JPH10269060A - Montgomery division device, montgomery inverse element calculation device, montgomery division method and montgomery inverse element calculation method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a Montgomery division device capable of obtaining a divided result in a Montgomery arithmetic area at a high speed. SOLUTION: This Montgomery division device 200 for obtaining the divided result Y in the Montgomery arithmetic area to be Y=B.A' (-1).2 n mod N for the integer (n) of (n)>=L when a bit length at the time of binarily expressing N is defined as L for a positive integer N, the positive integer A (0<=A<N and A and N are mutually prime) and the positive integer B is provided with a Montgomery inverse element calculation part 201 for inputting the integer A and a modulus N and obtaining an inverse element X=A (-1).2 (2n) mod N and a Montgomery multiplication part 202 for inputting the obtained inverse element X, the modulus N and the B and obtaining the divided result Y=B.X.2 (-n) mod N.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention repeatedly performs a multiple-length arithmetic operation using an odd integer as a modulus, such as encryption of data in data communication on a computer network or public key encryption used for confirming a communication partner. The present invention relates to a Montgomery division apparatus, a Montgomery inverse element calculation apparatus, a Montgomery division method, and a Montgomery inverse element calculation method for processing to be used.

[0002]

2. Description of the Related Art In information communication networks and computer systems, electronic information is exchanged and stored. In a situation where such a system is enlarged and used by an unspecified number of users, eavesdropping or falsification of information by a malicious user becomes a problem, and public key encryption technology is often used as a countermeasure.

[0003] In public key cryptography, there are many schemes realized by an operation modulo a multiple-precision odd integer, and the speeding up thereof affects performance. Among the four arithmetic operations modulo a multiple-precision odd integer, multiplication and division have a particularly large effect on processing time.
Among them, Montgomery arithmetic is known as a calculation algorithm suitable for repeatedly executing multiplication. The Montgomery algorithm is described in Ref. L. Montgome
ry, “Modularmultiplication
"without trial division",
Math. of Comp. Vol. 44, no.
170, pp. 519-521 (1985).

The Montgomery arithmetic method is a method of calculating a multiple-precision remainder multiplication with a processing amount of about twice the multiple-length multiplication. Multiple-precision remainder arithmetic often has lower performance than multiple-precision multiplication,
Higher speed can be realized. This Montgomery arithmetic method is a multiplication algorithm of the element of the Montgomery operation area (which is also the same remainder system). To perform multiplication in a general remainder system, first convert the multiplier and the multiplicand into the Montgomery operation area, and then Montgomery multiplication is performed, and finally the result is inversely transformed from the Montgomery operation area to the original remainder system. Since both the Montgomery transform and the inverse Montgomery transform are processes of about one multiple length multiplication, the overhead of the transform and the inverse transform is small in the exponentiation operation in which the remainder multiplication is repeated, and the speed can be increased. Therefore, RSA (Rivest-Sham)
The ir-Adleman) encryption and many other public key cryptosystems a modular exponentiation c = m ^e mod N in the residue system and its basic operation, can be effectively utilized the Montgomery algorithm (although simple Is not necessarily efficient because of the overhead of the transform and inverse transform.)

In recent years, various new cryptosystems have been studied and proposed. For example, elliptic curve cryptosystems have been receiving attention in public key cryptosystems. This is based on the expectation that the discrete logarithm problem on an elliptic curve is computationally more difficult than the prime factorization of a composite number on which RSA encryption is based.

Here, the basic operation of the elliptic curve cryptosystem will be briefly described.

In a finite field Fp (where p> 3), E (a, b) / Fp: y ² = x ³ + ax + b mod
p, where 0 ≦ a, b <p, an integer satisfying 4a ³ + 27b ² ≠
A curve defined by 0 mod p is called an elliptic curve on a finite field Fp. A point on the elliptic curve satisfies the above equation (x,
y) (where 0 ≦ x, y <p is an integer) and an infinity point O is added. This infinity point O is a unit element for addition.

The points on the elliptic curve form a group with respect to the following additions: Point P on elliptic curve = (x ₁ , y ₁ ), Q =
If the addition point of (x ₂ , y ₂ ) is S (x ₃ , y ₃ ),
It looks like this: _{However, -P = (x 1, -y} 1) is.

(1) When Q is a unit element O, S = P + Q = Q + P = P (2) When Q = -P, S = P + Q = Q + P = O (3) When P ≠ Q (where 1) Other than (2)), x ₃ = (y ₂ −y ₁ ) ² / (x ₂ −x ₁ ) ² −x ₁ −x
₂ mod py ₃ = (y ₂ −y ₁ ) (x ₁ −x ₃ ) / (x ₂ −x ₁ )
-Y ₁ mod p (4) When P = Q, For _{· y 1 ≠ 0 x 3 =} (3x 1 2 + a) 2 / (2y 1) 2 -2x 1 m
_{od p y 3 = (3x 1} 2 + a) (x 1 -x 3) / (2y 1) -
In the case of y ₁ mod p · y ₁ = 0 S = O Further, e (integer) of a point P = (x ₁ , y ₁ ) on the elliptic curve
The multiplication operation is defined as the repetition of the above addition as follows. eP = P + P +... + P (P is added e times) However, when e <0, the point (−P) is multiplied by (−e) ((−e) is positive). When e = 0, 0P = O.

In the elliptic curve cryptography, a scalar multiplication (power addition) of a point on the elliptic curve is a basic operation. For example, the operation occupies most of the processing in the elliptical ElGamal encryption, the elliptical ElGamal signature, the elliptic DH, and the like.

Therefore, while the RSA cryptosystem uses remainder multiplication as a basic operation, elliptic curve cryptography requires four arithmetic operations to realize the basic operation.

In the case where the basic operation is a repetition of a multiple-length arithmetic operation such as elliptic curve cryptography, the four arithmetic operations that require a long processing time are remainder multiplication and remainder division. In order to speed up the entire cryptographic process, it is necessary to speed up these remainder multiplication and remainder division. The remainder multiplication may use the Montgomery multiplication algorithm described in reference (1).

On the other hand, remainder division can be realized by a combination of inverse element calculation and remainder multiplication, and the inverse element can be generally calculated by an algorithm called extended Euclidean mutual division method. However, this algorithm is generally not very fast. As a higher-speed inverse element calculation method, a calculation method configured by right-shifting (multiplying by 1/2), addition, and subtraction of a multiple-precision integer is described in, for example, Reference (2) Ka.
liski, B .; S, Jr. , "The Montgo
Mary invers and and it's appli
site ", IEEE Tr. Comp., Vo
l. 44, no. 8, pp. 1064-1065, (A
ug. 1995).

However, the high-speed calculation method of the Montgomery multiplication of the above-mentioned reference (1) and the division in the remainder system of the reference (2) cannot be directly applied. This is because the conversion and inverse conversion between the Montgomery operation area and the original remainder system must be performed each time multiplication or division is performed, which increases overhead.

Further, there is no algorithm for efficiently obtaining the remainder division in the Montgomery operation area.

As described above, there is a problem that it is difficult to speed up the remainder division.

Therefore, there is a problem that it is difficult to speed up a cryptographic process in which the basic operation is an iterative process of four arithmetic operations (remainder operation), such as elliptic curve cryptography.

[0018]

As described above,
Conventionally, an algorithm for improving the efficiency of repetition processing of operations including multiplication and division in a modulo system, which is a basic operation of public key cryptography, has not been realized. There is a problem that it is difficult to improve the processing time.

The present invention has been made in view of the above circumstances, and provides a Montgomery inverse element calculation apparatus and method capable of rapidly obtaining an inverse element in a Montgomery operation area, and a method for rapidly dividing a Montgomery operation area. It is an object of the present invention to provide a Montgomery division device and method which can be obtained.

[0020]

Means for Solving the Problems The present invention (claim 1) provides:
For a positive integer N, a positive integer A (0 ≦ A <N, where A and N are relatively prime), and a positive integer B, where L is the bit length when N is expressed in binary, and n ≧ L. For Y = B
A Montgomery division device for obtaining a division result Y in a Montgomery operation area of A ⁻¹ · 2 ⁿ mod N,
Montgomery inverse element calculating means for obtaining the inverse element X = A ⁻¹ · 2 ²ⁿ mod N by inputting the inverse element X, the modulus N and B, and the division result Y = B · X · 2 ^-n mo
and Montgomery multiplication means for obtaining dN.

According to a second aspect of the present invention, in the Montgomery division device according to the first aspect, the Montgomery inverse element calculating means receives an integer A and a modulus N as inputs and obtains an intermediate result C = A ^-1.
Inverse element calculating means for obtaining 2 ^k mod N and a parameter k (L ≦ k ≦ 2L), and obtaining an inverse element X = C · 2 ^{2n− k} mod N by using the obtained intermediate result C, parameter k, and modulus N as inputs. And an inverse correction means.

According to the present invention (claim 3), a positive integer N, a positive integer A (0 ≦ A <N, A and N are relatively prime), a positive integer B
, L is the bit length when N is expressed in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ
A Montgomery division device for obtaining a division result Y in a Montgomery operation area of mod N, wherein an integer A and a modulus N are input and a first intermediate result C = A ⁻¹ · 2 ^k mod N and a parameter k (L ≦ k .Ltoreq.2L), a second intermediate value obtained by inputting the obtained first intermediate result C, modulo N and B,
Montgomery multiplication means for obtaining an intermediate result D = B · C · 2 ⁻ⁿ mod N, a second intermediate result D obtained by the Montgomery multiplication means, a parameter k obtained by the inverse element calculation means, and a modulus N , The result of division Y = D
-Inverse correction means for obtaining ^22n-K mod N is provided.

The present invention (claim 4) provides a positive odd integer N and a positive integer A (0 ≦ A <N, where A and N are relatively prime).
Assuming that the bit length when N is expressed in binary is L, Montgomery inverse element calculation apparatus for finding the inverse element X in the Montgomery operation area where X = A ^-1・²ⁿ mod N for an integer n where n ≧ L And the intermediate result C =
A- ¹ · 2 ^k mod N and parameter k (L ≦ k ≦ 2
L), an inverse element X = ^{CＣ2 2n−k} with the obtained intermediate result C, parameter k and modulus N as inputs.
and an inverse correction means for obtaining mod N.

According to the present invention (claim 5), in the Montgomery inverse element calculation device according to claim 4, a plurality of registers for storing intermediate variables therein, and a bit shifter for shifting the registers right or left are provided. An adder / subtractor for adding or subtracting the contents of two registers, and a determiner for comparing the contents of the two registers and determining the value of a predetermined bit position inside the register; The invention is characterized in that the inverse element correction unit is configured.

According to the present invention (claim 6), for a positive odd integer N and a positive integer A (0 ≦ A <N, A and N are relatively prime),
Assuming that the bit length when N is expressed in binary is L, Montgomery inverse element calculation apparatus for finding the inverse element X in the Montgomery operation area where X = A ^-1・²ⁿ mod N for an integer n where n ≧ L Where U = N, V =
A, T = 0, S = 1, k = 0, and if the least significant bit of U is 0, U is shifted right, S is shifted left, k is increased by 1 and the least significant bit of V is If 0, shift V to the right, shift T to the left, and increase k by 1;
Is 1 and the least significant bit of V is 1, U>
If V, subtract V from U, shift U to the right, add S to T, shift S to the left, and increase k by 1. If the least significant bit of U is 1 and the least significant bit of V is If 1, U ≦ V, U is subtracted from V, V is shifted to the right, T is added to S, T is shifted to the left, and k is incremented by 1. When V = 0, if T ≧ N, N is subtracted from T, and then N to T
T is the value obtained by subtracting T from T, and T is the value obtained by subtracting T from N if T <N. The initial state is i = 0, and T obtained by the inverse calculation means is left. After shifting,
If T ≧ N, N is subtracted from T to increase i by 1. If T <N, a loop process of increasing i by 1 is performed while i <2n−k.
It is characterized by comprising inverse element correcting means for repeatedly setting T when X = 2n−k as an inverse element X.

According to the present invention (claim 7), in the Montgomery inverse element calculation device according to claim 6, a U register in which N is set as an initial state, a V register in which A is set as an initial state, A T register in which 0 is set as a state, an S register in which 1 is set as an initial state,
A k register whose initial state is set to 0, a bit shifter for executing a specified one of a U register right shift, a V register right shift, a T register left shift, and an S register left shift; A process of subtracting the contents of the V register from the U register, a process of subtracting the contents of the U register from the V register, a process of adding the contents of the S register to the T register, a process of adding the contents of the T register to the S register, and subtracting N from the T register An adder / subtracter for executing a specified one of a process, a process of subtracting the contents of the T register from N, and a process of adding 1 to the k register, and whether the least significant bit of the U register is 0 or not, Determination of whether the least significant bit is 0, whether the value of the V register is 0, and whether the value of the T register is N or more When, wherein the bit shifter, comprising a control unit for controlling the adder-subtractor and said determiner.

In the present invention (claim 8), a positive integer N, a positive integer A (0 ≦ A <N, A and N are relatively prime), a positive integer B
, L is the bit length when N is expressed in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ
A Montgomery division method for obtaining a division result Y in a Montgomery operation area of mod N, wherein a first step of obtaining an inverse element X = A ⁻¹・ 2 ⁿ mod N using an integer A and a modulus N as inputs is performed. And a second step of ^{obtaining a} division result Y = B ^× X 2 ⁻ⁿ mod N by using the inverse element X, the modulus N and B as inputs.

According to the present invention (claim 9), in the Montgomery division method according to claim 8, the first step comprises:
Intermediate result C = A ⁻¹ · 2 ^km with integer A and modulus N as inputs
and a parameter k (L ≦ k ≦ 2L), and an inverse element X = C · 2 ^2n−k mod N is obtained by using the obtained intermediate result C, parameter k, and modulus N as inputs. I do.

According to the present invention (claim 10), when a positive integer N, a positive integer A (0 ≦ A <N, A and N are relatively prime), and a positive integer B, when N is expressed in binary, Assuming that the bit length is L, for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ
A Montgomery division method for obtaining a division result Y in a Montgomery operation area of mod N, wherein an integer A and a modulus N are input and a first intermediate result C = A ⁻¹ .2 ^k mod N and a parameter k (L ≦ k ≦ 2L); and
The first intermediate result C obtained by this first step
And the second intermediate result D = B · C · 2 by using
^-n mod N, a second intermediate result D obtained by the second step, and the first
And a third step of obtaining a division result Y = D · 2 ^2n−K mod N using the parameter k and the modulus N obtained in the above step as inputs.

According to the present invention (claim 11), a positive odd integer N,
For a positive integer A (0 ≦ A <N, A and N are relatively prime), let L be the bit length when N is represented in binary, and n ≧
A Montgomery inverse element calculation method for obtaining an inverse element X in a Montgomery operation area of X = A ⁻¹ · ²ⁿ mod N with respect to an integer n of L, wherein an intermediate result C = A- ¹ · 2 ^k mod N and parameter k (L ≦ k ≦
2L) is obtained, and the inverse element X = C 22 ^{2 -k} mod N is obtained by using the obtained intermediate result C, parameter k, and modulus N as inputs.

According to the present invention (claim 12), a positive odd integer N,
For a positive integer A (0 ≦ A <N, A and N are relatively prime), let L be the bit length when N is represented in binary, and n ≧
A Montgomery inverse element calculation method for obtaining an inverse element X in a Montgomery operation area of X = A ⁻¹ · 2 2 ⁿ mod N for an integer n of L, where U = N in a binary representation, V
= A, T = 0, S = 1, k = 0, and if the least significant bit of U is 0, U is shifted right, S is shifted left, and k is 1
If the least significant bit of V is 0, V is shifted right, T is shifted left, and k is increased by 1;
If the least significant bit of U is 1 and the least significant bit of V is 1,
If> V, subtract V from U, shift U right, and add S to T
, S is shifted to the left, and k is increased by one. When the least significant bit of U is 1 and the least significant bit of V is 1, U ≦ V
Then, a series of loop processing consisting of subtracting U from V, shifting V to the right, adding T to S, shifting T to the left, and increasing k by 1 is repeated while V> 0. = 0, if T ≧ N, then subtract N from T, then N to T
A first step in which T is a value obtained by subtracting T from N if T <N, and an initial state i = 0,
After shifting T obtained in the first step to the left, if T ≧ N, N is subtracted from T, i is increased by 1, and T <
If N, the loop processing of increasing i by 1 is repeated while i <2n−k, and T when i = 2n−k is replaced by the inverse element X
And a second step.

According to the present invention, since the Montgomery inverse element calculation means and the Montgomery multiplication means for performing the Montgomery inverse element calculation in the Montgomery operation area are used, the division result in the Montgomery operation area is input with the Montgomery operation area element as an input. Can be obtained directly. As a result, since there is no overhead of conversion and inverse conversion between the Montgomery operation area and the original remainder system, division in the Montgomery operation area can be realized at high speed.

Further, according to the present invention, the Montgomery inverse element calculation can be performed in the Montgomery operation area, and there is no overhead of conversion and inverse conversion between the Montgomery operation area and the original remainder system. Can be realized at high speed.

Further, according to the present invention, the inverse calculation in the Montgomery operation area can be realized by addition / subtraction of a multiple-length register and bit shift, so that a high-speed device configuration can be realized by either software implementation or hardware implementation. Become. further,
A high-speed device configuration can also be realized for division in the Montgomery operation area.

Therefore, in an encryption such as an elliptic curve encryption which uses a repetition of an operation including multiplication and division in a remainder system as a basic operation, the overall processing time can be shortened.

The present invention relating to the apparatus is also realized as an invention relating to a method, and the present invention relating to a method is also realized as an invention relating to an apparatus.

The present invention relating to an apparatus or a method is provided for causing a computer to execute a procedure corresponding to the present invention (or for causing a computer to function as means corresponding to the present invention, or a computer corresponding to the present invention). The present invention is also realized as a computer-readable recording medium in which a program for realizing the function of performing the above is recorded.

[0038]

Embodiments of the present invention will be described below with reference to the drawings.

In the following, for integers s and u, s
mod u represents the remainder when s is divided by u.

As described above, it is generally known that multiplication in the Montgomery operation area can be implemented more efficiently than multiplication in the remainder system. May be used. However, there are ciphers that use not only multiplication but also division and inverse element calculation for encryption / decryption like the RSA encryption. For example, in elliptic curve cryptography, a unit operation is configured by combining four arithmetic operations in the remainder system, and an encryption algorithm is configured by repeating the unit operation a predetermined number of times. However, there is nothing that can be efficiently implemented as division or inverse element calculation in the Montgomery operation area, and in the case where unit arithmetic is formed by combining four arithmetic operations in a remainder system such as elliptic curve cryptography, the Montgomery operation area It was difficult to improve the efficiency of processing using

The dividing device and the inverse computing device according to the present embodiment can efficiently obtain the results of the remainder division and the inverse computing in the Montgomery operation area, respectively.

First, the relationship between a normal remainder system Zp (representing a remainder system modulo p) and a Montgomery operation area and an operation in the Montgomery operation area will be described.

FIG. 12 shows the Montgomery operation area and the remainder system Zp.
2 shows a relationship between a domain, an element, an inverse element, and four arithmetic operations of addition, subtraction, multiplication, and division between the two algebraic systems.

Although the modulus value p is an integer, an odd integer is preferably used. When applied to a cryptographic system, p is often a prime number.

When an element in the remainder system Zp is a, the element A in the Montgomery operation area corresponding thereto is given by A = a · R mod p.

On the other hand, the inverse transformation from the element A of the Montgomery operation area to the element a of the remainder system Zp is given by a = A · R ⁻¹ mod p.

Here, R is a parameter that defines the Montgomery operation area, and there are two conditions: (i) R and modulus p are relatively prime; and (ii) R> p.

In general, R is a power of 2 (R = 2 ⁿ ),
Further, a multiple of the word length of hardware is often used. In order to make the operation width as small as possible, when the number of bits of the modulus p is L, it is preferable to use the minimum value that satisfies n ≧ L and is a multiple of the word length. In the following, for the sake of simplicity, it is assumed that n is equal to the bit length L of the modulus p.

FIG. 13A shows that p = 23 and R = 2 ⁵ (n
= 5), the correspondence between the element a of the remainder system Zp and the element A of the Montgomery operation area is shown as an example (however, p used in an actual encryption device or the like is a very large integer).

It is assumed that R = 2 ⁿ is used in the division device and the inverse calculation device in the Montgomery operation area.

Next, the inverse element calculation and the four arithmetic operations in the Montgomery operation area are performed by A = a · R mod with respect to the element a of the remainder system Zp.
Considering that the element of the Montgomery operation area of p corresponds, it can be defined as shown in FIG.

First, addition and subtraction in the Montgomery operation area are defined by A + B mod p AB mod p, similarly to those in the remainder system.

Next, Montgomery multiplication is given by A · B · R ⁻¹ mod p.

Operations in other Montgomery operation areas are defined as follows based on Montgomery multiplication ABR ^-1 mod p.

The inverse element X of A is such a value that, when Montgomery multiplication is performed with A and X as multipliers and multiplicands, R as a unit element in the Montgomery operation area is given as a result. That is, the inverse element X is a value that satisfies A · X = R ² mod p.

Therefore, the modulus in the Montgomery operation domain is p
The inverse calculation for A is given by X = A ⁻¹ · R ² mod p.

The inverse calculation device according to the present embodiment, which will be described later, has X = A ⁻¹ · R ² mod with respect to the input A and the modulus p.
This is a device for efficiently obtaining p.

Similarly, Montgomery division where the modulus is p, A is a divisor, and B is a dividend is: Y = B · A ⁻¹ · R mod p = B · A ⁱ · R ⁻¹ mod p (where A ⁱ is given by the inverse of A in the Montgomery operation domain).

A dividing apparatus according to the present embodiment, which will be described later, is an apparatus for efficiently obtaining B ・^Ai・ R mod p with respect to inputs A and B and modulus p.

FIG. 13B shows that p = 23 and R = 2 ⁵ (n
= 5) is shown as an example of the correspondence between the element a and the inverse element x in the remainder system Zp. FIG. 13C shows that p
= 23, R = 2 ⁵ (n = 5), the correspondence between the element A and the inverse element X in the Montgomery operation area is shown as an example.

To use such a Montgomery operation, conversion from the remainder system Zp to a Montgomery operation region is first performed, and a predetermined operation process is repeated in the Montgomery operation region. Inverse conversion to Zp is performed. Note that each of these conversions and inverse conversions is a process of about one multiple length multiplication, and does not have a very large overhead as a whole.

Here, a specific example utilizing the Montgomery operation will be described.

For example, assume that p = 23 and R = 2 ⁵ (n = 5), and the inverse element x of the element a = 3 of the remainder system Zp is obtained using Montgomery arithmetic. First, the element a of the residue system Zp
= 3 is converted to the element A of the Montgomery operation area, A = 4 is obtained. Next, X = 3 is obtained as the inverse element X of the element A = 4 in the Montgomery operation area. Then, when the element X = 3 in the Montgomery operation area is inversely transformed into the element x of the remainder system Zp, x = 8 is obtained. When the inverse element x of the element a = 3 of the remainder system Zp is directly obtained by the remainder system, x = 8, which is consistent with the above result.

Further, for example, p = 23, R = 2 ⁵ (n =
5) Consider a case where multiplication 3 × 6 of the remainder system Zp is performed using Montgomery arithmetic. First, 3 and 6 of the residue system Zp are converted into 4 and 8 of the Montgomery operation area, and Y = 4 × 8 ×
From R ^-1 mod p, Y = 1 is obtained. When this is inversely transformed into the remainder system Zp, y = 18 is obtained as a multiplication result. Note that when y = 3 × 6 mod p is directly obtained by the remainder system Zp, y = 18, which is consistent with the above result.

Further, for example, p = 23, R = 2 ⁵ (n =
5) Consider a case where the remainder division 6/2 of the remainder system Zp is performed using Montgomery arithmetic. First, 6 and 2 of the remainder system Zp are converted into 8 and 18 of the Montgomery operation area, 16 is obtained as the inverse of the dividend 18, and Y = 8/18 × R ⁻¹ m
Y = 4 is obtained from od p = 8 × 16 × R ⁻¹ mod p. When this is inversely transformed into a remainder system Zp, y = 3 is obtained as a division result. Note that y = 6 /
When 2 mod p is obtained, y = 3, which is consistent with the above result.

In the following, the inverse calculation device and the division device in the Montgomery operation area according to the present embodiment will be described.

FIG. 1 shows a basic configuration of a division device in a Montgomery operation area according to an embodiment of the present invention. The division device 200 includes a Montgomery inverse element calculation unit 201 and a Montgomery multiplication unit 202.
And the Montgomery multiplication unit 202 are sequentially used to constitute the Montgomery division device 200.

In the present embodiment, Montgomery division Y = B ·
A ⁻¹ · R mod p is represented by Y = B · (A ⁻¹ · R ² ) · R ⁻¹ mod p = (B · (A ⁻¹ · R ² mod p) · R ⁻¹ mod p = B · X · R ⁻¹ mod p, and first, using the divisor A and the modulus p as inputs, the Montgomery inverse element calculation unit 201 obtains the inverse element X of A in the Montgomery operation area. Using the dividend B and the modulus p as inputs, the Montgomery multiplication unit 202 calculates Y = B × X ・ R
^-1 mod p, that is, Y = B · A ⁻¹ · R mod
Find p.

It is known that the Montgomery multiplication unit 202 can be realized at a higher speed than a multiplication unit in a remainder system, and in this embodiment, a known technique disclosed in, for example, Reference (1) can be used. .

FIG. 14 shows an example of the processing procedure in the Montgomery multiplication section 202. Here, it is described that A · B · R ⁻¹ mod N is calculated for two numbers A and B.

V = −N ⁻¹ mod R (ie, V ·
N = V that satisfies −1 mod R) (Step S)
101), T = AB is obtained (step S102),
= ((T mod R) · V) mod R is obtained (step S103), T + W · N is substituted for T (step S104), and T = T / R is executed (step S10).
5). If T> N (step S106), T
Is subtracted from N (step S107). T obtained at this time is a Montgomery multiplication result of A and B where the modulus is N. If R is a power of 2, the remainder calculation and the division are 2
It can be realized by cutting out the lower part or the upper part of the radix.
Further, by calculating the value of V with respect to the modulus N, it is possible to increase the processing efficiency.

FIG. 15 shows another example of the processing procedure in the Montgomery multiplication section 202. This processing procedure is obtained by improving the processing procedure of FIG. 14 and reducing the number of necessary operations to about two times multiple-precision multiplication. Here, A · B for two numbers A and B
Notation for calculating R ^-1 mod N A, B, N, and the like are assumed to be represented by a radix b. For example, A = _ar- ^1br-1 + _ar- ^2br-2 + ... +
a ₁ b + a ₀ . Here, the radix b is a power of 2, for example, 2 ⁸ or 2 ¹⁶ . Of course, b =
2 is acceptable.

V ₀ = −N ₀ ⁻¹ mod b (ie,
v v ₀₎ to seek to meet the _{0 · N 0 = -1 mod b} ,
Also, T = 0 and i = 0 (step S201), and T +
substituting a _i Bb ⁱ to T (step S202), m _i =
t _i v seek ₀ mod b (step S203), T
+ M _i Nb ⁱ a is substituted into T (step S204), 1 increasing i. Next, in step S206, i ≦ (r−
If 1), the process returns to step S202. Step S
If i> (r−1), the process exits the loop and moves to step S207, where T = T / R is executed (step S2).
07). If T> N (step S208),
N is subtracted from T (step S209). T obtained at this time is a Montgomery multiplication result of A and B where the modulus is N.

One feature of this procedure is that step S20
Immediately before the execution of 7, all the L blocks on the lower side of T become 0 (that is, T is a multiple of R). Therefore, the work area can be reduced. Also,
The remainder operation can be realized by cutting out the lower part of a binary number. Also,
By calculating the value of v ₀ with respect to the modulus N, the efficiency of the processing can be increased.

As described above, the Montgomery multiplication unit 202
Efficient realization is possible. Further, as will be described later in detail, according to the present invention, the Montgomery inverse element calculation unit 201 can be efficiently realized. Therefore, according to the division device 200 of the present embodiment, division in the Montgomery operation area can be efficiently executed.

FIG. 2 shows an example of the basic configuration of the inverse element calculation device 201 in the Montgomery operation area according to the present embodiment. Of course, this inverse element calculation device 201 can be used as the Montgomery inverse element calculation unit 201 of the Montgomery division device 200 in FIG.

The inverse element calculation unit 201 includes the inverse element calculation unit 30
1 and an inverse element correction unit 302.
The Montgomery inverse calculation device 201 is configured by sequentially using the inverse correction unit 302.

In the present embodiment, the inverse element calculation X = A ⁻¹ · R ²
Mod p = A ⁻¹ · 2 ²ⁿ modp, X = A ⁻¹ · (2 ^k · 2 ^2n−k ) mod p = (A− ¹ · 2 ^k ) · 2 ^2n−k mod p = (A ⁻¹⁾ • 2 ^k mod p) · 2 ^2n−k mod p = C · 2 ^2n−k mod p, first, the inverse element calculation unit using the integer A and the modulus p (where A is relatively prime to p) as input According to 301, C = A ^-1.
Find 2 ^k mod p and k. Here, k is not less than L and 2
It is an integer less than or equal to L and is a value uniquely determined from A and p. Next, the C, k, and modulus p are input and the inverse element correction unit 3
02, the inverse element X = C ・ 2 ^2−k mod p, that is, X = A ⁻¹ · R ² mod p is obtained.

FIG. 3 and FIG. 4 show an example of a processing procedure in the inverse calculation unit 301.

This procedure consists of the U register, V register, T
Using a multiple length register of four registers, a register and an S register, the register is configured by a shift operation to the left and right of the register and addition and subtraction of the registers, and the number of loop iterations is stored in a variable k used as a loop counter. The value of k is modulo p
Is L or more and 2L or less and the processing amount of addition and subtraction is O (L), so that the total processing amount is at most O (L ² ). Hereinafter, the procedures of FIGS. 3 and 4 will be described following the flow.

First, the given modulus p is stored in the register U,
The following positive integer A is set in register V: Further, 0 is set in the register T, 1 is set in the register S, and 0 is set in the register k (step S401). The above is the variable initialization processing.

Thereafter, steps S402 to S4
The process of 10 is repeated while the register V is a positive value (until it becomes 0).

First, if the value of the register V is not 0, the process is repeated, and the process jumps to step S403 (step S402).

It is determined whether the least significant bit of the register U is 0 (step S403). If 0, the register U is shifted right by one bit (step S411), and the register S is shifted left by one bit (step S41).
2), and skip to step S410. Then, step S4
At 10, the value of k is increased by 1, and the process returns to step S402.

If the least significant bit of register U is not 0 at step S403, the least significant bit of register V is 0
It is determined whether or not (step S404). If 0, the register V is shifted right by one bit (step S4).
13) The register T is shifted one bit to the left (step S414), and the process skips to step S410. Then, in step S410, the value of k is increased by 1, and in step S402
Return to

If the least significant bit of the register U is not 0 in step S403 and the least significant bit of the register V is not 0 in step S404, the magnitudes of the registers U and V are compared (step S405).

If U> V, the content of register V is subtracted from register U (step S415), register U is shifted right by one bit (step S416), and the content of register S is added to register T (step S416). S417),
The register S is shifted left by one bit (step S41).
8). Then, in step S410, the value of k is increased by 1, and the process returns to step S402.

If U <V or U = V as a result of step S405, the contents of register U are subtracted from register V (step S406), and register V is shifted right by one bit (step S407). Is added to the contents of the register T (step 408), and the register T is shifted one bit to the left (step S409). Then, in step S410, the value of k is increased by 1, and the process returns to step S402.

The above loop is repeated, and step S40
If the value of the register V becomes 0 in Step 2, the process proceeds to Step S419.
Move on to Then, first, it is checked whether or not the content of the register U is 1. Since the contents of register U are the greatest common divisor of input A and modulus p, if U is not 1, A and p are not disjoint, and there is no inverse of A.
Therefore, error processing is performed in step S423, and the process ends.

If it is not an error, that is, step S4
If the content of the register U is 1 in step 19, step S
At 420, a comparison is made between T and p. If T is greater than or equal to p, p is subtracted from T (step S421), and T becomes p.
It should be the following integer. Then, step S42
The result obtained by subtracting the contents of T from p in step 2 is stored in T, and the process ends.

By the above processing, the content of T is A ⁻¹ · 2
The calculation result of ^k mod p is stored.

Next, the values of T = A ⁻¹ .2 ^k mod p and k are input to the inverse correction unit 302 to calculate the Montgomery inverse value.

FIG. 5 shows an example of the processing procedure of the inverse correction unit 302. Hereinafter, the procedure of FIG. 5 will be described following the flow.

First, a value obtained by doubling n where R = 2 ⁿ is set to L, and a loop counter i is set to 0 (step S501).

Next, as the number of loop repetitions, L−k
Is obtained and set to m (step S502).

Thereafter, steps S503 to S5
Step 07 is repeated until the loop counter reaches m.

That is, i and m are compared in step S503, and if i is less than m, the register T is first shifted left by one bit (step S504). Next, T and p
(Step S505), and if T is p
If so, p is subtracted from T (step S506). Then, the value of i is increased by 1 in step S507, and the process returns to step S503.

If i = m in step S503, the process exits the above processing loop. The value of T at the time of exiting this loop is the Montgomery inverse value. Finally, step S
In step 508, the inverse value T is output, and the process ends.

Since the procedures of FIGS. 3, 4 and 5 described above are realized only by addition and subtraction and bit shift of a register,
Efficient deviceization is possible.

Hereinafter, the operation of the Montgomery inverse element calculation device 201 (or the Montgomery inverse element calculation unit of the division device 200) 201 of this embodiment will be described using a specific example.

Here, as an example, the modulus value p = 23,
The case where the inverse element of the element A = 19 in the Montgomery calculation area when R = 2 ⁵ (n = 5) will be described.

FIGS. 6A and 6B show the inverse element calculation unit 30.
1, U register, V register, T register, S register
The contents of each register are represented by binary numbers (however, the upper bits of the T register and the S register are 0 bits).
Is omitted) and the transition of the value of the content of the loop counter k expressed in decimal notation is shown for each processing loop.

FIG. 6C shows the inverse correction unit 302.
Shows the transition of the value of the T register expressed in binary number (however, the display of 0 of the upper bit is omitted) for each processing loop.

First, in the inverse element calculation unit 301, as a result of the initialization processing, U register = p = 1111, V register = A = 10011, T register = 0, S register = 1,
k = 0 is set.

In the first loop, since U> V, the result of step S405 is Yes, and steps S415 to S41
8 and S410 are executed. As a result, U register = 0
0010, V register = 10011, T register = 1,
S register = 10 and k = 1.

In the second loop, since LSB (U) = 0, the result is Yes in step S403, and step S41
1, S412 and S410 are executed. As a result, U register = 00001, V register = 10011, T register = 10, S register = 100, and k = 2.

In the third loop, No is determined in step S405 from U <V, and steps S406 to S409 are performed.
And S410 are executed. As a result, U register = 00
001, V register = 01001, T register = 10,
S register = 101 and k = 3.

As a result of repeating the processing as described above,
After execution of the seventh loop, U register = 00001, V
Register = 000000, T register = 100000, S
Register = 10111, k = 7, V register = 0
Since it is 0000, the process exits the processing loop.

Next, since U = 1, step S419
At step S420 because T> p.
At step S421. As a result, at step S421, T =
TP = 100000-10111 = 11001, and
Finally, at step S422, T = p−T = 10111−
1001 = 1110.

Therefore, the output of the inverse calculation unit 301 is T =
1110 (= 14 in decimal notation), and k = 7.

Next, in the inverse correction unit 302, T = 1110, i = 0, and m = 3 are set as initial states (the values of i and m are represented by decimal numbers).

In the first loop, the T register is shifted to the left to reach T = 11100, and Y is determined in step S505.
Because of es, T = 101 in step S506, and i = 1.

In the second loop, the T register is shifted leftward to T = 1010, and the result in step S505 is No.
Therefore, step S506 is not executed, and i = 2.

In the third loop, the T register is shifted leftward to T = 10100, and N is determined in step S505.
o, the step S506 is not executed, and i = 3 =
m, and exits the processing loop.

As a result, the output T = 10100 = 20 in decimal notation.

In this way, the modulus value p = 23 and R = 2
⁵ (n = 5), the inverse element X = 20 of the element A = 19 in the Montgomery operation area can be obtained.

The elements 19 and 20 in the Montgomery operation area
, And the elements are also found in the residual system Zp,
It becomes 0 and 15. That is, 15 is obtained as the inverse of the element 20 in the remainder system Zp.

Hereinafter, other examples of the processing in the inverse element calculation unit 301 and the inverse element correction unit 302 will be described.

First, FIG. 7 and FIG.
5 shows another example of the processing procedure. This procedure is shown in FIGS.
Is basically the same as the processing procedure shown in FIG. 3, but in steps S403 and S4 in the procedures of FIG. 3 and FIG.
At step 04, only the least significant bits of the multiple length registers U and V are used as criteria for determination, and if the least significant bit is 0, the subsequent steps S411 and S41
2. The register is shifted by one bit in step S413 and step S414, but is improved so that a plurality of bits can be shifted at a time when a plurality of zeros continue from the least significant bit. . As described above, it is often advantageous to collectively process a plurality of bits at a time, and the speed is high particularly in software implementation.

Hereinafter, the procedures in FIGS. 7 and 8 will be described with reference to the flow.

First, a modulus p given as an input is set in a register U, and a positive integer A equal to or smaller than p is set in a register V.
Further, 0 is set in the register T, 1 is set in the register S, and 0 is set in the register k (step S601).

Thereafter, steps S602 to S6
Step 12 is repeated while the register V is a positive value (until it becomes 0).

If the register V is not 0 in step S602, first, the run length of "0" from the least significant bit of the register U is counted and this value is set to w (step S60).
3). Next, it is determined whether w is 0 (step S60).
4) If not 0, register U is shifted right by w bits (step S613), register S is shifted left by w bits (step S614), and w is added to loop counter K (step S615). S602
Hetobu.

If w is 0 in step S604, the run length of "0" from the least significant bit of the register V is counted and this value is set to w (step 605). Next, it is determined whether or not w is 0 (step S606). If not, the register V is shifted right by w bits (step S606).
616), the register T is shifted leftward by w bits (step S617), w is added to the loop counter K (step S618), and the process proceeds to step S602.

If w is 0 in step S606, the values of registers U and V are compared (step S607).
If> V, the contents of the register V are subtracted from the register U (step S619), the register U is shifted right by one bit (step S620), and the contents of the register S are added to the register T (step S621). Is shifted to the left by 1 bit (step S622), 1 is added to the loop counter K (step S623), and step S60 is performed.
Jump to 2.

If U <V or U = V as a result of step S607, the contents of register U are subtracted from register V (step S608), and register V is shifted right by one bit (step S609). Is added to the contents of the register T (step S610).
Is shifted one bit to the left (step S811), 1 is added to the loop counter K (step S623), and the process returns to step S602.

The above loop is repeated, and step S60
When the register V becomes 0 at 2, the processing loop is exited,
First, it is checked whether the content of the register U is 1 (step S624). Since the contents of the register U are the greatest common divisor of the input A and the modulus p, if U is not 1, error processing is performed in step S628 and the processing is terminated.

If it is not an error, that is, step S6
24, if the contents of the register U are 1, the register T
And p are compared (step S625), and if T is p
If so, subtract p from T (step S626),
Let T be an integer less than or equal to p. Then, in step S627, the result of subtracting the contents of T from p is stored in T, and the process ends.

According to the above processing, the content of T is A ^−1.
2 ^k mod p is calculated.

Next, another example of the processing flow of the inverse correction unit 302 is shown in FIGS.

This procedure is also the same in principle as the processing procedure shown in FIG. 5, but in the procedure of FIG.
4 is repeated to shift the multiple length register T leftward by one bit, but is improved so that multiple bits can be shifted at a time. in this way,
In many cases, it is advantageous to process a plurality of bits at a time, especially in software implementation.

Hereinafter, the procedures of FIG. 9 and FIG. 10 will be described following the flow.

First, a value obtained by doubling n where R = 2 ⁿ is set to L, and the loop counter i is set to 0 (step S701).

Next, L−k is calculated as the number of loop repetitions.
Is obtained and set to m (step S702).

Hereinafter, steps S703 to S7
Step 10 is repeated until the loop counter i reaches m.

In step S703, i and m are compared. If i is less than m, first, when the register T is viewed as a binary number having the same size as the modulus p, a sequence of "0" from the most significant bit is read. The length is counted and this value is set to w (step S70)
4).

Next, it is determined whether w is 0 or not (step S705). If w is 0, the register T is shifted left by one bit (step S712). As a result, the value of T becomes larger than p, so the value of p is subtracted from the register T in step S713. Then, 1 is added to the loop counter i (step S714), and the process proceeds to step S703. If w is not 0 in step S705, then i + w is calculated, and this value is compared with m in magnitude (step S70).
6). If i + w> m, w is set to mi (step S715), and the register T is shifted leftward by w bits (step S716). The loop counter is set to m (step S717). Here, since the result of the left shift in step S716 is always smaller than p, no correction is necessary, and the process jumps to step S703.

In step S706, i + w <m or i
If + w = m, the register T is shifted leftward by w bits (step S707). As a result, the value of T may be larger than p.
And p are compared, and if T is greater than or equal to p, the value of p is subtracted from T (step S709). Finally, w is added to the loop counter i (Step S710), and Step S70
Return to 3.

The above loop is repeated, and step S70
When i = m in 3, the processing exits the processing loop. The value of T at the time of exiting this loop is the Montgomery inverse value, and this value is output (step S711), and the process ends.

The procedures of FIGS. 7 and 8 and FIGS. 9 and 10 described above are also realized only by addition / subtraction of registers and bit shift.

In the Montgomery inverse element calculation unit of the Montgomery inverse element calculation device of FIG. 2 or the Montgomery division device of FIG. 1, the inverse element calculation unit 301 may be any one of FIG. 3, FIG. 4, FIG. 7, and FIG. As the inverse correction unit 302, any one of FIGS. 5, 9, and 10 can be used in any combination.

Incidentally, the present Montgomery division device is similar to that shown in FIG.
The present invention is not limited to the configuration exemplified in the above, and other configurations are possible.
FIG. 16 shows another example of the basic configuration of the Montgomery division device according to the present embodiment.

As illustrated in FIG. 2, the Montgomery inverse element computer can be divided into an inverse element calculation section 301 and an inverse element correction section 302 as an example. In FIG.
01 is arranged before the Montgomery multiplication unit 202, and the inverse correction unit 302 is arranged after the Montgomery multiplication unit 202. This is the output C of the inverse calculation unit 301.
Is based on the fact that commutability with respect to the order is established because both the operation of the inverse correction unit 302 and the operation of the Montgomery multiplication unit 202 are multiplications. This is represented by the following equation.

Y = B · A ⁻¹ · R mod p = B · (A ^{−12 K} ) 2 ^-K · (R ⁻¹ R ² ) mod p = B · (A ^{−12 K} mod p) · ^{R -1 (R 2 · 2 -K} ) mod p = (B · C · R -1 mod p) · 2 2n-K mod p = D · 2 2n-K mod p Thus Montgomery division device necessarily Montgomery It can be configured without using the inverse element calculation unit and the Montgomery multiplication unit sequentially. What is important is to efficiently calculate the Montgomery division Y = B (A ^-1 ) R mod p. For this purpose, an inverse element calculation unit which is a component (module) of the Montgomery inverse element calculation device is used. The inverse correction unit can be used separately.

As described above, according to the present embodiment, when the iterative processing of multi-length arithmetic operations such as elliptic curve cryptography is performed at high speed, an element in the Montgomery operation area is used as an input.
Montgomery inverse calculation and Montgomery division can be performed. Therefore, after the element is first converted from the original remainder system to the Montgomery operation area, the repetitive processing can be executed in the Montgomery operation area. Finally, since the inverse transformation from the Montgomery operation area to the original remainder system may be performed, the overhead of the Montgomery transformation / inverse transformation as a whole can be reduced.
Further, the Montgomery inverse element calculation and the Montgomery division of the present embodiment can be realized only by addition / subtraction and bit shift of the multiple-length register, and therefore can be efficiently realized by either software or hardware.

The hardware configuration of the inverse computing device in the Montgomery operation area according to the present embodiment will be described below.

FIG. 11 is a block diagram showing an example of the configuration of the inverse calculation device.

This inverse element calculation device uses a multiple length register U (8
01), a multiple-precision register V (802), a multiple-precision register S (803), a multiple-precision register T (804), a single-precision register K (805) serving as a loop counter, and an adder / subtractor 806 as an arithmetic unit. Bit shifter 807, adder / subtractor 8
A multiple-length register 808 storing the output of the bit-shifter 806 and a multiple-length register 80 storing the output of the bit shifter 807
9, and a control unit (not shown) for controlling the entire operation as components. Each of these components is
It is connected to the bus 810 and can transfer data mutually. The control unit also performs 0/1 determination of a specific bit of the register and checks a consecutive length of 0 of a specific part of the register in accordance with the processing procedure described above.

The inverse calculation unit 301 in FIG. 2 is realized by controlling these constituent elements to perform operations according to FIGS. 3 and 4, or FIGS. 7 and 8, and the inverse correction unit 302 in FIG. Sets the modulus p to an empty register (eg, U register) and
And control is performed so as to perform the operation according to FIG.

Each of the above functions can be implemented as software.

The present embodiment is also directed to a computer which records a program for causing a computer to execute a predetermined procedure (or for causing the computer to function as predetermined means, or for causing the computer to realize a predetermined function). It can also be implemented as a readable recording medium.

The present invention is not limited to the above-described embodiments, but can be implemented with various modifications within the technical scope.

[0153]

According to the present invention, since the division result is obtained by performing the inverse element calculation and multiplication in the Montgomery operation area, it is possible to directly obtain the division result in the Montgomery operation area using the element of the Montgomery operation area as an input. Can be. As a result, since there is no overhead of conversion and inverse conversion between the Montgomery operation area and the original remainder system, division in the Montgomery operation area can be realized at high speed.

Also, according to the present invention, the Montgomery inverse element calculation can be performed in the Montgomery operation area, and there is no overhead of conversion and inverse conversion between the Montgomery operation area and the original remainder system. Can be realized at high speed.

Further, according to the present invention, the inverse calculation in the Montgomery operation area can be realized by addition / subtraction of a multiple-precision register and bit shift, so that a high-speed device configuration can be realized by either software implementation or hardware implementation. Become. further,
A high-speed device configuration can also be realized for division in the Montgomery operation area.

Therefore, in an encryption such as an elliptic curve encryption which uses a repetition of an operation including multiplication and division in a remainder system as a basic operation, the processing time as a whole can be shortened.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration example of a division calculation device in a Montgomery operation area according to the present invention.

FIG. 2 is a diagram showing a configuration example of an inverse element calculation device in a Montgomery operation area according to the present invention;

FIG. 3 is a flowchart illustrating an example of a processing procedure in an inverse element calculation unit in FIG. 2;

FIG. 4 is a flowchart illustrating an example of a processing procedure in an inverse element calculation unit in FIG. 2;

FIG. 5 is a flowchart illustrating an example of a processing procedure in an inverse correction unit in FIG. 2;

FIG. 6 is a diagram for explaining a specific operation example of the inverse calculation device of FIG. 2;

FIG. 7 is a flowchart showing another example of the processing procedure in the inverse calculation unit of FIG. 2;

FIG. 8 is a flowchart showing another example of the processing procedure in the inverse calculation unit of FIG. 2;

FIG. 9 is a flowchart illustrating another example of the processing procedure in the inverse correction unit of FIG. 2;

10 is a flowchart showing another example of the processing procedure in the inverse correction unit in FIG. 2;

FIG. 11 is a block diagram showing a hardware configuration of an inverse computing device in the Montgomery operation area according to the present invention;

FIG. 12 is a diagram showing the correspondence between the Montgomery operation area and the operation of the remainder system Zp.

FIG. 13 is a diagram showing a specific example of the Montgomery operation area and the elements and inverse elements of the remainder system Zp.

FIG. 14 is a flowchart illustrating an example of processing in the Montgomery multiplication unit in FIG. 1;

FIG. 15 is a flowchart showing another example of the processing in the Montgomery multiplication unit in FIG. 1;

FIG. 16 is a diagram showing another configuration example of the division calculation device in the Montgomery operation area according to the present invention.

[Explanation of symbols]

Reference numeral 200: Montgomery division device 201: Montgomery inverse element calculation device (Montgomery inverse element calculation unit) 202: Montgomery multiplication unit 301: Inverse element calculation unit 302: Inverse element correction unit 801,802,803,804,805,808,8
09 Register 806 Adder / subtractor 807 Bit shifter

Claims (12)

[Claims] A positive integer N, a positive integer A (0 ≦ A <N, A
And N are relatively prime), and for a positive integer B, let L be the bit length when N is represented in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ mod N A Montgomery division device for obtaining a division result Y in a Montgomery operation area, wherein an inverse element X = A ⁻¹ · 2 ²ⁿ mod using an integer A and a modulus N as inputs.
Montgomery inverse element calculating means for obtaining N, the obtained inverse element X, modulo N and B are input, and the division result Y =
A Montgomery division device comprising: a Montgomery multiplication means for obtaining BX2- ⁿ modN. 2. The Montgomery inverse element calculating means receives an integer A and a modulus N as inputs and obtains an intermediate result C = A ⁻¹ · 2 ^km
an inverse element calculating means for obtaining an odd N and a parameter k (L ≦ k ≦ 2L); and an inverse element for obtaining an inverse element X = C · 2 ^2n−k mod N using the obtained intermediate result C, the parameter k, and the modulus N as inputs. The Montgomery division device according to claim 1, further comprising a source correction unit. 3. A positive integer N, a positive integer A (0 ≦ A <N, A
And N are relatively prime), and for a positive integer B, let L be the bit length when N is represented in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ mod N A Montgomery division apparatus for obtaining a division result Y in a Montgomery operation area, wherein an integer A and a modulus N are input and a first intermediate result C = A ⁻¹ · 2
Inverse element calculating means for calculating ^k mod N and parameter k (L ≦ k ≦ 2L); second intermediate result D = B · C · 2 with the obtained first intermediate result C, modulus N and B as inputs ^-n mod N, a second intermediate result D obtained by the Montgomery multiplication means, and a parameter k obtained by the inverse element calculation means.
And the modulus N as input, the division result Y = D 2 ^2n-K mod N
A Montgomery division device comprising: 4. A positive odd integer N and a positive integer A (0 ≦ A <N,
(A and N are mutually prime), and let L be the bit length when N is expressed in binary, and for an integer n where n ≧ L, X =
A Montgomery inverse element calculation apparatus for obtaining an inverse element X in a Montgomery operation area of A ⁻¹ · 2 ²ⁿ mod N, wherein an intermediate result C = A ⁻¹ · 2 ^km with an integer A and a modulus N as inputs
an inverse element calculating means for obtaining an odd N and a parameter k (L ≦ k ≦ 2L); and an inverse element for obtaining an inverse element X = C · 2 ^2n−k mod N using the obtained intermediate result C, the parameter k, and the modulus N as inputs. A Montgomery inverse element calculation device comprising: element correction means. 5. A plurality of registers for storing intermediate variables therein; a bit shifter for shifting the register right or left; an adder / subtractor for adding or subtracting the contents of two registers; 5. The Montgomery according to claim 4, wherein the inverse element calculation unit and the inverse element correction unit are configured by using a determiner for comparing the magnitude of contents and determining a value of a predetermined bit position in a register. Inverse computing device. 6. A positive odd integer N and a positive integer A (0 ≦ A <N,
(A and N are mutually prime), and let L be the bit length when N is expressed in binary, and for an integer n where n ≧ L, X =
A Montgomery inverse element calculation apparatus for calculating an inverse element X in a Montgomery operation area of A ⁻¹ · 2 ²ⁿ mod N, wherein U = N, V = A, T = 0, S =
1, k = 0, if the least significant bit of U is 0, right shift U, shift left S, increase k by 1, and if the least significant bit of V is 0, shift V right Then shift T to the left and set k to 1
Increasing processing, the least significant bit of U is 1 and the least significant bit of V is 1,
If> V, subtract V from U, shift U right, and add S to T
, S is shifted to the left and k is increased by one, and the least significant bit of U is one and the least significant bit of V is one,
If ≤V, subtract U from V, shift V to the right, and add T to S
, And a series of loop processing consisting of shifting T to the left and increasing k by 1 is repeated while V> 0. When V = 0, if T ≧ N, N is subtracted from T. Later, T is the value obtained by subtracting T from N, and T is the value obtained by subtracting T from N if T <N, and the initial state is i = 0. After T is shifted to the left, if T ≧ N, N is subtracted from T, i is increased by 1, and T <
Inversely, loop processing for increasing i by 1 if N is repeated for i <2n−k, and inverting element T as an inverse element X when i = 2n−k is provided. Montgomery inverse element calculator. 7. A U register in which N is set as an initial state, a V register in which A is set as an initial state, a T register in which 0 is set as an initial state, and S in which 1 is set as an initial state. A register, a k register in which 0 is set as an initial state, a bit shift for executing a specified one of a right shift of a U register, a right shift of a V register, a left shift of a T register, and a left shift of an S register. A process of subtracting the contents of the V register from the U register, a process of subtracting the contents of the U register from the V register, a process of adding the contents of the S register to the T register, a process of adding the contents of the T register to the S register, The designated one of the process of subtracting N, the process of subtracting the contents of the T register from N, and the process of adding 1 to the k register is executed. A subtractor, whether the least significant bit of the U register is 0, whether the least significant bit of the V register is 0, whether the value of the V register is 0, and the value of the T register The Montgomery inverse element calculation apparatus according to claim 6, further comprising: a determination unit that determines whether the number is equal to or greater than N; and a control unit that controls the bit shifter, the addition / subtraction unit, and the determination unit. . 8. A positive integer N, a positive integer A (0 ≦ A <N, A
And N are relatively prime), and for a positive integer B, let L be the bit length when N is represented in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ mod N A Montgomery division method for obtaining a division result Y in a Montgomery operation area, wherein an inverse element X = A ⁻¹ · 2 ²ⁿ mod using an integer A and a modulus N as inputs.
A first step of obtaining N, and a division result Y =
And a second step of obtaining B.X.2- ⁿ mod N. A Montgomery division method. 9. The method according to claim 1, wherein the first step is to input an integer A and a modulus N as input and obtain an intermediate result C = A ⁻¹ · 2 ^km
o N and a parameter k (L ≦ k ≦ 2L) are obtained, and an inverse element X = C · 2 ^2n−k mod N is ^obtained by inputting the obtained intermediate result C, the parameter k, and the modulus N. The Montgomery division method according to claim 8, wherein 10. A positive integer N, a positive integer A (0 ≦ A <N,
A and N are mutually prime), and for a positive integer B, let L be the bit length when N is expressed in binary, and for an integer n where n ≧ L, Y = B · A ⁻¹ · 2 ⁿ mod N A Montgomery division method for obtaining a division result Y in a Montgomery operation area, wherein an integer A and a modulus N are input and a first intermediate result C = A ⁻¹ · 2
^a first step of calculating ^k mod N and a parameter k (L ≦ k ≦ 2L), and a first intermediate result C obtained by the first step
And the second intermediate result D = B · C · 2 by using
^-n mod N, and a second intermediate result D obtained by the second step.
And the parameter k and the modulus N obtained in the first step as inputs, the division result Y = DＤ2 ^2n−K mod N
And a third step of obtaining the Montgomery division formula. 11. A positive odd integer N and a positive integer A (0 ≦ A <
N, A and N are relatively prime), where L is the bit length when N is expressed in binary, and for an integer n such that n ≧ L,
A Montgomery inverse element calculation method for obtaining an inverse element X in a Montgomery operation area of X = A ⁻¹・²ⁿ mod N, wherein an intermediate result C = A ⁻¹・ 2 ^{km using} an integer A and a modulus N as input.
od N and a parameter k (L ≦ k ≦ 2L) are obtained, and an inverse element X = C · 2 ^2n−k mod N is obtained by using the obtained intermediate result C, parameter k and modulus N as inputs. Inverse calculation method. 12. A positive odd integer N and a positive integer A (0 ≦ A <
N, A and N are relatively prime), where L is the bit length when N is expressed in binary, and for an integer n such that n ≧ L,
A Montgomery inverse element calculation method for calculating an inverse element X in a Montgomery operation area of X = A ⁻¹ · 2 ²ⁿ mod N, wherein U = N, V = A, T = 0, S =
1, k = 0, if the least significant bit of U is 0, right shift U, shift left S, increase k by 1, and if the least significant bit of V is 0, shift V right Then shift T to the left and set k to 1
Increasing processing, the least significant bit of U is 1 and the least significant bit of V is 1,
If> V, subtract V from U, shift U right, and add S to T
, S is shifted to the left and k is increased by one, and the least significant bit of U is one and the least significant bit of V is one,
If ≤V, subtract U from V, shift V to the right, and add T to S
, And a series of loop processing consisting of shifting T to the left and increasing k by 1 is repeated while V> 0. When V = 0, if T ≧ N, N is subtracted from T. Later, a first step in which the value obtained by subtracting T from N is T, and a value obtained by subtracting T from N if T <N is T, and the initial state is i = 0. After T is shifted to the left, if T ≧ N, N is subtracted from T, i is increased by 1, and T <
A second step of repeating a loop process of increasing i by 1 if N, while i <2n−k, and setting T as an inverse element X when i = 2n−k. Montgomery inverse element calculation method.