JPH10254683A - Remainder arithmetic device, information processor and remainder arithmetic method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a remainder arithmetic device capable of executing the arithmetic operation of the form of x<2> mod n or x.u mod n at a high speed. SOLUTION: This remainder arithmetic device for obtaining x<2> mod n for integers (n) and (x) (0<=x<n) is provided with a means for obtaining x<2> mod (n-1), the means for obtaining x<2> mod (n-2) and the means for obtaining the value of x<2> mod n based on the obtained value of x<2> mod (n-1) and the obtained value of x<2> mod (n-2). Also, the remainder arithmetic device for obtaining x.u mod u for the integers (n,) (x) (0<=x<n) and (u) (0<=u<n) is provided with the means for obtaining x.u mod (n-1,) the means for obtaining x.u mod (n-2) and the means for obtaining the value of x.u mod n based on the obtained value of x.u mod (n-1) and the obtained value of x.u mod (n-2).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

TECHNICAL FIELD The present invention relates to x ² mod n
Alternatively, the present invention relates to a modular arithmetic device, an information processing device, and a modular arithmetic method that execute an operation in the form of x · u mod n at high speed.

[0002]

2. Description of the Related Art The RSA encryption is one of the powerful public key encryption systems, but higher-speed encryption and decryption are desired. RSA
The reason why the encryption is relatively slow is that the modular exponentiation of a huge number M
^This is because the operations of ^e mod n and C ^d mod n are slow. The RSA encryption is described in, for example, Reference 1 (R. Riv
est, A .; Shamir and L.M. Adlema
n: “A Method for Obtaining
Digital Signatures and P
public Key Cryptosystem ", C
omm. ACM, Vol. 21, No. 2, pp. 12
0-126, 1978. ).

[0003] The point that this high speed is desired is the same in systems other than the RSA encryption, and the same structure as the RSA encryption, that is, the encryption system having the structure of ^ck mod n has exactly the same problem. The encryption method includes not only a so-called encryption method but also each method in the case where a similar algorithm is used for various purposes, such as a signature method or a key distribution method.

[0004] In order to solve this problem, several methods have been proposed as one method for realizing an operation of the form c ^k mod n without obtaining a ^b . For example, a power multiplication requires d-1 multiplications in a simple multiplication iteration, but a combination of squaring and multiplication based on the binary expansion of d gives 2
There is a method in which the number of multiplications is reduced to about log ₂ d.
There is also a method of reducing the number of multiplications such as addition chains. As another method, a method of substituting a part of the calculation by table search by preliminary calculation is also a practically effective method. There is also a method that can be applied only when the prime factorization of the modulus is known, for example, in the decryption process of RSA encryption. These methods are described, for example, in Reference 2 (DE Knoth: The Ar).
t of Computer Programming
Vol. 2.2nd ed. , Chapter 4,
1980), Reference 3 (Toshiya Ito, Kazue Sako: "Algorithms on Finite Fields and High-Speed Arithmetic of Multiple-Length / Remainder Operations", Information Processing, Vol. 34, No. 2, pp. 170-17)
9, 1993), Reference 4 (Morita Morita: "Cryptography and High-Speed Algorithms", Information Processing, Vol. 34, No. 3, pp. 33)
6-342, 1993).

[0005]

However, with the conventional method, a sufficient calculation speed cannot be obtained yet, and a further increase in the calculation speed is desired.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and provides a residue arithmetic device, an information processing device, and a residue arithmetic method capable of executing an operation in the form of x ² mod n or x · u mod n at high speed. The purpose is to provide.

It is another object of the present invention to provide a decoding apparatus and a decoding method in which a decoding operation is speeded up by performing a remainder multiplication at a higher speed.

[0008]

According to a first aspect of the present invention, there is provided a remainder calculating apparatus for calculating a remainder of an integer X whose modulus is n, a plurality of integers obtained by X using a plurality of integers other than n as a modulus. It is characterized by having means for obtaining from the remainder.

[0009] According to the present invention (claim 2),
Means for obtaining a remainder of an integer X whose modulus is n from a remainder of X whose modulus is a first integer other than n and a remainder of X whose modulus is a second integer other than n. And

Preferably, the integer is one which can be easily decomposed into prime factors or one which can be easily decomposed into a plurality of relatively prime integers.

The first integer and the second integer are, for example, n
-1 and n-2, n-1 and n + 1, n + 1 and n +
Any set, such as two sets, is possible.

The present invention (claim 3) is based on claim 1 or 2
Wherein the integer X is x ² (where x is an integer satisfying 0 ≦ x <n) or x · u (where x is an integer satisfying 0 ≦ x <n and u is 0 ≦ u <An integer satisfying n).

[0013] The remainder calculating method according to the present invention (claim 4)
A method for calculating a remainder of an integer X modulo a key n in a processing device to which a predetermined encryption method is applied, wherein the modulus is n
The process of obtaining the remainder of X as a first integer other than n and the process of obtaining the modulus from the remainder of X as a second integer other than n are executed sequentially or in parallel. The method is characterized in that a remainder of X whose modulus is n is obtained based on the two remainders.

According to the present invention (claim 5), in the remainder calculation method according to claim 4, the integer X is x ² (where x is an integer satisfying 0 ≦ x <n) or x · u (where x Is 0
≦ x <n and u is an integer satisfying 0 ≦ u <n).

In the present invention (claim 6), an integer n and an integer x
A modulo arithmetic device for obtaining x ² modn for (0 ≦ x <n), wherein a is an integer other than 0 and x ² mod
First processing means for obtaining (na), second processing means for obtaining x ² mod (n−b), where b is an integer other than 0 and a ≠ b, and x ² mod ( n-
and a third processing means for obtaining a value of x ² mod n based on the value of a) and the obtained value of x ² mod (n−b).

In the present invention (claim 7), an integer n and an integer x
X · u for (0 ≦ x <n) and integer u (0 ≦ u <n)
a modulo arithmetic unit for calculating mod n, wherein a is an integer other than 0, first processing means for obtaining x · u mod (na), and b is an integer other than 0 and a ≠ b,
a second processing means for calculating x · u mod (n−b), based on the calculated value of x · u mod (na) and the calculated value of x · u mod (n−b) Then x
A third processing means for obtaining a value of u mod n.

The above (na) and (nb) are preferably those which can be easily decomposed into prime factors or those which can be easily decomposed into a plurality of relatively prime integers.

The set of (na) and (nb) is, for example, a set of n-1 and n-2, a set of n-1 and n + 1, and n + 1
An arbitrary set such as a set of and n + 2 can be considered.

According to the present invention (claim 8), an integer n and an integer x
What is claimed is: 1. A residue calculating device for obtaining x ² modn for (0 ≦ x <n), wherein a first device for obtaining x ² mod (n−1)
Processing means for obtaining x ² mod (n−2)
And third processing means for calculating the value of x ² mod n based on the calculated value of x ² mod (n-1) and the calculated value of x ² mod (n-2) And characterized in that:

According to the present invention (claim 9), an integer n and an integer x
X · u for (0 ≦ x <n) and integer u (0 ≦ u <n)
A modular arithmetic unit for calculating mod n, wherein x · um
first processing means for obtaining od (n-1); x · um
second processing means for obtaining the od (n-2), the value of the obtained x · u mod (n-1) and the obtained x · u
x · u mod based on the value of mod (n−2)
and a third processing means for obtaining the value of n.

According to a tenth aspect of the present invention, in the residue calculating apparatus according to any one of the sixth to ninth aspects, each of the first processing means and the second processing means is a modulo modulo. In the case where the value to be assumed is expressed as the product of a plurality of disjoint values, the means for calculating the remainder of a given value modulo each disjoint value, and the same variable as the left side, Means for solving a simultaneous congruence using the prime value corresponding to the remainder of the right side as a modulus, and obtaining the obtained solution as a value to be obtained.

According to the present invention (claim 11), in the modular arithmetic device according to any one of claims 6 to 9, the third processing means may be a modulo of the modulus used in the first processing means. The value obtained by the first processing means and the second processing means, which are determined according to a set of a difference between the value and n and a difference between the value of the modulus used in the second processing means and n. Means for calculating a predetermined function using the value obtained by the above as an input, and obtaining the obtained solution as a value to be obtained.

According to the present invention (claim 12), in a processing apparatus to which a predetermined encryption method is applied, an integer x (0
A ≦ x <n) remainder calculation method for obtaining the x ² mod n for, as a non-zero integer and a, x ² mod
(Na), and before or after or in parallel with this, b is an integer other than 0 and a ≠ b, and x ² mo
d (n−b) is obtained, and the obtained x ² mod (n
The method is characterized in that a value of x ² mod n is obtained based on the value of −a) and the obtained value of x ² mod (n−b).

Preferably, a = 1 and b = 2 may be used.

[0025] Preferably, x ² is hit determining mod (n-a) and x ² mod the (n-b) respectively, in each, a value to be modulo remainder by the product of a plurality of disjoint values Each of the disjoint values in the case of being expressed is modulo, the remainder of a given value is obtained, then the same variable is set as the left side, the obtained remainder is set as the right side, and the remainder corresponding to the remainder of the right side is obtained. A simultaneous congruence equation modulo a prime value may be solved and the obtained solution may be set as a value to be obtained.

Preferably, x ² mod (n−
If the value of the value and x ² mod (n-b) of a) is obtained, then, determined according to a set of a and b, the values of the determined x ² mod (n-a) and x ² m
A predetermined function that receives the value of od (n−b) as an input may be calculated, and the obtained solution may be set as a value to be obtained.

According to the present invention (claim 13), in a processing apparatus to which a predetermined encryption method is applied, an integer x (0
≦ x <n) and integer u (0 ≦ u <n)
A modulo calculation method for calculating umod n, wherein x is set to an integer other than 0, x · mod (na) is obtained, and b is an integer other than 0 and a X · u mod (n−b) is obtained as ≠ b, and based on the obtained value of x · u mod (na) and the obtained value of x · u mod (n−b), X · u mod n to obtain the value of x · u mod n.

Preferably, a = 1 and b = 2 may be used.

Preferably, x · u mod (na)
And x · u mod (n−b), respectively, in each case, when a value to be used as a remainder is expressed as a product of a plurality of disjoint values, the respective disjoint values are modulo Determine the remainder of the given value, then the same variable as the left side, the determined remainder as the right side, solve the simultaneous congruence modulo the prime value corresponding to the remainder of the right side, The obtained solution may be set to a value to be obtained.

Preferably, x · u mod (n
Once the value of −a) and the value of x · u mod (n−b) are determined, it is then determined according to the set of a and b.
The calculated value of x · u mod (na) and x · u mod (na)
A predetermined function that receives the value of u mod (n−b) as an input may be calculated, and the obtained solution may be set as a value to be obtained.

According to the present invention (claim 14), the value of c ^k mod n is defined as x ² as data before conversion or data after conversion using a key corresponding to the pair of k and n as a key.
first arithmetic means for performing an operation of the form mod n (where 0 ≦ x <n) and y · mod n (where 0 ≦ y <
(n, 0 ≦ u <n). The information processing apparatus according to claim 1, wherein the second arithmetic unit executes an arithmetic operation in the form of an integer other than 0. as, x ² mod a first processing means for obtaining an (n-a), and b is an integer and a ≠ b other than 0, x ²
second processing means for calculating mod (n-b), the value of the determined x ² mod (na) and the determined x ²
x ² mod based on the value of mod (n−b)
a third processing means for obtaining a value of n, wherein the second arithmetic means includes a fourth processing means for obtaining y · u mod (na), and a y · u mod (n−b) Fifth to seek
Processing means and the determined yumod (na)
And a sixth processing means for obtaining a value of yumod n based on the value of y · mod (n−b).

The information processing device is, for example, an encryption device, a decryption device, a signature device, an authentication device, and a key distribution device.

Preferably, a = 1 and b = 2 may be used.

Preferably, each of x ² mod (na) and x ² mod (nb) is determined by calculating the value to be used as the remainder modulo the product of a plurality of disjoint values. Each of the disjoint values in the case of being expressed is modulo, the remainder of a given value is obtained, then the same variable is set as the left side, the obtained remainder is set as the right side, and the remainder corresponding to the remainder of the right side is obtained. A simultaneous congruence equation modulo a prime value may be solved and the obtained solution may be set as a value to be obtained.

Preferably, x ² mod (n−
If the value of the value and x ² mod (n-b) of a) is obtained, then, determined according to a set of a and b, the values of the determined x ² mod (n-a) and x ² m
A predetermined function that receives the value of od (n−b) as an input may be calculated, and the obtained solution may be set as a value to be obtained.

Preferably, yumod (na)
And y · u mod (n−b), respectively, in each case, when the value to be used as the remainder is expressed as the product of a plurality of disjoint values, the respective disjoint values are modulo Determine the remainder of the given value, then the same variable as the left side, the determined remainder as the right side, solve the simultaneous congruence modulo the prime value corresponding to the remainder of the right side, The obtained solution may be set to a value to be obtained.

Also, preferably, yumod (n
Once the value of -a) and the value of yumod (n-b) have been determined, they are then determined according to the set of a and b,
The obtained value of y · u mod (na) and y · u mod (na)
A predetermined function that receives the value of u mod (n−b) as an input may be calculated, and the obtained solution may be set as a value to be obtained.

According to the present invention (claim 15), the value of c ^k mod n is defined as x ² , using a pair of k and n as a key and a as data before conversion or data after conversion by a key corresponding to the key.
operation of the form mod n (where 0 ≦ x <n) and yu
mod n A (where 0 ≦ y <n, 0 ≦ u <n) modular reduction method in an information processing apparatus for determining by appropriately repeatedly executes the operation form of said x ² mo
In obtaining the value of dn, x is assumed to be an integer other than 0, x ² mod (na) is obtained, and b is an integer other than 0 and a
As ^{≠ b, x 2 mod (n} -b) the calculated, the obtained x ² mod x ² obtained and the value of (n-a)
x ² mod based on the value of mod (n−b)
In obtaining the value of n and the value of yumod n, x · u mod (na) is obtained, and before, in parallel with, or in parallel with this, x · u mod
(N−b) is obtained, and the obtained x · u mod (n−
The method is characterized in that the value of x · u mod n is obtained based on the value of a) and the obtained value of x · u mod (n−b).

It should be noted that the above-described inventions relating to the respective devices also hold as descriptions relating to methods, and the inventions relating to the respective methods described above also hold as descriptions relating to devices.

The above-described invention is also realized as a machine-readable medium storing a program for causing a computer to execute the corresponding procedure or means.

According to the present invention, the value of X (X is, for example, x ² or x · u) mod n is obtained from a plurality of remainders obtained by modulating a plurality of integers other than n with respect to X. , X mod n can be performed at high speed.

More specifically, the remainder whose modulus is n is represented by an operation based on a plurality of remainders obtained by modulating a plurality of integers other than n (for example, xa and xb). , N is n even if the prime factorization is difficult or impossible
Other integers can be easily factorized or factored into several relatively prime integers by choosing n and X mod
(X−a) and X mod (n−b) can be computed at high speed with the help of the Chinese Remainder Theorem, thereby obtaining X m
The operation speed of odn can be increased.

Thus, for example, x ² mod n
And “x · u mod n” can be realized at higher speeds.

[0044]

Embodiments of the present invention will be described below with reference to the drawings.

According to the present invention, X = x ² or X
= X · u (0 ≦ x <n, 0 ≦ u <n, x, u, and n are integers), and X mod n is X mod (na)
And a simple function of Xmod (n−b) (a and b are positive integers or negative integers other than 0; for example, a =
1, b = 2), n is chosen such that even if na is difficult or impossible, na and nb can easily be factored or decomposed into several relatively prime integer products X mod (na) and X mod (n-
By allowing b) to be operated at high speed with the help of the Chinese Remainder Theorem, the operation speed of X mod n is increased.

In the following, the notation y = _{na will} be referred to as n
Indicates that x and a are congruent modulo. Also, y
= _N a means congruent with a modulo n
(0 ≦ y <n).

First, FIG. 2 shows an example of a remainder calculation algorithm according to an embodiment of the present invention. Here, X in modulus n
Is shown as one calculation method of the remainder y = X mod n. In the encryption system, since x ² mod n and x u mod n for x satisfying 0 ≦ x <n and u satisfying 0 ≦ u <n are used, 0 ≦ X ≦ (n−1) ^Let it be ² .
Also, y ₁ = X mod (n−1), y ₂ = X mod
When obtaining (x ² mod n) which is d (n−2), y ₁ = x ² mod (n−1), y ₂ = x ² m
od (n−2), and when obtaining x · u mod n, y ₁ = x · u mod (n−1), y ₂ = x ·
u mod (n-2)).

First, X and n are input (step S).
1).

Here, 0 ≦ X ≦ (n−1) ² . When x ² mod n is obtained, X = x ² ,
When obtaining x · u mod n, X = x · u.

Next, conditional branching is performed according to the value of X. If X <n, y = X is output (step S2).
If (n-1) ² , y = 1 is output (step S3),
If X = n (n−2), y = 0 is output (Step S)
4).

If n ≦ X ≦ n ² −2n−1, first, y ₁ = X mod (n−1) and y ₂ = X mod
(N-2) the determined (step S5), and then conditional branch again, determine the y ₁ ≧ y ₂ if _{y = n 2y 1 -y 2 +2} , outputs y (step S6), y ₁ <y ₂ if y
= Seeking _n 2y ₁ -y _2, and outputs the y (step S
7).

Here, an application example of the algorithm Red of FIG. 2 is shown in FIG.
Shown in The list shown in FIG. 3 shows the values of y, y ₁ , and y ₂ for some values of X when n = 37 × 61 = 2257.

Now, arithmetic operations such as encryption and decryption in various encryption systems such as the RSA encryption require a modular exponentiation, which is a quadratic remainder and a modular multiplication, that is, x ² mod n x. u mod n.

However, as described above, y = x ² mod
Let n be y ₁ = x ² mod (n−1), y ₂ = x ² m
od (n-2) can be obtained by a simple calculation,
Similarly, change y = x · u mod n to y ₁ = x · u mod
(N-1), it can be determined by simple calculation from _{y 2 = x · umod (n} -2). As will be described later in detail, the calculation of y ₁ and y ₂ can be parallelized by using the Chinese remainder theorem, and the amount of time calculation can be reduced. Therefore, x ² mod n and x · mod n
Can be obtained at high speed.

As will be described later, x ² mod n
, Y ₁ = x ² mod (n−1) and y ₂ =
x ² mod (n−2) is obtained when x · u mod n is obtained by the procedures of FIGS. 4 and 5, respectively, and y ₁ = x
U mod (n-1) and y ₂ = x u mod
(N-2) can be obtained at high speed by the procedures shown in FIGS. 8 and 9, respectively.

Next, a description will be given of a modular-square arithmetic device according to an embodiment of the present invention.

As shown in FIG. 1, the quadratic residue arithmetic device 2
Is x ² mod n for n and x (0 ≦ x <n)
Is a device that obtains and outputs

The quadratic residue arithmetic device 2 is different from FIG.
X ² mod n is obtained according to the procedures shown in FIGS.

Here, X = x ² , y ₁ = x ² mod
(N-1), a ^{_{y 2 = x 2 mod (n}} -2).

First, x and n are input (step S)
1).

Here, 0 ≦ x <n.

[0062] Next, conditional branch by the value of x ^2, x ² <
n If outputs y = x ² (step S
^{2), x 2 = (n} -1) outputs a ² if y = 1 (step S3), and outputs a ^{x 2 = n (n-2} ) if y = 0 (step S4).

If n ≦ x ² ≦ n ² −2n−1,
First, y ₁ = x ² mod (n−1) and y ₂ = x ²
mod (n-2) the determined (step S5), and again to conditional branch, y ₁ ≧ y ₂ if y = _n 2y ₁ -y ₂ +
2 calculated, outputs y (step S6), and the calculated y ₁ <y ₂ if y = _n 2y ₁ -y _2, and outputs the y (step S7).

Next, with reference to FIG.
The procedure for obtaining y ₁ = x ² mod (n-1) in 5 will be described.

First, as a preliminary calculation, n-
Decompose 1 into products of relatively prime integers. Note that it is not always necessary to perform the prime factorization. Various methods such as a trial division method and a secondary sieving method can be used for this decomposition. n-1 = Π _{i = 1} ^h p _i Alternatively, when n is a public key in, for example, RSA cryptography, n-1 may be disclosed in the form of factorization to eliminate this preliminary calculation.

When p ₁ ... P _h are obtained, then x _i = x
mod p _i , i = 1,..., h are calculated (step S11).

Next, a _i = x _i ² , i = 1,..., H are calculated (step S12).

Next, a _i = a _i mod p _i , i =
, H are calculated (step S13). Note that a _i = a
_i mod p _i means to substitute a _i mod p _i for a _i .

Then, the following simultaneous congruence equation is solved using the Chinese Remainder Theorem (step S14). _{y 1 = p1 a 1 y 1} = p2 a 2 ... y 1 = pn a h It should be noted that the solution of using the Chinese Remainder Theorem coalition congruence, for example Iwanami course, the road to modern mathematics, Yoshihiko Yamamoto "Number Theory Getting Started 1 ", Iwanami Shoten.

According to the solution of the simultaneous congruence equation, y ₁ = x ²
mod (p ₁ · p ₂ ... _ph-1 · _ph ) = x ² mo
d (n-1) is obtained.

Next, referring to FIG. 5, y ₂ = x ² mo
The procedure for obtaining d (n-2) will be described.

As in the case of n-1, first, as a preliminary calculation, n-2 is decomposed into a product of relatively prime integers as in the following equation. Note that it is not always necessary to perform the prime factorization. Of course, in this case as well, various methods such as a trial division method and a secondary sieving method can be used for the decomposition. n−2 = Π _{i = 1} ^m q _{i When} n−1 is disclosed in the form of factorization as described above, n−2 is also disclosed in the form of factorization, and this preliminary calculation is performed. Is unnecessary.

When q ₁ ... Q _m are obtained, then x _i = x
Mod q _i , i = 1,..., m are calculated (step S21).

Next, a _i = x _i ² , i = 1,..., M are calculated (step S22).

Next, a _i = a _i mod q _i , i =
, M are calculated (step S23). Note that a _i = a
_i mod q _i means to substitute a _i mod q _i for a _i .

Then, the following simultaneous congruence equation is solved using the Chinese Remainder Theorem (step S24). _{y 2 = q1 a 1 y 2} = q2 a 2 ... y 2 = qm a m by the solution of the simultaneous congruence, y ^₂ = x ₂ mod
(Q ₁ · q ₂ ... q _m-1 · q _m ) = x ² mod (n-
2) is obtained.

Here, a calculation example of y ₁ and y ₂ for the case of n = 37 × 61 = 2257 will be described.

First, n-1 and n-2 are decomposed as preliminary calculations. n-1 = 2256 = 2 ⁴ × 3 × 47 = 47 × 48 n−2 = 2255 = 5 × 11 × 41 = 41 × 55, p ₁ = 47, p ₂ = 48, q ₁ = 41 , Q
_{It is} assumed that ₂ = 55.

Here, when x = 1065, x ² mo
dn shall be calculated.

First, y ₁ = x ² mod (n−1) is calculated.

In step S11, the following result is obtained. x ₁ = 1065 mod 47 = 31 x ₂ = 1065 mod 48 = 9 In step S12, the following result is obtained. a ₁ = 31 ² = 961 a ₂ = 9 ² = 81 In step S13, the following result is obtained. a ₁ = 961 mod 47 = 21 a ₂ = 81 mod 48 = 33 Then, in step S14, the following simultaneous congruence equation is solved using the Chinese remainder theorem, so that y ₁ = ₄₇₂₁ y ₁ = ₄₈ 33 y ₁ = X ² mod (n-1) = 1713.

Note that y ₁ is a solution of the following simultaneous congruence equation.

Y ₁ = ₄₇ ((1065 mod 4
7) ² ) mod 47 = 21 y ₁ = ₄₈ ((1065 mod ₄₈ ) ² ) mod ₄₈
= 33 Next, y ₂ = x ² mod (n−2) is calculated.

In step S21, the following result is obtained. x ₁ = 1065 mod 41 = 40 x ₂ = 1065 mod 55 = 20 In step S22, the following result is obtained. a ₁ = 40 ² = 1600 a ₂ = 20 ² = 400 In step S23, the following result is obtained. a ₁ = 1600 mod 41 = 1 a ₂ = 400 mod 55 = 15 Then, in step S24, the following simultaneous congruence equation is solved using the Chinese Remainder Theorem, so that y ₂ = ₄₁ 1 y ₂ = ₅₅ 15 y ₂ = X ² mod (n−2) = 2215.

Note that y ₂ is a solution of the following simultaneous congruence equation. y ₂ = ₄₁ ((1065 mod ₄₁ ) ² ) mod ₄₁
= 1 y ₂ = ₅₅ ((1065 mod ₅₅ ) ² ) mod ₅₅
= 15 Finally, since y ₁ = 1713 and y ₂ = 2215, in step S7, y = 2 × y ₁ −y ₂ = 2 ×
1713-2215 = 1211.

That is, y = 1065 ² mod 225
7 = 1211.

Here, x ² mod n is changed to y ₁ = x ²
FIG. 6 is a block diagram illustrating a configuration obtained from mod (n−1) and y ₂ = x ² mod (n−2).

In FIG. 6, 12-1 to 12-h correspond to steps S11 to S13 in FIG. 4, 14 corresponds to step S14 in FIG. 4, and 16-1 to 16-m correspond to FIG. Steps S21 to S23, 18 corresponds to step S24 in FIG. 5, and 19 corresponds to S6 and S7 in FIG.

Assuming that p _{1 to} p _h are of substantially the same size, the speed of each calculation of 12-1 to 12-h is x
^The speed is increased by an order of 1 / h ² with respect to ² mod (n−1) (since the time required for the square calculation is almost proportional to the square of the number of digits).

Accordingly, one CPU 12-1 to 12-
When each calculation of h is executed in order, 1 / h ² × h = 1 /
h, the calculation speed is increased in the order of 1 / h with respect to x ² mod (n−1).

Also, since the calculations of 12-1 to 12-h can be executed in parallel, if h CPUs are used, the calculation of 12-1 to 12-h is performed.
If each calculation of the 2-h was executed simultaneously, computation speed is faster in the 1 / h ² orders.

The above points are the same for the calculations of 16-1 to 16-m, and the speed can be increased by 1 / m ² to 1 / m.

Further, using h + m CPUs, 12
The calculations -1 to 12-h and the calculations 16-1 to 16-m can all be executed simultaneously. This case is the fastest, and min (1) for x ² mod (n−1).
/ H ² , 1 / m ² ), the calculation speed is increased.

Further, using a single CPU, 12-1 to 1
2-h each and every calculation of each calculation and 16-1 to 16-m of even when calculated in order, the case of x ² mod (n-1) with respect to 1 / h + 1 / m ( h = m, 2 / H), the calculation speed is increased.

Next, the calculation for solving the congruence formula of 14 and 18 can be performed at high speed by using the well-known Chinese remainder theorem. The calculation of 14 and the calculation of 18 can be performed simultaneously.

Furthermore, the operation of 19 is only a simple judgment and calculation, and this can also be calculated at a high speed.

Therefore, as shown in the block diagram of FIG. 6, without directly calculating x ² mod n, y ₁ = x ²
mod (n-1) and y ₂ = x ² mod (n-
2) that the value of x ² mod n can be obtained at high speed.

Next, a modular multiplication unit according to an embodiment of the present invention will be described.

As shown in FIG. 7, the modular multiplication unit 4
Is a device for obtaining and outputting x · u mod n for n, x (0 ≦ x <n) and u (0 ≦ u <n).

This modular multiplication unit 4 is different from FIG.
X · u mod n is obtained by the procedure shown in FIGS. 8 and 9.

Here, X = x · u, y ₁ = x · um
od (n-1), y ₂ = x ・ mod (n-2).

First, x, u, and n are input (step S).
1).

Here, 0 ≦ x <n and 0 ≦ u <n.

Next, conditional branching is performed according to the value of x · u.
If u <n, y = x · u is output (step S2). If x · u = (n−1) ² , y = 1 is output (step S3), and x · u = n (n−2). ) If y = 0
Is output (step S4).

If n ≦ x · u ≦ n ² −2n−1, first, y ₁ = x · u mod (n−1) and y ₂ =
x · u mod (n−2) is obtained (step S5),
Here also, conditional branching is performed, and if y ₁ ≧ y ₂ , y = _n 2y ₁
−y ₂ +2 is determined, y is output (step S6), and y _{1 is} calculated.
<Asking y ₂ if y = _n 2y ₁ -y _2, and outputs the y (step S7).

Next, with reference to FIG.
The procedure for obtaining y ₁ = x · u mod (n−1) in 5 will be described.

First, as a preliminary calculation, n−
Decompose 1 into products of relatively prime integers. Note that it is not always necessary to perform the prime factorization. As in the case of FIG. 4, various methods such as a trial division method and a secondary sieving method can be used for this decomposition. n-1 = Π _{i = 1} ^h p _i Alternatively, as in the case of FIG. 4, when n is a public key in, for example, RSA encryption, n-1 is made public in the form of factorization, and this preliminary calculation is performed. May be unnecessary.

When p ₁ ... _Ph are obtained, then x _i = x
mod p _i , i = 1,..., h and u _i = u mo
_{d p i, i = 1,} ..., it calculates the h (step S3
1).

Next, a _i = x _i × u _i , i = 1,.
h is calculated (step S32).

Next, a _i = a _i mod p _i , i =
, H are calculated (step S33). Note that a _i = a
_i mod p _i means to substitute a _i mod p _i for a _i .

Then, the following simultaneous congruence equation is solved using the Chinese remainder theorem (step S34). y ₁ = _{p 1} a ₁ y ₁ = _{p 2} a ₂ ... y ₁ = _pn a _h By the solution of this simultaneous congruential equation, y ₁ = x · u mod
(P ₁ · p ₂ ... _ph-1 · _ph ) = x · u mod (n
-1) is obtained.

Next, referring to FIG. 9, y ₂ = x · um
A procedure for obtaining od (n-2) will be described.

As in the case of n-1, first, as a preliminary calculation, n-2 is decomposed into a product of relatively prime integers as in the following equation. Note that it is not always necessary to perform the prime factorization. Of course, also in this case, various methods such as a trial division method and a secondary sieving method can be used. n−2 = Π _{i = 1} ^m q _{i When} n−1 is disclosed in the form of factorization as described above, n−2 is also disclosed in the form of factorization, and this preliminary calculation is performed. Is unnecessary.

When q ₁ ... Q _m are obtained, then x _i = x
mod q _i , i = 1,..., m and u _i = u mo
dq _i , i = 1,..., m are calculated (step S4).
1).

Next, a _i = x _i × u _i , i = 1,.
m is calculated (step S42).

Next, a _i = a _i mod q _i , i =
, M are calculated (step S23). Note that a _i = a
_i mod q _i means to substitute a _i mod q _i for a _i .

Then, the following simultaneous congruence equation is solved using the Chinese Remainder Theorem (step S44). _{y 2 = q1 a 1 y 2} = q2 a 2 ... y 2 = qm a m by the solution of the simultaneous congruence, y ^₂ = x ₂ mod
(Q ₁ · q ₂ ... q _m-1 · q _m ) = x ² mod (n-
2) is obtained.

Here, a calculation example of y ₁ and y ₂ for the case of n = 37 × 61 = 2257 will be described.

First, n-1 and n-2 are decomposed as preliminary calculations.

[0120] The substance decomposes ^{n-1 = 2256 = 2 4} × 3 × 47 = 47 × 48 n-2 = 2255 = 5 × 11 × 41 = 41 × 55, p 1 = 47, p 2 = 48, q ₁ = 41, q
_{It is} assumed that ₂ = 55.

Here, it is assumed that x · u mod n is calculated when x = 639 and u = 1775.

First, y ₁ = x · u mod (n−1)
Is calculated.

At step S31, the following result is obtained. x ₁ = 639 mod 47 = 28 x ₂ = 639 mod 48 = 15 u ₁ = 1775 mod 47 = 36 u ₂ = 1775 mod 48 = 47 In step S32, the following result is obtained. a ₁ = 28 × 36 = 11064 a ₂ = 15 × 47 = 705 In step S33, the following result is obtained. a ₁ = 1008 mod 47 = 21 a ₂ = 705 mod 48 = 33 Then, in step S34, the following simultaneous congruence equation is solved using the Chinese remainder theorem, so that y ₁ = ₄₇ 21 y ₁ = ₄₈ 33 y ₁ = X ² mod (n-1) = 1713.

Incidentally, y ₁ is a solution of the following simultaneous congruence equation.

Y ₁ = ₄₇ ((639 mod ₄₇ ) ×
(1775 mod 47)) mod 47 = 21 y ₁ = ₄₈ ((639 mod ₄₈ ) × (1775 mod)
d48)) mod 47 = 33 Next, y ₂ = x · u mod (n−2) is calculated.

In step S41, the following result is obtained. x ₁ = 639 mod 41 = 24 x ₂ = 639 mod 55 = 34 u ₁ = 1775 mod 41 = 12 u ₂ = 1775 mod 55 = 15 In step S42, the following result is obtained. a ₁ = 24 × 12 = 288 a ₂ = 34 × 15 = 510 In step S43, the following result is obtained. a ₁ = 288 mod 41 = 1 a ₂ = 510 mod 55 = 15 Then, in step S24, the following simultaneous congruence equation is solved using the Chinese remainder theorem, so that y ₂ = ₄₁₁ 1 y ₂ = ₅₅ 15 y ₂ = X ² mod (n−2) = 2215.

Incidentally, y ₂ is a solution of the following simultaneous congruential equation. y ₂ = ₄₁ ((639 mod ₄₁ ) × (1775 mo
d41)) mod41 = 1 y ₂ = ₅₅ ((639 mod ₅₅ ) × (1775 mo)
d55)) mod55 = 15 Finally, since it is _{y 1 = 1713, y 2 =} 2215, in step _{S7, y = 2 × y 1} -y 2 = 2 ×
1713-2215 = 1211.

That is, y = 639 × 1775 mod
2257 = 1211.

Here, x · u mod n is represented by y ₁ = x ·
u mod (n-1) and y ₂ = x · u mod (n
-2) can be represented by a block diagram as shown in FIG.
become that way.

In FIG. 10, 22-1 to 22-h are
8 corresponds to steps S31 to S33 in FIG. 8, 24 corresponds to step S34 in FIG. 8, and 26-1 to 26-m correspond to FIG.
2 corresponds to step S44 in FIG. 9, and 29 corresponds to S6 and S7 in FIG.

In this case as well, as in the case of FIG.
In each of the calculations 1 to 22-h and each of the calculations in 24-1 to 24-m, the speed of each calculation itself is x · u mod (n−
1) It is faster, and the processing speed can be further increased by parallelizing the processing using a plurality of CPUs.

As described above, the calculation for solving the congruence formula of 24 and 28 can be performed at high speed by using the well-known Chinese Remainder Theorem. Further, the calculation of 14 and the calculation of 18 can be performed simultaneously. Can also.

Furthermore, the operation 29 is only a simple judgment and calculation, and this can also be calculated at a high speed.

Therefore, as shown in the block diagram of FIG. 10, without calculating x.u mod n directly, y ₁ =
x · u mod (n−1) and y ₂ = x · u mod
(N-2), x · u mo
It can be seen that the value of dn can be obtained at high speed.

Next, FIG. 11 shows a procedure equivalent to FIG.

According to this procedure, the quadratic residue arithmetic unit 2 in FIG.
Finds x ² mod n, y is the same as in the previous case.
₁ = x ² mod (n-1), y ₂ = x ² mod
(N-2).

First, x and n are input (step S10).
1).

Here, 0 ≦ x <n.

Next, y ₁ = x ² mod (n−1) and y ₂ = x ² mod (n−2) are obtained (step S).
102).

The procedure for obtaining y ₁ = x ² mod (n−1) is the procedure of FIG. 4, and y ₂ = x ² mod (n)
The procedure for obtaining -2) is the procedure in FIG. Note that p ₁
... p _h, Determination of q ₁ ... q _m are the same as described above, may be a method of obtaining by calculation may be the manner in which externally applied.

Here, conditional branching is performed, and if y ₁ = ₂ , y = _n
y ₁ next (step S103), y _1> y ₂ if y = _n 2y ₁ -y ₂ +2 next (step S10
4) If y ₁ <y ₂ , y = _{n 2} y ₁ −y ₂ (step S 105).

Here, without directly calculating x ² mod n, y ₁ = x ² mod (n−1) and y ₂ = x ²
FIG. 6 is a block diagram showing a configuration obtained from mod (n−2) and x ² mod as described above.
It can be seen that the value of n can be obtained at high speed.

On the other hand, when the modular multiplication unit 4 of FIG. 7 obtains x · u mod n according to this procedure, y ₁ = x · u mod (n−1) and y ₂ = x ·
umod (n-2).

First, x, u and n are inputted (step S).
101).

Here, 0 ≦ x <n and 0 ≦ u <n.

Next, y ₁ = x · u mod (n−1)
And y ₂ = x · u mod (n−2) (step S102).

The procedure for obtaining y ₁ = x ² mod (n−1) is the procedure shown in FIG. 8, and y ₂ = x ² mod (n)
The procedure for obtaining -2) is the procedure in FIG. Note that p ₁
... p _h, Determination of q ₁ ... q _m are the same as described above, may be a method of obtaining by calculation may be the manner in which externally applied.

Here, conditional branching is performed, and if y ₁ = ₂ , y = _n
y ₁ next (step S103), y _1> y ₂ if y = _n 2y ₁ -y ₂ +2 next (step S10
4) If y ₁ <y ₂ , y = _{n 2} y ₁ −y ₂ (step S 105).

Here, without directly calculating x · u mod n, y ₁ = x · u mod (n−1) and y ₂ = x
A configuration obtained from u mod (n−2) is represented by a block diagram as shown in FIG. 10, and as described above, x ·
It can be seen that the value of u mod n can be obtained at high speed.

In the above, the remainder of n has been calculated using the remainder of n-1 and the remainder of n-2. However, if the remainder can be easily decomposed into a product of two or more integers, n- Even if it is not the remainder of 1 and the remainder of n-2, the remainder of na can be generally used. For example, various methods such as a method using the remainder of n−1 and n + 1 are conceivable.

For example, to find the remainder of n, the remainder of n + 1 and the remainder of n + 2 may be used. in this case,
x ² mod n or x · u mod n is expressed as x ² mod n
mod (n + 1) and x ² mod (n + 2) or x · u mod (n + 1) and x · u mod
A procedure as shown in FIG. 12 is obtained as a procedure using (n + 2).

When the modulo square arithmetic unit 2 of FIG. 1 obtains x ² mod n according to the procedure of FIG. 12, y ₁ = x ² m
od (n + 1) and y ₂ = x ² mod (n + 2).

First, x and n are input (step S20).
1).

Here, 0 ≦ x <n.

Next, y ₁ = x ² mod (n + 1) and y ₂ = x ² mod (n + 2) are obtained (step S).
202).

The procedure for obtaining y ₁ = x ² mod (n + 1) is the procedure in FIG. 4, and y ₂ = x ² mod (n
The procedure for finding +2) is the procedure in FIG. Where n
^{_{+ 1 = Π i = 1 h}} p i, is _{n + 2 = Π i = 1} m q i. Incidentally, p ₁ ... p _h, Determination of q ₁ ... q _m are the same as described above, may be a method of obtaining by calculation may be the manner in which externally applied.

Here, conditional branching is performed, and if y ₁ = ₂ , y = _n
y ₁ next (step S203), y ₁ <y ₂ if y = _n 2y ₁ -y ₂ +2 next (step S20
4), a y _1> y ₂ if y = _n 2y ₁ -y ₂ (step S205).

Here, without directly calculating x ² mod n, y ₁ = x ² mod (n + 1) and y ₂ = x ²
FIG. 6 is a block diagram showing a configuration obtained from mod (n + 2). However, in FIG.
Becomes y ₁ = x ² mod (n + 1), and the output of 18 becomes y ₂ = x ² mod (n + 2). Also in this case, as described above, it can be seen that the value of x ² mod n can be obtained at high speed.

On the other hand, when the modular multiplication unit 4 of FIG. 7 obtains x · u mod n according to the procedure of FIG. 12, y ₁ =
x · u mod (n + 1), y ₂ = x · u mod
(N + 2).

First, x, u, and n are input (step S).
201).

Here, 0 ≦ x <n and 0 ≦ u <n.

Next, y ₁ = x ² mod (n + 1) and y ₂ = x ² mod (n + 2) are obtained (step S).
202).

The procedure for obtaining y ₁ = x · u mod (n + 1) is the procedure of FIG. 8, and y ₂ = x · u mod
The procedure for obtaining (n + 2) is the procedure in FIG. Here, n + 1 = Π _{i = 1} ^h p _i and n + 2 = Π _{i = 1} ^m q _i . Incidentally, p ₁ ... p _h, Determination of q ₁ ... q _m are the same as described above, may be a method of obtaining by calculation may be the manner in which externally applied.

Here, conditional branching is performed, and if y ₁ = ₂ , y = _n
y ₁ next (step S203), y ₁ <y ₂ if y = _n 2y ₁ -y ₂ +2 next (step S20
4), a y _1> y ₂ if y = _n 2y ₁ -y ₂ (step S205).

Here, without directly calculating x · u mod n, y ₁ = x · u mod (n + 1) and y ₂ = x
FIG. 10 is a block diagram showing a configuration obtained from u mod (n + 2). However, in FIG. 10, the output of 24 is y ₁ = x · u mod (n + 1)
And the output of 28 is y ₂ = x · u mod (n +
2) Also in this case, as described above, x · u mo
It can be seen that the value of dn can be obtained at high speed.

In addition to the above, n-1, n-2, n
Various methods are conceivable, such as a method using the remainder of −3 and a method using the remainder of n−1 and n + 1.

Note that the present invention can be applied recursively. For example, in each of the above embodiments, the present invention can also be applied to the remainder calculation (the value obtained by decomposing na, for example, the above-mentioned remainder calculation modulo p ₁ ) when calculating the right side of the joint simultaneous equation, Further speedup can be expected.

In the following, a comparison will be made between the ordinary direct methods of modular square calculation and modular multiplication and this method on the assumption that parallel calculation is possible. Consider the computational complexity of multiplication and division by the bit complexity of a naive algorithm. That is, each calculation amount is as follows.

M (k, j) = j (k + j) = bit calculation amount of multiplication of k-bit number and j-bit number D (k, j) = j (k-j) = k-bit number by j-bit number In the following, n is k bits, p _i , q _i , i = 1,
The maximum number of..., H is j bits.

The conventional ordinary direct method requires multiplication of k-bit numbers and division of k-bit number divided by 2k-bit number. Therefore, the calculation amount is T ₀ = M (k, k) + D (2k, k) = 3k ² .

In the present method, in order to obtain the value on the right side of the simultaneous equation, division of the number of k bits divided by the number of j bits, multiplication of the number of j bits, and division of the number of j bits divided by the number of 2j bits are required. Its computational than above, the D (k, j) + M (j, j) + D (2j, j) = j (k-j) + 2j 2 + j 2 = j (k + 2j).

The solution of the simultaneous congruence equation is calculated by j bits and k
Multiplication by the number of bits and division by the number of k bits divided by the number of k + j bits are required. From the above, the calculation amount is M (k, j) + D (k + j, k) = j (k + j) + kj = j (2k + j).

Therefore, the calculation amount of the present method is as follows: T = 3j (k + j).

In particular, when j = k / 2 as in the above numerical example, T = 9/4 · k ^2, which is ／ of the direct method.
Further if the general j = k / K is, T = 3k / K · ( K + 1) / K · K = 3 (K + 1) k 2 / K 2 = (K + 1) is a / k ² · T _0. For example, if K = 4, the calculation amount can be reduced to about 30%.

By the way, the effectiveness of this method is n-1, n-
2 strongly depends on how small the prime factor is. maximum prime factor of integer x chosen in the following Tandamu r is r ^0.6 or less at about 50% probability (Reference 2). In other words, it can be expected that the maximum prime factor of a random number less than r with respect to the number of bits k of r is at most 0.6 k bits with half the probability. Further, as shown in the numerical examples, n may be set so as to be decomposed into three or more prime factors, and the calculation amount may be reduced.

Next, a case will be described in which the present invention is applied to the operation of a device that performs processing based on the encryption method.

The present invention can be applied to an apparatus that performs an operation expressed in the form of Y = c ^k mod n, and a typical one is based on an encryption method, a signature method, a key distribution method, and the like.
= C ^k mod n. Such devices include an encryption device, a decryption device, a signature device (a device that performs a signature, a device that authenticates a signature), a key distribution device, and the like.

For example, FIG. 13 is a diagram showing an encryption device 101 and a decryption device 102 according to the RSA encryption method. The encryption device 101 encrypts M corresponding to a plaintext and outputs C corresponding to a ciphertext. C is passed to the decryption device 102 via a predetermined transmission medium such as a communication medium or a recording medium, and the decryption device 102 decrypts C corresponding to a cipher text and outputs M corresponding to a plain text.

[0179] Given the keys e and n and the input M, the encryption device 101 calculates C = ^Me mod n.

On the other hand, given the keys d and n and the input C, the decryption device 102 calculates M = C ^d mod n.

As can be seen from the above, the encryption device 101 and the decryption device 102 have the same structure.

[0182] Now, usually, when performing the calculation in the form of M ^e mod n, first to calculate the Z = M ^e, then Z mod n
Is not used.

Here, regarding mod n, mod
n has the property that it is the same whether it is taken during the calculation or only once at the end. For example, a ² mod n = (a mod n) ² mod n or a × b mod n = ((a mod n) × (b m
od n)) mod n.

[0184] By utilizing this property, in the case of performing the calculation in the form of M ^e mod n, taking a mod n in the middle of a calculation,
A method of increasing the execution speed by not increasing the number of operations or reducing the number of operations is often adopted.

For example, as is well known, M ^em
od n are x ² mod n and x · u mod n
(0 ≦ x <n, 0 ≦ u <n) can be realized at high speed by repeating two types of operations.

One procedure is shown in FIG.

First, e is binary-expanded, and e = (e _k−1 , e
_k-2, ..., and e _{0) 2.} Then, C = 1 and i = k are initialized (step S301).

Thereafter, 1 is subtracted from i (step S30).
2), C = C × C mod n is calculated (step S3)
04), if e _i = 1, calculate C = C × M mod n (steps S305 and S306), and step S302
Is repeated until i <0 in step S303 and the process exits the loop.

Here, the above-described residue calculation of the present invention is applied to the residue calculation in step 304, and step 3 is performed.
By applying the modular multiplication of the present invention as described above to the modular multiplication of 06, the calculation of FIG. 14 can be executed at high speed.

FIG. 14 shows the procedure on the encryption device side, and the procedure on the decryption device side is also the same as that in FIG. 14 (M and C are exchanged and e is replaced with d). By applying the remainder calculation and the multiplication remainder calculation, the decoding operation can be executed at high speed.

The calculation in the form of Y = c ^k mod n is
There are various algorithms that are performed in a procedure different from that in FIG. 14, but in any case, x
^If a part of the calculation of ² mod n and / or x · u mod n is included, the present invention is applicable to that part as well.

Therefore, the present invention is applicable not only to an encryption device and a decryption device using the RSA encryption method, but also to Y = c ^k mod
perform an operation expressed in the form of n, or x ² mod
It is applicable to any device that performs operations expressed in the form n and / or x u mod n.

For example, Rabin encryption or ES
All devices using the IGN encryption method (signature method) have Y =
a device for performing an operation represented in the form of ^ck mod n,
The present invention is applicable.

Further, for example, Elgamal encryption method (signature method), Schnorr encryption method (signature method),
DSS encryption method (signature method), Fiat-Shamir
Encryption method (signature method), DH encryption method (key distribution method),
Each of the 3-pass protocol encryption systems (key distribution systems) is a device that performs an operation expressed in the form of Y = ^ck mod n, and the present invention can be applied. In addition, although n is a prime number for these things, if n is selected so that the values before and after n can be easily decomposed,
The present invention is applicable without any modification.

The present invention can be used in combination with other methods, for example, with Montgomery arithmetic.

Further, the present invention can be used in combination with a conventional method and, for example, the methods disclosed in References 1 to 4.

The above functions can also be realized as software. Further, the present invention can be embodied as a machine-readable medium storing a program for causing a computer to execute the above-described procedures or means.

The present invention is not limited to the above-described embodiments, but can be implemented with various modifications within the technical scope thereof.

[0199]

According to the present invention, the value of X (X is, for example, x2 or x · u) mod n is obtained from a plurality of residues obtained by modulating a plurality of integers other than n with respect to X. Therefore, an operation in the form of X mod n can be executed at high speed.

[Brief description of the drawings]

FIG. 1 is a diagram showing a modular-square arithmetic device according to an embodiment of the present invention;

FIG. 2 is a flowchart illustrating an example of a remainder calculation algorithm according to the embodiment of the present invention.

FIG. 3 is a diagram showing a specific example of numerical values obtained by applying the procedure of FIG. 2;

FIG. 4 is a flowchart showing an example of a procedure for obtaining x ² mod (n-1).

FIG. 5 is a flowchart showing an example of a procedure for obtaining x ² mod (n-2).

FIG. 6 is a block diagram showing a configuration for obtaining x ² mod n.

FIG. 7 is a diagram showing a modular multiplication unit according to an embodiment of the present invention.

FIG. 8 is a flowchart illustrating an example of a procedure for obtaining x · u mod (n−1).

FIG. 9 is a flowchart illustrating an example of a procedure for obtaining x · u mod (n−2).

FIG. 10 is a block diagram showing a configuration for obtaining x · u mod n;

FIG. 11 is a flowchart illustrating an example of a remainder calculation algorithm according to the embodiment of the present invention.

FIG. 12 is a flowchart illustrating an example of a remainder calculation algorithm according to the embodiment of the present invention.

FIG. 13 is a diagram showing an encryption device and a decryption device to which the present invention is applied;

[14] M ^e mod n a x ² mod n and x · u
A flow chart showing an example of a procedure for obtaining by repeating two kinds of operations of mod n

[Explanation of symbols]

2 ... operation Operations ^{16-1~16-m ... x 2 mod q} i quadratic residue calculation apparatus 4 ... modular multiplication apparatus ^{12-1~12-h ... x 2 mod p} i 14,18,24,28 ... operation 19, 29 ... synthesis calculation of the arithmetic 26-1~26-m ... x · u mod q i of operation 19 ... combining operation 22-1~22-h ... x · u mod p i for obtaining the solutions of simultaneous congruences

Claims (15)

[Claims] 1. A remainder calculating apparatus comprising: means for obtaining a remainder of an integer X whose modulus is n from a plurality of remainders obtained by using a plurality of integers other than n for X modulo. 2. A means for obtaining a remainder of an integer X whose modulus is n from a remainder of X whose modulus is a first integer other than n and a remainder of X whose modulus is a second integer other than n. A residue arithmetic device, comprising: 3. The integer X is x ² (where x is 0 ≦ x <
n) or x · u (where x is 0 ≦ x <n)
The remainder arithmetic device according to claim 1, wherein an integer satisfying and u is an integer satisfying 0 ≦ u <n). 4. A method for calculating a remainder of an integer X modulo a key n in a processing apparatus to which a predetermined encryption method is applied, wherein a remainder of X having a modulus modulo a first integer other than n is determined. A process and a process of obtaining a modulus from a remainder of X that is a second integer other than n are executed sequentially or in parallel, and a modulus is defined as n based on the obtained two remainders. X to do
Residue calculation method, characterized in that the remainder is obtained. 5. The integer X is x ² (where x is 0 ≦ x <
n) or x · u (where x is 0 ≦ x <n)
5. The method of claim 4, wherein u is an integer satisfying 0 ≦ u <n. 6. For an integer n and an integer x (0 ≦ x <n), x
² a remainder calculation device for determining a mod n, the integer other than 0 and a, and a first processing means for determining the ^{x 2 mod (n-a)} , and b is an integer and a ≠ b other than 0, x ² mod
(N-b) and a second processing means for determining a, ² a value of the obtained x ² mod (n-a) value and the obtained x ² mod (n-b) based on x m
and a third processing unit for obtaining a value of odn. 7. An integer n, an integer x (0 ≦ x <n) and an integer u
A modulo arithmetic unit for calculating x · u mod n for (0 ≦ u <n), wherein a is an integer other than 0 and x · u mod (na)
X · u mod where b is an integer other than 0 and a ≠ b
Second processing means for calculating (n−b), and x · u mod (n−b) based on the calculated value of x · u mod (na) and the calculated value of x · u mod (n−b). u
and a third processing means for obtaining a value of mod n. 8. For integer n and integer x (0 ≦ x <n), x
A modulo arithmetic unit for determining ² mod n, a first processing unit for determining x ² mod (n-1), a second processing unit for determining x ² mod (n-2), the value ^{of 2} mod (n-1) value and the obtained x ² mod ^(n-2) based on x ² mo
and a third processing unit for obtaining a value of dn. 9. An integer n, an integer x (0 ≦ x <n) and an integer u
A modulo arithmetic unit for obtaining x · u mod n for (0 ≦ u <n), a first processing unit for obtaining x · u mod (n−1), and x · u mod (n−2) Second processing means for obtaining, and x · u based on the obtained value of x · u mod (n−1) and the obtained value of x · u mod (n−2)
and a third processing means for obtaining a value of mod n. 10. Each of said first processing means and said second processing means converts each of said disjoint values when a value to be treated as a remainder is expressed by a product of a plurality of disjoint values. As a modulus, means for respectively calculating the remainder of a given value, and solving the simultaneous congruence equation in which the same variable is defined as the left side, the determined remainder is defined as the right side, and the prime value corresponding to the remainder of the right side is modulo. 10. The remainder calculating apparatus according to claim 6, further comprising: means for setting an obtained solution to a value to be obtained. 11. The third processing means includes: a difference between the modulus value used in the first processing means and n; and a difference between the modulus value used in the second processing means and n. A predetermined function which receives the value obtained by the first processing means and the value obtained by the second processing means, which is determined according to the set of 10. The remainder calculating device according to claim 6, further comprising: 12. A processing apparatus to which a predetermined encryption method is applied, wherein x ^{2 is used} for an integer x (0 ≦ x <n) using a key n as a modulus.
A modulo calculation method for obtaining mod n, wherein a is an integer other than 0, x ² mod (na) is obtained, and b is an integer other than 0 and a ≠ As b, x ² mod (n−
b) the seek, the value of the obtained x ² mod (n-a) value and the obtained x ² mod (n-b) based on x ² m
A residue calculation method, wherein a value of odn is obtained. 13. A processing apparatus to which a predetermined encryption method is applied, wherein an integer x (0 ≦ x <n) and an integer u (0
A method for calculating a remainder x · u mod n for ≦ u <n, where a is an integer other than 0 and x · u mod (na)
And before or after or in parallel with this, b
Is an integer other than 0 and a ≠ b, x · u mod
(N−b) is obtained, and x · u mod (n−a) is obtained based on the obtained value of x · u mod (n−a) and the obtained value of x · u mod (n−b).
A method for calculating a remainder, comprising determining a value of u mod n. 14. A pair of k and n as a key, and c as data before conversion or data after conversion by a key corresponding to the key.
Change the value of ^ck mod n to x ² mod n (where 0
≦ x <n) and a first operation means for executing an operation of y ·
an information processing apparatus for performing a calculation in a form of u mod n (where 0 ≦ y <n, 0 ≦ u <n), and by appropriately repeatedly executing the second calculation means, calculating means, as an integer other than 0 and a, and a first processing means for determining the ^{x 2 mod (n-a)} , and b is an integer and a ≠ b other than 0, x ² mod
(N-b) and a second processing means for determining a, ² a value of the obtained x ² mod (n-a) value and the obtained x ² mod (n-b) based on x m
third processing means for calculating the value of odn; fourth processing means for calculating y · u mod (na); and y · u mod (n−b). Fifth processing means for obtaining the value of y · u mod (n−a) and the value of y · u mod (n−b) based on the obtained value of y · u mod (n−b).
an information processing apparatus comprising: sixth processing means for obtaining a value of mod n. 15. A pair of k and n as a key and c as data before conversion or data after conversion by a key corresponding to the key.
Change the value of ^ck mod n to x ² mod n (where 0
≦ x <n) and an operation of y · u mod n (where 0
≦ y <n, 0 ≦ u <n) is a remainder calculation method in an information processing apparatus, which is obtained by appropriately and repeatedly executing an arithmetic operation in the form of ≦ y <n, 0 ≦ u <n). In obtaining the value of x ² mod n, X ² mod (n−a) is obtained as an integer other than x, and before or after or in parallel with this, b is an integer other than 0 and a ≠ b, and x ² mod (n−a)
b) the seek, the value of the obtained x ² mod (n-a) value and the obtained x ² mod (n-b) based on x ² m
In determining the value of odn and the value of yumodn, x · umod (na) is obtained, and before, in parallel with, or in parallel with this, x · umod (n− b)
Is calculated based on the obtained value of x · u mod (n−a) and the obtained value of x · u mod (n−b).
A method for calculating a remainder, comprising determining a value of u mod n.