to the present invention,
Since division and remainder calculation by a polynomial are unnecessary, a polynomial having a finite commutative ring R as a coefficient or a Galois field GF (q) And a computing device that can reduce the amount of computation on GF (q ^m ) to speed up the computation itself and reduce the circuit scale of the computation circuit.

[Brief description of the drawings]

FIG. 1 is a diagram showing a schematic configuration of an arithmetic unit according to Embodiment 1 of the present invention.

FIG. 2 is a diagram showing a schematic configuration of a vector adder according to Embodiment 1 of the present invention.

FIG. 3 is a diagram showing a schematic configuration of a vector multiplier according to Embodiment 1 of the present invention.

FIG. 4 is a diagram showing a schematic configuration of a vector multiplier according to Embodiment 2 of the present invention.

FIG. 5 is a diagram showing a conventional calculation method.

FIG. 6 is a diagram showing a calculation method according to a third embodiment of the present invention.

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 arithmetic unit 101 first vector data input unit 102 second vector data input unit 103 third vector data input unit 104 vector data output unit 105 first vector multiplication unit 106 second vector multiplication unit 107 vector addition unit 200 vector adder 300 vector multiplier 400 vector multiplier

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Koichi Sugimoto 2-1-1 Kotani, Samukawa-cho, Koza-gun, Kanagawa F-term in Toyo Tsushinki Co., Ltd. (Reference) 5B056 AA01 BB42 BB74 FF01 FF02 HH00 5J104 AA25 JA24 NA16

Claims (8)

[Claims] (1) m + 1 in which each element is an element of a finite commutative ring R
A first vector data input unit for inputting vector data of the number of elements, and inputting vector data of the number of n elements in which each element is an element of the finite commutative ring R in a positive integer n of m-1 or more. A second vector data input unit for inputting vector data of m + n elements, each element being an element of the finite commutative ring R, and a second vector data input unit for inputting A vector data output unit for outputting vector data of m elements as elements of R, and inputting and multiplying vector data of two n elements, each element of which is an element of the finite commutative ring R, Lower n of multiplication result
A first vector multiplication unit that outputs the elements as vector data, and inputs and multiplies vector data of n elements and vector data of m + 1 elements, where each element is an element of the finite commutative ring R, A second vector multiplication unit that outputs the higher-order m elements of the multiplication result as vector data, and inputs and adds two m-element vector data, each element being an element of the finite commutative ring R, A vector adder that outputs vector data of m elements as the addition result, wherein a first input of the first vector multiplier is the third input.
Are the lower n elements in the vector data of the number of m + n elements input from the vector data input unit of the second type, and the second input of the first vector multiplication unit is the second input
The first input of the second vector multiplication unit is the first input of the second vector multiplication unit.
And the second input of the second vector multiplier is the first input of the first vector multiplier.
The first input of the vector addition unit is a high-order vector data of the number of m + n elements input from the third vector data input unit. The second input of the vector addition unit is a vector data output of m elements output from the second vector multiplication unit. The vector data output unit outputs the vector addition unit An arithmetic device characterized in that vector data of m elements output by the above is output. 2. A notation claim 1 wherein the finite-friendly commutative rings R on the multiplicative identity element according 1, such that relatively prime to the defined order n monic monomial x ⁿ on the finite-friendly commutative rings R The m-order monic polynomial on the finite commutative ring R is And a polynomial of degree less than n on the finite commutative ring R And the polynomial g ^* (x) on the finite commutative ring R on the finite commutative ring R: The vector data of the number of (m + 1) elements having a coefficient in the f (x) as an element in the first vector data input unit according to claim 1, U ₀ is the lowest element, u ₁ is the second lowest element,
···, u _m is input as the highest-order element, and the second vector data input unit according to claim 1 is an n-element vector data having a coefficient at f ^* (x) as an element. A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 are input as the highest-order element. 3. A first vector data input unit for inputting vector data of m + 1 elements, each element being an element of a Galois field GF (q), and each element in a positive integer n of m-1 or more. Is the above GF
A second vector data input unit for inputting vector data of n elements as an element of (q); and a second vector data input unit for inputting vector data of m + n elements as each element of the GF (q). A third vector data input unit; a vector data output unit for outputting vector data of m elements, each element being an element of the GF (q); and each element being an element of the GF (q) A first vector multiplication unit for inputting and multiplying two vector data of n elements and outputting the lower n elements of the multiplication result as vector data; and n in which each element is an element of the GF (q) A second vector multiplication unit that inputs and multiplies the vector data of the number of elements and the vector data of the number of m + 1 elements to each other, and outputs the high-order m elements of the multiplication result as vector data; Under And a vector adder that inputs and adds two m-element vector data to each other and outputs m-element vector data as a result of the addition, and one of the first vector multiplication sections Eye input is the third
Are the lower n elements in the vector data of the number of m + n elements input from the vector data input unit of the second type, and the second input of the first vector multiplication unit is the second input
The first input of the second vector multiplication unit is the first input of the second vector multiplication unit.
And the second input of the second vector multiplier is the first input of the first vector multiplier.
The first input of the vector addition unit is a high-order vector data of the number of m + n elements input from the third vector data input unit. The second input of the vector addition unit is a vector data output of m elements output from the second vector multiplication unit. The vector data output unit outputs the vector addition unit An arithmetic device characterized in that vector data of m elements output by the above is output. 4. The Galois field GF (q) according to claim 3,
The above multiplicative unit is expressed as 1, and the n-th order monic monomial x defined on the above GF (q)
An m-order monic polynomial on GF (q) that is relatively prime to ⁿ is And a polynomial of degree less than n on the GF (q) And the polynomial g ^* (x) on the GF (q)
On F (q), The vector data of the number of (m + 1) elements having a coefficient in the f (x) as an element in the first vector data input unit according to claim 3. U ₀ is the lowest element, u ₁ is the second lowest element,
· The u _m input as top-level elements, the f ^* n number of elements of the vector data to the coefficient elements in (x) in the second vector data input unit according to claim 3, wherein A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 is input as the highest-order element. 5. The Galois field GF (q) according to claim 3,
The above multiplicative unit is expressed as 1, and the m-th irreducible polynomial on GF (q) is And a polynomial of degree less than n on GF (q) And the polynomial g ^* (x) on the GF (q)
On F (q), The vector data of the number of (m + 1) elements having a coefficient in the f (x) as an element in the first vector data input unit according to claim 3. U ₀ is the lowest element, u ₁ is the second lowest element,
· The u _m input as top-level elements, the f ^* n number of elements of the vector data to the coefficient elements in (x) in the second vector data input unit according to claim 3, wherein A v ₀ the least significant element, v 2-th element ₁ from the lowest, -
.., V _n-1 is input as the highest-order element. 6. A first vector data input section for inputting vector data represented by m + 1 bits, and a vector data input section for inputting vector data represented by n bits in a positive integer n of m-1 or more. A second vector data input unit, a third vector data input unit for inputting vector data represented by m + n bits, a vector data output unit for outputting vector data represented by m bits, Input and multiply two n-bit vector data,
A first vector multiplication unit that outputs the lower n bits of the multiplication result; and a second vector that inputs and multiplies the n-bit vector data and the m + 1-bit vector data and outputs the upper m bits of the multiplication result. A multiplication unit, and a vector addition unit that inputs and adds two m-bit vector data to each other and outputs m-bit vector data as a result of the addition. The third input is the third input
Are the lower n bits in the m + n-bit vector data input from the vector data input unit, and the second input of the first vector multiplication unit is the second input
The first input of the second vector multiplication unit is the first input of the first vector multiplication unit.
The second input of the second vector multiplication unit is the first input of the first vector multiplication unit.
The first input of the vector addition unit is the upper m bits in the m + n bit vector input from the third vector data input unit. The second input of the vector addition unit is an m-bit vector data output output from the second vector multiplication unit. The vector data output unit outputs m-bit output from the vector addition unit. An arithmetic unit characterized by outputting a vector of 7. A multiplicative identity on a Galois field GF (2) is 1
And the n-th order monomial x defined on the GF (2)
An m-order polynomial on GF (2) that is relatively prime to ⁿ is And a polynomial of degree less than n on GF (2) And the polynomial g ^* (x) on GF (2)
In the above, 7. An (m + 1) -bit vector data having a coefficient at f (x) as an element in the first vector data input unit according to claim 6. The second bit least significant bit u _0, the u ₁ from the lowest, ..., a u _m input as the most significant bits, the said second vector data input unit according to claim 6, wherein f ^* N-bit vector data having the coefficient in (x) as an element The v ₀ the least significant bit, the second bit from the least significant v _1, · · ·, v arithmetic apparatus according to claim 6, wherein the _n-1, characterized in that input as the most significant bit. 8. The multiplicative identity on the Galois field GF (2) is 1
And the m-order irreducible polynomial on GF (2) is And a polynomial of degree less than n on GF (2) And the polynomial g ^* (x) on GF (2)
In the above, 7. An (m + 1) -bit vector data having a coefficient at f (x) as an element in the first vector data input unit according to claim 6. The second bit least significant bit u _0, the u ₁ from the lowest, ..., a u _m input as the most significant bits, the said second vector data input unit according to claim 6, wherein f ^* N-bit vector data having the coefficient in (x) as an element The v ₀ the least significant bit, the second bit from the least significant v _1, · · ·, v arithmetic apparatus according to claim 6, wherein the _n-1, characterized in that input as the most significant bit.