JP6093718B2 - Expansion field multiplication device, expansion field multiplication method and program - Google Patents

Description

  The present invention relates to information security technology, and more particularly, to technology for calculating multiplication on an algebraic structure called an extension field of 2 used in encryption and codes.

The 2 m-th extension field element is represented by an m-bit bit string. Hereinafter, the m-th order expansion field of 2 is written as GF (2 ^m ). Addition on GF (2 ^m ) is expressed by bitwise exclusive OR (XOR), and is easy to calculate. On the other hand, multiplication has the following meaning and is more complicated than addition.

First, each bit of the m-th order extension field element a∈GF (2 ^m ) is interpreted as the coefficients a ₀ ,..., A _m-1 of the m−1 order polynomial a [X] as follows.

At this time, the product ab∈GF (2 ^m ) of the m-th order extension field elements a and b is expressed as follows.

Here, f [X] is a specific m-order polynomial called an irreducible polynomial. For example, 1 + X + X ² is a quadratic irreducible polynomial.

  Non-Patent Document 1 describes a polynomial method, a cyclic group method, a normal definition method, a method using a multiplication table, and the like as conventional techniques for calculating the expansion field multiplication of 2.

Tetsuji Tanaka, Takanori Yasuda, Koichi Sakurai, “Implementation of high-speed computation on gf (232) using Graphics processing unit”, Computer Security Symposium 2013, 2013

  The prior art described in Non-Patent Document 1 has a problem that the calculation speed is slow.

  It is an object of the present invention to calculate a multiplication field of 2 at high speed.

  In order to solve the above problem, the expansion field multiplication apparatus of the present invention uses A and B as values composed of L elements of an m-th order expansion field of 2, and for i = {0,1}, from value A A first shuffle unit that generates a value A ′ [i] represented by the following equation and generates a value B ′ [i] represented by the following equation from the value B;

For i = {0,1}, a value A ′ [i] and a value B ′ [i] are input and a carryless multiplication unit that calculates a value C ′ [i] by carryless multiplication, and a value C ′ [0] , C ′ [1], the second shuffle part that generates the value C shown in the following formula,

A third shuffler that generates a value D shown in the following equation from the values C ′ [0] and C ′ [1];

Calculates the remainder from the m-th irreducible polynomial f [X] for the value D, generates the value D ', and the exclusive logic that calculates the exclusive OR of the value C and the value D' Wabe.

  According to the present invention, it is possible to calculate 2 field multiplications at high speed.

FIG. 1 is a diagram illustrating a functional configuration of the expansion field multiplier. FIG. 2 is a diagram illustrating a processing flow of the expansion field multiplication method.

  The present invention is a method for performing parallel processing of two m-th order extended field multiplications for L times at high speed when processing called Lm-bit carry-free multiplication and processing called shuffle are available.

  Carry means carry and multiplication without carry is, for example, multiplication in which there is no carry for each digit when multiplication is performed by handwriting. In particular, this invention refers to the case of binary numbers. Shuffle is an operation of rearranging each element by specifying the arrangement order when there is a vector.

  Some recent CPUs (Central Processing Units) are equipped with 64-bit carry-free multiplication and 128-bit or 256-bit shuffle.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the component which has the same function in drawing, and duplication description is abbreviate | omitted.

[Embodiment]
With reference to FIG. 1, the example of a structure of the expansion field multiplication apparatus 1 is demonstrated. The expansion field multiplier 10 includes an input unit 1, a first shuffle unit 2, a carryless multiplication unit 3, a second shuffle unit 4, a third shuffle unit 5, a remainder calculation unit 6, an exclusive OR unit 7 and an output unit 8. including. The expansion field multiplication device 10 is configured, for example, by loading a special program into a known or dedicated computer having a central processing unit (CPU), a main storage device (Random Access Memory, RAM), and the like. It is a special device. The expansion field multiplication device 10 executes each process under the control of the central processing unit, for example. The data input to the expansion field multiplication device 10 and the data obtained in each process are stored in, for example, the main storage device, and the data stored in the main storage device is read out as necessary for other processing. Used.

  With reference to FIG. 2, an example of the processing flow of the expansion field multiplication method executed by the expansion field multiplication device 10 according to the embodiment will be described in the order of procedures actually performed.

In step S 1, two Lm-bit values A and BεGF (2 ^m ) ^L are input to the input unit 1.

  In step S <b> 2, the first shuffler 2 generates an Lm-bit value A ′ [i] represented by the following equation by shuffling from the value A for i = {0, 1}.

  The first shuffler 2 generates an Lm-bit value B ′ [i] represented by the following equation from the value B by shuffling for i = {0, 1}.

  The values A ′ [0], A ′ [1], B ′ [0], B ′ [1] are output to the carryless multiplication unit 3.

  In step S3, the carryless multiplication unit 3 calculates a carryless multiplication for the i = {0,1} by using the value A ′ [i] and the value B ′ [i] as input and the value C ′ [ i]. The values C ′ [0] and C ′ [1] are output to the second shuffle part and the third shuffle part.

However, CLM is a function that calculates a carry-free operation of 2 Lm bit input and Lm bit output.

  In step S4, the second shuffle unit 4 generates a value C represented by the following equation from the values C '[0], C' [1] by shuffling. The value C is output to the exclusive OR unit 7.

  In step S5, the third shuffle unit 5 generates a value D shown in the following equation from the values C '[0], C' [1] by shuffling. The value D is output to the remainder calculation unit 6.

  In step S <b> 6, the remainder calculation unit 6 calculates a remainder based on the irreducible polynomial f [X] with respect to the value D by the following equation by parallel bit operation, and generates a value D ′. The value D ′ is output to the exclusive OR unit 7.

  In step S <b> 7, the exclusive OR unit 7 calculates an exclusive OR of the value C and the value D ′, and generates a value E. The value E is output to the output unit 8.

  In step S8, the output unit 8 outputs the value E.

  As described above, the extension field multiplication technique of the present invention can simultaneously calculate L multiplications in parallel by two carryless multiplications when a multi-bit long carryless multiplication can be used. Therefore, the expansion field multiplication of 2 can be calculated at high speed.

  The present invention is not limited to the above-described embodiment, and it goes without saying that modifications can be made as appropriate without departing from the spirit of the present invention. The various processes described in the above embodiment may be executed not only in time series according to the order of description, but also in parallel or individually as required by the processing capability of the apparatus that executes the processes or as necessary.

[Program, recording medium]
When various processing functions in each device described in the above embodiment are realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, various processing functions in each of the above devices are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

DESCRIPTION OF SYMBOLS 10 Extension field multiplication apparatus 1 Input part 2 1st shuffle part 3 Carryless multiplication part 4 2nd shuffle part 5 3rd shuffle part 6 Remainder calculation part 7 Exclusive OR part 8 Output part

Claims (5)

Let A and B be values consisting of L elements of an m-th order expansion field of 2 and
For i = {0,1}, a value A ′ [i] shown in the following expression is generated from the value A, and a first shuffle part that generates a value B ′ [i] shown in the following expression from the value B;

For i = {0,1}, a carry-less multiplication unit that calculates a value C ′ [i] by multiplication without carry with the value A ′ [i] and the value B ′ [i] as inputs,
A second shuffle unit that generates a value C represented by the following expression from the values C ′ [0] and C ′ [1];

A third shuffle unit that generates a value D shown in the following equation from the values C ′ [0] and C ′ [1];

A remainder calculation unit for calculating a residue by an m-th irreducible polynomial f [X] for the value D and generating a value D ′;
An exclusive OR part for calculating an exclusive OR of the value C and the value D ′;
An expansion field multiplication device. The expansion field multiplication device according to claim 1,
The first shuffler and the carryless multiplier perform parallel and simultaneous processing for i = {0, 1}. An extension field multiplication method executed by an extension field multiplier including a first shuffle part, a carryless multiplication part, a second shuffle part, a third shuffle part, a remainder calculation part, and an exclusive OR part,
Let A and B be values consisting of L elements of an m-th order expansion field of 2 and
The first shuffle unit generates a value A ′ [i] represented by the following expression from the value A and a value B ′ [i] represented by the following expression from the value B for i = {0,1} Shuffle step,

A carry-less multiplication unit, for i = {0,1}, a value A ′ [i] and a value B ′ [i] as inputs and calculate a value C ′ [i] by carry-free multiplication;
A second shuffle unit for generating a value C represented by the following equation from the values C ′ [0] and C ′ [1]:

A third shuffle step in which a third shuffle unit generates a value D shown in the following equation from the values C ′ [0] and C ′ [1];

A residue calculating step for calculating a residue by an m-th irreducible polynomial f [X] for the value D and generating a value D ′;
An exclusive OR step in which an exclusive OR unit calculates an exclusive OR of the value C and the value D ′;
An extension field multiplication method including The expansion field multiplication method according to claim 3,
The first shuffle step and the carry-less multiplication step perform an extension field multiplication method in which i = {0, 1} are simultaneously processed in parallel.   A program for causing a computer to function as the expansion field multiplier according to claim 1.

Images