JP5294787B2 - Data processing apparatus and data processing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data processing device capable of improving computation efficiency of a modular multiplication with respect to a data having a bit number exceeding twice as large as the arithmetic bit number of a modular multiplier. <P>SOLUTION: When a quotient and a remainder of 2w-bit modular multiplication are calculated from a quotient and a remainder of w-bit modular multiplication by recursively repeating computation of modular multiplication in a plurality of times by a computation unit (310), a control unit (320) controls to distribute the remainder and the quotient of w-bit modular multiplication determined by the preceding computation of modular multiplication into the next computation of modular multiplication. Accordingly, no new computation is required for the quotient of preceding computation necessary to the succeeding computation to be recursively carried out, compared to an arithmetic algorithm in which computation in the preceding modular multiplication demands only a remainder of w-bit modular multiplication. This improves the computation efficiency of modular multiplication on data having a bit number equal to a multiple of two of the computation bit number of a modular multiplication unit. <P>COPYRIGHT: (C)2010,JPO&amp;INPIT

Description

  The present invention relates to a data processing apparatus having a modular multiplication function in the field of information security. For example, the present invention relates to an IC card microcomputer to which an encryption technique using modular multiplication is applied, and further to an IC card having the microcomputer.

  As represented by RSA cryptography, which is a de facto standard for public key cryptography, modular multiplication is one of the most basic operations in cryptography. In order to perform heavy multiplication, which is a heavy calculation process, at high speed, a modular multiplication unit (hereinafter also referred to as a modular multiplication unit) is installed as dedicated hardware that can be used by many cryptographic devices such as IC cards. Yes.

  On the other hand, cryptographic algorithms that employ modular multiplication tend to recommend a long key length year by year from the viewpoint of security. In particular, RSA encryption and elliptic curve encryption, which are typical encryption algorithms for public key encryption, require longer key lengths due to recent improvements in performance of computing devices and improvements in decryption algorithms. In order to cope with a long key length, the above-described dedicated modular multiplication unit having a large circuit scale is required. However, an increase in the circuit scale leads to an increase in production cost. In recent years, there has been a strong demand for adopting a cryptographic device for the purpose of protecting the privacy of users even for small devices typified by RFID. Therefore, there is a strong demand for downsizing the circuit for the above-mentioned residue multiplication dedicated device. In view of this, a data processing apparatus is provided that can calculate a remainder multiplication with a long bit length using an arithmetic unit with a short maximum bit length that can be calculated. Non-Patent Document 1, which describes a technique that realizes a remainder multiplication twice the maximum bit length that can be calculated by a dedicated residue multiplication device, as a technique that can suppress the maximum bit length that can be calculated and contribute to downsizing of the entire circuit. There are Non-Patent Document 2 and Non-Patent Document 3. Further, Non-Patent Document 4 is a generalized document obtained by organizing the general calculation procedures of Non-Patent Documents 1 to 3 described above.

In Non-Patent Document 4, algorithm 1 for calculating a quotient of remainder multiplication using the above-described residue multiplication exclusive device capable of calculating a remainder multiplication of maximum w bits and a remainder multiplication (up to 2 w bits) using the quotient. The algorithm 2 for calculating the remainder) is introduced. However, in the quotient q and the remainder r of the remainder multiplication,
r = xy2 ^-m mod (z) (Formula a)
xy = qz + r2 ^m (Formula b)
The following equation holds.

[Algorithm 1]
Input: x, y, z, where 0 ≦ x, y <z, gcd (z, 2 ^m ) = 1 and 0 ≦ m <w
Output: xy / z, xy mod (z)
Step 1. r ← xy2 ^-m mod (z)
Step 2. r '← xy2 ^-m mod (z + 2 ^m )
Step 3. q ← r-r '
Step 4.q ≤-2 ^m , q ← q + z + 2 ^m
Step 5. Return (q, r)
In the algorithm 1, the quotient (q) of the remainder multiplication is calculated from the remainders of the two types of remainder multiplication (the remainder r in step 1 and the remainder r ′ in step 2). Therefore, the algorithm 1 needs to calculate the remainder of at least two remainder multiplications. gcd (z, 2 ^m ) = 1 means that the greatest common divisor of z and 2 ^m is 1, that is, z and 2 ^m are mutually prime.

[Algorithm 2]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
Output: XY mod Z
Step 1.r1 ← x1 y1 2 ^-m mod (z1) and q1 ← x1 y1 -r1 z1 2 ^m
Step 2.r2 ← q1 z0 2 ^-m mod (c) and q2 ← q1 z0 -r2 c 2 ^m
Step 3.r3 ← (x0 + x1) (y0 + y1) 2 ^-m mod (c) and q3 ← (x0 + x1) (y0 + y1) -r3c2 ^m
Step 4.r4 ← x0 y0 2 ^-m mod (c) and q4 ← x0 y0 -r4c2 ^m
Step 5.r5 ← c (-q2 + q3-q4 + r1) 2 ^-m mod (z1) and q5 ← c (-q2 + q3-q4 + r1) -r5 z1 2 ^m
Step 6.r6 ← q5 z0 2 ^-m mod (c) and q6 ← q5 z0 -r6 c 2 ^m
Step 7. Return (q2 + q4-q6-r1-r2 + r3-r4 + r5) c + (r2 + r4-r6) 2 ^m
At the input of the algorithm 2, the data X of the maximum bit length 2w, represented by data Y, data x1 of the data Z smaller bit length, x0, y1, y0, z1 , z0, c, 2 m. However, since m is determined from the residue multiplication implemented by the above-described dedicated multiplier device, other values are determined by setting the value of c. For example, according to the value of m, values such as c = 1 (when m = w), c = 2 ^m (m = 0), c = 2 ^w −1 (m is arbitrary) are set to c. In this algorithm 2, an operation for obtaining a remainder is repeated using the quotient obtained in the algorithm 1 with respect to the data having the small bit length, and finally, a remainder obtained by dividing XY represented by XYmodZ by Z is obtained. This algorithm 2 requires 6 sets of remainder multiplication quotient and remainder (step 1 to step 6). When addition or subtraction with a relatively light calculation amount is ignored, the algorithm 2 has a calculation cost substantially equal to the sum of the quotients of six sets of remainder multiplication and the calculation cost of the remainder.

W. Fischer, J.A. -P. Seifert: “Increasing the bit length of crypto-coprocessors” CHES2002, vol. 2523 of Lecture Notes in Computer Science, Springer-Verlag, pp. 2523 71--81 (2003). Benoit Chevallier-Mames, Marc Joye, and Pascal Pallier: “Faster Double-Size Modular Multiplexing From Multiple Multipliers” CHES2003, vol. 2779 of Lecture Notes in Computer Science, Springer-Verlag, pp. 214-227 (2003). Masayuki Yoshino, Katsukiyuki Okeya, and Camille Vuillaume. Universe Bit-Length of a Crypto-Processor with Management Multiplication. In Preprocesseds of SAC2006 pp. 184-198 (2006) Masayuki Yoshino, Katsukiyuki Okeya, and Camille Vuillaume. “Double-Size Bipartite Multiplication” ACISP2007, vol. 4586 of Lecture Notes in Computer Science, Springer-Verlag, pp. 4586. 230-244 (2007)

  In the implementation method introduced in Non-Patent Document 4 (hereinafter referred to as the prior art), the above algorithm 1 and the above-described dedicated multiplication unit are limited in the maximum bit length (w) that can be calculated at one time. The algorithm 2 is used to calculate a remainder multiplication of a maximum bit length (2w). That is, the quotient and remainder of the remainder multiplication of the maximum bit length w are sequentially calculated using the above algorithms 1 and 2, and the remainder of the 2w remainder multiplication that is twice the maximum bit length can be obtained. The present inventor further developed this, and studied recursively repeating a double multiplication with a double bit length according to the above algorithm to perform a quadruple or even a 8-bit remainder multiplication. However, to perform a quadruple bit length remainder multiplication by recursively repeating a double bit length remainder multiplication, to perform a quadruple bit length remainder multiplication, a double bit length remainder multiplication is required. The quotient used in is needed. However, since the technique described in the non-patent document is a technique specialized for doubling, it has not been considered to output the quotient used for the calculation so that it can be used for the recursive calculation. Therefore, when the algorithm is simply applied to quadruple, when performing quadruple bit length remainder multiplication, a special sequential quotient is newly obtained according to a double bit length remainder multiplication algorithm. You must add an operation. Moreover, since such an operation must be added at each step of the algorithm 2, the overall processing time increases significantly. The following is a summary of problems related to a modular multiplication operation that is a multiple of the maximum bit length of the modular multiplier.

Challenge 1: Efficiency
(a): In the prior art, the calculation cost of the quotient of the remainder multiplication exceeding the maximum bit length (w) that can be calculated at one time by the above-described dedicated multiplier multiplication is large. For example, according to the algorithm 1 and the algorithm 2 described above, an example of calculating a remainder calculation with a bit length (4w) that is a maximum of four times that of the dedicated multiplication unit is shown. In the calculation of 4w bit remainder multiplication, according to the above algorithm 2, each of the 6w 2w bit remainder multiplications (r1, r2, r3, r4, r5, r6) and the quotient (q1, q2, q3, q4, q5) Q6) is required. In order to calculate the remainder of each 2w-bit modular multiplication, again according to the above algorithm 2, the remainder (r1, r2, r3, r4, r5, r6) and the quotient (q1) , Q2, q3, q4, q5, q6). On the other hand, in the calculation of the quotient of the 2w bit remainder multiplication, the remainder of the two kinds of remainder multiplication, that is, the remainder of the 2w bit remainder multiplication obtained above from the algorithm 1 and the remainder of the remainder multiplication having another value are obtained. is necessary. Therefore, for calculating the quotient (q1, q2, q3, q4, q5, q6) of six 2w-bit modular multiplications, the remainders (r1 ′, r2 ′, r3 ′) of six different 2w-bit modular multiplications are used. , R4 ′, r5 ′, r6 ′), and according to the above algorithm 2, each requires a quotient and a remainder of 6 w-bit remainder multiplications.

Therefore, when the bit length of the remainder multiplication to be calculated increases, the number of remainders and quotients of the w-bit remainder multiplication necessary for the calculation (that is, the number of times of w-bit remainder multiplication is calculated) increases exponentially. For example, when the remainder multiplier for calculating the remainder of the maximum w-bit remainder multiplication is used and the 2w-bit remainder multiplication is calculated, the w-bit remainder multiplication is calculated 12 times and the 4w-bit remainder multiplication is calculated. In order to calculate 12 ² times of w-bit remainder multiplication and 12 ³ times to calculate 8 w-bit remainder multiplication. Thereby, the subject that it was necessary to suppress the computational complexity which increases exponentially was discovered.
(b): In the algorithm 1 and the algorithm 2, it is necessary to process not only modular multiplication but also four arithmetic operations (addition, subtraction, multiplication, and division). Therefore, in addition to the calculation function of remainder multiplication, the performance may be improved if a part or all of the calculation functions for the four arithmetic operations (addition, subtraction, multiplication, division) are provided in the implementation environment. As a result, in addition to the remainder multiplication, it is found that it is a good idea to calculate a remainder multiplication exceeding twice the maximum bit length that can be calculated once by the above-mentioned remainder multiplication dedicated device using four arithmetic operations. It was done.

Problem 2: Flexible bit length expansion
(a): In the prior art using the above algorithm 1 and the above algorithm 2, when the above-mentioned residue multiplication dedicated unit calculates a maximum w bit remainder multiplication at a time, a 2 w bit remainder multiplication can be calculated. By using this method recursively, it is possible to calculate a remainder multiplication of a power of 2 of w bits, such as 4 w bits, 8 w bits, and 16 w bits. However, the multiple is always limited to a power of two. For this reason, when the bit length that can be calculated by the above-described dedicated residue multiplication unit cannot be changed (for example, only the maximum bit length remainder multiplication can be calculated), it is necessary to substitute a short bit length remainder multiplication with a long bit length remainder multiplication. . For example, if the above-mentioned special multiplication unit can calculate a maximum of 1024 bits, but a 512 bit remainder multiplication, instead of processing a 1536 (= 512 × 3) bit remainder multiplication, 2048 (= 512 × 2 ² ) bits Need to calculate the remainder multiplication. When the bit length of the remainder multiplication is long, the time required for calculation and the memory required for temporary storage of data increase. As a result, it has been found that it is desirable to be able to calculate not only a multiple of 2, but a remainder multiplication that is an integral multiple of the bit length of the remainder multiplication dedicated device.
(b): When the bit length of the remainder multiplication to be calculated is long, a larger area (memory or the like) is required for temporary storage of data. As a result, it has been found that it is desirable to easily increase the work memory of the remainder multiplier.

  An object of the present invention is to provide a data processing apparatus capable of improving the operation efficiency of remainder multiplication for data having a bit number exceeding twice the number of operation bits of a remainder multiplier.

  Another object of the present invention is to provide a data processing apparatus capable of improving the operation efficiency of remainder multiplication for data having a bit number that is an integer multiple exceeding twice the number of operation bits of a remainder multiplier.

  Still another object of the present invention is to provide a data processing apparatus capable of easily increasing a work memory for remainder multiplication for data having a number of bits exceeding twice the number of operation bits of a remainder multiplier. .

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  The following is a brief description of an outline of typical inventions disclosed in the present application.

  [1] When calculating the quotient and remainder of the 2w-bit remainder multiplication from the remainder and quotient of the w-bit remainder multiplication by recursively repeating the computation process of the remainder multiplication a plurality of times, it is obtained by the previous remainder multiplication calculation process. Further, control is performed to distribute the remainder and the quotient of the w-bit remainder multiplication to the next remainder multiplication operation. This makes it possible to newly calculate the quotient of the previous calculation process required for the subsequent calculation recursively compared to the calculation algorithm in which the calculation process of the previous multiplication is only the remainder of the w-bit modular multiplication. I don't need it. It is possible to improve the calculation efficiency of the residue multiplication for data having a bit number that is a multiple of 2 of the calculation bit number of the remainder multiplier.

  [2] Division operation that divides kw-bit multiplication into w-bit multiplication when calculating kw-bit (k> 2) quotient and remainder from the remainder and quotient of remainder multiplication of w-bit remainder multiplication The calculation unit is caused to execute a reduction process for calculating a remainder multiplication from a product of the process and the divided product. As a result, it is possible to improve the calculation efficiency of the remainder multiplication for data having a bit number that is an integer multiple exceeding twice the number of calculation bits of the remainder multiplier.

  [3] The control unit of the arithmetic unit that performs modular multiplication can use a RAM arranged in the address space of the central processing unit as a work memory of the arithmetic unit. The work memory for remainder multiplication can be increased without increasing the work memory inside the arithmetic unit for performing remainder multiplication.

  The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.

  [1] It is possible to improve the operation efficiency of the remainder multiplication for data having a bit number exceeding twice the number of operation bits of the remainder multiplier.

  [2] It is possible to improve the calculation efficiency of the remainder multiplication for data having a bit number that is an integer multiple that exceeds twice the number of calculation bits of the remainder multiplier.

  [3] It is possible to easily increase the work memory for remainder multiplication for data having a bit number exceeding twice the number of operation bits of the remainder multiplier.

1. First, an outline of a typical embodiment of the invention disclosed in the present application will be described. Reference numerals in the drawings referred to in parentheses in the outline description of the representative embodiments merely exemplify what are included in the concept of the components to which the reference numerals are attached.

  [1] A data processing device (601) according to the present invention includes a calculation unit (310) and a control unit (320) for remainder multiplication. The arithmetic unit performs arithmetic operation of remainder multiplication. The control unit recursively repeats the arithmetic operation of the remainder multiplication a plurality of times to calculate the quotient and remainder of the 2w bit remainder multiplication from the remainder and quotient of the w bit remainder multiplication. Control is performed to distribute the remainder and quotient of the w-bit remainder multiplication obtained in (5) to the next remainder multiplication operation processing (algorithm 3).

[2] More specifically, the data processing device (601) according to the present invention includes a calculation unit (310) and a control unit (320) for remainder multiplication. The arithmetic unit is a positive integer representing the number of bits of the w calculated value, x, y, z and 0 ≦ x, y, nonnegative integer w bits satisfying z <2 ^w, X, Y, and Z 0 ≦ X, Y, Z <2 ^2w bit non-negative integer satisfying 2w, m and n are set as non-negative integers, and the integer q and integer r satisfying the arithmetic expression xy = qz + r2 ⁿ are output. For this purpose. When the control unit recursively repeats the arithmetic processing, the control unit obtains the integer q and the integer r that are output from the remainder multiplication dedicated unit, an integer Q and an integer R that satisfy a multiplication arithmetic expression XY = QZ + R2 ^2m. The process of distributing to the next calculation process to obtain is controlled (algorithm 3).

  [3] In the data processing device according to item 2, the arithmetic unit includes a remainder multiplier (101), an adder (102), and a subtracter (103).

  [4] In the data processing device according to item 3, the arithmetic unit further includes: a data memory (306); an accumulator (312); and the remainder multiplier, the adder, or the subtractor from the data memory or the accumulator. And a selector for selecting a data route to the. The accumulator accumulates the outputs of the remainder multiplier, the adder, or the subtracter, and outputs the accumulated data to a selector or a data memory.

  [5] In the data processing device according to item 2, the control unit decodes the arithmetic instruction read from the program memory (305) holding the arithmetic control program describing the procedure of the processing and the arithmetic memory. A control circuit (303) for generating a control signal for causing the unit to execute the arithmetic processing.

  [6] The data processing apparatus according to [2], further including a central processing unit (603) that gives an instruction to the control unit to perform multiplication or decryption for encryption or decryption, and is formed on one semiconductor substrate. .

  [7] The data processing apparatus according to item 2 further includes a RAM (606) arranged in the address space of the central processing unit, and the control unit can use the RAM as a work memory of the arithmetic unit. Is done.

  [8] A data processing device (601) according to another aspect of the present invention includes a calculation unit (310) and a control unit (320) for remainder multiplication. The arithmetic unit performs arithmetic operation of remainder multiplication. The controller divides kw-bit multiplication into w-bit multiplication when calculating a kw-bit (k> 2) quotient and remainder from the remainder and quotient of the remainder multiplication of the w-bit remainder multiplication. The calculation unit is caused to execute a division calculation process and a reduction process for calculating a remainder multiplication from the divided multiplication product (algorithm 10).

[9] The data processing device (601) according to a more specific viewpoint includes a calculation unit (310) and a control unit (320) for remainder multiplication. The arithmetic unit performs arithmetic operation of remainder multiplication. The control unit sets X, Y, and Z as kw-bit non-negative integers that satisfy 0 ≦ X, Y, and Z <2 ^kw, and sets a non-negative integer R that satisfies a remainder multiplication arithmetic expression R = XY 2 ^−kw mod Z A division operation for dividing a product XY of multiplications of integers of kw bits into products of multiplication of a small number of bits, and an order with respect to the multiplication product XY subjected to the division processing based on the integer Z The calculation unit is caused to execute a reduction process for lowering (algorithm 10).

  [10] In the data processing device according to item 9, the reduction process is a process of finally obtaining a value of 0 or more and less than Z for the product XY obtained by the division process.

  [11] In the data processing device according to item 10, the arithmetic unit includes a remainder multiplier (101), an adder (102), and a subtractor (103).

  [12] In the data processing device according to item 11, the arithmetic unit further includes a data memory (306), an accumulator (312), and the data memory or the accumulator to the remainder multiplier, the adder, or the subtractor. And a selector (308) for selecting a data path to the. The accumulator accumulates the outputs of the remainder multiplier, the adder, or the subtracter, and outputs the accumulated data to a selector or a data memory.

  [13] In the data processing device according to item 9, the control unit decodes an arithmetic instruction read from the program memory (305) holding an arithmetic control program describing a procedure of the processing, and the arithmetic operation And a control circuit (303) that generates a control signal for causing the division calculation process and the reduction process to be performed in the unit.

  [14] The data processing apparatus according to [9] further includes a central processing unit (603) that gives an instruction of a remainder multiplication process for encryption or decryption to the control unit, and is formed on one semiconductor substrate. .

  [15] The data processing device according to item 14 further includes a RAM (606) arranged in an address space of the central processing unit, and the control unit can use the RAM as a work memory of the arithmetic unit. Is done.

2. Details of Embodiments Embodiments will be further described in detail.

<< Embodiment 1 >>
In the algorithm 1 and the algorithm 2 described in Non-Patent Document 4, when a remainder multiplication exceeding twice the maximum bit length of the remainder multiplication that can be calculated by the remainder multiplication unit at a time is calculated, the quotient of the remainder multiplication is calculated. The problem 1 is that the cost is high. This is because the calculation of the quotient of the modular multiplication requires two types of modular multiplication.

  Therefore, instead of a method for calculating the quotient from the remainder of the remainder multiplication (that is, the method according to the algorithm 1 and the algorithm 2), an algorithm 3 for calculating the multiplication and efficiently calculating the quotient and the remainder of the remainder multiplication is used. It is shown below.

[Algorithm 3]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
^{Output: XY2 -2m / Z, XY2 -2m} mod Z
Step 1.r1 ← x0 y0 2 ^-m mod (2 ^w ) and q1 ← x0 y0 -r1 2 ^w 2 ^m
Step 2.r2 ← (x0 + x1) (y0 + y1) 2 ^-m mod (z1) and q2 ← (x0 + x1) (y0 + y1) -r2 z1 2 ^m
Step 3.r3 ← x1y1 2 ^-m mod (z1) and q3 ← x1y1 -r3 z1 2 ^m
Step 4.r4 ← (r3-q1) c 2 ^-m mod (z1) and q4 ← (r3-q1) c -r4 z1 2 ^m
Step 5. r5 ← q3 z0 2 ^-m mod (z1) and q5 ← q3 z0 -r5 z1 2 ^m
Step 6.r6 ← (q2-q3 + q4-q5) z0 2 ^-m mod (2 ^w ) and q6 ← (q2-q3 + q4-q5) z0 -r6 2 ^w 2 ^m
Step 7. Return q3 2 ^wm + (q2-q3 + q4-q5) 2 ^m and (q1-q6-r1 + r2-r3 + r4-r5) 2 ^wm + (r1-r6) 2 ^m
However, the output value (XY2 ^-2m / Z) divides the XY two ^-2m in Z, is a value obtained by truncating decimals. The input / output data in the algorithm 3 satisfies the following identity.
^{XY = (XY2 -2m / Z)} Z + (XY2 -2m mod Z) 2 2m
That, (XY2 ^-2m / Z) Q the quotient of modular multiplication with a value of, when R a remainder having a value of (XY2 ^-2m mod Z), (formula a), (formula b) Similarly, the following The formula holds.
R = XY2 ^-2m mod Z ··· (formula A)
XY = QZ + R2 ^2m ... (Formula B)
Each step of the algorithm 3 includes a calculation for obtaining a quotient of remainder multiplication and a remainder, and addition and subtraction. Compared with the prior art that required the algorithm 2 to be called twice (recursively) each time the quotient of the remainder multiplication is calculated, the algorithm 3 that computes the quotient and the remainder of the remainder multiplication together has a calculation amount of Less overall processing time.

For example, when the remainder multiplier for calculating the remainder of the maximum w-bit remainder multiplication is used and the 2w-bit remainder multiplication is calculated, the number of w-bit remainder multiplications is 12, and the above algorithm 2 is used. The calculation amount is the same as that of the conventional technique. However, when calculating a 4w bit remainder multiplication, the w bit remainder multiplication is 6 * 12 (= 72) times, and when calculating an 8w bit remainder multiplication, it is 6 ² * 12 (= 432) times. In the prior art using algorithm 1 and algorithm 2 above, 12 ² (= 144) times in the case of 4w bits and 12 ³ (= 1728) times in the case of 8w bits. (4w bit) and 25% (8w bit) are small. In general, when calculating the remainder multiplication of 2 ^× w bits using the remainder multiplier for calculating the remainder of the maximum multiplication of w bits, the calculation amount is only (1/2 ^{× −1} ) * as compared with the prior art. 100% is sufficient (however, other calculations such as addition and subtraction are neglected in theory).

  Therefore, in the present invention, a processing flow that suppresses the exponentially increasing calculation amount and more efficiently calculates both the remainder and the quotient of the remainder multiplication, and the remainder multiplication that calculates the remainder multiplication using the processing flow. Can be provided.

  The implementation device of the algorithm 3 may be implemented with a remainder multiplication calculation function and an addition or subtraction calculation function in the above-described residue multiplication dedicated device.

Note that the algorithm 3 is essentially the same as other algorithms for calculating the quotient and remainder of the remainder multiplication greater than or equal to the maximum bit length that can be calculated by the remainder multiplication unit at one time. For example, in the following algorithm 4, the quotient and the remainder can be calculated similarly. Therefore, the processing of the above algorithm 3 and the following algorithm 4 is essentially the same. Algorithm 4 is
[Algorithm 4]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
^{Output: XY2 -2m / Z, XY2 -2m} mod Z
Step 1.r1 ← x0 y0 2 ^-m mod (2 ^w ) and q1 ← x0 y0 -r1 2 ^w 2 ^m
Step 2.r2 ← x1 y0 2 ^-m mod (z1) and q2 ← x1 y0 -r2 z1 2 ^m
Step 3.r3 ← x0 y1 2 ^-m mod (z1) and q3 ← x0 y1 -r3 z1 2 ^m
Step 4.r4 ← x1 y1 2 ^-m mod (z1) and q4 ← x1 y1 -r4 z1 2 ^m
Step 5. r5 ← r4 c 2 ^-m mod (z1) and q5 ← r4 c -r5 z1 2 ^m
Step 6.r6 ← q4 z0 2 ^-m mod (z1) and q6 ← q4 z0 -r6 z1 2 ^m
Step 7.r7 ← (-q2-q3-q5 + q6) z0 2 ^-m mod (2 ^w ) and q7 ← (-q2-q3-q5 + q6) z0 -r7 2 ^w 2 ^m
Step 8. Return q4 2 ^wm + (q2 + q3 + q5-q6) 2 ^m and (r2 + r3 + r5-r6 + q1 + q7) 2 ^wm + (r1 + r7) 2 ^m
It is.

Also in the algorithm 5 below, the quotient and the remainder can be calculated similarly. Algorithm 5 is
[Algorithm 5]
Input: X = x1 s + x0 2 ^m , Y = y1 s + y0 2 ^m , Z = z1 s + z0 2 ^m , where 0≤m <w and s ² = Z + a
^{Output: XY2 -2m / Z, XY2 -2m} mod Z
Step 1.r1 ← x0 y0 2 ^-m mod (s) and q1 ← x0 y0 -r1 s 2 ^m
Step 2.r2 ← (x1 + x0) (y1 + y0) 2 ^-m mod (s) and q2 ← (x1 + x0) (y1 + y0) -r2 s 2 ^m
Step 3.r3 ← x1 y1 2 ^-m mod (s) and q3 ← x1 y1 -r3 s 2 ^m
Step 4.r4 ← a q3 2 ^-m mod (s) and q4 ← a q3 -r4 s 2 ^m
Step 5.r5 ← a (-q1 + q2-q3 + q4 + r3) 2 ^-m mod (s) and q5 ← a (-q1 + q2-q3 + q4 + r3) -r5 s 2 ^m
Step 6. Return q3 2 ^wm + (q1-q3 + q4-q5) 2 ^m and (r1 + r4-r6) 2 ^wm + (q2-q6 + r1-r2-r3 + r4-r5) 2 ^m
It is.

In addition, the quotient and remainder of any kind of remainder multiplication can be calculated regardless of the kind of remainder multiplication implemented by the above-described residue multiplication dedicated device. For example, when the variable m in the above-described dedicated multiplier unit satisfies m = 1 (generally referred to as Montgomery multiplication), the quotient when the variable m is m = 0.5 (generally referred to as binary divisional multiplication). And the remainder can be calculated according to the following algorithm 6. Algorithm 6 is
[Algorithm 6]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
Output: XY2 ^-m / Z and XY2 ^-m mod (Z)
Step 1.r1 ← x1 y1 2 ^-m mod (2 ^w ) and q1 ← x1 y1 -r1 2 ^w 2 ^m
Step 2.r2 ← (x1 + x0) (y1 + y0) 2 ^-m mod (2 ^w ) and q2 ← (x1 + x0) (y1 + y0) -r2 2 ^w 2 ^m
Step 3.r3 ← x0 y0 2 ^-m mod (2 ^w ) and q3 ← x0 y0 -r3 2 ^w 2 ^m
Step ^{4. r4 ← q3 2 w 2 -m} mod (z1) and q4 ← q3 2 w -r4 z1 2 m
Step 5. r5 ← r1 1 2 ^-m mod (z0) and q5 ← r1 1 -r5 z0 2 ^m
Step 6.r6 ← q4 z0 2 ^-m mod (2 ^w ) and q6 ← q4 z0 -r6 2 ^w 2 ^m
Step 7.r7 ← q5 z1 2 ^-m mod (2 ^w ) and q7 ← q5 z1 -r7 2 ^w 2 ^m
Step 8. Return q4 2 ^w + q5 and (r4-q1 + q2-q3-q6-q7) 2 ^w + (q1-r1 + r2 + r5-r6-r7)
It is.

When Z = 2 ^2w and m = 0, or Z = 2 ^2w and m = 1 in the modulus Z and the variable m, the multiplication is performed in place of the algorithm 3 for calculating the quotient and the remainder of the remainder multiplication. The following algorithm 7 may be executed. However, in the algorithm 7 below, the upper 2w bits of the multiplication result is the quotient of the remainder multiplication (when m = 0) or the remainder of the remainder multiplication (m = 1), and the lower 2w bit is the remainder of the remainder multiplication (when m = 1) ) Or the quotient of remainder multiplication (m = 0). Algorithm 7 is
[Algorithm 7]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
^{Output: XY2 -2m / Z and XY2 -2m} mod (Z)
Step 1.r1 ← x0 y0 2 ^-m mod (2 ^w ) and q1 ← x0 y0 -r1 2 ^w 2 ^m
Step 2.r2 ← x0 y1 2 ^-m mod (2 ^w ) and q2 ← x0 y1 -r2 2 ^w 2 ^m
Step 3.r3 ← x1 y0 2 ^-m mod (2 ^w ) and q3 ← x1 y0 -r3 2 ^w 2 ^m
Step 4.r4 ← x1 y1 2 ^-m mod (2 ^w ) and q4 ← x1 y1 -r3 2 ^w 2 ^m
Step 5.sum = x1y12 ^2w + (x1y0 + x0y1) 2 ^w + x0y0
Step 6. Return sum / 2 ^2w and sum mod (2 ^2w )
It is.

Similar to algorithm 3 above, algorithm 7 is also an example of a calculation method, and by using multiplication, the quotient and remainder of the remainder multiplication greater than or equal to the maximum bit length that can be calculated by the remainder multiplication unit at a time. It is essentially the same as any other algorithm that computes. For example, there is the following algorithm 8 as another calculation method. Algorithm 8 is
[Algorithm 8]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
^{Output: XY2 -2m / Z and XY2 -2m} mod (Z)
Step 1.r1 ← x0 y0 2 ^-m mod (2 ^w ) and q1 ← x0 y0 -r1 2 ^w 2 ^m
Step 2.r2 ← (x0 + x1) (y1 + y0) 2 ^-m mod (2 ^w ) and q2 ← (x0 + x1) (y0 + y1) -r2 2 ^w 2 ^m
Step 3.r3 ← x1 y1 2 ^-m mod (2 ^w ) and q3 ← x1 y1 -r3 2 ^w 2 ^m
Step 4.sum = x1y12 ^w (2 ^w -1) + (x1 + x0) (y1 + y0) 2 ^w -x0y0 (2 ^w -1)
Step 5. Return sum / 2 ^2w and sum mod (2 ^2w )
It is.

  Next, a processing flow when the algorithm 3 is realized in the remainder multiplication unit will be described. However, the processing flow is not particularly limited, and can be realized in the same manner even when the algorithm 4, the algorithm 6, the algorithm 7, the algorithm 8, and other algorithms are processed.

  First, the arithmetic unit used for the processing will be described. Although not particularly limited, FIG. 1A shows an arithmetic unit that calculates an operation specific to each arithmetic unit from a given input value and outputs the calculation result. In the following, 3 of the MM calculator 101 as a remainder multiplier for calculating the quotient and remainder of the remainder multiplication, the ADD calculator 102 as the adder for calculating addition, and the SUB calculator 103 as the subtractor for calculating subtraction. A case where the above algorithm 3 is processed using a type of arithmetic unit will be described below. However, in order for the remainder multiplication unit to process the above algorithm 3, it is only necessary to be able to process the remainder multiplication, addition, and subtraction, and they need not be separate arithmetic units. For example, one arithmetic unit having a calculation function of remainder multiplication, addition, and subtraction may be used. Further, the subtraction may be processed by using the data represented by the two's complement expression and the ADD calculator 102.

  Furthermore, another arithmetic unit may be used in the quotient of the remainder multiplication and the remainder calculation. In accordance with the algorithm 2, for example, the MM2 calculator 151 that calculates the remainder of the remainder multiplication shown in (B) in FIG. 1 may be used. In addition, modular multiplication can be calculated using multiplication and division. Therefore, a MU computing unit 152 that calculates multiplication shown in FIG. 1B or a DIV computing unit 153 that calculates division may be used.

  FIG. 2 illustrates a processing flow related to the algorithm 3. Here, a processing flow related to the algorithm 3 using the MM computing unit 101, the ADD computing unit 102, and the SUB computing unit 103 defined in FIG. However, the numbers in parentheses in the computing unit in FIG. 2 are reference numbers as step numbers using the computing unit. Also, when the lines intersect in FIG. 2, there is no influence when there is no black circle mark, and when there is a black circle mark, it indicates a branching process of data having the same value. Therefore, the processing flow in FIG. 2 distributes the computation results of w bits required for each quotient and remainder of 2w bits by the order of input to each arithmetic unit, the presence or absence of black circles, and the connection processing. Have In addition, with this distribution processing, the processing flow of FIG. 2 is finally a quotient of 2w bit remainder multiplication combining q3 which is the output value of the algorithm 3 and (q2-q3 + q4-q5). q3c + (q2-q3 + q4-q5), (q1-q6-r1 + r2-r3 + r4-r5) and (r1-r6) are combined and the remainder of 2w bit remainder multiplication (q1-q6- r1 + r2-r3 + r4-r5) c + (r1-r6) is obtained.

  For example, the MM calculator (m1) accepts x0, y0, and c as input values, and outputs a quotient q1 and a remainder r1 of the remainder multiplication. The quotient q1 output from the MM calculator (m1) is received as an input value by the connected SUB calculator (s2) and SUB calculator (s3), and similarly, the remainder r1 is the SUB calculator (s3) and SUB. It is accepted as an input value by the arithmetic unit (s7). The SUB calculator that receives q1 and r1 as input values calculates the subtraction (q1-r1) and outputs the result to the ADD calculator (a3). Similar processing is also performed in another arithmetic unit. As a result, P1 = q3, P2 = (q2-q3 + q4-q5), P3 = (q1- q6-r1 + r2-r3 + r4-r5), P4 = (r1-r6).

  FIG. 3 illustrates the configuration of the modular multiplication unit 3 that can execute the processing flow of FIG. Note that all the functional blocks shown in FIG. 3 are formed on one semiconductor substrate such as a single crystal silicon substrate.

  In FIG. 3, reference numeral 300 denotes a system bus used for connection of the remainder multiplication unit and other devices. Reference numeral 301 is a clock generator, 302 is an input / output port (simply referred to as I / F), 303 is a control circuit that controls other devices in accordance with a program memory 305 as a program memory, and 304 is the status of each device in the control circuit 303 A register for management (referred to as a management register), 305 is a program memory for storing a program and data read from the control circuit 303 (which may be readable and may be a non-volatile medium such as a ROM), and 306 is data A memory for storing data as a memory (a program may be stored, and a volatile medium such as a RAM is desirable), 307 is a control register, and 308 is a selector. 101 is an MM calculator that calculates the quotient and remainder of remainder multiplication, 102 is an ADD calculator that calculates addition, 103 is a SUB calculator that calculates subtraction, and 312 is an accumulator that stores the data output from each calculator. is there.

  Although not particularly limited, a program in which a processing procedure for realizing the algorithm 3 is described is stored in the program memory 305, and data used for input / output or calculation during processing is stored in the data memory 306. Further, the memory capacity for use may be adjusted by making the program memory 305 and the data memory 306 detachable and replacing or adding other memory. The modular multiplication unit 3 does not include the clock generator 301 and may operate based on an externally supplied clock signal.

  In the modular multiplication unit 3, the modular multiplier (MM computing unit) 101, the adder (ADD computing unit) 102, the subtracter (SUB computing unit) 103, the selector 308, the accumulator 213, and the data memory 306 are the computing unit 310. The control circuit 303 and the program memory 305 are examples of the control unit 320.

  FIG. 4 shows an outline of the processing flow for executing the processing flow of FIG. 2 in the remainder multiplication unit 3. In the processing flow of FIG. 4, the quotient of the remainder multiplication and the calculation of the remainder are the MM calculator 101, the addition is the ADD calculator 102, and the subtraction is the calculation process that should be borne by the SUB calculator 103.

  First, the control circuit 303 reads a program describing the algorithm 3 from the program memory 305 (S401). The control circuit 303 determines whether or not it is necessary to transfer data in the data memory 306 and the accumulator 312 according to the read program and the state of the management register 304 (S402). When it is determined that the transfer is necessary, the data is transferred from the data memory 306 or the accumulator 312 or between each other. For example, the data in the accumulator 312 is transferred to the data memory 306 so that the data stored in the accumulator 312 is not overwritten with the data output in the next arithmetic processing (S403). The control circuit 303 transmits a control signal and sets a register value in the control register 307 (S404). As shown in FIG. 5A, the register value in the control register 307 includes an operation code (501) for determining a computing unit to be used and an address code (502) indicating the location of data to be input to the computing unit. Consists of. According to the register value in the control register 307, the selector 308 transmits data to the computing unit (S405). The computing unit to which the data has been sent processes the computation (modulus multiplication quotient and remainder computation, addition or subtraction), and outputs the computation result to the accumulator 312 (S406). As shown in FIG. 5B, the accumulator 312 transmits the presence / absence of carry (carrying up) or borrowing (carrying down) of the output value to the management register 304 (S407). The control circuit 303 determines whether to end the process according to the read program and the state of the management register 304 (S408).

In the above description, the MM arithmetic unit 101 that can calculate the quotient and the remainder of the remainder multiplication is assumed. The calculation method of the modular multiplication in the MM computing unit 101 is not limited, and for example, the MM computing unit 101 that implements classical modular multiplication or Montgomery multiplication may be used. The same calculation can be performed by using another arithmetic unit instead of the MM arithmetic unit 101. For example, an MM2 calculator 151 that outputs the remainder of the remainder multiplication as shown in FIG. Furthermore, when the MM calculator 101 can calculate not only the remainder multiplication but also addition and subtraction, the ADD calculator 102 and the SUB calculator 103 need not be used, and the circuit scale of the remainder multiplication unit can be reduced. Further, instead of the MM calculator 101, a MU calculator 152 for calculating multiplication and a DIV calculator 153 for calculating division may be used. An arithmetic unit that receives data X, data Y, data Z, and data T as inputs and outputs (XY + T2 ^k ) / Z and XY + T2 ^k (mod Z) may be used. In this case, there is the following algorithm 9. Algorithm 9 is
[Algorithm 9]
Input: X = x1 c + x0 2 ^m , Y = y1 c + y0 2 ^m , Z = z1 c + z0 2 ^m , where 0≤m <w
^{Output: XY2 -2m / Z and XY2 -2m} mod (Z)
Step 1.r1 ← x1 y1 2 ^-m mod (z1) and q1 ← x1 y1 -r1 z1 2 ^m
Step 2.r2 ← (x0 + x1) (y1 + y0) 2 ^-m mod (2 ^w -1) and q2 ← (x0 + x1) (y0 + y1) -r2 (2 ^w -1) 2 ^m
Step 3.r3 ← x0 y0 2 ^-m mod (2 ^w ) and q3 ← x0 y0 -r3 2 ^w 2 ^m
Step 4.r4 ← q2 z0 2 ^-m + (r2-q3) 2 ^w mod (2 ^w ) and q4 ← q2 z0 + (r2-q3) 2 ^w -r4 2 ^w 2 ^m
Step 5.r5 ← (q1-q2-q4) z0 2 ^-m mod (2 ^w ) and q5 ← (q1-q2-q4) z0 -r5 2 ^w 2 ^m
Step 6. Return q3 2 ^w + (q1-q2-q4) and (r1-r2-r3-r4 + q3-q5) 2 ^w + r3-r4-r5
It is.

In particular, when the multiplication can be calculated in addition to the remainder multiplication, the algorithm 3 may calculate the multiplication instead of the remainder multiplication. As shown in FIG. 5C, in step 1 of algorithm 3 above, when c = 2 ^w , the upper w bits of the product of the w bit integers x0 and y0 are equal to the quotient q1 of the remainder multiplication (551). ), The lower w bits are equal to the remainder r1 of the remainder multiplication. In step 6, the quotient q6 and the remainder r6 are obtained on the same principle (552).

  Further, instead of using a computing unit, each computation result may be written in the memory in advance, and the memory value may be appropriately referred to from the input value to obtain a computation result. In this case, the circuit scale required by the arithmetic unit can be reduced, but the amount of memory used is increased instead.

  FIG. 6 shows an example of a schematic block diagram of a microcomputer 601 capable of executing the algorithm 3 for calculating the quotient and remainder of the remainder multiplication unit. In FIG. 6, 602 is a clock generator, 603 is a CPU, 604 is an input / output port (referred to as I / O port), 605 is a ROM which is a read-only memory storing programs and data, 606 is a work of the CPU 603 A RAM which is a memory providing an area, 607 is an EEPROM which is a memory for storing programs and data, and 3 is a remainder multiplication unit. The CPU 603, I / O port 604, ROM 605, RAM 606, EEPROM 607, and remainder multiplication unit 3 are connected to a bus 611 that is a generic name for an address bus and a control bus, and a bus 612 that is a generic term for a data bus. The clock generator 602 generates an internal operation reference clock signal based on the clock signal supplied from the clock terminal CLK or supplies it to the CPU 603. The I / O port 604 is connected to the data input / output external terminal I / O. Vcc and Vss are power supply external terminals of the microcomputer 601, and RES is a microcomputer reset external terminal.

  A microcomputer 601 shown in FIG. 6 is formed on a single semiconductor substrate such as a single crystal silicon substrate by, for example, a complementary MOS integrated circuit manufacturing technique. The microcomputer 601 shown in FIG. 6 is one example of mounting, and can be similarly mounted on other devices. For example, it can be mounted on small devices such as RFID, PDA, and cellular phone.

<< Embodiment 2 >>
The above algorithm 2 of Non-Patent Document 4 is a bit length that can be calculated as a power of a multiple of 2 (= 2 ^× multiples) of the bit length of the above-mentioned special multiplication unit. There was a problem 2 in which the increase in the amount and the increase in the consumed memory were caused. An algorithm and a processing flow for calculating a remainder multiplication that is an integral multiple of the bit length of the remainder multiplication exclusive device effective for the above problem 2 will be described below.

First, an algorithm 10 for calculating a remainder multiplication of a maximum of 3 times the bit length that can be calculated at once by the above-mentioned residue multiplication dedicated unit is illustrated below. Algorithm 10 is
[Algorithm 10]
Input: X = x2 c ² + x1 c + x0, Y = y2 c ² + y1 c + y0, Z = z2 c ² + z1 c + z0
Output: XY mod Z
Step 1.q1 ← x2 y2 / z2 and r1 ← x2 y2 mod (z2)
Step 2.q2 ← q1 z1 / z2 and r2 ← q1 z1 mod (z2)
Step 3.q3 ← r1 c / z2 and r3 ← r1 c mod (z2)
Step 4.q4 ← x2 y1 / z2 and r4 ← x2 y1 mod (z2)
Step 5.q5 ← x1 y2 / z2 and r5 ← x1 y2 mod (z2)
Step 6.q6 ← q1 z0 / z2 and r6 ← q1 z0 mod (z2)
Step 7.q7 ← (-q2 + q3 + q4 + q5) z1 / z2 and r7 ← (-q2 + q3 + q4 + q5) z1 mod (z2)
Step 8.q8 ← (-r2 + r3 + r4 + r5) c / z2 and r8 ← (-r2 + r3 + r4 + r5) c mod (z2)
Step 9.q9 ← x2 y0 / z2 and r9 ← x2 y0 mod (z2)
Step 10.q10 ← x1 y1 / z2 and r10 ← x1 y1 mod (z2)
Step 11.q11 ← x0 y2 / z2 and r11 ← x0 y2 mod (z2)
Step 12.q12 ← (-q2 + q3 + q4 + q5) z0 / c and r12 ← (-q2 + q3 + q4 + q5) z0 mod (c)
Step 13.q13 ← (-q6-q7 + q8 + q9 + q10 + q11) z1 / c and r13 ← (-q6-q7 + q8 + q9 + q10 + q11) z1 mod (c)
Step 14.q14 ← x1 y0 / c and r14 ← x1 y0 mod (c)
Step 15.q15 ← x0 y1 / c and r15 ← x0 y1 mod (c)
Step 16.q16 ← (-q6-q7 + q8 + q9 + q10 + q11) z0 / c and r16 ← (-q6-q7 + q8 + q9 + q10 + q11) z0 mod (c)
Step 17.q17 ← x0 y0 / c and r17 ← x0 y0 mod (c)
Step 18. Return ((-q12-q13 + q14 + q15-r6-r7 + r8 + r9 + r10 + r11) c ² + (-r12-r13 + r14 + r15- q16 + q17) c + (-r16 + r17)) (mod Z)
It is.

  The algorithm 10 can be similarly realized using the remainder multiplication unit in the first embodiment. Therefore, in Embodiment 1 and Embodiment 2, the devices that can be mounted are the same except for the program. In short, a program in which a data processing procedure for realizing the algorithm 10 is stored is stored in the program memory 305, and a control circuit 303 and arithmetic units 101, 102, 103, etc. for processing data defined by the program are shown in FIG. The configuration of 3 may be used as it is.

  Each step of the algorithm 10 includes a calculation for obtaining a quotient and a remainder of remainder multiplication, addition, and subtraction. Compared to the case where the algorithm 3 for calculating the remainder multiplication twice the bit length of the remainder multiplication dedicated unit is recursively called twice, the number of steps is overwhelmingly smaller. For example, in the algorithm 10, the calculation of the algorithm 3 is 36 times with respect to the quotient of 17 multiplications and the calculation of the remainder. Therefore, the calculation amount of the remainder multiplication is less than half (= 17/36), and the entire processing time can be shortened.

  The following shows that the algorithm 10 can correctly calculate the remainder multiplication (XY mod Z).

If c = 2 ^w , using integer c and the formula (X = x2c ² + x1c + x0), 3w bit integer X is converted to integer x2, x1, Can be divided into x0. The other integers Y and Z are similarly expressed as w-bit integers y2, y1, y0, z2, z1, and z0 (Y = y2c ² + y1c + y0, Z = z2c ² + z1c + z0). Therefore, when the multiplication XY is expanded with a w-bit integer, it can be expanded as in (Expression 0) to (Expression 1).
XY = (x2 c ² + x1c + x0) (y2 c ² + y1c + y0) ... (Equation 0)
= x2y2c ⁴ + (x2y1 + x1y2) c ³ + (x2y0 + x1y1 + x0y2) c ² + (x1y0 + x0y1) c + x0y0… (Formula 1)
As expansion methods, in addition to simple expansion equations such as (Equation 1), the Karatsuba algorithm, which is known for efficient conversion to multiplication equations, Tom-Cook multiplication algorithms, fast Fourier transform algorithms, etc. A calculation method may be used.

Thereafter, each item of (Equation 1) is converted and arranged so that the value of (Equation 1) is less than modulus Z. The key is the following formula
z2c ² = -z1c-z0 (mod Z)
It is. The contents of the conversion and organization are shown below.

(First term of Formula 1) x2y2c ⁴
= (q1z2 + r1) c ⁴ (Formula (x2 y2 = q1 z2 + r1), ie, using r1 = x2y2 modz2 and q1 = x2y2 / z2)
= -q1 (z1c + z0) c ² + r1c ⁴ (using the formula (z2c ² = -z1c -z0 (mod Z)))
= (-q1z1 + r1c) c ³ -q1z0c ² (Formula 2)
X2 y2 = q1 z2 + r1 holds in the first and second expressions of the above expansion formula. Q1 and r1 satisfying the above equation have an integer having a value of (x2 y2 / z2), q1 and a value of (x2 y2 mod (z2)) from the relational expression of (Expression a) and (Expression b). The integer may be r1. Therefore, step 1 of algorithm 10 above
q1 ← x2 y2 / z2
r1 ← x2 y2 mod (z2)
Was able to lead.

The first term of (Equation 1) is expanded (Equation 2), and the common term of other terms in Equation 1 is searched. Then, the second term of the first term of (formula 2) (Equation 1) are combined in a common section c ^3. That is,
The first term of (Formula 2) + the second term of (Formula 1)
= (-q1z1 + r1c) c ³ + (x2y1 + x1y2) c ³
= ((-q2 + q3 + q4 + q5) z2 + (-r2 + r3 + r4 + r5)) c ³
= (q 'z2 + r') c ³ (arranged as q '=-q2 + q3 + q4 + q5 and r' =-r2 + r3 + r4 + r5)
=-q 'z1c ² -q'z0c + r'c ³ … (Formula 3) (Using Formula (z2c ² = -z1c -z0 (mod Z)))
It becomes.

As in the case where Step 1 is derived, from the relational expression of (Expression a) and (Expression b), q1z1 = q2z2 + r2, r1c = q3z2 + r3, x2y1 = q4z2 + r4, x1y2 = q5z2 + r5 holds.
Therefore,
Step 2.q2 ← q1 z1 / z2 and r2 ← q1 z1 mod (z2)
Step 3.q3 ← r1 c / z2 and r3 ← r1 c mod (z2)
Step 4.q4 ← x2 y1 / z2 and r4 ← x2 y1 mod (z2)
Step 5.q5 ← x1 y2 / z2 and r5 ← x1 y2 mod (z2)
Thus, step 2 to step 5 of the algorithm 10 can be derived.

(Formula 3), which is the expansion formula including the first term of (Formula 2), which is the expansion of the first term of (Formula 1), and the other terms of (Formula 2) Search for common terms. Then, summarized in paragraph (Expression 2) of the second term and the common is first term and the third term of (formula 3) term c ² (Equation 1). That is,
The third term of (Formula 1) + the second term of (Formula 2) + the first term of (Formula 3) + the third term of (Formula 3)
= (x2y0 + x1y1 + x0y2) c ² -q1z0c ² -q'z1c ² + r'c ³
= ((-q6-q7 + q8 + q9 + q10 + q11) z2 + (-r6-r7 + r8 + r9 + r10 + r11)) c ²
= q``z2c ² + r''c ²
(Arranged as q '' =-q6-q7 + q8 + q9 + q10 + q11 and r '' =-r6-r7 + r8 + r9 + r10 + r11)
=-q''z1c-q''z0 + r''c ² ... (Formula 4) (Using Formula (z2c ² = -z1c-z0 (mod Z)))
It is.

Similar to the case where Step 1 to Step 5 are derived, from the relational expression of (Expression a) and (Expression b), q1z0 = q6z2 + r6, (−q2 + q3 + q4 + q5) z1 = q7z2 + r7, (-r2 + r3 + r4 + r5) c = q8z2 + r8, x2y0 = q9z2 + r9, x1y1 = q10z2 + r10, x0y2 = q11z2 + r11. Therefore,
Step 6.q6 ← q1 z0 / z2 and r6 ← q1 z0 mod (z2)
Step 7.q7 ← (-q2 + q3 + q4 + q5) z1 / z2 and r7 ← (-q2 + q3 + q4 + q5) z1 mod (z2)
Step 8.q8 ← (-r2 + r3 + r4 + r5) c / z2 and r8 ← (-r2 + r3 + r4 + r5) c mod (z2)
Step 9.q9 ← x2 y0 / z2 and r9 ← x2 y0 mod (z2)
Step 10.q10 ← x1 y1 / z2 and r10 ← x1 y1 mod (z2)
Step 11.q11 ← x0 y2 / z2 and r11 ← x0 y2 mod (z2)
Thus, step 6 to step 11 of the algorithm 10 can be derived.

As summarized in common item c ² and the common term c, to terms of the equation not you common terms Deku calculates a multiplication modulo or c. Therefore, the following formula can be derived. That is,
4th term of (Formula 1) + 2nd term of (Formula 3) + 1st term of (Formula 4)
= (x1y0 + x0y1) c-q'z0c-q 'z1c
= (-q12-q13 + q14 + q15) c ² + (-r12-r13 + r14 + r15) c ... (Formula 5)
The fifth term of (Formula 1) + the second term of (Formula 4)
= -q``z0 + x0y0
= (-q16 + q17) c + (-r16 + r17) (Equation 6)
It is.

As in the case of deriving from step 1 to step 11, from the relational expression of (expression a) and (expression b), (-q2 + q3 + q4 + q5) z0 = q12c + r12, (-q6-q7 + q8 + q9 + q10 + q11) z1 = q13c + r13, x1y0 = q14c + r14, x0y1 = q15c + r15, (-q6-q7 + q8 + q9 + q10 + q11) c = q16c + r16, x0y0 = q17c + r17 It holds. Therefore,
Step 12.q12 ← (-q2 + q3 + q4 + q5) z0 / c and r12 ← (-q2 + q3 + q4 + q5) z0 mod (c)
Step 13.q13 ← (-q6-q7 + q8 + q9 + q10 + q11) z1 / c and r13 ← (-q6-q7 + q8 + q9 + q10 + q11) z1 mod (c)
Step 14.q14 ← x1 y0 / c and r14 ← x1 y0 mod (c)
Step 15.q15 ← x0 y1 / c and r15 ← x0 y1 mod (c)
Step 16.q16 ← (-q6-q7 + q8 + q9 + q10 + q11) z0 / c and r16 ← (-q6-q7 + q8 + q9 + q10 + q11) z0 mod (c)
Step 17.q17 ← x0 y0 / c and r17 ← x0 y0 mod (c)
Thus, step 12 to step 17 of the algorithm 10 can be derived.

When all of the above equations are arranged, (Equation 1) is expressed by the third term of (Equation 4), the first term of (Equation 5), the second term of (Equation 5), and the first term of (Equation 6). It can be expressed as the sum of the second term of (Equation 6). Therefore, the following formula
(Formula 1)
= 3rd term of (Expression 4) + 1st term of (Formula 5) + 2nd term of (Formula 5) + 1st term of (Formula 6) + 2nd term of (Formula 6)
= (-q12-q13 + q14 + q15 + r``) c ² + (-r12-r13 + r14 + r15-q16 + q17) c + (-r16 + r17) ... (Equation 7)
Holds. The value of (Equation 7) can be less than 0 or greater than or equal to modulus Z. Therefore, when the value is less than 0, the modulus Z is added. When the value is not less than the modulus Z, the modulus Z is repeatedly subtracted to obtain a value not less than 0 and less than the modulus Z. This led to step 18 of the above algorithm.

  The program describing the expansion method of (Equation 0) may be managed by the program memory 305, and the control circuit 303 in the remainder multiplication unit may calculate the expansion equation according to the program. Alternatively, the program may be managed by the ROM 605, the RAM 606, or the EEPROM 607, and the CPU 603 in the microcomputer may calculate the expansion formula according to the program.

  The algorithm 10 can be used when calculating a remainder multiplication of a maximum of 3 times the bit length of the remainder multiplication dedicated device. FIG. 7 shows a processing flow for calculating a remainder multiplication that is an integer multiple (2, 3, 4, 5,...) Of the bit length of the above-described dedicated multiplication unit, which is a generalization of the above algorithm 10. Shown in According to the processing flow of FIG. 7, a remainder multiplication of an integral multiple of the bit length of the copro can be calculated.

First, parameters (multiplier X, multiplicand Y, modulus Z) necessary for the modular multiplication are decomposed in accordance with the bit length of the above-mentioned dedicated multiplier unit. The decomposition formula is not particularly limited, but can be expressed by the following formula, for example.
X = Σ _{(i = 0)} ^{[k / w]} xic ⁱ , Y = Σ _{(i = 0)} ^{[k / w]} yic ⁱ , Z = Σ _{(i = 0)} ^{[k / w]} zic ^i. (Formula 8)
Here, k is the bit length of each integer, and [k / w] is an integer obtained by rounding down the value obtained by dividing the bit length k by the bit length w of the above-mentioned residue multiplication dedicated device.

For example, (Equation 0) of the algorithm 10 corresponds to the same decomposition step as (Equation 8) (S701). The decomposed parameters are expanded, and multiplication for each parameter is configured. In this expansion step, simple expansion formulas, calculation methods such as Karatsuba algorithm, Tom-Cook multiplication algorithm, and fast Fourier transform algorithm can be used. For example, (Equation 1) of the algorithm 10 corresponds to the expansion step (S702). In the developed equation, the processing is started from the item of the highest order bit or the lowest order bit. When starting from the highest order bit in (Equation 1), the first term is 6 w bits, the second term is 5 w bits, the third term is 4 w bits, the fourth term is 3 w bits, and the fifth term is 2 w bits. Therefore, (Equation 1) In paragraph X2y2c ⁴ is the highest bit length (S703). Calculate remainder multiplication for the above items. At this time, the highest-order integer z [k / w] in the method Z of (Equation 8) is used as the remainder multiplication method. For example, in the algorithm 10, to X2y2c ⁴ is a highest order of the items, integers z2 is law modular multiplication (S704). Put together common items to organize whether each item can be calculated at once. In the case of the algorithm 10, the second term of the calculation of the first term of (formula 2) (Equation 1), and each integer q2, q3, q4, q5 to multiplicand the Z2c ^2, and the multiplicand and c ³ The integers r2, r3, r4, and r5 are grouped into q ′ and r ′, respectively (S705).
By transforming (Equation 8), the following equation is obtained.
z [k / w] = -Σ _{(i = 0)} ^{[k / w] -1} zic ⁱ (mod Z) (Equation 9)
Using (Equation 9), reduction processing is performed to reduce the order of items related to the quotient of the remainder multiplication calculated in S704. For example, in the case of the algorithm 10, the 6w bit integer q1z2c ⁴ is converted into a 5w bit integer q1z1c ³ and a 4w bit integer q1z0c ² from the second expression of the modified expression of x2y2c ⁴ (first term of expression 1). It is transformed using (Equation 9) (S706).

  If the maximum bit length of each item is substantially equal to or less than that for the bits of modulus Z, the process proceeds to S708, and if not, the process returns to S702 (S707).

  Sum the values of each item. If the total value is negative or greater than or equal to the modulo Z, addition / subtraction of the modulo Z is performed so that it is 0 or more and less than the modulo Z. For example, in the algorithm 10, the processing after (Expression 7) corresponds to this (S708).

  As in the first embodiment, three types of calculators are used: an MM calculator 101 that calculates a quotient and a remainder of a remainder multiplication, an ADD calculator 102 that calculates an addition, and a SUB calculator 103 that calculates a subtraction. 7 can be processed (including the above algorithm 10).

  Similar to the first embodiment, the remainder multiplication unit 3 in the block diagram schematically shown in FIG. 3 can execute the processing flow of FIG. 3 can be formed using a single semiconductor substrate such as a single crystal silicon substrate.

  Similarly to the first embodiment, the processing flow shown in FIG. 4 can be used to execute the processing flow shown in FIG. In addition, in the processing flow in FIG. 4, regardless of the calculation method of the modular multiplication in the MM computing unit 101, for example, instead of the assumed MM computing unit 101 that can calculate the quotient and remainder of the modular multiplication, for example, classical modular multiplication Alternatively, the MM calculator 101 that implements Montgomery multiplication may be used. The same calculation can be performed by using another arithmetic unit instead of the MM arithmetic unit 101. For example, an MM2 calculator 151 that outputs the remainder of the remainder multiplication as shown in FIG. Furthermore, when the MM calculator 101 can calculate not only the remainder multiplication but also addition and subtraction, the ADD calculator 102 and the SUB calculator 103 need not be used, and the circuit scale of the remainder multiplication unit can be reduced. Further, instead of the MM calculator 101, a MU calculator 152 for calculating multiplication and a DIV calculator 153 for calculating division may be used. In particular, as in the first embodiment, when multiplication can be calculated in addition to remainder multiplication, multiplication may be calculated instead of remainder multiplication. Further, instead of using the computing unit, each computation result may be written in the memory in advance, and the memory value may be appropriately referred to from the input value to obtain the computation result.

  As in the first embodiment, in the microcomputer shown in the block diagram schematically shown in FIG. 6, the process flow in FIG. 4 can be executed. The microcomputer 601 illustrated in FIG. 6 can be formed using a single semiconductor substrate such as a single crystal silicon substrate. Furthermore, the microcomputer 601 shown in FIG. 6 is an example of implementation, and can be implemented in other devices such as an RFID, a PDA, and a mobile phone.

  In the cryptographic algorithm, there are cases where iterative modular multiplication is processed, such as RSA cryptography that requires exponentiation modular multiplication. FIG. 8 shows an outline of a processing flow of the microcomputer 601 provided with the remainder multiplication unit. The arithmetic function provided in the modular multiplication unit can be used repeatedly to cope with such modular multiplication. Note that the remainder multiplication calculation procedure is not particularly limited to the processing flow of FIG. For example, the processing from S801 to S805 in FIG. 8 is performed by the CPU 603, and the processing from S851 to S854 is performed by the modular multiplication unit, but the divisions in charge may be changed. For example, the remainder multiplication unit may be in charge of all processing.

  First, the CPU 603 designates data X, data Y, and data Z to be input to the remainder multiplication unit (S801). If the input data is already set in the remainder multiplication unit, the already set data may be omitted, and a variable necessary for the remainder multiplication operation, the bit length of the remainder multiplication, and the like are input by the remainder multiplication unit. It may be specified in the data. The value or address of the designated data (which may be a direct address or an address where data can be indirectly referenced) is notified from the CPU 603 to the remainder multiplication unit (D801). The remainder multiplication unit uses the designated data and sets the input value of the remainder multiplication (S851). The CPU 603 transmits a control signal instructing the remainder multiplication unit to start computation (S802). If there is a variable necessary for starting the computation of the remainder multiplication, it may be transmitted to the remainder multiplication unit in S802. The control signal indicating the start of calculation is notified from the CPU 603 to the remainder multiplication unit (D802). When the remainder multiplication unit receives the control signal, the remainder multiplication unit calculates a remainder multiplication (S852). While the remainder multiplication unit is calculating the remainder multiplication, the CPU 603 waits for the computation of the remainder multiplication unit to finish or executes another computation (S803). The remainder multiplication unit outputs remainder multiplication (S853). The remainder multiplication unit notifies the CPU 603 of the end of calculation (S854). When an error occurs in the calculation process or output process of the remainder multiplication unit, a signal indicating the error may be transmitted to the CPU 603 in S854 (D803). The CPU 603 receives the signal and confirms the end of the calculation (S804). When a signal indicating an error is received, the CPU 603 confirms the occurrence of an error in the calculation process. Through the above process, the CPU 603 and the remainder multiplication unit can calculate the quotient and remainder of the remainder multiplication or the remainder of the remainder multiplication. The CPU 603 determines whether or not to repeat the process according to an algorithm for performing power-residue multiplication (S806). If the above process is repeated, the process returns to S801, and if not repeated, the process ends.

  The above procedure is a case of calculating the remainder of remainder multiplication, or the quotient and remainder of remainder multiplication, but the same applies to the case of performing other operations such as addition and subtraction. Control signals may be transmitted and received via the system bus 300.

  Although the invention made by the present inventor has been specifically described based on the embodiments, it is needless to say that the present invention is not limited thereto and can be variously modified without departing from the gist thereof. The present invention can be widely applied not only to an IC card, but also to various embedded devices having an encryption function and arithmetic units used for information security technology.

FIG. 1 is an explanatory diagram showing an arithmetic unit that a remainder multiplication unit may or may have in Embodiment 1 of the present invention. FIG. 2 is a flowchart showing an outline of the processing flow in the first embodiment of the present invention. FIG. 3 is a block diagram illustrating a configuration of a modular multiplication unit capable of executing the processing flow shown in FIG. 2 in Embodiment 1 of the present invention. FIG. 4 is a flowchart illustrating a data processing procedure for executing the processing flow shown in FIG. 2 in the first embodiment of the present invention. FIG. 5 shows an example of a register value in the control register 307 in the remainder multiplication unit, an example of a transmission procedure of the management register 304 and the accumulator 312 in the remainder multiplication unit, and step 1 and step of algorithm 3 in Embodiment 2 of the present invention. FIG. 6 is an explanatory diagram showing a quotient of remainder multiplication and a corresponding portion of the remainder from the result of multiplication when performing multiplication instead of remainder multiplication in FIG. FIG. 6 is a block diagram illustrating a configuration of a microcomputer 601 capable of executing the algorithm 3 for calculating the quotient and the remainder of the remainder multiplication unit. FIG. 7 is a flowchart illustrating a processing flow for calculating a remainder multiplication with a bit length that is an integral multiple of the bit length that can be calculated at one time by an arithmetic unit that can calculate the remainder multiplication. FIG. 8 is a flowchart schematically showing a data processing flow of the microcomputer 601 provided with the remainder multiplication unit.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 MM computing unit 102 ADD computing unit 103 SUB computing unit 152 MM2 computing unit 152 MU computing unit 153 DIV computing unit 301 Clock generator 302 Input / output port 303 Control circuit 305 Program memory 305
304 Management Register 306 Memory for Data Storage 307 Control Register 308 Selector 601 Microcomputer 602 Clock Generator 603 CPU
604 I / O port 605 ROM
606 RAM
607 EEPROM

Claims (15)

An arithmetic unit and a control unit for remainder multiplication;
The arithmetic unit performs a modular multiplication operation,
The control unit recursively repeats the arithmetic operation of the remainder multiplication a plurality of times, from the remainder and quotient of w bits (where w is a positive integer representing the number of bits of the operation value) , the quotient of 2w bit remainder multiplication. When calculating the remainder, the data processing device performs control to distribute the remainder and the quotient of the w-bit remainder multiplication obtained in the previous remainder multiplication computation process to the next remainder multiplication computation process. An arithmetic unit and a control unit for remainder multiplication;
In the arithmetic unit, w is a positive integer representing the number of bits of the arithmetic value,
x, y, z is a w-bit non-negative integer satisfying 0 ≦ x, y, z <2 ^w ,
2w bit non-negative integer satisfying X, Y, Z 0 ≦ X, Y, Z <2 ^2w ,
When m and n are non-negative integers,
An arithmetic process for outputting an integer q and an integer r satisfying an arithmetic expression xy = qz + r2 ⁿ is performed,
When the control unit recursively repeats the arithmetic processing, the control unit obtains the integer q and the integer r that are output from the remainder multiplication dedicated unit, an integer Q and an integer R that satisfy a multiplication arithmetic expression XY = QZ + R2 ^2m. A data processing apparatus that controls processing to be distributed to the next arithmetic processing to obtain.   The data processing apparatus according to claim 2, wherein the arithmetic unit includes a remainder multiplier, an adder, and a subtracter. The arithmetic unit includes a data memory,
An accumulator,
A selector that selects a data path from the data memory or the accumulator to the remainder multiplier, the adder, or the subtractor;
The data processing apparatus according to claim 3, wherein the accumulator accumulates outputs of the remainder multiplier, the adder, or the subtracter, and outputs the accumulated data to a selector or a data memory. The control unit includes a program memory that holds an arithmetic control program that describes the procedure of the processing;
The data processing apparatus according to claim 2, further comprising: a control circuit that decodes a calculation instruction read from the program memory and generates a control signal for causing the calculation unit to execute the calculation process.   The data processing apparatus according to claim 2, further comprising: a central processing unit that gives an instruction of a remainder multiplication process for encryption or decryption to the control unit, and formed on one semiconductor substrate. A RAM disposed in the address space of the central processing unit;
The control unit is possible and the use Iruko the RAM as a work memory of the arithmetic unit, the data processing apparatus according to claim 6, wherein. An arithmetic unit and a control unit for remainder multiplication;
The arithmetic unit performs a modular multiplication operation,
The control unit calculates a quotient and a remainder of a kw bit (k> 2) remainder multiplication from a remainder and a quotient of a remainder multiplication of a remainder multiplication of w bits (w is a positive integer representing the number of bits of an operation value ). A data processing device that causes the arithmetic unit to execute a division operation process for dividing kw-bit multiplication into w-bit multiplication and a reduction process for calculating a remainder multiplication from the product of the divided multiplications.   A data processing method executed by a data processing apparatus having a calculation unit and a control unit for remainder multiplication,
  Arithmetic processing of remainder multiplication by the arithmetic unit;
  The arithmetic operation of the remainder multiplication executed by the control unit is recursively repeated a plurality of times, and the 2w bit is obtained from the remainder and quotient of w bits (where w is a positive integer representing the number of bits of the operation value). A data processing method, comprising: calculating a quotient and a remainder of a remainder multiplication and allocating a remainder and a quotient of a w-bit remainder multiplication obtained by a previous remainder multiplication operation process to a next remainder multiplication operation process.   A data processing method executed by a data processing apparatus having a calculation unit and a control unit for remainder multiplication,
  w is a positive integer representing the number of bits of the operation value,
  x, y, z 0 ≦ x, y, z <2 ^w W-bit non-negative integer that satisfies
  X, Y, Z is 0 ≦ X, Y, Z <2 ^2w 2w bit non-negative integer that satisfies
  When m and n are non-negative integers,
  Remainder multiplication expression xy = qz + r2 executed by the calculation unit ⁿ Arithmetic processing for outputting an integer q and an integer r satisfying
  When the arithmetic processing executed by the control unit is recursively repeated, the integer q and the integer r output from the remainder multiplication dedicated unit are multiplied by an arithmetic expression XY = QZ + R2 ^2m A data processing method including an integer Q satisfying the above and a control for processing to distribute to the next arithmetic processing for obtaining the integer R.   The data processing method according to claim 10, wherein the arithmetic unit includes a remainder multiplier, an adder, and a subtracter.   The arithmetic unit includes a data memory,
  An accumulator,
  A selector that selects a data path from the data memory or the accumulator to the remainder multiplier, the adder, or the subtractor;
  The data processing method according to claim 11, wherein the accumulator accumulates outputs of the remainder multiplier, the adder, or the subtracter, and outputs the accumulated data to a selector or a data memory.   The control unit includes a program memory that holds an arithmetic control program that describes the procedure of the processing;
  The data processing method according to claim 10, further comprising: a control circuit that decodes a calculation instruction read from the program memory and generates a control signal for causing the calculation unit to execute the calculation process.   The data processing method according to claim 10, further comprising: a central processing unit that gives an instruction of a remainder multiplication process for encryption or decryption to the control unit, and formed on one semiconductor substrate.   A RAM disposed in the address space of the central processing unit;
  The data processing method according to claim 14, wherein the control unit can use the RAM as a work memory of the arithmetic unit.

Images