KR100480996B1 - Apparatus for operating an inverse number in limited gf and method thereof - Google Patents

Abstract

The present invention relates to an apparatus and method for inverting an efficient hardware implementation in a finite field GF (2 ^m ). For two elements a (x) and f (x) of GF (2 ^m ), Calculate the inverse a ^-1 (x) of a (x). To this end, the inverse arithmetic unit of the present invention sets u = a (x), v = f (x), c = 0, b = 1, and repeats a lower value of u in a repeating operation until u = 1. processing the lower value of b at least two bits simultaneously, processing the u, v, c, and b in parallel simultaneously, comparing the order of u and v and processing the lower value of u simultaneously Implement the modified MAIA algorithm to be added, and for the hardware implementation of this algorithm, four u, v, c, b operation registers for storing the inverse operation and the intermediate operation result, and the inputs of the u, v operation register Two u and v input processors for value computation and selection, an order finder to retrieve orders, an order comparison generator for order comparisons and new order generation, and du and dv for storing order values of u and v Du input to select order register and input value of du order register Implement a reciprocal computing device that includes a processor and a controller to control all these blocks. The present invention is modified to implement the existing MAIA in hardware as described above, there is an advantage that can be efficiently and quickly perform the inverse operation in the finite field GF (2 ^m ) that takes a lot of time.

Description

Inverse Calculation Apparatus and Method in Finite Field G.F {APPARATUS FOR OPERATING AN INVERSE NUMBER IN LIMITED GF AND METHOD THEREOF}

TECHNICAL FIELD The present invention relates to the finite field GF (2 ^m ) operation, and more particularly, to an apparatus and method for inverting arithmetic efficient for hardware implementation in a finite field GF.

In general, the reciprocal operation in the finite field GF (2 ^m ) is a necessary operation for performing a communication system or a public key cryptographic algorithm, and thus many operations are repeatedly performed, which is a major factor in the performance degradation of the entire system.

In order to solve this problem, the communication system increases performance by storing all expected reciprocal values in memory by using the calculated number of numbers.

However, in public key cryptographic algorithms, the size of the calculated number is usually hundreds of bits, so it is almost impossible to store the inverse value in memory in advance. As the reciprocal calculation method, EEA (Extended Euclidean Algorithm) and AIA (Almost Inverse Algorithm) algorithms are commonly used.

The AIA has a smaller number of repetitive operations than the EEA algorithm, but has a disadvantage of requiring additional reduction operations. This additional reduction operation may be performed in the middle of the operation using a Modified Almost Inverse Algorithm (MAIA) algorithm as shown in FIG. 1. Step 2.2 in the MAIA algorithm represents the reduction operation.

However, the above-described MAIA algorithm is easier to implement hardware than the EEA and AIA algorithms, but there are still many problems that need to be performed repeatedly.

Accordingly, an object of the present invention is to provide an apparatus and method for inverting arithmetic that is effective for hardware implementation in a finite field GF.

In order to achieve the above object, the present invention provides an apparatus and method for calculating a reciprocal in a finite field G. F, comprising: a plurality of storage means for storing an initial input value (a (x)) and an intermediate arithmetic result of a reciprocal operation; ; A plurality of input processing means for performing an operation and selecting an input value stored in said storage means; Order retrieving means for retrieving the order of the operation result value; Order comparison generating means for comparing the orders retrieved through said order retrieving means and for generating new orders; And a control means for controlling the operation of the means for the inverse operation. The apparatus for implementing a reciprocal calculation includes: an initial input value a (x) and an initial minimum polynomial f (x) in GF (2 ^ m). In calculating the inverse a ⁻¹ (x) of a (x) with respect to the modular f (x), (a) the variables u = a (x), v = f (x), b = 1, setting c = 0 and decreasing the orders of u and v, increasing the orders of b and c and calculating the inverse; (b) repeating the inverse operation until the degree of the u value becomes '0'; (c) simultaneously processing the lower values of u and b for two or more bits at the same time when the inverse operation is repeated; (d) simultaneously processing the u, v, c, and b in parallel; (e) simultaneously performing the order comparison processing between u and v and lower value processing of u; (f) If the lowest value of u is '1', add v to u to make a new u value, add c to b and make it a new b value, and add the least significant bit value of the new u value. And performing a reduction operation on the new b-value while erasing 0 '.

Hereinafter, with reference to the accompanying drawings will be described in detail the operation of the preferred embodiment according to the present invention.

2 illustrates a MAIA algorithm according to an embodiment of the present invention.

When comparing the MAIA algorithm of FIG. 2 with the MAIA algorithm of FIG. 1, it can be seen that the MAIA step 3 of FIG. 1 is changed to the entire conditional step 2 in the modified MAIA algorithm of FIG. 2. This is to allow simultaneous processing with other operations without allocating a separate operation time to determine that the operation is completed in the hardware implementation.

In the modified algorithm of FIG. 2, step 2 is divided into steps 2.1 and 2.2, and 2.1 performs the same operation as step 2 of FIG. In this case, as in the MAIA of FIG. 1, four bits are processed simultaneously instead of one bit.

This can reduce the computation time drastically because there are many cases of probable consecutive '0', and the number of bits processed in parallel at once can be increased according to the condition of the implementing system.

However, more than 8 bits are not efficient because they rarely produce consecutive '0's. All statements in step 2.1 are performed on one clock. Step 2.2 is a syntax for processing steps 4 and 5 of the prior art FIG. In the MAIA of FIG. 1, steps 4 and 5 may be simultaneously performed in hardware implementation, and the result of step 5 is to perform step 2 unconditionally. Therefore, the modified MAIA of FIG. 2 is modified to process operations to be performed in step 2.2 operation, and in particular, to process multiple bits simultaneously as in step 2.1. In many cases, the modified algorithm performs only step 2.2 operation to obtain a fast calculation speed.

FIG. 3 is a block diagram illustrating a hardware block configuration of the reciprocal arithmetic unit according to the embodiment of the present invention, which implements the MAIA algorithm of FIG. 2. Referring to FIG. 3, the inverse calculation apparatus includes a u register 400 for storing an input value and an intermediate operation result, a u input processor 100 for calculating and selecting an input value of the u register 400, and an initial value. V register 500 for storing the minimum polynomial f (x) and intermediate operation results, b register 600 for storing intermediate operation results and final output values, and for calculating and selecting input values of the b register 600. b input processor 200, c register 700 for storing intermediate calculation results, order finder 800 for order searching, du register c00 for storing u values and orders, du register du input processor (a00) for input value selection (c00), dv register (b00) for storing the order of the v value, and controller (300) for controlling all these blocks.

FIG. 6 illustrates a detailed block configuration of the order finder of FIG. Hereinafter, referring to FIG. 6, the degree finder 800 of the present invention basically searches for an order using a look-up table. In FIG. 6, the order is retrieved using the memory table 802 for a 16-bit input. The size of the memory table 802 may vary depending on the system requirements. Meanwhile, for this purpose, the input value u_out is divided into 16 bits and input to the multiplexer 0 801, and the values input to the multiplexer 0 801 are input to the 16-bit table 802 from the upper bit value.

At this time, there are two output values of the 16-bit table 802, order information (degree_u) for the input and information (not_zero) for determining whether the input value is '0'. The not_zero signal is input to the controller 300 again, and if the upper bit values are continuously determined to be '0', the control signal of the multiplexer 0 801 is adjusted to input the next higher 16 bits. When the order is retrieved from the 16-bit table 802, the order information is output by combining the output of the table 802 and the control signal sel_u_word of the multiplexer 0 801. The retrieved order information is stored in the du register c00. At the same time, the order of f (x) is stored in the dv register b00.

In this case, since the order of f (x) is determined in advance, a separate search procedure is not required. When the order is searched and stored, steps 2.1 and 2.2 in the MAIA of FIG. 2 are repeated. Steps 2.1 and 2.2 are different depending on whether the lowest value of the u register 400 is '0' or '1'. If the lowest value of the u register 400 is '0', step 2.1 is performed and the u register ( If the lowest value of 400) is '1', step 2.2 is performed. The main operations in the above steps 2.1 and 2.2 are the operation of the value of the u register 400 and the value of the b register 600, and these operations are performed in the u input processor 100 and the b input processor 200.

4 is a detailed block diagram of the hardware of the u input processor 100 for computing and selecting an input value of the u register 400 of FIG. 3. Referring to FIG. 4, the u input processor 100 includes a GF (2 ^m ) adder (XOR) 101, SR1 (102, 106), which is a one-bit right shifter, SR2 (103, 107), which is a two-bit right shifter, It consists of three bit right shifter SR3 (104,108), four bit right shifter SR4 (105,109), and multiplexers (110,111, 112,113). Perform the operation. In the case of the above step 2.1 operation, the output u_out of the u register 400 is shifted in the SR1 102, the SR2 103, the SR3 104, and the SR4 105, respectively, and then the multiplexer 0 110 is performed. Is entered. At this time, the multiplexer 0 110 is controlled by the lower 4 bits u_out [3: 0] of the u register 400, and an output is selected according to the number of consecutive '0's. In the case of the above step 2.2 operation, after the u register 400 value u_out and the v register 500 value v_out are calculated by the adder 101, the output of the adder 101 is different from that of step 2.1. Perform the same operation. In this case, the multiplexer 1 111 is controlled by the lower four-bit value uv_out [3: 0] of the adder 101 output. The multiplexer 2 112 is controlled by the lowest value u_out [0] of the u register 400. When the lowest value is '0', the result of Step 2.1 is outputted. Causes the output to be printed The multiplexer 3 113 determines whether to output an internal operation result or an input to the system, and the final output is input to the u register 400.

FIG. 5 is a detailed block diagram of the hardware of the b input processor 200 for calculating and selecting an input value of the b register 600 of FIG. 3. Referring to FIG. 5, the b input processor 200 includes a GF (2 ^m ) adder 201, 202, 210, 211, 214, 215, 218, 219, 222, 223, SR1 (212, 213, 216, 217, 220, 221, 224, 225) and a multiplexer 226, 227, 228. As in the input processor 100, the operation of the input values of the register b of step 2.1 and step 2.2 in the MAIA of FIG. 2 is performed. In the case of the above step 2.1 operation, the lower 4 bit values of the b register 600 are calculated by f (x) and multipliers (AND) 206, 207, 208, and 209, respectively, and then the addition operation is sequentially performed as shown in FIG. Shift operation is performed. Each output is input to multiplexer 1 227 and is selected differently according to the value of the lower 4 bits u_out [3: 0] of the u register 400. In the case of the operation 2.2, the register b (600) output (b_out) and the c register output (c_out) are added in the adder 201, and then the same operation is performed on the output value as in the step 2.1. The outputs of the multiplexer 0 226 and the multiplexer 1 227 are selected and finally outputted according to the u-out [0] value in the multiplexer 2 228.

The v register 500 and the c register 700 are the u register 400 and the b register 600 without any operation when the order of the v register 500 is greater than the order of the u register 400 in step 2.2.1. ) Value is stored. The operation of step 2.2.1 is performed in parallel regardless of steps 2.2.2 to 2.2.5. The order comparison for step 2.2.1 and the order calculation of the u register 400 according to the operations of steps 2.1 and 2.2 are performed in the order comparison generator 900.

7 is a detailed block diagram of the hardware of the order comparison generator 900 of FIG. 3. Referring to FIG. 7, the order comparison generator 900 includes a comparator 905 for comparing the order values of the u register 400 and the v register 500, a lower 4-bit output of the u register 400, and a v register 500. Adder 903 for the addition operation of the lower 4 bit output, an integer subtractor 904, 906, 907 for calculating the order change of the u register 400 and the v register 500 as the operation is performed, and multiple inputs for selecting multiple inputs. Firearms 901, 902, 908, and 909. The order comparison generator 900 performs two operations: first, order comparison of the u register 400 and order of the v register 500, and second, order generation of a new u register 400 according to the operation. . The order comparison is performed in the comparator 905 and output. The new order value calculation is performed throughout the process of the inverse operation. In step 2.1, the bit length shifted in the u register 400 order value is subtracted by the subtractor 904 to generate a new order. The bit length to be shifted is selected in the multiplexer 0 (901). In the case of step 2.2, the bit length shifted in the multiplexer 1 902 is selected, and the order of the u register 400 or the order value of the v register 500 and the subtractor 906 and 907 are generated to generate a new order. do. At this time, if the order of the v register 400 is large according to the result of the comparator 905, the order value of the v register 400 is selected, otherwise the order value of the u register 400 is selected. In multiplexer 3 909, the final output is selected by u register 400 least significant value u_out [0]. The output value is input to the du input processor a00 and selectively input to the du register b00 by the u-order selection signal sel_deg_u.

When the inverse arithmetic start signal start_inv is input, the controller 300 controls each hardware such that the above operation is repeated, and outputs an operation completion signal done_inv when the degree of the last u register 400 becomes '0'. And outputs the result of the last inverse operation to the v register.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

As it described above, the present invention provides an efficient reciprocal operation in the finite field GF (2 ^m), to the modulo f (x) with respect to the two elements a (x) and f (x) in GF (2 ^m) a By performing the inverse operation by calculating the inverse a- ¹ (x) of (x), hardware implementation and expansion of the inverse operation apparatus is easy, and there is an advantage that high performance can be obtained. In addition, it can be used as the inverse calculation device of the elliptic curve encryption device, there is an advantage that enables the high-speed processing of the elliptic curve encryption device.

1 is a flow diagram of a MAIA process for a conventional inverse operation,

2 is a flowchart of an MAIA processing for inverse calculation according to an embodiment of the present invention;

3 is a block diagram of a reciprocal calculation apparatus according to an embodiment of the present invention;

4 is a block diagram illustrating an internal input processor according to an exemplary embodiment of the present invention;

5 is a block diagram illustrating an internal configuration of an input processor according to an embodiment of the present invention;

6 is a block diagram illustrating an internal order finder according to an embodiment of the present invention;

7 is a block diagram illustrating an internal order comparison generator according to an embodiment of the present invention.

Claims (16)

delete delete delete delete delete In the device for calculating the inverse in finite field G.F, A first operation register for storing an initial input value a (x) and an intermediate operation result, a second operation register for storing an initial minimum polynomial f (x) and an intermediate operation result, the intermediate operation result and a final output result A plurality of storage means for storing an initial input value (a (x)) of an inverse operation and an intermediate operation result including a third operation register for storing and a fourth operation register for storing the intermediate operation result; The first operation register may be generated by simultaneously processing the lower 4 bits, and the first operation may be processed when the lowest value of the first operation register is a logic value '0' and '1'. A first input processor for calculating and selecting an input value of a register, and a second input processor for calculating and selecting an input value of the second operation register, and for performing and selecting an input value stored in the storage means. A plurality of input processing means; Order retrieving means for retrieving the order of the operation result value; Order comparison generating means for comparing the orders retrieved through said order retrieving means and for generating new orders; Control means for controlling the operation of each means for the reciprocal calculation; Inverse operation apparatus comprising a. The method of claim 6, The second input processor may simultaneously process up to four lower bits to generate an input value of the second operation register, and may process both when the lowest values of the second operation register are logical values '0' and '1'. A reciprocal arithmetic unit, characterized in that implemented in the form that can be. delete In the device for calculating the inverse in finite field G.F, A first operation register for storing an initial input value a (x) and an intermediate operation result, a second operation register for storing an initial minimum polynomial f (x) and an intermediate operation result, the intermediate operation result and a final output result A plurality of storage means for storing an initial input value (a (x)) of an inverse operation and an intermediate operation result including a third operation register for storing and a fourth operation register for storing the intermediate operation result; A plurality of input processing means for performing an operation and selecting an input value stored in said storage means; A multiplexer for multiplexing the input value from the first operation register to 16 bits, and a lookup table for sequentially storing the multiplexed input values from an upper bit value to store order information of the input values, and refer to the lookup table. Order retrieving means for retrieving orders of input values from the first operation register; Order comparison generating means for comparing the orders retrieved through said order retrieving means and for generating new orders; Control means for controlling the operation of each means for the reciprocal calculation; Inverse operation apparatus comprising a. In the device for calculating the inverse in finite field G.F, A first operation register for storing an initial input value a (x) and an intermediate operation result, a second operation register for storing an initial minimum polynomial f (x) and an intermediate operation result, the intermediate operation result and a final output result A plurality of storage means for storing an initial input value (a (x)) of an inverse operation and an intermediate operation result including a third operation register for storing and a fourth operation register for storing the intermediate operation result; A plurality of input processing means for performing an operation and selecting an input value stored in said storage means; Order retrieving means for retrieving the order of the operation result value; A comparator for comparing the orders of the first and second operation register values, an adder for adding a lower 4 bit output of the first operation register value and a lower 4 bit output of the second operation register value, and an operation in the adder An integer subtractor for calculating the order change of the first and second operation register values according to the execution, and a plurality of multiplexers for multiplexing the input values from the first and second operation registers and the first and second order registers. Order comparison generating means for comparing the orders retrieved through said order retrieving means and for generating new orders; Control means for controlling the operation of each means for the reciprocal calculation; Inverse operation apparatus comprising a. In calculating the inverse a- ¹ (x) of a (x) for modular f (x) for the initial input a (x) and initial minimum polynomial f (x) at GF (2 ^m ), (a) Set the variables u = a (x), v = f (x), b = 1, c = 0 for the inverse operation, reduce the orders of u and v, increase the orders of b and c, and increase the inverse. Calculating; (b) repeating the inverse operation until the degree of the u value becomes '0'; (c) simultaneously processing the lower values of u and b for two or more bits at the same time when the inverse operation is repeated; (d) simultaneously processing the u, v, c, and b in parallel; (e) simultaneously performing the order comparison processing between u and v and lower value processing of u; (f) If the lowest value of u is '1', add v to u to make a new u value, add c to b and make it a new b value, and add the least significant bit value of the new u value. And performing a reduction operation on the new b-value while erasing 0 '. The method of claim 11, The variable u stores an a (x) as an input value as an initial input variable, and stores an intermediate arithmetic result performed on the initial value a (x). The method of claim 12, U is added to the value stored in the intermediate arithmetic variable v or shifted to a reciprocal operation, and the order is gradually reduced. The method of claim 11, The variable v initially stores a modular value f (x) as an intermediate arithmetic variable, and temporarily stores a value in which the least significant bit of the values stored in the u is '1' during the intermediate arithmetic operation. Way. The method of claim 11, The variable b is a final output variable, the initial value is set to '1', the inverse calculation method characterized in that for storing the final output of the operation. The method of claim 11, The variable c is an intermediate arithmetic variable whose initial value is set to '0' and temporarily stores an intermediate arithmetic value stored in the final output variable b.