JP5896756B2 - Arithmetic apparatus and program - Google Patents

Description

The present invention relates to a calculation device, a calculation method, and a program.
In particular, the present invention relates to an arithmetic device and a program for performing addition, subtraction, multiplication, Montgomery reduction, and Montgomery multiplication of multiple-precision integers used in RSA (registered trademark) encryption, elliptic curve encryption, and the like.

Many public key ciphers, including RSA (registered trademark) ciphers, perform operations on a finite field modulo a certain odd integer.
At this time, it is necessary to perform an operation on a number exceeding a data length (for example, 32 bits) that can be calculated by a general CPU (Central Processing Unit).
In particular, the multiple multiplication requires a calculation amount of O (n ² ) for n = 1 / b when the CPU internal calculation width is b (bit) and the input length is l (bit). This is one of the heavy processing among multiple length calculations.

On the other hand, Montgomery transformation is applied to the input, and the data after Montgomery transformation is subjected to processing called multiple-precision multiplication and Montgomery reduction, thereby avoiding high-cost division and remainder calculation. It is shown.
In addition, multiple length multiplication and Montgomery reduction are often performed in pairs, and these are collectively called Montgomery multiplication.
Usually, Montgomery reduction also requires O (n ² ).
In order to speed up public key cryptography, it is necessary to speed up these processes.

  As a method for speeding up multiplication and Montgomery reduction, devices for speeding up by using dedicated hardware or converting input have been proposed (for example, Patent Document 1, Patent Document 2, Patent Document) 3, Patent Document 4).

JP-A 63-28893 JP 2000-10479 A JP 2000-353077 A JP 2001-194993 A

According to Patent Document 1 and Patent Document 3, multiple-length arithmetic is accelerated using a computer having a dedicated processor architecture or memory architecture.
However, in order to realize the methods of Patent Document 1 and Patent Document 3, a dedicated device is required.

According to Patent Document 2, positive integers C and p are input, the bit length when p is expressed in binary is L, and R defined as R = ²ⁿ using an integer n where n ≧ L. In calculating D = C · R ⁻¹ mod p, an integer pair (α, β) satisfying C = αR + β is calculated (α, β), and R ⁻¹ = ε (mod p) is satisfied. ε is obtained, α + εβ is calculated, and congruent residue values less than or equal to p are obtained by using p as the modulus.
However, in the case of this method, it is necessary to perform multiple-length residue calculation by the modulus p, and the calculation cost is required for the residue calculation.

According to Patent Document 4, the input is converted into a residue number system, and Montgomery listing calculation is realized on the converted system, thereby achieving parallel processing and realizing high speed.
However, in this method, the base extension requires a calculation cost, and it is necessary to perform an integer remainder calculation.
Compared to other operations, a processor with a slow remainder calculation costs more.

  The main object of the present invention is to solve the above-mentioned problems, and it is a main object of the present invention to realize a multiple-length operation at a high speed with a low calculation cost without using a dedicated device.

The arithmetic device according to the present invention is:
An arithmetic device that includes a control unit, a calculation unit, and a storage unit, and performs addition of input values,
The controller is
The respective bit widths are common, and the input value X and the input value Y, each of which is larger than the calculation bit width of the calculation unit, are divided for each calculation bit width of the calculation unit,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n (n ≧ 2) divided values divided from the input value X; , N variables Y [0] to Y [n−1] for storing n divided values divided from the input value Y are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
U (u> n) variables Z [0] to Z [u−1] for allocating a predetermined storage area in the storage unit and storing the addition result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
In the thread t where the thread number = t (t is one of “0 to n−1”), as the first phase process,
Using the value of the t-th variable X [t] of the input value X and the value of the t-th variable Y [t] of the input value Y, the value of (X [t]) + (Y [t] Value), obtain the addition result and carry value c, and store the addition result in the t-th variable Z [t],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t that are not stopped until the counter value i reaches n or all the threads t stop the processing of the second phase, the counter value i is incremented,
The computing unit is
Each time the counter value i is incremented by the control unit, in the thread t that has not been stopped, as processing for one round of the second phase,
<a> Using the value of the (t + i) th variable Z [t + i] and the carry value c obtained in the thread t, (Z [t + i] value) + c is calculated, and a new addition result and a new value are calculated. Obtain carry value c,
<B> The value of the variable Z [t + i] is compared with the new addition result, and if the two match, the second phase processing of the thread t is stopped, and if both do not match, a new The addition result is stored in the (t + i) -th variable Z [t + i].

In the present invention, the addition of each divided value is completed once as the first phase process, and then the carry value process is performed as the second phase.
Normally, the carry value processing is completed in several rounds, so the second phase processing is completed early in all threads t, and the addition processing can be performed at high speed.
As described above, according to the present invention, multiple length arithmetic can be realized at high speed with low calculation cost without using a dedicated device.

The figure which shows the structural example of the multiple length arithmetic unit which concerns on Embodiment 1-5. FIG. 3 is a flowchart showing a procedure of multiple length addition according to the first embodiment. FIG. 6 shows a specific example of multiple length addition according to the first embodiment. FIG. 6 shows a calculation process of multiple length addition according to the first embodiment. FIG. 9 is a flowchart showing a procedure of multiple length subtraction according to the second embodiment. FIG. 10 shows a specific example of multiple length subtraction according to the second embodiment. The figure which shows the calculation process of the multiple length subtraction which concerns on Embodiment 2. FIG. FIG. 9 is a flowchart showing a procedure for multiple-length multiplication according to the third embodiment. FIG. 10 is a diagram illustrating a specific example of multiple length multiplication according to the third embodiment. FIG. 10 is a diagram illustrating a specific example of multiple length multiplication according to the third embodiment. FIG. 10 is a diagram showing a calculation process of multiple length multiplication according to the third embodiment. FIG. 10 is a diagram showing a calculation process of multiple length multiplication according to the third embodiment. The flowchart figure which shows the procedure of Montgomery reduction which concerns on Embodiment 4. FIG. FIG. 10 is a diagram illustrating a specific example of Montgomery reduction according to the fourth embodiment. FIG. 10 is a diagram illustrating a specific example of Montgomery reduction according to the fourth embodiment. The figure which shows the calculation process of the Montgomery reduction which concerns on Embodiment 4. FIG. The figure which shows the calculation process of the Montgomery reduction which concerns on Embodiment 4. FIG. FIG. 10 is a flowchart showing a procedure of Montgomery multiplication according to the fifth embodiment. FIG. 10 shows a specific example of Montgomery multiplication according to the fifth embodiment. FIG. 10 shows a specific example of Montgomery multiplication according to the fifth embodiment. FIG. 10 is a diagram illustrating a calculation process of Montgomery multiplication according to the fifth embodiment. FIG. 10 is a diagram illustrating a calculation process of Montgomery multiplication according to the fifth embodiment.

In the first to fifth embodiments, a multiple length arithmetic device that realizes multiple length arithmetic at high speed will be described.
In the first to fifth embodiments, as an example, a multiple length arithmetic apparatus using a SIMD (Single Instruction Multiple Data) calculator will be described.
In addition, the multiple length arithmetic devices according to Embodiments 1 to 5 can also be realized using a generally available GPU (Graphics Processing Unit).

Embodiment 1 FIG.
FIG. 1 is a block diagram illustrating a configuration example of a multiple length arithmetic apparatus 100 according to Embodiments 1 to 5.
The multiple length arithmetic apparatus 100 according to Embodiments 1 to 5 has a configuration in which a calculation unit 101, a memory 102, and a communication port 103 are connected by a bus 104.
Note that the multiple length arithmetic device 100 according to Embodiments 1 to 5 corresponds to an example of an arithmetic device.

  The calculation unit 101 includes a plurality of processors 105 to 106, an instruction decoder 107, and registers 108 and 109.

The processors 105 to 106 execute the instruction decoded by the instruction decoder 107 on different data.
Any one of the processors 105 to 106 has a role as a control unit that performs control necessary when performing multiple-length arithmetic.
In addition, any one of the processors 105 to 106 or all of the processors 105 to 106 has a role as an arithmetic unit that performs a calculation process of multiple length arithmetic.
A processor that functions as a control unit may function together as a calculation unit.
Details of processing performed by the processors 105 to 106 as the control unit and details of processing performed as the calculation unit will be described later.
The processor functioning as a calculation unit performs a calculation with a predetermined calculation width b bits (for example, 32 bits).
Hereinafter, b bits of the operation width are referred to as one word.
Hereinafter, a processor that functions as a control unit is also simply referred to as a “control unit”, and a processor that functions as a calculation unit is also simply referred to as a “calculation unit”.

Data is stored in the general register 108.
Data is exchanged between processors via the memory 102.
The special register 109 is a register that stores special information other than the calculated values of the processors 105 to 106.
The general-purpose register 108 and the memory 102 correspond to an example of a storage unit.

A unit of a program executed by each processor is called a thread.
One of the features of the multiple length arithmetic apparatus 100 according to Embodiments 1 to 5 is that one multiple length calculation is performed using a plurality of threads.
The number of threads n (n ≧ 2) is n ≧ ceil (l / b) when the input value is l (l> b) bits.
Here, ceil (a) is the smallest integer of integers greater than or equal to a.
A thread number of 0 or more and (n-1) or less is assigned to a thread executed by each processor.
The processors 105 to 106 can acquire the number of threads and the number of threads processed by each processor from the special register 109.

As shown in FIG. 1, the multiple-length arithmetic device 100 according to Embodiments 1 to 5 includes processors 105 and 106, registers 108 and 109, a memory 102 (for example, a RAM (Random Access Memory)), a communication port 103, A general computer including the bus 104 can be used.
Although not shown in FIG. 1, the multiple length arithmetic unit 100 includes a nonvolatile storage device typified by a magnetic disk device.
A computer program and an operating system for realizing later-described operations of the control unit and the calculation unit are stored in a nonvolatile storage device.
At least a part of the computer program for realizing the operations of the control unit and the calculation unit may be included in the operating system.
The processors 105 and 106 load the computer program for realizing the operations of the control unit and the calculation unit into the memory 102 while operating the operating system, and read and execute the computer program from the memory 102. Thus, it functions as a control unit and a calculation unit.
Further, the operation procedure of the multiple length arithmetic apparatus 10 can be regarded as an arithmetic method.

  Next, an outline of the operation of the calculation unit 101 according to the present embodiment will be described.

In the present embodiment, the addition result (X + Y) of the input value X and the input value Y is output to the variable Z.
Both the input value X and the input value Y are l (l> b) bits.
That is, the bit width (1 bit) between the input value X and the input value Y is larger than b bits, which is one word of each processor.

In the present embodiment, the control unit divides the input value X and the input value Y into n digits.
The control unit also stores n variables X [0] to X [n−1] for storing n divided values divided from the input value X and n pieces of divided values from the input value Y. N variables Y [0] to Y [n−1] for storing the division value are provided in any storage area (for example, the memory 102).
Further, the control unit stores the divided value including the least significant bit in the input value X in the 0th variable X [0], and the divided value including the most significant bit as the (n−1) th variable X. N division values are stored in variables X [0] to X [n−1] so as to be stored in [n−1].
Similarly, the control unit stores the divided value including the least significant bit in the input value Y in the 0th variable Y [0], and the divided value including the most significant bit is the (n−1) th variable. The n divided values are stored in variables Y [0] to Y [n-1] so as to be stored in Y [n-1].
Further, u (u> n) variables Z [0] to Z [u−1] for storing the addition result by the calculation unit are provided in any storage area (for example, the memory 102).
The number of variables Z can be any number as long as it is greater than or equal to n. In the following, 2n variables Z, that is, variables Z [0] to Z [2n-1] are provided (variables). The description proceeds with an example in which Z has a size of 2n words.

The arithmetic unit executes n threads in which “0 to n−1” is set as the thread number in parallel.
The processing of the computing unit is roughly divided into a first phase process and a second phase process.

  In the thread t with thread number = t (t is any one of “0 to n−1”), the arithmetic unit, as the first phase process, sets the t-th variable X [t] of the input value X. (X [t] value) + (Y [t] value) is calculated using the value and the value of the t-th variable Y [t] of the input value Y, and the addition result and the carry value c are calculated. The addition result is stored in the t-th variable Z [t].

Next, the control unit sets the counter value i to 1, and causes the calculation unit to start the second phase process.
Then, every time the processing of one round of the second phase is completed in all the threads t that are not stopped, until the counter value i reaches n or all the threads t stop the processing of the second phase, The control unit increments the counter value i.

Each time the counter value i is incremented by the control unit, the arithmetic unit repeats the process for one round of the second phase in the thread t that is not stopped.
The processing for one round of the second phase is the following processing <a> and <b>.
<a> Using the value of the (t + i) th variable Z [t + i] and the carry value c obtained in the thread t, (Z [t + i] value) + c is calculated, and a new addition result and a new value are calculated. A carry value c is obtained.
<B> The value of the variable Z [t + i] is compared with the new addition result, and if the two match, the second phase processing of the thread t is stopped, and if both do not match, a new The addition result is stored in the (t + i) th variable Z [t + i].

Next, with reference to the flowchart of FIG. 2, the procedure in the case of performing multiple length addition in the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In FIG. 2, variables indicated by uppercase letters are data on the memory 102, and variables indicated by lowercase letters are data on the general-purpose register 108.
The data length of each variable is 1 word.
If the input value ceil (l / b) word is less than n, the word of the lesser part is cleared to 0 in advance.

  First, the calculation unit obtains the number of threads to be calculated with its own thread number for each thread from the general-purpose register 108 (S201).

Next, the arithmetic unit clears the upper n digits of the output Z to zero, calculates the addition of X and Y for each thread, stores the added value in the lower n digits of Z, and the control unit sets 1 to the variable (counter value) i. Is set (S202).
Here, Add_cc (a, b) means that the result of a + b is output to the general-purpose register 108 and the carry value is output to the special register 109 for one-word inputs a and b.
The process 2 and the process 3 of S202 illustrated in FIG. 2 correspond to the first phase process.

When i is less than n, the calculation unit reads the value of Z [t + i] and adds 0 (S203).
Here, Addc_cc (a, b) adds a and b and the carry value of the special register 109 to the input a and b of one word, and outputs the addition result to the general-purpose register 108. This means that the value is output to the special register 109.

If there is no change in the value before and after the addition (YES when s == a?), The calculation unit considers the carry value to be 0 and ends the processing of the thread t.
If there is a change (NO when s == a?), The calculation unit outputs the addition result to Z [t + i], and the control unit adds 1 to i (S204).
S203 and S204 are repeated until the carry value becomes 0 (that is, when s == a? Becomes YES) or i becomes n.
When all n threads have exited the loop, the process is terminated.
Process 1 and process 2 of S203 shown in FIG. 2, s == a? The process 1 of S204 corresponds to the process for one round of the second phase.

FIG. 3 shows a change in value in the multiple length addition according to the present embodiment.
FIG. 3 shows a case where the internal calculation width is a decimal number and a 4-digit calculation is executed by four threads (thread numbers 0 to 3) in order to facilitate understanding of the contents. FIG. 3 shows an example in which 1234 (X) +5678 (Y) = 6912 (Z) is calculated.
FIG. 4 shows the breakdown of the calculation shown in FIG.

Next, the effect of the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In the present embodiment, addition of each digit is completed once, and then carry processing is performed.
The worst case of carry processing is O (n), but if the input is random, the probability of the carry remaining to the end is very low, so it is possible to exit the loop of FIG. 2 with several carry calculations. Therefore, the addition process can be performed at high speed.
Further, by comparing the values before and after the carry addition, the presence / absence of carry can be determined even if the carry information cannot be directly referred to.
In addition, as described above, the multiple length arithmetic device 100 according to the present embodiment can be realized by a normal computer such as a SIMD computer, and can perform multiple length addition at high speed without using a dedicated device. Can do.

As described above, in the present embodiment,
A multiple-precision integer arithmetic unit comprising a plurality of processors, a computer capable of executing a single instruction simultaneously on a plurality of data, and a memory for storing data and simultaneously accessible by the processor, wherein the input X , Y, a multiple-precision integer arithmetic unit that executes multiple-precision addition for calculating Z = X + Y in the following steps has been described.
1. 1. A step of dividing input data into a plurality of digits (hereinafter referred to as X [n] and Y [n], respectively) for each internal calculation width of the computer. 2. Obtaining the number n of threads to be calculated with its own thread number t for each thread 3. Set Z to 0 4. Calculate X [t] + Y [t], obtain the addition result and carry c, and store the addition result in Z [t] 5. Set digit i to 1 6. Calculate Z [t + i] + c, obtain a new addition result and a new carry c, and store the addition result in Z [t + i] 7. Add 1 to digit i 8. Steps 6-7 are executed while i <n and c ≠ 0 Waiting for all of the threads to complete steps 6-8.

Embodiment 2. FIG.
In the present embodiment, multiple length subtraction processing is performed.
The configuration of the multiple length arithmetic apparatus 100 according to the present embodiment is the same as that shown in FIG.

  Next, an outline of the operation of the calculation unit 101 according to the present embodiment will be described.

In the present embodiment, a subtraction result (Y−X) obtained by subtracting the input value X from the input value Y is output to the variable Z.
As in the first embodiment, in this embodiment, the bit width of the input value X and the input value Y is l (l> b) bits, and the control unit sets the input value X and the input value Y to n. Dividing into digits, variables X [0] to X [n-1] and variables Y [0] to Y [n-1] are provided, and variables Z [0] to Z [2n-1] are further provided. .
In the present embodiment, the number of variables Z can be set to an arbitrary number as long as it is n or more, but 2n variables Z are provided as in the first embodiment (the size of the variable Z is 2n words). The explanation will proceed with an example.
Further, the procedure for the control unit to store the divided values in X [0] to X [n-1] and the procedure for storing in Y [0] to Y [n-1] are the same as in the first embodiment.
Further, as in the first embodiment, the arithmetic unit also executes n threads in parallel to perform the first phase process and the second phase process.

  In the present embodiment, as the processing of the first phase, the arithmetic unit performs processing of the t-th variable X [t] of the input value X and the t-th variable Y [t] of the input value Y in the thread t. Using the value, (Y [t] value) − (X [t] value) is calculated, the subtraction result and the borrow value d are obtained, and the subtraction result is stored in the t-th variable Z [t]. .

Next, the control unit sets the counter value i to 1, and causes the calculation unit to start the second phase process.
Then, every time the processing of one round of the second phase is completed in all the threads t that are not stopped, until the counter value i reaches n or all the threads t stop the processing of the second phase, The control unit increments the counter value i.

Each time the counter value i is incremented by the control unit, the arithmetic unit repeats the process for one round of the second phase in the thread t that is not stopped.
The processing for one round of the second phase is the following processing <a> and <b>.
<a> Using the value of the (t + i) th variable Z [t + i] and the borrow value d obtained in the thread t, (Z [t + i] value) −d is calculated, and the new subtraction result and the new value are calculated. The borrow value d is determined.
<B> The value of the variable Z [t + i] is compared with the new subtraction result, and if the two match, the second phase processing of the thread t is stopped, and if both do not match, a new The subtraction result is stored in the (t + i) th variable Z [t + i].

Next, with reference to the flowchart of FIG. 5, the procedure in the case of performing multiple length subtraction in the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In FIG. 5, variables indicated by uppercase letters are data on the memory 102, and variables indicated by lowercase letters are data on the general-purpose register 108.
The data length of each variable is 1 word.
When the input value ceil (l / b) word is less than n, the word of the lesser part is cleared to 0 in advance.

  First, the calculation unit obtains the number of threads to be calculated with its own thread number for each thread from the general-purpose register 108 (S401).

Next, the arithmetic unit clears the upper n digits of the output Z to zero, obtains the subtraction of Y and X for each thread, stores the subtraction value in the lower n digits of Z, and the control unit sets 1 to the variable (counter value) i. Is set (S402).
Here, Sub_cc (a, b) means that for one word input a, b, the result of ba is output to the general register 108 and the borrow value is output to the special register.
Process 2 and process 3 of S402 shown in FIG. 5 correspond to the process of the first phase.

When i is less than n, the arithmetic unit reads the value of Z [t + i] and performs subtraction with 0 (S403).
Here, Subc_cc (a, b) subtracts the borrow value of a and the special register 109 from b for one word input a and b, outputs the subtraction result to the general-purpose register 108, and sets the borrow value to the special register. Means output to 109.

If there is no change in the value before and after subtraction (YES when s == a?), The calculation unit assumes that the borrow value is 0, and ends the processing of thread t.
If there is a change (NO at s == a?), The calculation unit outputs the subtraction result to Z [t + i], and the control unit adds 1 to i (S404).
S403 and S404 are repeated until the borrow value becomes 0 (that is, when s == a? Becomes YES) or i becomes n.
When all n threads have exited the loop, the process is terminated.
Process 1 and process 2 of S403 shown in FIG. 5, s == a? The process 1 of S404 corresponds to the process for one round of the second phase.

FIG. 6 shows a change in value in the multiple length subtraction according to the present embodiment.
FIG. 6 shows a case where the internal operation width is a decimal number and a 4-digit operation is executed by four threads (thread numbers 0 to 3) in order to facilitate understanding of the contents. FIG. 6 shows an example in which 7634 (Y) −5678 (X) = 1957 (Z) is calculated.
FIG. 7 shows a breakdown of the calculation shown in FIG.

Next, the effect of the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In the present embodiment, subtraction of each digit is completed once, and then borrow processing is performed.
The worst case of borrow processing is O (n), but if the input is random, the probability that the borrow will remain until the end is very low, so it is possible to exit the loop of FIG. 5 with several borrow calculations. .
Therefore, the subtraction process can be performed at high speed.
Also, by comparing the values before and after borrow subtraction, it is possible to determine whether or not there is a borrow even if the borrow information cannot be directly referenced.
In addition, as described above, the multiple length arithmetic apparatus 100 according to the present embodiment can be realized by a normal computer such as a SIMD computer, and can perform multiple length subtraction at high speed without using a dedicated device. Can do.

As described above, in the present embodiment,
A multiple-precision integer arithmetic unit comprising a plurality of processors, a computer capable of executing a single instruction simultaneously on a plurality of data, and a memory for storing data and simultaneously accessible by the processor, wherein the input X , Y, a multiple-precision integer arithmetic unit that executes multiple-precision subtraction for calculating Z = Y−X in the following steps has been described.
1. 1. A step of dividing input data into a plurality of digits (hereinafter referred to as X [n] and Y [n], respectively) for each internal calculation width of the computer. 2. Obtaining the number n of threads to be calculated with its own thread number t for each thread 3. Set Z to 0 4. Calculate Y [t] -X [t], obtain the subtraction result and borrow d, and store the subtraction result in Z [t] 5. Set digit i to 1 6. Calculate Z [t + i] -c, obtain a new subtraction result and a new borrow d, and store the subtraction result in Z [t + i] 7. Add 1 to digit i 8. Steps 6-7 are executed while i <n and c ≠ 0 Waiting for all of the threads to complete steps 6-8.

Embodiment 3 FIG.
In the present embodiment, multiple length multiplication processing is performed.
The configuration of the multiple length arithmetic apparatus 100 according to the present embodiment is the same as that shown in FIG.

  Next, an outline of the operation of the calculation unit 101 according to the present embodiment will be described.

In the present embodiment, the multiplication result (X × Y) obtained by multiplying the input value X and the input value Y is output to the variable Z.
As in the first embodiment, in this embodiment, the bit width of the input value X and the input value Y is l (l> b) bits, and the control unit sets the input value X and the input value Y to n. Dividing into digits, variables X [0] to X [n-1] and variables Y [0] to Y [n-1] are provided, and variables Z [0] to Z [2n-1] are further provided. .
Further, the procedure for the control unit to store the divided values in X [0] to X [n-1] and the procedure for storing in Y [0] to Y [n-1] are the same as in the first embodiment.
Further, as in the first embodiment, the arithmetic unit also executes n threads in parallel to perform the first phase process and the second phase process.

In the present embodiment, first, the control unit sets the counter value i to 0, and causes the calculation unit to start the first phase process.
In addition, the control unit increments the counter value i every time the arithmetic unit finishes processing for one round of the first phase until the counter value i reaches n.

The arithmetic unit repeats the processing for one round of the first phase in the thread t every time the counter value i is incremented by the control unit until the counter value i reaches n.
The processing for one round of the first phase is the following <1-a> and <1-b> processing.
<1-a> The value of the t-th variable X [t] of the input value X, the value of the i-th variable Y [i] of the input value Y, the value of the (t + i) -th variable Z [t + i] Then, (X [t] value) × (Y [i] value) + (Z [t + i] value) + c is calculated using the carry component value c obtained in the thread t.
<1-b> The value of the lower 1 word of the calculation result is stored in the (t + i) th variable Z [t + i], and the value of the upper 1 word of the calculation result is set as a new carry component value c.

Next, when the counter value i reaches n, the control unit causes the calculation unit to start the second phase process.
Then, the control unit increments the counter value i every time the arithmetic unit finishes processing for one round of the second phase until the counter value i reaches 2n.

The arithmetic unit repeats the process for one round of the second phase in the thread t that is not stopped each time the counter value i is incremented by the control unit until the counter value i reaches 2n.
The processing for one round of the second phase is the following <2-a> and <2-b> processing.
<2-a> It is determined whether or not the carry component value c obtained by the thread t is 0. When the carry component value c is 0, the processing of the second phase of the thread t is stopped.
<2-b> If not 0 (value of Z [t + i]) + c, the value of the lower 1 word of the calculation result is set as the new value of the variable Z [t + i], and the value of the upper 1 word of the calculation result Is a new carry component value c.

Next, with reference to the flowchart of FIG. 8, the procedure in the case of performing multiple-precision multiplication in the multiple-precision arithmetic apparatus 100 according to the present embodiment will be described.
In FIG. 8, variables indicated by uppercase letters are data on the memory 102, and variables indicated by lowercase letters are data on the general-purpose register 108.
The data length of each variable is 1 word.
However, the variable written in bold in FIG. 8 is 2 words.
In the specification, a 2-word variable is expressed by double quotation (for example, “m”).
If the input value ceil (l / b) word is less than n, the word of the lesser part is cleared to 0 in advance.

  First, the calculation unit obtains its own thread number and the number of threads to be calculated for each thread from the general-purpose register 108, sets Z and “c” to 0, and the control unit sets i to 0 ( S601).

When i is less than n, the arithmetic unit performs a multiplication process.
That is, the calculation unit calculates “m” = X [t] × Y [i] + Z [t + i] + “c”.
Further, the arithmetic unit outputs the lower 1 word of “m” to Z [t + i] and the upper 1 word to “c”.
Next, the control unit adds 1 to i (S602).
Here, Mul_w (a, b) means that the product of 1 word a and b is obtained and the multiplication result of 2 words is output.
Note that the processes 1 to 4 in S602 in FIG. 8 correspond to the process for one round of the first phase.

When i is greater than or equal to n, the arithmetic unit exits the multiplication process and performs a carry process.
That is, the calculation unit determines whether or not the carry component value “c” is 0, and when “c” is not 0 (“c” == 0 ?? NO), “c” = Z [t + i ] + “C” is calculated, and the lower 1 word of “c” is output to Z [t + i] and the upper 1 word is output to “c”.
Then, the control unit adds 1 to the variable i (S603).
The loop is repeated until i ≧ 2n or “c” = 0.
That is, every time the variable i is incremented by the control unit until the variable i reaches 2n, the computation unit sets the carry component value “c” obtained in the thread t to 0 in the thread t that is not stopped. When the carry component value “c” is 0 (YES when “c” == 0?), The processing of the thread t is stopped, and the carry component value “c” is not 0. (“C” == 0? NO) performs the process of S603.
When all n threads have exited the loop, the process is terminated.
In addition, processings 1 to 3 in S603 shown in FIG. 8, “c” == 0? This corresponds to processing for one round of the second phase.

9 and 10 show changes in values in the multiple-precision multiplication according to the present embodiment.
FIGS. 9 and 10 show a case where the internal calculation width is a decimal number and a four-digit calculation is executed by four threads (thread numbers 0 to 3) in order to facilitate understanding of the contents. 9 and 10 show an example in which 1234 (X) * 5678 (Y) = 70000662 (Z) is calculated.
In FIG. 10, in order to clarify the continuity with FIG. 9, the calculation process when i = 3 shown at the bottom of FIG. 9 is presented again.
11 and 12 show the breakdown of the calculation shown in FIGS. 9 and 10 for thread number 0. FIG.

Next, the effect of the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In the present embodiment, the multiplication process is completed in n loops.
In addition, one of the features of the multiple multiplication of the present embodiment is that carry addition processing is also performed during multiplication processing.

Regarding carry processing, if carry components remain after multiplication processing, addition is performed until the carry components become zero.
The worst case of carry processing is O (n). However, if the input is random, the probability that the carry will remain until the end is very low, so it is possible to exit the loop with several carry calculations.
Therefore, the multiple length multiplication process can be performed by n + α (α <n).
In addition, as described above, the multiple-precision arithmetic apparatus 100 according to the present embodiment can be realized by a normal computer such as a SIMD computer, and can perform multiple-precision multiplication at high speed without using a dedicated device. Can do.

As described above, in the present embodiment,
A multiple-precision integer arithmetic unit comprising a plurality of processors, a computer capable of executing a single instruction simultaneously on a plurality of data, and a memory for storing data and simultaneously accessible by the processor, wherein the input X , Y, a multiple-precision integer arithmetic unit that executes multiple-precision multiplication for calculating Z = XY in the following steps has been described.
1. 1. A step of dividing input data into a plurality of digits (hereinafter referred to as X [n] and Y [n], respectively) for each internal calculation width of the computer. 2. Set 0 to output Z, carry c, digit i 3. Calculate “m” = X [t] × Y [i] + Z [t + i] + c, and output the lower 1 word of “m” to Z [t + i] and the upper 1 word to c 4. Add 1 to digit i 5. Perform steps 3-4 while i <n 6. Calculate c = Z [t + i] + c, and output the lower 1 word of c to Z [t + i] and the upper 1 word to c 7. Add 1 to i 8. Steps 6-7 are executed while i <2n and c ≠ 0 Waiting for all of the threads to complete steps 6-8.

Embodiment 4 FIG.
In the present embodiment, multiple-length Montgomery reduction processing is performed.
The configuration of the multiple length arithmetic apparatus 100 according to the present embodiment is the same as that shown in FIG.

  Next, an outline of the operation of the calculation unit 101 according to the present embodiment will be described.

In the present embodiment, r = 2 ^b and R = r ⁿ are defined for the input value X and modulus M having a bit width larger than one word (b bits) which is the calculation bit width of the calculation unit. Montgomery reduction is performed to calculate (XR ⁻¹ mod M) using R and MINv defined as (−M ⁻¹ mod r). However, 0 ≦ X <MR.
In addition, said n is the division | segmentation number of the modulus M at the time of dividing the modulus M for every word, and it is n> = 2.
In the present embodiment, the number of divisions of the input value X when the input value X is divided for each word is 2n.

First, the control unit divides the input value X and the modulus M for each word.
In addition, the control unit stores 2n variables X [0] to X [2n−1] for storing 2n divided values divided from the input value X in any storage area (for example, the memory 102). ).
Further, the control unit stores the divided value including the least significant bit in the input value X in the 0th variable X [0], and the divided value including the most significant bit as the (2n−1) th variable X. 2n divided values are stored in variables X [0] to X [2n-1] so as to be stored in [2n-1].
Further, the control unit stores n variables M [0] to M [n−1] for storing n divided values divided from the modulus M in any storage area (for example, the memory 102). Is provided.
The control unit stores the division value including the least significant bit in the modulus M in the 0th variable M [0], and the division value including the most significant bit as the (n−1) th variable M [[ n divided values are stored in variables M [0] to M [n−1].
Further, the control unit provides n variables Z [0] to Z [n−1] for storing the calculation result by the calculation unit in any storage area (for example, the memory 102).

As in the first to third embodiments, the arithmetic unit executes n threads in which “0 to n−1” is set as the thread number in parallel.
The processing of the computing unit is roughly divided into first phase to fourth phase processing.

The calculation unit performs the following <1-a> and <1-b> processing as the first phase processing.
<1-a> In the thread t, using the value of the 0th variable X [0] of the input value X and MINv, (X [0] value) × MINv is calculated, and the calculation result of 2 words Let u be the value of the lower 1 word.
<1-b> In the thread t, using the value of the t-th variable M [t] of the modulus M, the value of the t-th variable X [t] of the input value X, and the u, (M [ t] value) × u + (X [t] value), the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the new value of the variable X [t]. The value of the upper one word of the result m is set as the carry component value c.
<1-c> In thread 0, which is the 0th thread, the value of the lower 1 word of carry component value c obtained in thread 0 is set as the new value of variable X [0].

Next, the control unit sets the counter value i to 1, and causes the calculation unit to start the second phase process.
The counter value i is incremented every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n.

The calculation unit repeats the process for one round of the second phase every time the counter value i is incremented by the control unit.
The processing for one round of the second phase is the following <2-a> and <2-b> processing.
<2-a> In the thread t, using the value of the 0th variable X [0] of the input value X, the value of the ith variable X [i], and MINv, the value of {(X [0] ) + (Value of X [i])} × MINv, and let u be the value of the lower 1 word of the 2-word calculation result.
<2-b> In the thread t, the value of the t-th variable M [t] of the modulus M, u, the value of the (t + i) -th variable X [t + i] of the input value X, and the thread t Using the obtained carry component value c, (M [t] value) × u + (X [t + i] value) + c is calculated, the calculation result of 2 words is m, and the lower 1 word of the calculation result m Is the new value of the variable X [t + i], and the value of the upper one word of the calculation result m is the new carry component value c.
<2-c> In the thread 0 as the 0th thread, the value of the lower 1 word of the carry component value c obtained in the thread 0 is set as a new value of the variable X [0].
When the counter value i reaches n, the arithmetic unit sets the value 0 as a new value of the variable X [0] in the thread 0.

Next, when the counter value i reaches n, the control unit causes the arithmetic unit to start the process of the third phase after the value 0 is changed to the new value of the variable X [0] in the thread 0.
Then, every time the processing for one round of the third phase is completed in all the threads t that are not stopped, until the counter value i reaches 2n or all the threads t stop the processing of the third phase, Increment the counter value i.

The arithmetic unit repeats the process for one round of the third phase in the thread t that is not stopped each time the counter value i is incremented by the control unit until the counter value i reaches 2n.
The processing for one round of the third phase is the following <3-a> and <3-b> processing.
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0. When the carry component value c is 0, the third phase processing of the thread t is stopped.
<3-b> When not 0, (X [(t + i) mod 2n] value) + c is calculated, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the variable X [(( t + i) mod 2n] as the new value, and the value of the upper one word of the calculation result m as the new carry component value c.

  When the counter value i reaches 2n, or when all the threads t stop the third phase process, the control unit causes the calculation unit to start the fourth phase process.

The calculation unit performs the following processing as the fourth phase processing.
The value of variable X [0] is stored in variable a, and the values of variables X [n] to X [2n-1] are stored in variables X [0] to X [n-1], respectively.
When the value of the variable a is not 0, or when the value obtained by concatenating the values of the variables X [n−1] to X [0] is not less than the modulus M, X−M is calculated, and the calculation result is the variable X [0] to X [n-1] are stored, and the values of the variables X [0] to X [n-1] are stored in the variables Z [0] to Z [n-1].

Next, a procedure when Montgomery reduction is performed by the multiple length arithmetic apparatus 100 according to the present embodiment will be described with reference to the flowchart of FIG.
In FIG. 13, the result XR ⁻¹ mod M of the Montgomery reduction of the input value X is output to the variable Z.
The input value X is divided into 2n digits, and calculation is performed using n threads.
The input value X satisfies the relationship X <M · R.
Here, the R = ^{r n,} and r = ^{2 b.}
Z has a size of n words.
MINv is a 1-word integer that satisfies −M ⁻¹ mod r.

In FIG. 13, variables indicated by uppercase letters are data on the memory 102, and variables indicated by lowercase letters are data on the general-purpose register 108.
The data length of each variable is 1 word.
However, the variable written in bold in FIG. 13 is 2 words.
In the specification, a 2-word variable is expressed by double quotation (for example, “m”).
If the input value ceil (l / b) word is less than n, the word of the lesser part is cleared to 0 in advance.

  First, the calculation unit obtains the thread number to be calculated for each thread from the general-purpose register 108, and the control unit sets 1 to the variable i (S801).

Next, Montgomery reduction processing is performed.
Specifically, the calculation unit obtains the lower 1 word u of X [0] × MINv and calculates “m” = M [t] × u + X [t].
Here, Mul_lo (a, b) means that a × b is calculated for one word input a, b, and the lower one word is output.
Then, the arithmetic unit outputs the lower 1 word of “m” to X [t] and outputs the upper 1 word to “c” (S802).
When the thread number is 0 (YES when t == 0?), The arithmetic unit outputs the lower 1 word of “c” to X [0] (S803).
Note that S802 and S803 in FIG. 13 correspond to the processing of the first phase.

When i is less than n, the arithmetic unit obtains the lower 1 word u of (X [0] + X [i]) × MINv and calculates “m” = M [t] × u + X [t + i] + “c” To do.
The arithmetic unit outputs the lower 1 word of “m” to X [t + i] and outputs the upper 1 word to “c”.
Then, the control unit adds 1 to the variable i (S804).
When the thread number is 0 (YES when t == 0?), The arithmetic unit outputs the lower 1 word of “c” to X [0] (S805).
Note that processes 1 to 6 and S805 of S804 in FIG. 13 correspond to the process for one round of the second phase.

When i becomes n or more, the Montgomery reduction process is exited and the carry process is performed.
First, when the thread number is 0 (YES when t == 0?), The arithmetic unit outputs 0 to X [0] (S806).
Further, the calculation unit calculates “m” = X [(t + i)% 2n] + “c”, the lower one word of “m” is set to X [(t + i)% 2n], and the upper one word is set to “c”. To "".
The control unit adds 1 to the variable i (S807).
The loop is repeated until i ≧ 2n or “c” = 0.
That is, every time the variable i is incremented by the control unit until the variable i reaches 2n, the computation unit sets the carry component value “c” obtained in the thread t to 0 in the thread t that is not stopped. When the carry component value “c” is 0 (YES when “c” == 0?), The processing of the thread t is stopped, and the carry component value “c” is not 0. (“C” == 0? NO) performs the processing of S807.
When all n threads have exited the loop, the carry process is terminated.
Note that “c” == 0? The processes 1-4 of S807 correspond to the process for one round of the third phase.

If there is sufficient memory, the 2n remainder operation may be omitted.
Note that in this case, the data stored in the variable a in the subtraction process described later is X [2n].

When the carry process is completed, a subtraction process is performed.
The arithmetic unit first outputs the value of X [0] to the variable a, and shifts the value of X by n words (S808).
That is, the calculation unit stores the values of the variables X [n] to X [2n-1] in the variables X [0] to X [n-1], respectively.
When the value of a is not 0 or the value of X [n−1,..., 0] (the value obtained by concatenating the values of X [n−1] to X [0]) is equal to or greater than the modulus M The arithmetic unit executes multiple-precision integer subtraction X-M and stores the result in X (S809).
Finally, the calculation unit stores the values of X [0] to X [n−1] in Z [0] to Z [n−1] (S810).
Note that S808 to S810 illustrated in FIG. 13 correspond to the fourth phase process.

14 and 15 show changes in values in Montgomery reduction according to the present embodiment.
14 and 15 show a case where the internal calculation width is a decimal number and four-digit calculation is executed by four threads (thread numbers 0 to 3) in order to facilitate understanding of the contents. 14 and 15 show an example in which 2345678 (X) * R ⁻¹ mod 3511 (M) = 1745 (Z) is calculated.
In this case, n = 4, R = 10 ⁿ = 10 ⁴ , r = 10, and MINv = −3511 ⁻¹ mod 10 = 9.
In FIG. 15, in order to clarify the continuity with FIG. 14, the calculation process at the time of i = 3 shown at the bottom of FIG. 14 is presented again.
FIGS. 16 and 17 show the breakdown of the calculation shown in FIGS. 14 and 15 for the thread number 0.

Next, the effect of the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In the present embodiment, the Montgomery reduction process is completed in n loops.
One of the features of this embodiment is that carry addition processing is also performed during Montgomery reduction processing.
In each step, the calculation amount can be set to O (n) by outputting the carry of the thread that processes the least significant digit to the memory.

Regarding carry processing, if carry components remain after Montgomery reduction processing, addition is performed until the carry components become zero.
The worst case of carry processing is O (n). However, if the input is random, the probability that the carry will remain until the end is very low, so it is possible to exit the loop with several carry calculations.
Further, by taking the remainder by 2n, Montgomery reduction can be performed with the same memory size as the multiple-precision integer multiplication.
Further, when n is a power of 2, a remainder operation with a high operation cost can be realized by a bit operation with a low operation cost.
In addition, as described above, the multiple length arithmetic device 100 according to the present embodiment can be realized by a normal computer such as a SIMD computer, and can perform Montgomery reduction at high speed without using a dedicated device. it can.

In the present embodiment, the bit width of the input value X is divided into 2n when divided in units of one word, and 2n variables X are provided .
For this reason, 2n remainder calculation is performed in the processing 1 and the processing 3 in S807 of FIG.
However, if the memory is sufficient, the variable X for storing the input value X, v number (where, v is a multiple of n, i.e., v is 3n, 4n etc.) may be constituted by. However, the range of values stored in the input X satisfies 0 ≦ X <MR.
In the case of such a variable X, the 2n remainder calculation in the processing 1 and the processing 3 in S807 in FIG. 13 is omitted.
Similarly, the data stored in the variable a in the subtraction process (process 1 in S808 in FIG. 13) is X [ 2n ].
Further, in the subtraction process (process 2 of S808 in FIG. 13), the values of X [ n ] to X [ 2n -1] are stored in X [0] to X [n-1], respectively.

As described above, in the present embodiment,
A multiple-precision integer arithmetic unit comprising a plurality of processors, a computer capable of executing a single instruction simultaneously on a plurality of data, and a memory for storing data and simultaneously accessible by the processor, wherein the input X , Modulus M, and R defined as “r = 2b”, “R = rn”, and MINv defined as “−M ⁻¹ mod r” for the internal computation width b (bit), Z A multiple-precision integer arithmetic unit that executes Montgomery reduction for calculating = XR ⁻¹ mod M in the following steps has been described.
1. 1. a step of dividing input data and a method into a plurality of digits (hereinafter referred to as X [n] and M [n], respectively) for each internal calculation width of the computer 2. Obtaining the number n of threads to be calculated with its own thread number t for each thread 3. Calculate the lower 1 word u of X [0] × MINv and calculate “m” = M [t] × u + X [t] 4. Output the lower 1 word of “m” to X [t] and output the upper 1 word to “c” 5. If the thread number is 0, output the lower 1 word of “c” to X [0] 6. Set the digit i to 1 7. Calculate the lower 1 word u of (X [0] + X [i]) × MINv and calculate “m” = M [t] × u + X [t + i] + “c” 8. Output the lower 1 word of “m” to X [t + i] and output the upper 1 word to “c” 9. If the thread number is 0, output the lower 1 word of c to X [0] 10. Add 1 to digit i 11. Perform steps 6-9 while i <n 12. If thread number is 0, outputting 0 to X [0] Step of calculating “m” = X [(t + i)% 2n] + “c” and outputting the lower 1 word of “m” to X [(t + i)% 2n] and the upper 1 word to “c” 14 . 15. Add 1 to digit i 15. Steps 13 to 14 are executed while i <2n and c ≠ 0. Wait for all of the threads to complete steps 13-15. Step of acquiring the value of X [0] in the variable a 18. 18. Shifting the value of X by n words If the value of a is not 0 or the value of X [n−1,..., 0] is greater than or equal to M, a multiple-precision integer subtraction X−M is executed and the result is stored in X20. Storing values of X [0] to X [n-1] in Z [0] to Z [n-1]

In the present embodiment,
In step 12 above, “m” = X [t + i] + “c” is calculated, and the step of outputting the lower 1 word of “m” to X [t + i] and the upper 1 word to “c” is executed. In the above step 17, the multiple-precision integer arithmetic unit that executes the step of acquiring the value of X [2n] in the variable a has been described.

Embodiment 5 FIG.
In the present embodiment, a multiple-length Montgomery multiplication process is performed.
The configuration of the multiple length arithmetic apparatus 100 according to the present embodiment is the same as that shown in FIG.

  Next, an outline of the operation of the calculation unit 101 according to the present embodiment will be described.

In this embodiment, each bit width is common, and each input value X, input value Y, and modulus M are larger than one word (b bits) that is the operation bit width of the operation unit. On the other hand, a Montgomery multiplication that calculates (XYR ⁻¹ mod M) using R defined as r = 2 ^b , R = r ⁿ and MInv defined as (−M ⁻¹ mod r) is performed. Do. However, 0 ≦ X, Y <M.
In addition, said n is the division | segmentation number of the modulus M at the time of dividing the modulus M for every word, and it is n> = 2.
In the present embodiment, the number of divisions of the input value X when the input value X is divided for each word and the number of divisions of the input value Y when the input value Y is divided for each word are n. Suppose there is.

First, the control unit divides the input value X, the input value Y, and the modulus M for each word.
The control unit also stores n variables X [0] to X [n−1] for storing n divided values divided from the input value X and n pieces of divided values from the input value Y. N variables Y [0] to Y [n−1] for storing the division value are provided in any storage area (for example, the memory 102).
Further, the control unit stores the divided value including the least significant bit in the input value X in the 0th variable X [0], and the divided value including the most significant bit as the (n−1) th variable X. N division values are stored in variables X [0] to X [n−1] so as to be stored in [n−1].
Further, the control unit stores the divided value including the least significant bit in the input value Y in the 0th variable Y [0], and the divided value including the most significant bit as the (n−1) th variable Y. The n divided values are stored in variables Y [0] to Y [n−1] so as to be stored in [n−1].
Further, the control unit stores n variables M [0] to M [n−1] for storing n divided values divided from the modulus M in any storage area (for example, the memory 102). Provided.
The control unit stores the division value including the least significant bit in the modulus M in the 0th variable M [0], and the division value including the most significant bit as the (n−1) th variable M [[ n divided values are stored in variables M [0] to M [n−1].
In addition, the control unit provides 2n variables Z [0] to Z [2n−1] for storing the calculation result by the calculation unit in any storage area (for example, the memory 102).

As in the first to fourth embodiments, the calculation unit executes n threads in which “0 to n−1” is set as the thread number in parallel.
The processing of the computing unit is roughly divided into first phase to fourth phase processing.

The computing unit performs the following processes <1-a> to <1-f> as the first phase process.
<1-a> In the thread t, using the value of the 0th variable X [0] of the input value X, the value of the 0th variable Y [0] of the input value Y, and MINv, (X [ [0] value) × (Y [0] value) × MINv, and the value of the lower 1 word of the 2-word calculation result is u.
<1-b> In the thread t, using the value of the t-th variable M [t] of the modulus M and the u, (M [t] value) × u is calculated, and the calculation result of 2 words is um.
<1-c> In the thread t, using the value of the 0th variable X [0] of the input value X and the value of the tth variable Y [t] of the input value Y, the value of (X [0] ) × (value of Y [t]), and the calculation result of 2 words is xy.
<1-d> In thread t, the lower 1 word of um and the lower 1 word of xy are added, the calculation result of 2 words is m, and the value of the lower 1 word of calculation result m is the t-th variable. Store in Z [t].
<1-e> In thread t, the upper 1 word of m, the upper 1 word of um, and the upper 1 word of xy are added, and the calculation result of 2 words is set as a carry component value c.
<1-f> In thread 0, which is the 0th thread, the value of the lower 1 word of carry component value c obtained in thread 0 is set as the new value of variable Z [0].

Next, the control unit sets the counter value i to 1, and causes the calculation unit to start the second phase process.
The control unit increments the counter value i every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n.

The calculation unit repeats the process for one round of the second phase every time the counter value i is incremented by the control unit.
The processing for one round of the second phase is the following <2-a> to <2-f> processing.
<2-a> In thread t, the 0th variable Z [0], the ith variable Z [i], the ith variable X [i] of the input value X, and the 0th variable of the input value Y Using Y [0] and MINv, {(value of Z [0]) + (value of Z [i]) + (value of X [i]) × (value of Y [0])} × MINv is calculated, and the value of the lower 1 word of the 2-word calculation result is set to u.
<2-b> In the thread t, using the value of the t-th variable M [t] of the modulus M and u, the value of (M [t]) × u is calculated. um.
<2-c> In the thread t, using the value of the i-th variable X [i] of the input value X and the value of the t-th variable Y [t] of the input value Y, the value of (X [i] ) × (value of Y [t]), and the calculation result of 2 words is xy.
<2-d> In the thread t, the lower 1 word of the um, the lower 1 word of the xy, the lower 1 word of the carry component value c obtained in step t, and the (t + i) th variable Z [t + i ], The calculation result of 2 words is set as m, and the value of the lower 1 word of the calculation result m is set as a new value of the (t + i) -th variable Z [t + i].
<2-e> In thread t, the upper 1 word of m, the upper 1 word of um, the upper 1 word of xy, and the upper 1 word of carry component value c obtained in step t are added Then, the calculation result of 2 words is set as a new carry component value c.
<2-f> In the thread 0 which is the 0th thread, the value of the lower 1 word of the carry component value c obtained in the thread 0 is set as a new value of the variable Z [0].
Further, when the counter value i reaches n, the arithmetic unit sets the value 0 as a new value of the variable Z [0] in the thread 0.

When the counter value i reaches n, after the value 0 is set as a new value of the variable X [0] in the thread 0, the control unit causes the calculation unit to start the third phase process.
Then, the control unit finishes processing for one round of the third phase in all the threads t that are not stopped until the counter value i reaches 2n or all the threads t stop the processing of the third phase. Each time, the counter value i is incremented.

The arithmetic unit repeats the process for one round of the third phase in the thread t that is not stopped each time the counter value i is incremented by the control unit until the counter value i reaches 2n.
The processing for one round of the third phase is the following <3-a> and <3-b> processing.
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0. When the carry component value c is 0, the third phase processing of the thread t is stopped.
<3-b> If it is not 0, the lower 1 word of the carry component value c obtained in the thread t and the value of the variable Z [(t + i) mod 2n] are added, and the calculation result of 2 words is set as m. The value of the lower 1 word of the calculation result m is set as a new value of the variable Z [(t + i) mod 2n], and the upper 1 word of the m and the upper 1 word of the carry component value c obtained by the thread t are added. The calculation result of 2 words is set as a new carry component value c.

  When the counter value i reaches 2n, or when all the threads t stop the third phase process, the control unit causes the calculation unit to start the fourth phase process.

The calculation unit performs the following processing as the fourth phase processing.
The value of variable Z [0] is stored in variable a, and the values of variables Z [n] to Z [2n-1] are stored in variables Z [0] to Z [n-1], respectively.
When the value of the variable a is not 0, or the value obtained by concatenating the values of the variables Z [n−1] to Z [0] is equal to or greater than the modulus M, Z−M is calculated, and the calculation result is the variable Store in Z [0] to Z [n-1].

Next, a procedure for performing Montgomery multiplication in the multiple-precision arithmetic apparatus 100 according to the present embodiment will be described with reference to the flowchart of FIG.
In FIG. 18, the result XYR ⁻¹ mod M of the Montgomery multiplication of the input values X and Y is output to Z.
Z has a size of 2n words and stores intermediate variable values.
The input values X and Y are divided into n digits, and calculation is performed using n threads.
Further, it is assumed that the input values X and Y satisfy the relationship of X and Y <M.
Here, the R = ^{r n,} and r = ^{2 b.}
MINv is a 1-word integer that satisfies −M ⁻¹ mod r.

In FIG. 18, variables indicated by capital letters are data on the memory 102, and variables indicated by small letters are data on the general-purpose register 108.
The data length of each variable is 1 word.
However, the variable written in bold in FIG. 18 is 2 words.
In the specification, a 2-word variable is expressed by double quotation (for example, “c”).
If the input value ceil (l / b) word is less than n, the word of the lesser part is cleared to 0 in advance.

  First, the calculation unit obtains its own thread number and the number of threads to be calculated for each thread from the general-purpose register 108, sets Z to 0, and sets the variable i to 1 (S1001).

Next, Montgomery multiplication processing is performed.
Specifically, the calculation unit obtains the lower one word u of X [0] × Y [0] × MINv and calculates M [t] × u + X [0] × Y [t].
Since the calculation is performed with a variable of 2 words or less, M [t] × u, X [0] × Y [t] is decomposed into an upper word and a lower word, and only the lower word is added. The lower 1 word is output to Z [t].
Further, the arithmetic unit adds the upper word of the addition result and the upper word of M [t] × u, X [0] × Y [t] to generate 2-word data “c” (S1002).
When the thread number is 0 (YES when t == 0?), The arithmetic unit outputs the lower 1 word of “c” to Z [0] (S1003).
Note that S1002 and S1003 in FIG. 18 correspond to the processing of the first phase.

When i is less than n, the arithmetic unit obtains the lower 1 word u of (Z [0] + Z [i] + X [i] × Y [0]) × MINv, and M [t] × u + X [0] × Y [t] + Z [t + i] + “c” is calculated.
Since the calculation is performed with a variable of 2 words or less, M [t] × u, X [0] × Y [t], “c” is decomposed into an upper word and a lower word, and only the lower word is added. , The lower one word of the addition result is output to Z [t + i].
The arithmetic unit adds the upper word of the addition result and the upper word of M [t] × u, X [0] × Y [t], “c” to generate 2-word data “c”. .
Further, the control unit adds 1 to the variable i (S1004).
When the thread number is 0 (YES when t == 0?), The arithmetic unit outputs the lower 1 word of “c” to Z [0] (S1005).
Note that processes 1 to 15 and S1005 of S1004 in FIG. 18 correspond to the process for one round of the second phase.

When i is greater than or equal to n, the Montgomery multiplication process is exited and the carry process is performed.
First, when the thread number is 0 (YES when t == 0?), The arithmetic unit outputs 0 to Z [0] (S1006).
Next, the calculation unit calculates Z [(t + i)% 2n] + “c”.
Since the calculation is performed with a variable of 2 words or less, “c” is decomposed into an upper word and a lower word, and only the lower word is added. Output.
The arithmetic unit adds the upper word of the addition result and the upper word of “c” to generate 2-word data “c”.
The control unit adds 1 to the variable i (S1007).
The loop is repeated until i ≧ 2n or “c” = 0.
That is, every time the variable i is incremented by the control unit until the variable i reaches 2n, the computation unit sets the carry component value “c” obtained in the thread t to 0 in the thread t that is not stopped. When the carry component value “c” is 0 (YES when “c” == 0?), The processing of the thread t is stopped, and the carry component value “c” is not 0. (If “c” == 0? NO), the processing of S1007 is performed.
When all n threads have exited the loop, the carry process is terminated.
Note that “c” == 0? The processes 1 to 4 of S1007 correspond to the process for one round of the third phase.

If there is sufficient memory, the 2n remainder operation may be omitted.
Note that in this case, the data stored in the variable a in the subtraction process described later is Z [2n].

When the carry process is completed, a subtraction process is performed.
The arithmetic unit first outputs the value of Z [0] to the variable a, and shifts the value of Z by n words (S1008).
That is, the calculation unit stores the values of variables Z [n] to Z [2n-1] in variables Z [0] to Z [n-1], respectively.
When the value of a is not 0 or the value of Z [n−1,..., 0] (the value obtained by concatenating the values of Z [n−1] to Z [0]) is equal to or greater than the modulus M The arithmetic unit executes multiple-precision integer subtraction ZM and stores the result in Z (S1009).
Finally, the calculation unit outputs Z [0] to Z [n-1].
Note that the outputs of S1008, S1009, and Z [0] to Z [n-1] shown in FIG. 13 correspond to the fourth phase process.

19 and 20 show changes in values in Montgomery multiplication according to the present embodiment.
19 and 20 show a case where the internal operation width is a decimal number and a 4-digit operation is executed by four threads (thread numbers 0 to 3) in order to facilitate understanding of the contents. 14 and 15 illustrate an example in which 5678 (X) * 4321 (Y) * R ⁻¹ mod 6131 (M) = 3736 (Z) is calculated.
In this case, n = 4, R = 10 ⁿ = 10 ⁴ , r = 10, and MINv = −6131 ⁻¹ mod 10 = 9.
In FIG. 20, in order to clearly show the continuity with FIG. 19, the calculation process (partial) at the time of i = 3 shown at the bottom of FIG. 19 is presented again.
21 and 22 show the breakdown of the calculation shown in FIGS. 19 and 20 for the thread number 0. FIG.

Next, the effect of the multiple length arithmetic apparatus 100 according to the present embodiment will be described.
In the present embodiment, the Montgomery multiplication process is completed in n loops.
One of the features of the present embodiment is that carry addition processing is also performed during Montgomery multiplication processing.
In addition, by dividing the addition data into the upper part and the lower part and adding, it is possible to perform a calculation that requires a variable of 3 words with a variable of 2 words or less.
Furthermore, at each step, the amount of calculation can be reduced to O (n) by outputting the carry of the thread that processes the least significant digit to the memory.

For carry processing, if carry components remain after the Montgomery multiplication processing, addition is performed until the carry components become zero.
The worst case of carry processing is O (n). However, if the input is random, the probability that the carry will remain until the end is very low, so it is possible to exit the loop with several carry calculations.
Further, by taking the remainder by 2n, Montgomery multiplication processing can be realized with the same memory size as that of multiple-precision integer multiplication.
Further, when n is a power of 2, a remainder operation with a high operation cost can be realized by a bit operation with a low operation cost.
In addition, as described above, the multiple length arithmetic apparatus 100 according to the present embodiment can be realized by a normal computer such as a SIMD computer, and can perform Montgomery multiplication at high speed without using a dedicated device. .

In the present embodiment, variable Z is composed of 2n words.
For this reason, 2n remainder calculation is performed in the processing 3 and the processing 4 of S1007 in FIG.
However, the variable Z may be composed of v words (where v is a multiple of n, that is, v is 3n, 4n, etc.).
In the case of such a variable Z, the 2n remainder calculation in the processing 3 and the processing 4 in S1007 in FIG. 18 is omitted.
Similarly, the data stored in the variable a in the subtraction process (process 1 in S1008 in FIG. 18) is Z [ 2n ].
Furthermore, the values of Z [ n ] to Z [ 2n -1] are stored in Z [0] to Z [n-1], respectively, in the subtraction processing (processing 2 in S1008 in FIG. 18).

As described above, in the present embodiment,
A multiple-precision integer arithmetic unit comprising a plurality of processors, a computer capable of executing a single instruction simultaneously on a plurality of data, and a memory for storing data and simultaneously accessible by the processor, wherein the input X , Y, modulus M, internal calculation width b (bit), R defined as “r = 2b”, “R = rn”, and MInv defined as “−M−1 mod r” , Z = XYR−1 mod A multi-precision integer arithmetic unit that executes Montgomery multiplication for calculating M in the following steps has been described.
1. 1. A step of dividing input data and a method into a plurality of digits (hereinafter referred to as X [n], Y [n], and M [n], respectively) for each internal calculation width of the computer. 2. Obtaining the number n of threads to be calculated with its own thread number t for each thread 3. Set Z to 0 4. Obtain lower 1 word u of X [0] × Y [0] × MINv and calculate M [t] × u and X [0] × Y [t] 5. After adding only the lower word of M [t] × u and X [0] × Y [t], outputting the lower 1 word of the addition result to Z [t] 6. Add the upper word of the addition result and the upper word of M [t] × u, X [0] × Y [t] to generate 2-word data “c” 7. If the thread number is 0, output the lower 1 word of “c” to Z [0] 8. Set the digit i to 1 (Z [0] + Z [i] + X [i] × Y [0]) × Calculating the lower 1 word u of MINv and calculating M [t] × u and X [i] × Y [t] 10 . After the addition of the lower word of M [t] × u, X [0] × Y [t], “c” and Z [t + i], the lower 1 word of the addition result is output to Z [t + i] Step 11 to perform 11. Add the upper word of the addition result and the upper word of M [t] × u, X [0] × Y [t], “c” to generate 2-word data “c” 12. Add 1 to variable i 13. If the thread number is 0, outputting the lower 1 word of “c” to Z [0] 15. Perform steps 9-13 while i <n If the thread number is 0, output 0 to Z [0] 16. Step of adding the lower word of “c” and Z [(t + i)% 2n] and then outputting the lower word of the addition result to Z [(t + i)% 2n] 17. adding the upper word of the addition result and the upper word of “c” to generate 2-word data “c” 18. Adding 1 to digit i 20. Steps 16-18 are executed while i <2n and c ≠ 0 20. Wait for all of the threads to complete steps 16-18. Step of obtaining the value of Z [0] in the variable a 22. 23. Shifting the value of Z by n words If the value of a is not 0 or the value of Z [n−1,..., 0] is greater than or equal to M, a multiple-precision integer subtraction Z−M is executed, and the result is stored in Z

In the present embodiment,
In step 16 above, after adding the lower word of “c” and Z [(t + i)], the step of outputting the lower 1 word of the addition result to Z [(t + i)] is executed. In step 21, the multiple-precision integer arithmetic unit that executes the step of acquiring the value of Z [2n] in the variable a has been described.

  100 multiple length arithmetic unit, 101 calculation unit, 102 memory, 103 communication port, 104 bus, 105 processor, 106 processor, 107 instruction decoder, 108 general purpose register, 109 special register.

Claims (8)

An arithmetic device that includes a control unit, a calculation unit, and a storage unit, and performs addition of input values,
The controller is
The respective bit widths are common, and the input value X and the input value Y, each of which is larger than the calculation bit width of the calculation unit, are divided for each calculation bit width of the calculation unit,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n (n ≧ 2) divided values divided from the input value X; , N variables Y [0] to Y [n−1] for storing n divided values divided from the input value Y are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
U (u> n) variables Z [0] to Z [u−1] for allocating a predetermined storage area in the storage unit and storing the addition result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
In the thread t where the thread number = t (t is one of “0 to n−1”), as the first phase process,
Using the value of the t-th variable X [t] of the input value X and the value of the t-th variable Y [t] of the input value Y, the value of (X [t]) + (Y [t] Value), obtain the addition result and carry value c, and store the addition result in the t-th variable Z [t],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t that are not stopped until the counter value i reaches n or all the threads t stop the processing of the second phase, the counter value i is incremented,
The computing unit is
Each time the counter value i is incremented by the control unit, in the thread t that has not been stopped, as processing for one round of the second phase,
<a> Using the value of the (t + i) th variable Z [t + i] and the carry value c obtained in the thread t, (Z [t + i] value) + c is calculated, and a new addition result and a new value are calculated. Obtain carry value c,
<B> The value of the variable Z [t + i] is compared with the new addition result, and if the two match, the second phase processing of the thread t is stopped, and if both do not match, a new An arithmetic unit characterized by performing a process of storing the addition result in a (t + i) -th variable Z [t + i]. An arithmetic unit that includes a control unit, a calculation unit, and a storage unit, and performs subtraction of an input value,
The respective bit widths are common, and the input value X and the input value Y, each of which is larger than the calculation bit width of the calculation unit, are divided for each calculation bit width of the calculation unit,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n (n ≧ 2) divided values divided from the input value X; , N variables Y [0] to Y [n−1] for storing n divided values divided from the input value Y are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
U (u> n) variables Z [0] to Z [u-1] for allocating a predetermined storage area in the storage unit and storing a subtraction result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
In the thread t where the thread number = t (t is one of “0 to n−1”), as the first phase process,
Using the value of the t-th variable X [t] of the input value X and the value of the t-th variable Y [t] of the input value Y, (value of Y [t]) − (X [t] Value), a subtraction result and a borrow value d are obtained, and the subtraction result is stored in the t-th variable Z [t].
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t that are not stopped until the counter value i reaches n or all the threads t stop the processing of the second phase, the counter value i is incremented,
The computing unit is
Each time the counter value i is incremented by the control unit, in the thread t that has not been stopped, as processing for one round of the second phase,
<a> Using the value of the (t + i) th variable Z [t + i] and the borrow value d obtained in the thread t, (Z [t + i] value) −d is calculated, and the new subtraction result and the new value are calculated. To obtain a simple borrow value d,
<B> The value of the variable Z [t + i] is compared with the new subtraction result, and if the two match, the second phase processing of the thread t is stopped, and if both do not match, a new An arithmetic unit characterized by performing a process of storing a subtraction result in a (t + i) -th variable Z [t + i]. An arithmetic device that includes a control unit, a calculation unit, and a storage unit and performs multiplication of input values,
The controller is
Each bit width is common, and each of the input value X and the input value Y, each bit width being larger than one word which is the calculation bit width of the calculation unit, is divided for each word,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n (n ≧ 2) divided values divided from the input value X; , N variables Y [0] to Y [n−1] for storing n divided values divided from the input value Y are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
U (u> n) variables Z [0] to Z [u-1] for allocating a predetermined storage area in the storage unit and storing the calculation result by the calculation unit are provided,
The counter value i is set to 0, and the arithmetic unit starts the first phase process,
Until the counter value i reaches n, each time the arithmetic unit finishes processing for one round of the first phase, the counter value i is incremented,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
Until the counter value i reaches n, each time the counter value i is incremented by the control unit, the thread number = t (t is one of “0 to n−1”). As a process for one round of the first phase,
<1-a> The value of the t-th variable X [t] of the input value X, the value of the i-th variable Y [i] of the input value Y, the value of the (t + i) -th variable Z [t + i] , (X [t] value) × (Y [i] value) + (Z [t + i] value) + c is calculated using the carry component value c obtained in the thread t.
<1-b> A process of storing the value of the lower 1 word of the calculation result in the (t + i) th variable Z [t + i] and setting the value of the upper 1 word of the calculation result as a new carry component value c,
The controller is
When the counter value i reaches n, the calculation unit starts the second phase process,
Until the counter value i reaches u, the arithmetic unit increments the counter value i every time the processing for one round of the second phase ends.
The computing unit is
Until the counter value i reaches u, each time the counter value i is incremented by the control unit, in the thread t that is not stopped, as processing for one round of the second phase,
<2-a> It is determined whether or not the carry component value c obtained by the thread t is 0, and when the carry component value c is 0, the processing of the second phase of the thread t is stopped.
<2-b> If not 0 (value of Z [t + i]) + c, the value of the lower 1 word of the calculation result is set as the new value of the variable Z [t + i], and the value of the upper 1 word of the calculation result An arithmetic unit characterized by performing a process for setting a new carry component value c. A control unit, a calculation unit, and a storage unit;
For an input value X and modulus M having a bit width larger than one word (1 word = b bits), which is the computation bit width of the computation unit, r = 2 ^b , R = r ⁿ (n is the modulus M Is the number of divisions of the modulus M when each word is divided, and R defined as n ≧ 2) and MINv defined as (−M ⁻¹ mod r), (XR ⁻¹ mod M) is an arithmetic unit that performs Montgomery reduction,
The controller is
The input value X and the modulus M are each divided into words,
2n variables X [0] to X [2n−1] for allocating a predetermined storage area in the storage unit and storing 2n divided values divided from the input value X are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (2n−1) th variable X [2n−1]. 2n division values are stored in variables X [0] to X [2n-1] so as to be stored,
N variables M [0] to M [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the modulus M are provided,
The division value including the least significant bit in the modulus M is stored in the 0th variable M [0], and the division value including the most significant bit is stored in the (n−1) th variable M [n−1]. As described above, n division values are stored in variables M [0] to M [n−1],
N variables Z [0] to Z [n-1] for allocating a predetermined storage area in the storage unit and storing a calculation result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
As the first phase process,
In a thread t where thread number = t (t is one of “0 to n−1”),
<1-a> Using the value of the 0th variable X [0] of the input value X and MINv, (X [0] value) × MINv is calculated, and the lower 1 word of the calculation result of 2 words Let u be the value
<1-b> Using the value of the t-th variable M [t] of the method M, the value of the t-th variable X [t] of the input value X, and u, the value of (M [t] ) × u + (value of X [t]), the calculation result of 2 words is set as m, the value of the lower 1 word of the calculation result m is set as the new value of the variable X [t], and the higher order of the calculation result m The value of one word is the carry component value c,
In thread 0, which is the 0th thread,
<1-c> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable X [0],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n, the counter value i is incremented.
The computing unit is
Each time the counter value i is incremented by the control unit, as a process for one round of the second phase,
In an individual thread t
<2-a> Using the value of the 0th variable X [0], the value of the ith variable X [i] of the input value X, and MINv, {(value of X [0]) + (X The value of [i])} × MINv is calculated, and the value of the lower 1 word of the calculation result of 2 words is set to u,
<2-b> Value of t-th variable M [t] of method M, u, value of (t + i) -th variable X [t + i] of input value X, and carry component obtained by thread t Using the value c, (M [t] value) × u + (X [t + i] value) + c is calculated, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is a variable A new value of X [t + i] is set, and the value of the upper one word of the calculation result m is set as a new carry component value c.
In thread 0, which is the 0th thread,
<2-c> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable X [0],
When the counter value i reaches n, in the thread 0, the value 0 is set as a new value of the variable X [0],
The controller is
When the counter value i reaches n, the value 0 is changed to the new value of the variable X [0] in the thread 0, and then the arithmetic unit starts the third phase process.
Every time processing for one round of the third phase is completed in all the threads t that are not stopped until the counter value i reaches 2n or all the threads t stop the processing of the third phase, the counter value i is incremented,
The computing unit is
Until the counter value i reaches 2n, each time the counter value i is incremented by the control unit, in the thread t that is not stopped, as a process for one round of the third phase,
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0, and when the carry component value c is 0, the processing of the third phase of the thread t is stopped.
<3-b> When not 0, (X [(t + i) mod 2n] value) + c is calculated, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the variable X [(( t + i) mod 2n], and the value of the upper one word of the calculation result m is set as a new carry component value c.
The controller is
When the counter value i reaches 2n, or when all the threads t stop the third phase processing, the calculation unit starts the fourth phase processing,
The computing unit is
As the fourth phase process,
The value of variable X [0] is stored in variable a,
The values of variables X [n] to X [2n−1] are stored in variables X [0] to X [n−1], respectively.
When the value of the variable a is not 0, or when the value obtained by concatenating the values of the variables X [n−1] to X [0] is not less than the modulus M, X−M is calculated, and the calculation result is the variable Stored in X [0] to X [n-1],
An arithmetic unit characterized in that values of variables X [0] to X [n-1] are stored in variables Z [0] to Z [n-1]. A control unit, a calculation unit, and a storage unit;
For an input value X and modulus M having a bit width larger than one word (1 word = b bits), which is the computation bit width of the computation unit, r = 2 ^b , R = r ⁿ (n is the modulus M Is the number of divisions of the modulus M when each word is divided, and R defined as n ≧ 2) and MINv defined as (−M ⁻¹ mod r), (XR ⁻¹ mod M) is an arithmetic unit that performs Montgomery reduction,
The controller is
The input value X and the modulus M are each divided into words,
Assigning a predetermined storage area in the storage unit, v for storing 2n pieces of divided value obtained by dividing the input value X (v is a multiple of n, v ≧ 3 n) pieces of variable X [0] to X [v-1] are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the ( 2n −1) th variable X [ 2n −1]. 2n division values are stored in variables X [0] to X [ 2n- 1] so as to be stored,
N variables M [0] to M [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the modulus M are provided,
The division value including the least significant bit in the modulus M is stored in the 0th variable M [0], and the division value including the most significant bit is stored in the (n−1) th variable M [n−1]. As described above, n division values are stored in variables M [0] to M [n−1],
N variables Z [0] to Z [n-1] for allocating a predetermined storage area in the storage unit and storing a calculation result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
As the first phase process,
In a thread t where thread number = t (t is one of “0 to n−1”),
<1-a> Using the value of the 0th variable X [0] of the input value X and MINv, (X [0] value) × MINv is calculated, and the lower 1 word of the calculation result of 2 words Let u be the value
<1-b> Using the value of the t-th variable M [t] of the method M, the value of the t-th variable X [t] of the input value X, and u, the value of (M [t] ) × u + (value of X [t]), the calculation result of 2 words is set as m, the value of the lower 1 word of the calculation result m is set as the new value of the variable X [t], and the higher order of the calculation result m The value of one word is the carry component value c,
In thread 0, which is the 0th thread,
<1-c> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable X [0],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n, the counter value i is incremented.
The computing unit is
Each time the counter value i is incremented by the control unit, as a process for one round of the second phase,
In an individual thread t
<2-a> Using the value of the 0th variable X [0], the value of the ith variable X [i] of the input value X, and MINv, {(value of X [0]) + (X The value of [i])} × MINv is calculated, and the value of the lower 1 word of the calculation result of 2 words is set to u,
<2-b> Value of t-th variable M [t] of method M, u, value of (t + i) -th variable X [t + i] of input value X, and carry component obtained by thread t Using the value c, (M [t] value) × u + (X [t + i] value) + c is calculated, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is a variable A new value of X [t + i] is set, and the value of the upper one word of the calculation result m is set as a new carry component value c.
In thread 0, which is the 0th thread,
<2-c> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable X [0],
When the counter value i reaches n, in the thread 0, the value 0 is set as a new value of the variable X [0],
The controller is
When the counter value i reaches n, the value 0 is changed to the new value of the variable X [0] in the thread 0, and then the arithmetic unit starts the third phase process.
Every time processing for one round of the third phase is completed in all the threads t that are not stopped until the counter value i reaches 2n or all the threads t stop the processing of the third phase, the counter value i is incremented,
The computing unit is
Until the counter value i reaches 2n , each time the counter value i is incremented by the control unit, in the thread t that is not stopped, as a process for one round of the third phase,
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0, and when the carry component value c is 0, the processing of the third phase of the thread t is stopped.
<3-b> If not 0, (X [t + i] value) + c is calculated, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the new value of the variable X [t + i]. A value, and the value of the upper one word of the calculation result m is set as a new carry component value c,
The controller is
When the counter value i reaches 2n , or when all the threads t stop the third phase processing, the calculation unit starts the fourth phase processing,
The computing unit is
As the fourth phase process,
The value of variable X [ 2n ] is stored in variable a,
The values of the variables X [ n ] to X [ 2n -1] are stored in the variables X [0] to X [n-1], respectively.
When the value of the variable a is not 0, or when the value obtained by concatenating the values of the variables X [n−1] to X [0] is not less than the modulus M, X−M is calculated, and the calculation result is the variable Stored in X [0] to X [n-1],
An arithmetic unit characterized in that values of variables X [0] to X [n-1] are stored in variables Z [0] to Z [n-1]. A control unit, a calculation unit, and a storage unit;
The respective bit widths are common, and for each of the input value X, the input value Y, and the modulus M, each bit width is larger than one word (1 word = b bits) that is the calculation bit width of the calculation unit. , R = 2 ^b , R = r ⁿ (n is the number of divisions of the modulus M when the modulus M is divided for each word, and n ≧ 2), and (−M ⁻¹ mod An arithmetic unit that performs Montgomery multiplication to calculate (XYR ⁻¹ mod M) using MINv defined as r),
The controller is
The input value X, the input value Y, and the modulus M are divided for each word,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the input value X, and the input value Y N variables Y [0] to Y [n−1] for storing the divided n divided values are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
N variables M [0] to M [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the modulus M are provided,
The division value including the least significant bit in the modulus M is stored in the 0th variable M [0], and the division value including the most significant bit is stored in the (n−1) th variable M [n−1]. As described above, n division values are stored in variables M [0] to M [n−1],
2n variables Z [0] to Z [2n−1] for allocating a predetermined storage area in the storage unit and storing the calculation result by the calculation unit are provided,
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
As the first phase process,
In a thread t where thread number = t (t is one of “0 to n−1”),
<1-a> Using the value of the 0th variable X [0] of the input value X, the value of the 0th variable Y [0] of the input value Y, and MINv, the value of (X [0] ) × (value of Y [0]) × MINv, and the value of the lower 1 word of the 2-word calculation result is u,
<1-b> Using the value of the t-th variable M [t] of method M and u, (M [t] value) × u is calculated, and the calculation result of 2 words is set to um,
<1-c> Using the value of the 0th variable X [0] of the input value X and the value of the tth variable Y [t] of the input value Y, (value of X [0]) × (Y [Value of [t]), the calculation result of 2 words is xy,
<1-d> The lower 1 word of um and the lower 1 word of xy are added, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the t-th variable Z [t] Stored in
<1-e> The upper 1 word of m, the upper 1 word of um, and the upper 1 word of xy are added, and the calculation result of 2 words is set as a carry component value c,
In thread 0, which is the 0th thread,
<1-f> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable Z [0],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n, the counter value i is incremented.
The computing unit is
Each time the counter value i is incremented by the control unit, as a process for one round of the second phase,
In an individual thread t
<2-a> The 0th variable Z [0], the ith variable Z [i], the ith variable X [i] of the input value X, and the 0th variable Y [0] of the input value Y And MINv, {(value of Z [0]) + (value of Z [i]) + (value of X [i]) × (value of Y [0])} × MINv is calculated. Let u be the value of the lower 1 word of the 2-word calculation result,
<2-b> Using the value of the t-th variable M [t] of the method M and u, (M [t] value) × u is calculated, and the calculation result of 2 words is set to um.
<2-c> Using the value of the i-th variable X [i] of the input value X and the value of the t-th variable Y [t] of the input value Y, (value of X [i]) × (Y [Value of [t]), the calculation result of 2 words is xy,
<2-d> The lower one word of the um, the lower one word of the xy, the lower one word of the carry component value c obtained in step t, and the value of the (t + i) th variable Z [t + i] And the calculation result of 2 words is m, the value of the lower 1 word of the calculation result m is the new value of the (t + i) th variable Z [t + i],
<2-e> The upper 1 word of m, the upper 1 word of um, the upper 1 word of xy, and the upper 1 word of the carry component value c obtained in step t are added to obtain 2 words And a new carry component value c,
In thread 0, which is the 0th thread,
<2-f> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable Z [0],
When the counter value i reaches n, in the thread 0, the value 0 is set as a new value of the variable Z [0], and
The controller is
When the counter value i reaches n, the value 0 is changed to the new value of the variable X [0] in the thread 0, and then the arithmetic unit starts the third phase process.
Every time processing for one round of the third phase is completed in all the threads t that are not stopped until the counter value i reaches 2n or all the threads t stop the processing of the third phase, the counter value i is incremented,
The computing unit is
Until the counter value i reaches 2n, each time the counter value i is incremented by the control unit, in the thread t that is not stopped, as a process for one round of the third phase,
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0, and when the carry component value c is 0, the processing of the third phase of the thread t is stopped.
<3-b> If it is not 0, the lower 1 word of the carry component value c obtained in the thread t and the value of the variable Z [(t + i) mod 2n] are added, and the calculation result of 2 words is set as m. The value of the lower 1 word of the calculation result m is set as a new value of the variable Z [(t + i) mod 2n], and the upper 1 word of the m and the upper 1 word of the carry component value c obtained by the thread t are added. A process of setting the calculation result of 2 words as a new carry component value c,
The controller is
When the counter value i reaches 2n, or when all the threads t stop the third phase processing, the calculation unit starts the fourth phase processing,
The computing unit is
As the fourth phase process,
The value of variable Z [0] is stored in variable a,
The values of variables Z [n] to Z [2n-1] are stored in variables Z [0] to Z [n-1], respectively.
When the value of the variable a is not 0, or the value obtained by concatenating the values of the variables Z [n−1] to Z [0] is equal to or greater than the modulus M, Z−M is calculated, and the calculation result is the variable An arithmetic unit that stores data in Z [0] to Z [n-1]. A control unit, a calculation unit, and a storage unit;
The respective bit widths are common, and for each of the input value X, the input value Y, and the modulus M, each bit width is larger than one word (1 word = b bits) that is the calculation bit width of the calculation unit. , R = 2 ^b , R = r ⁿ (n is the number of divisions of the modulus M when the modulus M is divided for each word, and n ≧ 2), and (−M ⁻¹ mod An arithmetic unit that performs Montgomery multiplication to calculate (XYR ⁻¹ mod M) using MINv defined as r),
The controller is
The input value X, the input value Y, and the modulus M are divided for each word,
N variables X [0] to X [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the input value X, and the input value Y N variables Y [0] to Y [n−1] for storing the divided n divided values are provided,
The divided value including the least significant bit in the input value X is stored in the 0th variable X [0], and the divided value including the most significant bit is stored in the (n−1) th variable X [n−1]. The n divided values are stored in the variables X [0] to X [n−1] so that the divided value including the least significant bit in the input value Y is the 0th variable Y [0. ] And the divided value including the most significant bit is stored in the (n−1) th variable Y [n−1], and the n divided values are stored in the variables Y [0] to Y [ n−1],
N variables M [0] to M [n−1] for allocating a predetermined storage area in the storage unit and storing n divided values divided from the modulus M are provided,
The division value including the least significant bit in the modulus M is stored in the 0th variable M [0], and the division value including the most significant bit is stored in the (n−1) th variable M [n−1]. As described above, n division values are stored in variables M [0] to M [n−1],
V variables (v is a multiple of n and v ≧ 3 n) variables Z [0] to Z [v−1] that allocate a predetermined storage area in the storage unit and store the calculation result by the calculation unit. ],
The computing unit is
N threads having “0 to n−1” set as thread numbers are executed in parallel,
As the first phase process,
In a thread t where thread number = t (t is one of “0 to n−1”),
<1-a> Using the value of the 0th variable X [0] of the input value X, the value of the 0th variable Y [0] of the input value Y, and MINv, the value of (X [0] ) × (value of Y [0]) × MINv, and the value of the lower 1 word of the 2-word calculation result is u,
<1-b> Using the value of the t-th variable M [t] of method M and u, (M [t] value) × u is calculated, and the calculation result of 2 words is set to um,
<1-c> Using the value of the 0th variable X [0] of the input value X and the value of the tth variable Y [t] of the input value Y, (value of X [0]) × (Y [Value of [t]), the calculation result of 2 words is xy,
<1-d> The lower 1 word of um and the lower 1 word of xy are added, the calculation result of 2 words is m, and the value of the lower 1 word of the calculation result m is the t-th variable Z [t] Stored in
<1-e> The upper 1 word of m, the upper 1 word of um, and the upper 1 word of xy are added, and the calculation result of 2 words is set as a carry component value c,
In thread 0, which is the 0th thread,
<1-f> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable Z [0],
The controller is
The counter value i is set to 1, and the arithmetic unit starts the second phase process;
Every time processing for one round of the second phase is completed in all the threads t until the counter value i reaches n, the counter value i is incremented.
The computing unit is
Each time the counter value i is incremented by the control unit, as a process for one round of the second phase,
In an individual thread t
<2-a> The 0th variable Z [0], the ith variable Z [i], the ith variable X [i] of the input value X, and the 0th variable Y [0] of the input value Y And MINv, {(value of Z [0]) + (value of Z [i]) + (value of X [i]) × (value of Y [0])} × MINv is calculated. Let u be the value of the lower 1 word of the 2-word calculation result,
<2-b> Using the value of the t-th variable M [t] of the method M and u, (M [t] value) × u is calculated, and the calculation result of 2 words is set to um.
<2-c> Using the value of the i-th variable X [i] of the input value X and the value of the t-th variable Y [t] of the input value Y, (value of X [i]) × (Y [Value of [t]), the calculation result of 2 words is xy,
<2-d> The lower one word of the um, the lower one word of the xy, the lower one word of the carry component value c obtained in step t, and the value of the (t + i) th variable Z [t + i] And the calculation result of 2 words is m, the value of the lower 1 word of the calculation result m is the new value of the (t + i) th variable Z [t + i],
<2-e> The upper 1 word of m, the upper 1 word of um, the upper 1 word of xy, and the upper 1 word of the carry component value c obtained in step t are added to obtain 2 words And a new carry component value c,
In thread 0, which is the 0th thread,
<2-f> A process of setting the value of the lower one word of the carry component value c obtained in the thread 0 as a new value of the variable Z [0],
When the counter value i reaches n, in the thread 0, the value 0 is set as a new value of the variable Z [0], and
The controller is
When the counter value i reaches n, the value 0 is changed to the new value of the variable X [0] in the thread 0, and then the arithmetic unit starts the third phase process.
Every time processing for one round of the third phase is completed in all the threads t that are not stopped until the counter value i reaches 2n or all the threads t stop the processing of the third phase, the counter value i is incremented,
The computing unit is
Until the counter value i reaches 2n , each time the counter value i is incremented by the control unit, in the thread t that is not stopped, as a process for one round of the third phase,
<3-a> It is determined whether or not the carry component value c obtained by the thread t is 0, and when the carry component value c is 0, the processing of the third phase of the thread t is stopped.
<3-b> When it is not 0, the lower 1 word of the carry component value c obtained in the thread t and the value of the variable Z [t + i] are added, the calculation result of 2 words is set to m, and the calculation result m The value of the lower 1 word is set as a new value of the variable Z [t + i], the upper 1 word of m is added to the upper 1 word of the carry component value c obtained by the thread t, and the calculation result of 2 words is newly obtained. To carry out the carry component value c,
The controller is
When the counter value i reaches 2n , or when all the threads t stop the third phase processing, the calculation unit starts the fourth phase processing,
The computing unit is
As the fourth phase process,
The value of variable Z [ 2n ] is stored in variable a,
The values of variables Z [ n ] to Z [ 2n -1] are stored in variables Z [0] to Z [n-1], respectively.
When the value of the variable a is not 0, or the value obtained by concatenating the values of the variables Z [n−1] to Z [0] is equal to or greater than the modulus M, Z−M is calculated, and the calculation result is the variable An arithmetic unit that stores data in Z [0] to Z [n-1].   A program comprising a group of instructions that enables processing of the control unit and the calculation unit according to claim 1.

Images