JP3315087B2 - Inverse calculation device and program recording medium for the same - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a device for calculating an inverse element of a remainder ring of an integer used in coding theory and information security technology, and a program recording medium therefor.

[0002]

2. Description of the Related Art An encryption technique is effective for concealing data. Encryption methods include symmetric key encryption and public key encryption. In common key cryptography, the same key is used on the encryption side and the decryption side, and this key is managed secretly. On the other hand, in public key cryptography, the encryption key and the decryption key are different, and it is widely believed that even if the encryption key is made public, the decryption key cannot be obtained in a realistic time.

[0003] A typical RSA cryptosystem as a public key cryptosystem is described in, for example, "Okamoto and Ota Co-editor:" Cryptography / Zero Knowledge Proof / Number Theory, "Kyoritsu Shuppan, 1995" (hereinafter referred to as Document O).
O). At 220 is shown. The RSA encryption requires a power operation on Z / NZ, where N is a natural number, a so-called modular exponentiation operation. In order to execute this modular exponentiation operation at high speed, it is necessary to refer to pp. The Montgomery method introduced in 179-181 is effective. Mo
To perform the ntgomery method requires the inverse operation in mod2 ^m where m is a natural number.

[0004] In general, in order to execute the inverse operation in modN, it is necessary to refer to pp. The extended Euclid algorithm in 120-121 can be used, but here the modulus is a special form of 2 ^m , so Hensell
ifting (polynomial roots from mod b ^m to mod
b ^{m + 1} ), and can be obtained efficiently. Further, when the inverse element calculation is performed by software, word multiplication is relatively fast in recent CPUs, so that when m is about the word length, Hensel
The method of Zassenhaus, which is the second version of lifting (see "H. Zassenhaus:" On He "
nsel Factorization, I, "Jou
rnal of number theory, vo
l. 1, pp. 291-311, 1969 ").

In the method of Zassenhaus, the input is x,
If the output is y, the auxiliary variables are a and b, and [x] is a Gaussian symbol (the largest integer not exceeding x), then m = 2 ⁿ (n
The case of ≧ 1) is as follows. In the bit position, the least significant bit is set to 0, and the bit lengths of x, y, a, and b are set to m. Step 1: Input x.

Step 2: y: = 1, b: as initial values
= [X / 2]. Step 3: The following is repeated for i = 0, 1,..., N−1. 1. The a (y × (2 ^ ( 2 i) - ( lower 2 ⁱ bits of b))) and the lower 2 ⁱ bits. Where p ＾ q is p
To the q-th power. 2. fitting the lower 2 ⁱ bits of a from 2 ⁱ bit of y in 2 ^{i + 1} -1-th bit.

[0007] 3. b is 2 ⁿ from the 2 ⁱ bit of xa + b
-2 ^{i The first} bit is substituted. Step 4: Output y. The bit processing in this case is based on the output y corresponding to the state change of i.
FIG. 3 shows the contents of the register in which is stored in binary notation. "1" is always 1, "." Is a determined bit, and "?" Is an unknown bit. Here, when the result of i = 2 is made from the result of i = 1, new
A bit has been found. Arranging data in the 4th to 7th bits is expressed as "fitting".

[0008]

The above-mentioned Zassenha
The us method has many bit-by-bit processes such as taking out and fitting the lower 2 ⁱ bits and, when implemented by software, increases the mask processing and is not very efficient. An object of the present invention is to reduce the mask processing.

[0009]

Means for Solving the Problems The above-mentioned Zassenhau
In the method of Step s, 2. of Step 3. Thus, when a is inserted into y, it is not inserted as it is, but is added (added) in the present invention. In this case, St
Ep3 1. Utilizing the property that the result is correct if the sign is inverted without masking with.

That is, the inverse y of the input x in the modm is obtained, where a and b are auxiliary variables, and m = 2 ⁿ (n ≧ 1)
And the bit length of x, y, a, and b is m. According to the present invention, x is input, stored in the storage means, x is read out as an initial process, and [x / 2] is converted to [x / 2]. The result is stored in the storage means as b, and the least significant bit of b is set to a
And a, x, and b are read out,
[(Ax + b) / 2] is calculated, b is updated with the result, x is read, and the lower two bits are stored in the storage means as y.

Next, for i = 1, 2,..., N−1,
b, y are read to calculate -by, a is updated in the storage means with the result, and b, a, x is read, and [(b
+ Ax) / (2 ＾ (2 ⁱ ))], b is updated in the storage means with the result, y and a are read, and y + a × 2
＾ (2 ⁱ ) is calculated, and the result is used to update y in the storage means. Here, p ＾ q represents p raised to the power q.

Next, y is read and output as an inverse operation result.

[0013]

Embodiments of the present invention will be described below. FIG. 1 shows the processing procedure. Input is x, output is y, auxiliary variables are a and b, and [x] is Gaussian symbol (x
, And the following is the case where m = 2 ⁿ (n ≧ 1). Here, the bit length of x, y, a, and b is m.

Step 1: x is input (S1). Step 2: The following calculation is performed as initial processing. 1. b: = [x / 2] 2. a: = least significant bit of b (S2) 3. b: = [(ax + b) / 2] 4. 4. Lower 2 bits of y: = x (S3) i: = 1 (S4) Step3: The following is repeated for i = 1, 2,..., n−1.

[0015] 1. a: = − by2. b: = [(b + ax) / (2 ＾ (2 ⁱ ))] 3. y: = y + a × 2 ＾ (2 ⁱ ) (S5) i: = i + 1 (S6) Step 4: Output y.

In Step 2, 1, 2, and 3 are executed in this order. Steps 4 and 5 may be executed at any timing. -In Step 3, even if executed in the order of 1 → 2 → 3,
Although it may be executed in the order of 1 → 3 → 2, it is better to execute the order in the order of 1 → 2 → 3 in recent computers due to data dependence.
Also, when i = n-1, b is not necessary and 2 need not be executed. Further, step 4 may be executed at an arbitrary timing.

The loop of the algorithm may be expanded in advance (the number of expansions is effective only in the order of the log of the number of bits to be inversed). By performing loop expansion, a constant depending on i can be calculated in advance, and the inverse element can be obtained at higher speed. Division and multiplication by a power of 2 can be performed at a higher speed by using a shift operation in an ordinary processor.

FIG. 2 shows a functional configuration of the apparatus of the present invention.
X is stored in the x storage area 13 of the storage device 12 by the input means 11
And x is read from the storage device 12 by the b initialization first means 14 in the arithmetic device 10, and [x / 2] is calculated, and the calculation result is set as b in the b storage area 15 of the storage device 12 Is stored in

The b is read from the storage device 12 by the a initialization means 16 and the least significant bit is stored in the a storage area 17 of the storage device 12 as a. The a, x, and b are read from the storage device 12 by the b initialization second means 18, and [(ax + b) / 2] is calculated, and the calculation result is updated to b to update the storage content of the b storage area 15. You. x is read from the storage device 12 by the y initialization means 19,
The lower two bits are stored in the y storage area 21 of the storage device 12 as y. storage device 1 by i initialization means 22
1 is set as i in the 2 i storage area 23.

The b and y are read from the storage device 12 by the a updating means 24, and -by is calculated, and a stored in the a storage area 17 is updated based on the calculation result. b, a, b,
x and i are read and [(b + ax) / 2 ／ (2 ⁱ )]
Is calculated, and b stored in the b storage area 15 is updated based on the calculation result.

The a, y, and i are read from the storage device 12 by the y updating means 26, and y + a × 2 ＾ (2 ⁱ ) is calculated. According to the calculation result, y stored in the y storage area 21 is calculated. Be updated. The i updating means 27 reads i from the storage device 12, calculates i + 1, and updates i stored in the i storage area 23 according to the calculation result.

The control means 28 sends i,
a updating means 24, b until n is read and i = n
The updating means 25, the y updating means 26, and the i updating means 27 are sequentially operated, and when i = n, y is read from the storage device 12 by the output means 29 and output to the outside. The apparatus of the present invention can also perform each function by causing a computer to analyze and execute a program.

[0023]

According to the present invention, 1 of Step 3,
As will be understood from a few cases, the bit inset processing is eliminated, and the bit processing which is a problem in implementing the method of Zassenhaus in software is reduced accordingly, and the inverse element can be calculated at high speed by mod2 ^m . .

N = 5 on a general-purpose workstation
(I.e., 32 bits), "Zassenhau
s method ”and the inverse operation method of the present invention were implemented in C language and the processing speed was compared. The input x was determined by generating a random number and repeatedly executed to remove the OS overhead and compared. However, it has been confirmed that the inverse operation method of the present invention can calculate the inverse at least 10% faster than the “Zassenhaus method”.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a processing procedure according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a functional configuration of the embodiment of the present invention.

FIG. 3 is a diagram showing an example of bit processing in the method of Zassenhaus.

Continuation of the front page (56) References JP-A-10-207689 (JP, A) About the high-speed algorithm of the inverse in GF (2m), IEICE Technical Report, July 18, 1987, Vol. 87, No. 120, IT87-24 Efficient recursive algorithm for inverse of finite field GF (2m), Proc. Of the 1988 IEICE Spring Conference, March 15, 1988, 1-299 Inverse computation algorithm, Proceedings of the 1997 Symposium on Cryptography and Information Security, January 29, 1997, 14A (58) Fields investigated (Int. Cl. ⁷ , DB name) G09C 1/00 650 G06F 7 / 72 JICST file (JOIS)

Claims (2)

(57) [Claims] An input means for storing the input x in a storage means; integers n and i (n is 1 or more) and an integer x of 2 ⁿ bits;
Using storage means for storing y, a, and b, and x stored in the storage means, calculate [x / 2] (where [x] is the largest integer not exceeding x), and set the calculation result as b B initialization first means stored in the storage means, a initialization means stored in the storage means as the least significant bit of b stored in the storage means, a, x, b stored in the storage means Using [(ax +
b) / 2], b-initializing second means for updating b stored in the storage means based on the calculation result, and the lower 2 bits of x stored in the storage means are acquired and stored as y Y initialization means for storing in the means, i initialization means for setting i stored in the storage means to 1, and -by using b and y stored in the storage means,
Using (a + b) updating means for updating a stored in the storage means and a, b, x, and i stored in the storage means based on the calculation result, [(b +
ax) / (2 ＾ (2 ⁱ ))], and b updating means for updating b stored in the storage means according to the calculation result (where p ＾ q represents p raised to the qth power). Y + a × 2 ＾ using a, y, i stored in the means
(2 ⁱ ) is calculated, and the result of the calculation is used to update y stored in the storage means, y update means updating i stored in the storage means to i + 1, and i storage means stored in the storage means Control means for sequentially operating the a updating means, the b updating means, the y updating means, and the i updating means until i = n, and outputting y stored in the storage means. An inverse operation device, comprising: output means. 2. A process of storing an input 2 ^n- bit integer (n is an integer of 1 or more) x in a storage means, reading x of the storage means, and [x / 2] (where [x] is x Is calculated, and the result of the calculation is 2
a process of storing in the storage unit as an ^n- bit integer b; a process of reading out b of the storage unit and storing the least significant bit of b in the storage unit as a 2 ^n- bit integer a; a, x, and b of the storage unit And [(ax + b) /
2], a process of storing the calculation result in the storage means as b, a process of reading out x from the storage means, obtaining the lower 2 bits of x, and storing the result as an integer y of 2 ⁿ bits; Is initialized to 1 and stored in the storage means; b and y are read from the storage means, -by is calculated, and a stored in the storage means is updated by the calculation result; A, b, x, i are read from the storage means, and [(b + a
x) / (2 ＾ (2 ⁱ ))], and b update processing for updating b stored in the storage means with the result of the operation (where p ＾ q represents p raised to the qth power). A, y, i are read from the means, and y + a × 2 ＾ (2
ⁱ ) is calculated, and based on the calculation result, y update processing for updating y stored in the storage means, i update processing for reading i from the storage means and updating i to i + 1, a process for sequentially and repeatedly performing the a updating process, the b updating process, the y updating process, and the i updating process until i = n; a process for reading and outputting y in the storage unit; Recording a program for causing a computer of an inverse operation device to execute the program.