JP2001109376A - Arithmetic circuit and arithmetic processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an arithmetic processor capable of operating at a high speed both arithmetic calculations of GF (p) and GF (2m) to any positive integer p and any positive integer m. SOLUTION: An extended arithmetic operation for GF (2m) is made to be executable by adding a word length of a processor or a GF (2m) extended arithmetic operation part of a multiple length thereof to an arithmetic operation part of an arithmetic processor, and taking similar executing procedures to those of an instruction provided in the original processor.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an arithmetic circuit and an arithmetic processor, and more particularly, to an arithmetic circuit and an arithmetic processor for performing an arithmetic operation on a Galois field used in a code / encryption device.

[0002]

2. Description of the Related Art In recent years, various services have been provided by digitization of information, and a comfortable living environment has been improved. For example, with the spread of the Internet, we can benefit from the services provided by servers around the world connected to the network. Further, with the spread of digital mobile phones, it is possible to immediately communicate when needed, and to use additional services other than telephone calls. Further, a credit card, a prepaid card, and the like have an advantage that troublesomeness of cash exchange is eliminated. The digitization of such information provides us with convenience, but has the problem of being easily harmed by unauthorized use. For example, privacy infringement due to eavesdropping, leakage of personal information, and unauthorized use of the system due to copying, falsification, and spoofing are examples. As a solution to these problems, cryptographic techniques have recently attracted attention. Among them, research and development on elliptic curve cryptography, one of cryptographic techniques using operations on Galois fields, has been actively conducted. . This elliptic curve cryptosystem is a public key cryptosystem based on the security of the discrete logarithm problem on the elliptic curve, and its standardization is being studied in IEEE P1363. Elliptic curve cryptosystems whose standardization is being studied in IEEE P1363 can be selected from two types: a case where a Galois field GF (p) is used as a definition field and a case where GF (2 ^m ) is used. Accordingly, there may be a case where two types of elliptic curve cryptosystems defined on GF (p) and GF (2 ^m ) must be processed by one cryptographic device, and GF (p) and GF (2 ^m ) A processor capable of performing both operations at high speed is required. The details of these Galois fields GF (p) and GF (2 ^m ) are described in a general algebra, and will be briefly described here. The Galois field GF (p) is
It is a set of p elements with p as a prime number, and usually uses an integer of 0 or more and less than p as an element.

The GF of two elements a and b on GF (p)
The addition on (p) is Becomes here, Indicates that a remainder obtained by dividing a + b by p is calculated. This can also be realized by reducing p when a + b becomes greater than or equal to p. The multiplication of two elements a and b on GF (p) on GF (p) is Becomes here, Indicates that a remainder obtained by dividing ab by p is calculated. In order for the elliptic curve cryptosystem to be computationally secure, the size of p needs to be about 160 bits. In recent processors, multiplication and division of an integer having a word length of the processor or a multiple thereof can be performed at high speed by hardware. Therefore, when an arithmetic processor is used for addition and multiplication on GF (p) for any p, in addition to integer addition and integer subtraction of the word length of the processor or a multiple thereof, integer multiplication and integer division are performed. They can be used in combination and can be operated at high speed. In addition, the Galois field GF (2
^m ) is a set composed of 2 ^m elements, and each element is generally represented by a vector expression. This vector representation means that GF (2 ^m ) is regarded as an m-dimensional vector space of GF (2), and an arbitrary element a is an m-dimensional vector It is expressed as Here, each element a _i of the vector
Is an element of GF (2), that is, 0 or 1. Also,
The above-mentioned m is called an expansion order.

In the above-described vector representation, a polynomial basis is one of the basis of the vector space. This polynomial basis is an m-order monic irreducible polynomial f (x) on GF (2)
Is a generator polynomial, and using an element z that is a root of f (x), Is the base. Also, any element on GF (2 ^m ) at this time Is a polynomial on GF (2) with respect to x That is, it can be expressed as an element of GF (2) [x]. This expression is called a polynomial expression. Furthermore, GF
(2 ^m) on the two elements a, will be described. Addition on GF (2 ^m) of b, if the original is vector representation, And expressing each as a polynomial, Therefore, the result of the addition is , And taking into account that the coefficient of each term is an element on GF (2), Becomes

Thus, the addition on GF (2 ^m ) is 2
The two elements a and b are added on GF (2) for each element. Since the addition on GF (2) can be realized by exclusive OR, the addition on GF (2 ^m )
May be exclusive ORed for each element. When an arithmetic processor is used, the addition on GF (2 ^m ) for any m can be realized by repeatedly using the exclusive OR operation of the word length of the processor or a multiple thereof. Also, two elements a on GF (2 ^m), will be described. Multiplication on GF (2 ^m) of b, and the original is long is vector representation, the multiplier and multiplicand, And if these are represented by a polynomial, Is a result of multiplying the above a and b by polynomial expression. With the above generator polynomial Divided by the remainder Is calculated. This remainder becomes a multiplication result on GF (2 ^m ). Becomes The multiplication on GF (2 ^m ) is, as described above,
Multiplication of polynomials of degree m-1 or less on F (2), polynomials of degree 2m-2 or less on GF (2), and GF
(2) It can be realized by division with the above m-th order polynomial. However, the multiplication on GF (2 ^m ) has conventionally been conventionally formed using a shift register.

FIG. 6 is a diagram showing a configuration example of a conventional GF (2 ^m ) multiplication circuit. Multiplication circuit 600 in FIG.
Is an example of a conventionally used GF (2 ^m ) multiplication circuit, and its operation will be described below. As mentioned above,
The generator polynomial of GF (2 ^m ) is age, For any m that satisfies, an element on GF (2 ^m ) To calculate the multiplication in, first Is set. Until the calculation is started, 0 is input to the terminal 607 in FIG. In this state, values input to x ₀ to x _n−1 are set in the D flip-flops 601 to 603. Therefore, when 1 is input to the terminal 607, the calculation is started, and the result is stored in the D flip-flops 604 to 606 after m clocks. That is, the multiplication result is Then Can be taken out. Therefore, the multiplication on GF (2 ^m ) is
Since it is customary to implement this using a dedicated circuit using a shift register, the operation of GF (2 ^m ) has been realized by adding the above dedicated circuit as a coprocessor to a normal processor.

[0007]

However, in such a conventional arithmetic processor, the multiplication circuit 600
However, there is a problem that the circuit scale must be increased in proportion to m when the expansion order m increases. Further, once the circuit is designed, the multiplication circuit 600 has a problem of poor versatility because it is impossible to calculate the multiplication of the expansion order where n <m. Further, the multiplying circuit 600 is different from the arithmetic circuit of a normal processor in that
There is a problem that the circuit scale becomes large. So G
As described above, multiplication on F (2 ^m ) is performed by multiplication between polynomials of degree m−1 or less on GF (2) and GF
It is also conceivable to realize the above by dividing the 2m-2 or lower polynomial in (2) above and the m-th polynomial in GF (2).
According to this, multiplication and division of a polynomial on GF (2) can usually be realized by repeatedly applying an exclusive OR operation and a shift operation of a word length of the processor or a multiple length thereof. However, if the exclusive OR operation and the shift operation of the word length of the processor or its multiple length are repeatedly applied, the number of steps is increased, and there is a problem that high-speed operation cannot be performed. The present invention has been made in view of the above problems, and for any p and any m,
It is an object of the present invention to provide an arithmetic circuit and an arithmetic processor capable of realizing both Galois field GF (p) and Galois field GF (2 ^m ) at high speed.

[0008]

In order to achieve the above object, according to the first aspect of the present invention, when n is a natural number, n
Two vectors represented by bits To each other, and a 2n-bit vector Where each element of the 2n-bit vector is It is assumed that According to a second aspect of the present invention, when n is a natural number, two vectors represented by n bits And a vector represented by 2n bits To each other, and a 2n-bit vector Where each element of the 2n-bit vector is It is assumed that According to a third aspect of the present invention, when n is a natural number, a vector represented by n bits And a 2n-bit vector Where each element of the 2n-bit vector is It is assumed that

According to a fourth aspect of the present invention, when n is a natural number, a vector represented by 2n bits And a vector represented by n bits excluding the 0 vector And a vector represented by 2n bits and And a vector represented by the 2n bits Is a polynomial on GF (2) with each element of A vector represented by the n bits Is a polynomial on GF (2) with each element of Then, the quotient obtained by dividing the D (x) by the A (x) is a vector represented by the 2n bits. Using each element of And the remainder obtained by dividing the D (x) by the A (x) is a vector represented by the n bits. Using each element of I will decide.

According to a fifth aspect of the present invention, there is provided an instruction storage unit for storing instructions, an instruction fetch unit for fetching instructions stored in the instruction storage unit, and decoding instructions fetched by the instruction fetch unit. A decoding unit, a data storage unit for storing data, a calculation unit for calculating data stored in the data storage unit, and the calculation unit and the calculation unit based on information decoded by the decoding unit. A control unit for controlling a data storage unit, wherein the operation unit incorporates a logic operation circuit including an exclusive OR operation having a word length or a multiple length thereof and an integer operation circuit, Part of the part is Galois body GF (2 ^m )
The GF (2 ^m ) extended operation unit has a built-in GF (2 ^m ) extended operation circuit having a word length or a multiple length thereof. Based on the control information transmitted from the control unit, data is read from the data storage unit, the data is calculated, and the calculation result is written to the data storage unit. According to a sixth aspect of the present invention, in the arithmetic processor according to the fifth aspect, one or both of the instruction storage unit and the data storage unit are external storages of the processor. According to a seventh aspect of the present invention, in the arithmetic processor of the fifth or sixth aspect, the GF (2 ^m ) extended arithmetic unit includes at least one of the arithmetic circuits of the first to fourth aspects. To be in the office. The invention according to claim 8 is the arithmetic processor according to claim 7, wherein the GF
An instruction set capable of operating the GF (2 ^m ) extended operation circuit provided in the (2 ^m ) extended operation unit without exception processing is provided.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings. (Embodiment 1) In Embodiment 1, an arithmetic processor according to the present invention will be described. FIG.
2 is a block diagram showing a configuration example of the arithmetic processor 100 according to the first embodiment. In FIG. 1, an arithmetic processor 100 includes an instruction storage unit 10 for storing instructions.
1, an instruction fetch unit 103 for fetching an instruction stored in the instruction storage unit 101, a decoding unit 104 for decoding the instruction fetched by the instruction fetch unit 103, and data for storing data. A storage unit 102, a calculation unit 106 for calculating data stored in the data storage unit 102, and a decoding unit 104
And a control unit 105 for controlling the arithmetic unit 106 and the data storage unit 102 based on the information decoded by the control unit 105. The operation unit 106 supports a logical operation including an exclusive OR operation having a word length or a multiple length thereof and an integer operation. Further, a part of the arithmetic unit 106 is an extended arithmetic unit 106a for the Galois field GF (2 ^m ). The extended arithmetic unit 106a for the GF (2 ^m ) has a word length or a multiple length GF ( ^2m ) extended operation is supported. Further, the arithmetic unit 106 reads data from the data storage unit 102 based on the control information transmitted from the control unit 105, performs the arithmetic operation, and writes the arithmetic result to the data storage unit 102.

FIG. 2 is a diagram showing a multiplication circuit 200 mounted on an extended operation unit 106a for Galois field GF (2 ^m ) which is a part of the operation unit 106 of FIG. This is a circuit configuration example when n = 4 in the arithmetic circuit (multiplying circuit) of claim 1. Multiplication circuit 20 shown in FIG.
0 is two vectors represented by 4 bits Input terminals a0 to a3 and b0 to b3 for inputting
Vector represented by 8 bits And output terminals d0 to d7 for outputting
It is composed of 16 AND elements and 9 exclusive OR elements. Next, the operation will be described. First, the elements a _{0 to} a ₃ of the vector are input to the input terminals a _{0 to} a ₃ , respectively, and the input terminal b 0
If the elements b _{0 to} b ₃ of the vector are respectively input to the output terminals d ₀ to d ₇ , D ₀ to d ₇ calculated by are respectively outputted.

FIG. 3 is a diagram showing a product-sum operation circuit 300 mounted on an extended operation unit 106a for the Galois field GF (2 ^m ) which is a part of the operation unit 106 in FIG. In particular, this is a circuit configuration example when n = 4 in the operation circuit (product-sum operation circuit) of the second aspect. The product-sum operation circuit 300 shown in FIG. 3 has two vectors represented by 4 bits. Input terminals a0 to a3 and b0 to b3 for inputting
Vector represented by 8 bits And input terminals c0 to c7 for inputting And output terminals d0 to d7 for outputting
It is composed of 16 AND elements and 16 exclusive OR elements. Next, the operation will be described.
First, the elements a _{0 to} a ₃ of the vector are input to the input terminals a _{0 to} a ₃ , respectively, and the input terminals b _{0 to} b ₃ are input.
3 respectively enter each element b ₀ ~b ₃ of the vector, the elements c ₀ ~ of the vector to the input terminal c0~c7 described above
When the c ₇ respectively input, the output terminal D0 to D7, May each output d ₀ to d ₇ calculated by. FIG. 4 is a diagram showing a square operation circuit 400 mounted on an extended operation unit 106a for Galois field GF (2 ^m ) which is a part of the operation unit 106 in FIG.
This is a circuit configuration example when n = 4 in the arithmetic circuit (square arithmetic circuit) of claim 3. The square operation circuit 400 shown in FIG. Input terminals a0 to a3 for inputting a vector and a vector represented by 8 bits And output terminals d0 to d7 for outputting the same. Next, the operation will be described. First, the input elements a0 to a3 are connected to the respective elements a _{0 of the} vector.
~ A ₃ are input to the output terminals d0-d7, respectively. D ₀ to d ₇ calculated by are respectively outputted.

FIG. 5 is a diagram showing a division circuit 500 mounted on an extended operation unit 106a for the Galois field GF (2 ^m ) which is a part of the operation unit 106 of FIG. This is a circuit configuration example when n = 4 in the arithmetic circuit (division circuit) of claim 4. The division circuit 50 shown in FIG.
0 is a vector represented by 8 bits Input terminals d0 to d7 for inputting a vector and a vector represented by 4 bits Input terminals a0 to a3 for inputting a vector and a vector represented by 8 bits And output vectors q0 to q7 for outputting Output terminals r0 to r3 for outputting the data and a control signal input terminal 501, and D flip-flops 511 to 51
8, 521 to 523, 531 to 538, a selector, an exclusive OR element, an AND element, and the like.

Next, the operation of the division circuit 500 will be described. First, each input each element d ₀ to d ₇ of the above-mentioned vector to the input terminal d0~d8 described above, the elements a ₀ ~ of the above-mentioned vector to the input terminal a0~a3 described above
keep each enter a _3. Also, the control signal input terminal 50
For 1, 0 is input until the calculation is started. In this state, the values input to the input terminals d0 to d7 are set in the D flip-flops 511 to 518, and the values of the D flip-flops 521 to 523 are set to 0.

Therefore, when 1 is input to the control signal input terminal 501, the calculation is started, and the results are stored in the D flip-flops 521 to 523 and the D flip-flops 531 to 538 after eight clocks. That is, the vector represented by the 8 bits Is a polynomial on GF (2) with each element of As the vector represented by the 4 bits Is a polynomial on GF (2) with each element of Then, the quotient obtained by dividing the D (x) by the A (x) is a vector represented by the 8 bits. Using each element of And the remainder obtained by dividing the A (x) by the B (x) is
Vector represented by the 4 bits Using each element of After eight clocks, the output terminals q0 to q
7 contains the vector Each element q ₀ to q ₇ is each output of the output terminal r0~r3
Has the vector Are output as r _{0 to} r ₃ . As explained above,
According to the first embodiment, the operation on the Galois field GF (2 ^m ) for an arbitrary m using the arithmetic processor 100 is
The multiplication circuit, the product-sum operation circuit, the square operation circuit, the division circuit, and the exclusive OR operation circuit having a word length of a processor incorporated in the operation processor or a multiple length thereof are shown in FIGS. It can be realized at high speed.

(Embodiment 2) In this embodiment 2,
Galois field GF (2 ^m ) using the arithmetic processor of the present invention
A case where the above squaring and multiplication are realized will be described. First, when n is a natural number, two vectors represented by n bits And a vector represented by 2n bits To each other to obtain a 2n-bit vector Where each element of the 2n-bit vector is The operation of the product-sum operation circuit is It is assumed that When n is a natural number, 2n
Vector represented by bits And a vector represented by n bits excluding the 0 vector To calculate a vector represented by 2n bits and Is a division circuit for calculating the vector represented by 2n bits described above. Is a polynomial on GF (2) with each element of And the vector represented by the n bits Is a polynomial on GF (2) with each element of Then, the quotient obtained by dividing the polynomial D (x) on the GF (2) by the polynomial A (x) on the GF (2) is 2n
Vector represented by bits Using each element of And the remainder obtained by dividing the D (x) by the A (x) is
A vector represented by the n bits By using each element of The operation of the division circuit It is assumed that

Further, C = ( _CL , _CR ), that is, D = (D _L , D _R ), that is, Is defined _{as, Q = (Q L, Q} R) In other words, Is defined. The generator polynomial of the Galois field GF (2 ^m ) is And a vector having the coefficients of the generator polynomial as elements, And the binary on the Galois field GF (2 ^m ) is Then, these three vectors are divided into blocks every n bits as follows. That is, However, It is. Also, However, And the operation result is stored in w.

As a first example, the Galois field GF (2 ^m )
Squaring on The calculation procedure of is shown below. Where X ← Y is Y
Is substituted for X. X << Y indicates that the content of X is shifted left by Y bits, and X >> Y indicates that the content of X is shifted right by Y bits. -------------------------------Preprocessing----------------- ---------- ------------------------------- 2 multiplication ----------------- ---------- -------------------------------division------------------ --------- ------------------------------- Post-processing ----------------- ----------

As a second example, the Galois field GF (2
^m ) Multiplication on The calculation procedure of is shown below. -------------------------------Preprocessing----------------- ---------- ------------------------------- Step multiplication ----------------- ---------- ------------------------------- Step division ----------------- ---------- ------------------------------- Post-processing ----------------- ---------- Note that the steps by the product-sum operation circuit used in the above two examples may be realized by a combination of the step by the multiplication circuit and the step by the exclusive-OR operation circuit. As described above, according to the second embodiment,
Using the arithmetic processor 100 described above, the Galois field GF
In realizing the squaring and multiplication on (2 ^m ),
The multiplier circuit, the product-sum operation circuit, the square operation circuit, and the division circuit shown in FIGS.
Arithmetic processing can be realized at high speed.

[0021]

According to the present invention, as described above, an extended arithmetic unit for GF (2 ^m ) having a word length of the processor or a multiple length thereof is added to the arithmetic unit of the arithmetic processor.
By performing the same procedure as the execution procedure of the instructions provided in the original arithmetic processor, the extended arithmetic operation for GF (2 ^m ) can be executed. In addition to the arithmetic processing on GF (p), This has a remarkable effect in realizing high-speed arithmetic processing on GF (2 ^m ).

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a schematic configuration of an arithmetic processor according to a first embodiment;

FIG. 2 is a diagram illustrating a schematic configuration of a multiplication circuit according to the first embodiment;

FIG. 3 is a diagram illustrating a schematic configuration of a product-sum operation circuit according to the first embodiment;

FIG. 4 is a diagram illustrating a schematic configuration of a square operation circuit according to the first embodiment;

FIG. 5 is a diagram showing a schematic configuration of a division circuit according to the first embodiment.

FIG. 6 is a diagram showing a schematic configuration of an example of a conventional GF (2 ^m ) multiplication circuit.

[Explanation of symbols]

100 arithmetic processor, 101 instruction storage unit, 102 data storage unit, 103 instruction fetch unit, 104 decoding unit, 105 control unit, 106 arithmetic unit, 106a extended arithmetic unit for GF (2 ^m ).

Claims (8)

[Claims] 1. When n is a natural number, two vectors represented by n bits To each other, and a 2n-bit vector Where each element of the 2n-bit vector is An arithmetic circuit characterized by the following. 2. When n is a natural number, two vectors represented by n bits And a vector represented by 2n bits To each other, and a 2n-bit vector Where each element of the 2n-bit vector is An arithmetic circuit characterized by the following. 3. A vector represented by n bits, where n is a natural number. And a 2n-bit vector Where each element of the 2n-bit vector is An arithmetic circuit characterized by the following. 4. A vector represented by 2n bits, where n is a natural number. And a vector represented by n bits excluding the 0 vector And a vector represented by 2n bits and An arithmetic circuit for calculating a vector represented by 2n bits Is a polynomial on GF (2) with each element of A vector represented by the n bits Is a polynomial on GF (2) with each element of The quotient obtained by dividing the D (x) by the A (x) is a vector represented by the 2n bits. Using each element of The remainder obtained by dividing the D (x) by the A (x) is a vector represented by the n bits. Using each element of An arithmetic circuit characterized by the following. 5. An instruction storage unit for storing instructions, an instruction fetch unit for fetching instructions stored in the instruction storage unit, a decoding unit for decoding instructions fetched by the instruction fetch unit, A data storage unit for storing data, a calculation unit for calculating data stored in the data storage unit, and controlling the calculation unit and the data storage unit based on information decoded by the decoding unit. A logic unit including an exclusive OR operation having a word length or a multiple length thereof and an integer operation circuit, and a part of the arithmetic unit is a Galois control unit. it becomes the body GF (2 ^m) for the extended computing unit, in the GF (2 ^m) for the extended computing unit, the word length or the length of multiples GF (2 ^m) for extended operation circuit is built, An arithmetic processor, wherein the arithmetic unit reads data from the data storage unit based on control information transmitted from the control unit, calculates the data, and writes the calculation result to the data storage unit. 6. The processor according to claim 5, wherein one or both of the instruction storage unit and the data storage unit are external storages of the processor. 7. The GF (2 ^m ) extended operation unit includes at least one of the operation circuits according to any one of claims 1 to 4. Arithmetic processor. Characterized by having a set of instructions that can be operated without exception handling instrumented GF (2 ^m) for extended operation circuit to wherein said GF (2 ^m) for the extended computing unit The arithmetic processor according to claim 7.