JP2005221830A - Inverse element arithmetic unit, arithmetic processing unit, and arithmetic processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To accelerate the speed of processing in halving a variable where a lot of 0s are in succession from the LSB until an odd number is obtained, especially to accelerate the speed of calculating a Montgomery inverse element. <P>SOLUTION: In the case of calculating the inverse element (r) of an integer (a) with the modulus (p), whether intermediate variables (u, v) are even numbers or not is discriminated (S103, S106). When the intermediate variables (u, v) are even numbers, the number of 0s (k0) in succession from the least significant bit of the intermediate variables (u, v) is counted (S211) and new intermediate variables (u, v) are set (S210) by deleting 0s in lower-order bits of the intermediate variables (u, v) counted by this counting. Also, a new intermediate variable (s) is set (S212) by adding 0s in the number counted by the counting to the low-order side of the intermediate variable (s). Then, the k0 counted by the counting is added to a loop count value (k) of Phase 1 to end the odd number processing to the intermediate variables (u, v). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an arithmetic device, and is particularly suitable for use when encrypting predetermined data with an encryption key.

  With the recent development of computer networks, the opportunity to send and receive computerized information such as e-mail and electronic news via the network has been rapidly increasing. Furthermore, services such as online shopping are being provided using such networks. However, on the other hand, problems of illegal acts such as eavesdropping / falsification of digitized data on the network, or impersonation of others and illegal provision of services have emerged.

  In response to these problems, encrypted electronic mail and user authentication systems that apply encryption technology have been proposed and are being introduced into various networks. In computer networks, encryption technology is becoming an essential technology.

  Such encryption techniques can be broadly classified into two types: private key cryptosystems and public key cryptosystems. The “secret key cryptosystem” is an encryption method for performing cryptographic communication when the sender and the receiver have the same key. That is, certain data is encrypted and transmitted based on the secret key, and the receiver side decrypts the encrypted data using this secret key, and obtains original data without encryption.

  In addition, the “public key cryptosystem” encrypts and transmits data using the public key disclosed by the receiver, and the receiver decrypts the encrypted data using the private key paired with this public key. The original data without encryption is acquired. That is, the encrypted data encrypted with the public key can be decrypted only with the secret key paired therewith, thereby maintaining the confidentiality of the data.

  Among public key cryptosystems, RSA (Rivest Shamir Adlman) cryptography is widely known. This encryption scheme was proposed in 1997 by Rivest Shamir Adlman. Using an encryption key (e, N) and a corresponding decryption key (d, N), e and N as public keys, d as a secret key, plain text as M, and cipher text as C, encryption by RSA encryption The algorithm of the conversion E and the decoding D is as follows.

C = E (M) = M ^e modN (1)
E = D (C) = C ^d modN (2)
However, d · e = 1 mod LCM (p−1, q−1) is satisfied. Note that LCM is the lowest common multiple, and P and Q are large prime numbers.

  Usually, since e, d, N, and M are large integers of 512 bits or more, various methods have been proposed for speeding up the remainder calculation required for encryption and decryption. One example uses Montgomery multiplication (see Non-Patent Document 1) proposed by Montgomery.

Montgomery multiplication MonPro (a, b) of two integers a and b satisfying [0, p−1] where p is the modulus of the remainder and R (R> p) is a radix that is relatively prime to the modulus of the remainder. Is
MonPro (a, b) = abR ⁻¹ mod p (3)
Is defined.

Here, when a power of 2 is used as the radix R, the division of the radix R necessary for executing the Montgomery multiplication can be replaced with a shift operation, so that the Montgomery multiplication can be speeded up.
MonPro (a, b) = ab2- ⁿ mod p (4)
Is often defined as

  Incidentally, among the “public key cryptosystems”, one that is currently standardized is Elliptic Curve Cryptography. This is based on the discrete logarithm problem of elliptic curves, and was proposed by N. Koblitz (see Non-Patent Document 2) and V. Miller (see Non-Patent Document 3).

Since this elliptic curve cryptography requires a division remainder operation, it is necessary to speed up the division residue operation. As a method for speeding up the division remainder calculation, there is a method using the Montgomery inverse element proposed by Kaliski (see Non-Patent Document 4). This Montgomery inverse element is
MonInv (a) = a− ¹ 2 ⁿ mod p (5)
Is defined.

When the multiplicand b in the Montgomery multiplication shown in the above equation (4) is b = 1, and the Montgomery inverse element shown in the above equation (5) and the Montgomery multiplication are continuously acted,
MonPro (MonInv (a), 1) = MonPro (a ^- 12 ⁿ modp, 1)
= ^A -1 ² n ² -n modp
= A-1 modp (6)
Thus, the inverse element of the integer a modulo p can be obtained. Here, since the Montgomery inverse element does not require division as described later, the inverse element of the integer a modulo p can be obtained without division, and a public key cryptosystem that requires a division remainder operation, for example, It is possible to reduce the calculation processing cost of the above elliptic curve cryptography.

  Such a Montgomery inverse element derivation algorithm is shown in FIGS.

  The Montgomery inverse element derivation algorithm includes Phase 1 shown in FIG. 4 and Phase 2 shown in FIG. When obtaining the inverse element r of the integer a modulo p, p and a are set as initial values for the intermediate variables u and v, respectively, and the operations of Phases 1 and 2 are executed. Thereby, the inverse element is obtained as the value of the variable r.

  In Phase 1, an operation is performed using variables u, v, r, and s for performing an intermediate operation and a variable k for performing a loop count. That is, after initial values are set for these variables (S101), until u becomes v = 0 (S102: YES), if u is an even number (S103: YES), u = u / 2, s = 2s (S104), if u is an odd number (S103: NO) and v is an even number (S106: YES), v = v / 2 and r = 2r are executed (S107), and u and v Are odd numbers (S103: NO, S106: NO) and u> v (S108: YES), u = (u−v) / 2, r = r + s, s = 2s are executed (S109). In other cases (S108: NO), while executing v = (v−u) / 2, s = r + s, r = 2r (S110), the loop count value k is added (S105). When the variable v becomes v = 0, the variable r is corrected (S111 to S113), r and k are output to Phase2, and the calculation of Phase1 is terminated.

When the calculation of Phase1 is completed, the variable r is r = a− ¹ 2 ^k mod p. Here, r = [0, p−1], n ≦ k ≦ 2n (n: number of digits when p is expressed in binary).

In Phase 2, r and k, which are outputs of Phase 1, and a variable i for performing loop count are used. That is, after initializing the variable i to 1 (S114) and until i = k−n (S115: YES), if r is an even number (S116: YES), r = r / 2 is executed ( If r is an odd number (S116: NO), r = (r + p) / 2 is executed (S118), and the loop count value i is added (S119). When the loop count value i becomes i = k−n (S115: YES), the variable r is output and the calculation of Phase 2 is terminated.
“Modular multiplication without trial division”, Mathematics of Computation, 44 (170): 519-521, April 1985 “A course in number theory and cryptography”, Spring-Verlag, 1997 “Use of elliptic curves in cryptography”, Advances in Cryptology-Proceedings of Crypto '85, Lecture Notes in Computer Science, 218 (1986), Spring-Verlag, pp417-426 “The Montgomery inverse and its application”, IEEE Transactions on Computers, 44 (8): 1064-1065, August 1995

  In the Montgomery inverse element calculation algorithm described above, the Phase 1 calculation process (S104, S107) and the Phase 2 calculation process (S117) are repeatedly executed until the variables u, v, or the variable r become odd. When a large number of zeros are consecutive from the LSBs of these variables u, v, and r, the arithmetic processing of these steps is repeatedly executed for the number of zeros. Here, assuming that the time for reading these variables from the memory is Tr, the processing time for performing 1/2 calculation is Tc, and the time for writing back the variables subjected to 1/2 calculation processing to Tw is Tw, N consecutive 0s from LSB In this case, the processing time T required to repeat these steps is T = N * (Tr + Tc + Tw).

  Therefore, the main object of the present invention is to speed up the processing for halving a variable in which a large number of zeros are consecutive from the LSB until it becomes an odd number, and in particular, speeding up the computation of the Montgomery inverse element It is intended to plan.

  The invention of claim 1 is a Montgomery inverse element arithmetic unit for calculating an inverse element of an integer a modulo p, a determination means for determining whether or not intermediate variables u and v are even numbers, and the intermediate variable u , V is an even number, the counting means for counting the number k0 of consecutive 0s from the least significant bit of the intermediate variable u, v, and 0 of the lower-order bits of the intermediate variables u, v counted by the counting means Is set as new intermediate variables u and v, and is set to a new intermediate variable s by adding 0 to the lower side of the intermediate variable s by the number counted by the counting means. And means for adding k0 counted by the counting means to the loop count value k of Phase1.

  The invention of claim 2 is a Montgomery inverse element arithmetic unit for calculating an inverse element of an integer a modulo p, a determination means for determining whether or not the intermediate variable r is an even number, and the intermediate variable r is an even number , The counting means for counting the number k0 of consecutive 0s from the least significant bit of the intermediate variable r, and a new intermediate by deleting 0 of the lower-order bits of the intermediate variable r counted by the counting means. It has an intermediate variable setting means for setting the variable r, and an adding means for adding k0 counted by the counting means to the loop count value i of Phase2.

  The invention according to claim 3 is an arithmetic processing unit that performs a 1/2 arithmetic process on the variable data until the value of the variable data becomes an odd number, and outputs the number of the 1/2 arithmetic processes repeated at this time. And counting means for determining whether or not the variable is an even number, a counting means for counting the number k0 of consecutive 0s from the least significant bit of the variable when the variable is an even number, and the counting step. Variable setting means for setting a new variable by deleting 0 of the lower-order bit of the variable, and loop count output means for outputting k0 counted by the counting step as the number of repetitions of the 1/2 arithmetic processing It is characterized by having.

  According to a fourth aspect of the present invention, the arithmetic processing is performed on the variable data by the arithmetic circuit until the value of the variable data becomes an odd number, and the number of the 1/2 arithmetic processing repeated at this time is output. A determination step for determining whether or not the variable is an even number, a counting step for counting the number k0 of consecutive 0s from the least significant bit of the variable when the variable is an even number, and the counting step A variable setting step for setting a new variable by deleting 0 of the lower-order bits of the variable counted in step (i), and a loop for outputting k0 counted in the counting step as the number of repetitions of the 1/2 arithmetic processing And a count output step.

  The features of the present invention will become more apparent from the following description of embodiments. However, the following embodiment is merely one embodiment of the present invention, and the meaning of the term of the present invention or each constituent element is not limited to that described in the following embodiment. Absent.

  According to the present invention, by counting the number of consecutive 0s from the least significant bit, the number of 1/2 arithmetic processes (loop count value) to be repeated before the variable becomes odd is detected, and Since the data after oddization is acquired by the higher-order bits obtained by removing consecutive 0s from the least significant bit, the data after oddization and the ½ operation can be obtained without actually repeating the ½ operation processing. The number of processing iterations can be calculated at a time, so that the time required to acquire these data can be significantly reduced. In particular, according to the invention of claim 1 or 2, the Montgomery inverse element The calculation process can be significantly speeded up.

The inventions of claims 1 and 2 relate to Phase 1 and Phase 2 of the Montgomery inverse element processing algorithm, respectively. In the implementation, these inventions can be applied to the Phase 1 and Phase 2 arithmetic processing of Montgomery inverse operation, or only one of them can be applied to the corresponding Phase processing. In the speeding up of the arithmetic processing, the former form is desirable. However, even in the latter form, it is possible to increase the speed by several steps compared to the case where the half arithmetic processing is actually repeated to make the odd number. it can.

  Embodiments of the present invention will be described below with reference to the drawings.

  First, FIG. 1 shows a configuration of a Montgomery inverse element computing device according to the embodiment.

  As illustrated, the Montgomery inverse element computing device according to the present embodiment includes a control unit 101, a memory 102, a memory control unit 103, an arithmetic processing unit 104, a zero detection unit 105, a zero counter 106, a loop The counter 107 is configured.

  The control unit 101 controls each unit according to a preset processing flow. The memory 102 sequentially updates and stores intermediate variables u, v, r, and s. The memory control unit 103 controls the memory 102 according to a command from the control unit 101. The arithmetic processing unit 104 performs arithmetic processing on the intermediate variable data (u, v, r, s) stored in the memory 102 in accordance with a command from the control unit 101, and writes the processing result back to the memory 102.

  The zero detection unit 105 refers to the intermediate variable data (u, v, r, s) stored in the memory 102 and detects consecutive zeros from the LSB of these intermediate variable data (u, v, r, s). To do. The zero counter 106 counts the number of zeros k0 detected by the zero detector 105. The loop counter 107 counts the loop count value k of Phase1 and the loop count value i of Phase2.

  FIG. 2 shows a processing algorithm of Phase 1 in the Montgomery inverse operation.

  In this processing algorithm, S104 → S105 and S106 → S107 in the algorithm of FIG. 4 are changed to S210 to S213 and S214 to S213, respectively.

  That is, when p and a are input to the control unit 101 in order to obtain the inverse element r of the integer a modulo p, the control unit 101 sets initial values (u = p, v = a, r = 0, s = 1) are set and stored in the memory 102 (S101). At the same time, the count value k of the loop counter 107 is reset.

  Here, if the variable u is an even number (S103: YES), the memory control unit 103 newly sets the variable u by removing the continuous 0 from the LSB of the variable u based on the detection value by the zero detection unit 105. It is set on the memory 102 (S210). In addition, the memory control unit 103 sets the count value k0 (zero count value of the variable u) by the zero counter 106 (S211), the number of zeros to be added to the LSB of the variable s, that is, the odd number of the variable u. This is held as the number of repetitions of doubling the variable s to be executed (S212). Further, the loop counter 107 executes k = k + k0 based on the count value k0 of the zero counter 106 (zero count value of the variable u), and updates the loop count value k (S213). With the above processing, the variable u is odd-numbered, the repetition processing of the doubling of the variable s, and the update of the loop count value k are completed.

  Note that the doubling of the variable s is actually performed by calculating the LSB of the variable s stored in the memory 102 to the LSB of the variable s stored in the memory 102 in the subsequent steps S109 and S110. This is done by adding zeros. That is, the control unit 101 executes the doubling process for the variable s by accessing the memory so that the data is output as data shifted upward by the K0 bit, and thereafter, the control processing unit 104 performs S109 and S110. Let us calculate the variable s at.

  Next, if the variable u is an even number (S106: YES), the memory control unit 103 newly sets the variable v by removing the continuous 0 from the LSB of the variable v based on the detection value by the zero detection unit 105. It is set on the memory 102 (S214). In addition, the memory control unit 103 sets the count value k0 (zero count value of the variable v) by the zero counter 106 (S215), the number of zeros to be added to the LSB of the variable r, that is, the odd number of the variable v. This is stored as the number of repetitions of doubling the variable r to be executed (S216). Further, the loop counter 107 executes k = k + k0 based on the count value k0 of the zero counter 106 (zero count value of the variable v), and updates the loop count value k (S213). Through the above processing, the variable v is made odd, the doubling of the variable r and the update of the loop count value k are completed.

  Note that the doubling of the variable r is actually performed by the count value k0 held in S216 in the LSB of the variable r stored in the memory 102 when performing the calculation using the variable r in the subsequent steps S109 and S110. This is done by adding zeros. That is, the control unit 101 executes a doubling process for the variable r by accessing the memory so that the data is output as data shifted upward by the K0 bit, and thereafter, the control processing unit 104 performs S109 and S110. The calculation of the variable s in is performed.

  If the variables u and v newly set as described above have a relationship of u> v (S108: YES), the arithmetic processing unit 104 determines that u = (u−v) / 2, r = r + s, s = 2s is executed (S109) and written back to the memory 102. At this time, the loop counter 107 executes k = k + 1 and updates the loop count value k (S105). If u ≦ v (S108: NO), the arithmetic processing unit 104 executes u = (v−u) / 2, s = r + s, and r = 2r (S109), and writes it in the memory 102. return. At this time, the loop counter 107 executes k = k + 1 and updates the loop count value k (S105).

  When either of the variables u or v is an even number by this processing, the odd processing of S211 to 213 or S215 to S213 is executed by the memory processing unit 103, and further, the arithmetic processing after S108 is performed by the arithmetic processing unit 104. Executed. Such processing is repeated until the variable v becomes v = 0 (S102: YES). When v = 0, the arithmetic processing unit 104 performs a correction operation for the variable r (S111 to S113), and writes the variable r obtained thereby back to the memory 102. Then, based on the variable r and the count value k of the loop counter 107 at this time, the Phase2 calculation process is started.

  That is, when the Phase 2 calculation process is started, the control unit 101 resets the count value i of the loop counter 107. Here, if the variable r is an even number (S116: YES), the memory control unit 103 newly sets the variable r by removing the consecutive 0 from the LSB of the variable r based on the detection value by the zero detection unit 105. The setting is made on the memory 102 (S220). Further, the loop counter 107 executes i = i + k0 based on the count value k0 of the zero counter 106 (zero count value of the variable r), and updates the loop count value i (S221). With the above processing, the odd number of the variable r and the update of the loop count value i associated therewith are completed.

  If the variable r is not an even number (S116: NO), the arithmetic processing unit 104 executes r = (r + p) / 2 (S118) and writes it back to the memory 102. At this time, the loop counter 107 executes i = i + 1 and updates the loop count value i (S119).

  The above processing is repeated until the count value i of the loop counter 107 reaches i = k−n. When i = k−n, the control unit 101 outputs the variable r stored in the memory 102 at that time as the inverse element value of the integer a modulo p.

  As described above, according to the present embodiment, in the odd-number processing of the variables u, v, and r, the data after the odd-numbering and the repetition of the half-calculation processing are performed without actually repeating the half-calculation processing. The number of times (loop count value) can be calculated at a time, so that the Montgomery inverse element processing can be significantly speeded up.

  Needless to say, the present invention is not limited to the above-described embodiment, and various other modifications are possible.

  The present invention provides an arithmetic processing device and an arithmetic processing method for performing 1/2 arithmetic processing on variable data until the value of the variable data becomes an odd number, and outputting the number of times of the 1/2 arithmetic processing repeated at this time. If there is, it is applicable not only to the Montgomery inverse element calculation process but also to other calculation processes as appropriate.

The embodiments of the present invention can be appropriately modified in various ways within the scope of the technical idea shown in the claims.

The figure which shows the structure of the Montgomery inverse element arithmetic unit which concerns on embodiment The figure which shows the inverse element calculation processing algorithm (Phase1) which concerns on embodiment The figure which shows the inverse operation processing algorithm (Phase2) which concerns on embodiment The figure which shows the inverse operation processing algorithm (Phase1) which concerns on the conventional form The figure which shows the inverse operation processing algorithm (Phase2) which concerns on the conventional form

Explanation of symbols

101 Control Unit 102 Memory 103 Memory Control Unit 104 Operation Processing Unit 105 Zero Detection Unit 106 Zero Counter 107 Loop Counter

Claims (4)

a Montgomery inverse element arithmetic unit for calculating an inverse element of an integer a modulo p,
Discriminating means for discriminating whether or not the intermediate variables u and v are even numbers;
Counting means for counting the number k0 of consecutive 0s from the least significant bit of the intermediate variables u and v when the intermediate variables u and v are even;
New intermediate variables u and v are set by deleting low-order bits 0 of the intermediate variables u and v counted by the counting means, and the lower order of the intermediate variable s by the number counted by the counting means. Intermediate variable setting means for setting a new intermediate variable s by adding 0 to the side,
Adding means for adding k0 counted by the counting means to the loop count value k of Phase 1;
An inverse element computing device comprising: a Montgomery inverse element arithmetic unit for calculating an inverse element of an integer a modulo p,
Determining means for determining whether or not the intermediate variable r is an even number;
Counting means for counting the number k0 of consecutive 0s from the least significant bit of the intermediate variable r when the intermediate variable r is an even number;
Intermediate variable setting means for setting a new intermediate variable r by deleting the lower-order bits 0 of the intermediate variable r counted by the counting means;
Adding means for adding k0 counted by the counting means to the loop count value i of Phase 2;
An inverse element computing device comprising: An arithmetic processing device that performs 1/2 arithmetic processing on the variable data until the value of the variable data becomes an odd number, and outputs the number of the 1/2 arithmetic processing repeated at this time,
Discriminating means for discriminating whether or not the variable is an even number;
Counting means for counting the number k0 of consecutive 0s from the least significant bit of the variable when the variable is even;
Variable setting means for setting a new variable by deleting 0 of the lower-order bits of the variable counted in the counting step;
Loop count output means for outputting k0 counted in the counting step as the number of repetitions of the 1/2 arithmetic processing;
An arithmetic processing apparatus comprising: An arithmetic processing method for performing a 1/2 arithmetic process on the variable data by an arithmetic circuit until the value of the variable data becomes an odd number, and outputting the number of the 1/2 arithmetic processes repeated at this time,
A determining step of determining whether or not the variable is an even number;
A counting step of counting the number k0 of consecutive 0s from the least significant bit of the variable when the variable is even;
A variable setting step of setting a new variable by deleting 0 of the lower-order bits of the variable counted in the counting step;
A loop count output step for outputting k0 counted in the counting step as the number of repetitions of the 1/2 arithmetic processing;
An arithmetic processing method characterized by comprising:

Images