KR101925614B1 - Method for processing scalar multiplication in elliptic curve cryptosystem, and elliptic curve cryptosystem - Google Patents

Abstract

Disclosed are a method for processing scalar multiplication in an elliptic curve cryptosystem and an elliptic curve cryptosystem. According to an embodiment of the present invention, the method for processing scalar multiplication in an elliptic curve cryptosystem comprises the steps of: generating a scalar operation expression for performing scalar multiplication on two arbitrary points on an elliptic curve; grouping each of the calculation expression constituting the scalar calculation expression according to a predetermined criterion and rewriting the scalar calculation expression into a combinatorial calculation expression; parallel-processing the combinatorial calculation expression by group using a plurality of processors; and outputting a result of encrypting the two arbitrary points as a result of the parallel processing.

Description

[0001] METHOD FOR PROCESSING SCALAR MULTIPLICATION IN ELLIPTIC CURVE CRYPTOSYSTEM, AND ELLIPTIC CURVE CRYPTOSYSTEM [0002]

The present invention relates to an elliptic curve cryptography (ECC) -related technique, in which an elliptic curve cryptosystem for encrypting a public key based on an elliptic curve (eg, 'Curve25519'), a Montgomery double- A scalar multiplication processing method in an elliptic curve cryptosystem, which improves processing performance by parallel processing operations on a group basis using a plurality of processors when a scalar multiplication operation is performed on GPGPU according to a Montgomery ladder method or a Montgomery ladder method And an elliptic curve encryption system.

In connection with the elliptic curve cryptography (ECC) technique recommended by the National Institute of Standards and Technology (NIST), safety problems with elliptic curve encryption have been raised as backdoors have been found in DUAL_EC_DRBG using elliptic curves.

의 형태를 갖는 몽고메리 커브(Montgomery Curve)를 바탕으로, 다니엘 번스타인(Daniel J. Bernstein)에 의해 제안된 타원곡선으로서, 다음과 같은 식으로 표현되고 있다(비특허문헌 1 참조).Accordingly, various researches for finding a safe elliptic curve (SafeCurves) have been newly carried out. Among them, the elliptic curve 'Curve25519'

Based on Montgomery Curve having the form of a curve of the shape of a circle, and expressed by Daniel J. Bernstein as an elliptic curve expressed by the following equation (see Non-Patent Document 1).

Elliptic curve encryption is a cryptosystem based on the discrete logarithm problem. It is a cryptographic scheme based on a discrete logarithm problem. It is a cryptosystem in which a predetermined constant on an elliptic curve, that is, a base point is scalar multiplication multiple times, Point, and it is difficult to know the number of scalar multiplications performed at this time.

Conventionally, when the scalar multiplication for the elliptic curve encryption is performed, the sum of the two points (Q, Q ') or the sum of the points (Q, Q') using the Montgomery double-and-add or Montgomery ladder method, It is possible to simultaneously output the result of the doubling of the quadrature (Q).

In the Montgomery ladder method, the scalar multiplication of an elliptic curve is performed by adding two points at a plurality of times, and the two results are used at the same time and only the necessary result is used. When doubling is required, only doubling is performed. The processing speed may be lower than the method of performing addition.

In other words, when the scalar multiplication of the elliptic curve ('Curve25519') according to the Montgomery ladder system is processed using one processor, only one operation is performed per one cycle. Therefore, as shown in FIG. 2, It may take a lot of processing time.

Non-Patent Document 1: Daniel J. Bernstein, (2005), Curve25519: new Diffe-Hellman speed records ('https://cr.yp.to/ecdh/curve25519-20051115.pdf')

In the embodiment of the present invention, the arithmetic expressions using the same operator are grouped into the same group when the scalar multiplication processing is performed according to the Montgomery ladder method, and each arithmetic expression in the group is divided into a plurality of processors (for example, four arrays) Parallel processing to increase the processing speed by reducing the total number of processing times and to improve the encryption performance of the elliptic curve.

The scalar multiplication processing method in an elliptic curve cryptosystem according to an embodiment of the present invention includes a step of creating a scalar operation expression for performing scalar multiplication on arbitrary two points on an elliptic curve, A step of grouping according to a predetermined criterion and rewriting the scalar expression expression into a combination expression expression, a step of parallel processing the combination expression expression by group using a plurality of processors, and a result of the parallel processing And outputting a result of encrypting the arbitrary two points.

According to another aspect of the present invention, there is provided an elliptic curve cryptosystem comprising: a generator for generating a scalar multiplication expression for performing scalar multiplication on arbitrary two points on an elliptic curve; A grouping unit for grouping the scalar expressions into groups according to a criterion, and rewriting the scalar expressions into a combination operation expression; and a grouping unit for parallel processing the combination operation expressions by groups using a plurality of processors, And a processing unit for outputting a result value obtained by encrypting any two points.

According to an embodiment of the present invention, when the scalar multiplication process is performed according to the Montgomery ladder method, operation expressions using the same operator are grouped into the same group, and each expression in the group is divided into a plurality of processors (for example, ) To reduce the total number of processes, thereby improving processing speed and performance.

In addition, according to an embodiment of the present invention, a Montgomery ladder-type scalar multiplication processing speed which is calculated by an existing single processor through parallel processing using a plurality of processors is improved, and a GPGPU Can be used to further enhance immunity to existing subchannel attacks.

1 is a block diagram illustrating an internal configuration of an elliptic curve cryptosystem according to an embodiment of the present invention.
2 is a diagram illustrating an example of a scalar operation expression in an elliptic curve encryption system according to an embodiment of the present invention.
3 is a diagram illustrating an example of a combination operation expression in an elliptic curve encryption system according to an embodiment of the present invention.
4 is a flowchart illustrating a procedure of a scalar multiplication processing method in an elliptic curve encryption system according to an embodiment of the present invention.
FIG. 5 is a detailed flowchart showing step 430 shown in FIG.

Hereinafter, an apparatus and method for updating an application program according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to or limited by the embodiments. Like reference symbols in the drawings denote like elements.

1 is a block diagram illustrating an internal configuration of an elliptic curve cryptosystem according to an embodiment of the present invention.

Referring to FIG. 1, an elliptic curve encryption system 100 according to an exemplary embodiment of the present invention may include a creation unit 110, a grouping unit 120, and a processing unit 130.

The creating unit 110 creates a scalar operation expression for performing scalar multiplication on any two points (Q and Q ') on the elliptic curve.

으로 표현되는 '커브25519(Curve25519)'을 타원곡선으로 예시하고 있다.In the present specification,

Quot; Curve 25519 (Curve 25519) " represented by an elliptic curve.

The creating unit 110 creates the scalar operation expression based on the elliptic curve (curve 25519) based on the Montgomery double-and-add method or the Montgomery ladder method .

In this specification, the Montgomery ladder system can have the structure as shown in FIG. In this case, each variable means the following.

2, the creating unit 110 includes a plurality of variables (x, z, z) that make up two arbitrary points (Q (x, z) and Q ' (1, 2, 3, 4) relating to at least one of an addition (+), a subtraction (-) and a multiplication (x) The first calculation expression can be generated.

(X '+ z'), (x '- z') and (x'-z ')) of each of the arithmetic expressions using the initial input values are added to the next arithmetic expression (5, 6, 12, 13) so as to be the input values of the input signals (5, 6, 12, 13)

The creating unit 110 includes arithmetic expressions 7 to 11 and 14 to 18 that use the processed values in the previous arithmetic expression or predetermined constants ('(A-2) / 4' and 'bp_x') as input values A third calculation expression can be created. As described above, since the variable A is '486662' in the Montgomery ladder system, the constant '121665' is input to the operation expression (16), and the constant '9' is input to the variable x ₁ as the base point (bp_x) .

The creation unit 110 generates a result value (x ₂ , z) obtained by encrypting the arbitrary two points (Q, Q ') including the first to third computation expressions ₂ , x ' ₃ , z' ₃ ).

That is, when the scalar multiplication process is performed using the Montgomery ladder method, the creating unit 110 can create a scalar expression 200 including a total of 18 arithmetic expressions.

The grouping unit 120 groups each of the arithmetic expressions constituting the scalar arithmetic expression according to a predetermined criterion (an operator, a processing order, an input value, and the like), and rewrites the scalar arithmetic expression into the arithmetic expression.

For example, the grouping unit 120 may use the fact that the processing unit 130, which will be described later, can perform only one kind of operation among addition, subtraction and multiplication per one cycle, Can be grouped to belong to the same group by grouping the same operations.

The grouping unit 120 classifies each of the operation expressions by operators (+, -, x), groups at least one operation expression classified by the same operator into the same group, and groups each group generated according to the grouping , And arranging them in accordance with the processing order among the processing expressions belonging to the group, so that the above-mentioned combination expressions can be rewritten. At this time, when the number of processors that enable simultaneous processing of operations is p (p is a natural number of 4 or more), the grouping unit 120 can group up to p operation expressions into the same group.

For example, referring to FIGS. 2 and 3, the grouping unit 120 may include an arithmetic expression having the same operator (+) among the arithmetic expressions (1 to 18) in the scalar arithmetic expression 200 shown in FIG. 1, 3) are grouped into a group of 1, and the operation formulas (2, 4) having the same operator (-) are grouped into the second group and the operation formulas (5, 6, 12, 13) are grouped into 3 groups, the operation expression (7) having the operator (+) is grouped into 4 groups and the operation expressions (8, 15) having the same operator (-) are grouped into 5 groups Grouping operation expressions (9,10,14,16) having the same operator (X) into groups of 6, grouping operation expressions (17) having an operator (+) into group 7, (18) can be grouped into 8 groups.

In addition, the grouping unit 120 may group the plurality of operation expressions classified into the same group according to at least one of a processing procedure of an operation expression, a processing value input from a previous operation expression, and a base pointer, And arranges the groups so that each group generated according to different grouping outputs the same result as that of the scalar operation expression, so that the combination operation expression can be rewritten.

In other words, when grouping the operation expressions classified by the same operator into the same group, the grouping unit 120 inputs the processing order of each operation expression in the scalar expression expression and the next operation expression from the previous operation expression It is also possible to group them by dividing them into different groups considering at least one of the processing value and the input constants ('(A-2) / 4' and 'bp_x'). Grouping unit 120 may be relocated to the respective group so as to output the same result value _{(x 2, z 2, x} '3, z' 3) expression and the scalar operation to rewrite the equation in combination.

For example, referring to FIG. 2 and FIG. 3, the grouping unit 120 may include all of the arithmetic expressions (1 to 18) having the same operator (+) among the arithmetic expressions 1 to 18 in the scalar arithmetic expression 200 shown in FIG. (1), (3), (7), and (17) are not grouped into one group and the processing values of the respective arithmetic expressions and the processing value input from the previous arithmetic expression are considered, And the equation (17) into different groups.

As described above, the grouping unit 120 groups the scalar operation expressions including m operation expressions (where m is a natural number of 2 or more) into n groups (n is a natural number) smaller than the m, Can be rewritten.

For example, referring to FIGS. 2 and 3, the grouping unit 120 groups 18 operators (1 to 18) included in the scalar expression 200 into 8 groups, Each group can be rearranged into a combination expression 300 as shown in FIG. 3 by arranging the groups in consideration of the processing sequence of each of the calculation expressions (1 to 18).

The processing unit 130 uses the plurality of processors to parallel-process the combination expression equations for each group, and outputs a result of encrypting the arbitrary two points as a result of the parallel processing.

Here, the processing unit 130 may include a plurality of processors, and may be implemented by a processor (not shown), for example, p (p is a natural number of 4 or more) processors. In particular, the processor 130 may be implemented using a processor such as a GPGPU having the property of instruction parallelism, and may process only one instruction (one type of operation) in the same core group. That is, the processing unit 130 can not simultaneously process subtraction in another processor while one processor is processing the addition, and can wait for the subtraction processing while the addition processing is in progress.

The processing unit 130 may simultaneously process an operation expression in a group according to at least one parallel method of task parallel and data parallel. In this case, the parallel operation method is a method in which each processor performs a division operation when there is no interdependency between data when the operation methods are simultaneously performed on different operation methods. In the case of data parallel processing, And the like.

For example, the processor 130 processes a large amount of data at the same time using a CPU having a Symmetric Multi Processor (SMP) and a processor having a plurality of cores such as a GPGPU. In the combination operation expression, By performing parallel processing of expressions, it is possible to improve the performance of the same kind of operation or the iterative operation on continuous data.

For example, the processing unit 130 may simultaneously process one or more operation expressions grouped into the same group in the combination operation expression using the plurality of processors.

In this specification, the processing unit 130 can process only one kind of operation among addition, subtraction and multiplication per one cycle. Therefore, it is possible to use a plurality of processors, Can be processed in parallel.

For example, when the elliptic curve cryptosystem includes p processors (p is a natural number equal to or greater than 4) considering the number of variables constituting the arbitrary two points, the processor 130 uses p processors , It is possible to simultaneously process at most p operations belonging to each group. That is, the processing unit 130 can concurrently process a maximum of p calculation expressions grouped in the same group at the same time.

In addition, the processing unit 130 may process the combination expression expressions for each group grouped by the same operator, and wait for another type of operation while processing one type of operation.

Specifically, when the processing unit 130 rewrites the scalar expression expression into a combination operation expression having a plurality of groups that sequentially include the first group and the second group, the processing unit 130 may perform one or more operations belonging to the first group Processing of one or more operations belonging to a second group different from the first group can be performed while the processing for the first group is being performed.

For example, referring to FIG. 3, the processing unit 130 processes the combining expression 300 in the order in which the groups 1 to 8 are arranged, Can be processed.

That is, the processor 130 performs parallel processing of two addition (+) arithmetic expressions in the group 1 by using four processors, and then parallel processing of two addition (-) arithmetic expressions in the group 2 (X) expression in the group 3 is processed in parallel and then one additive (+) expression in the group 4 is processed and then two subtractions (-) in the group 5 are processed. (X) in the group 6 is processed in parallel and then one additive (+) operation expression in the group 7 is processed, and thereafter, in the group 8 Two multiplication (x) arithmetic expressions can be processed in parallel.

When the processing unit 130 groups the scalar operation expressions including m arithmetic expressions of m (where m is a natural number of 2 or more) into n groups (n is a natural number) smaller than the m and rewrites them into the combination operation expression, The combination operation expression can be processed n times smaller than m using the p processors.

For example, referring to FIG. 2 and FIG. 3, the processing unit 130 processes a scalar expression 200 including 18 arithmetic expressions over a total of 18 arrays in a single processor. Processing can be completed for a total of eight times when a plurality of (for example, four) processors are parallel-processed by grouping operation expressions 300 in which the operations are grouped and rewritten.

That is, the processing unit 130 can perform the scalar multiplication processing according to the Montgomery ladder method in parallel with a plurality of processors after bundling together the same operations, thereby increasing the processing speed by drastically shortening the processing frequency and improving the encryption processing performance of the elliptic curve .

At this time, the processing unit 130 may process the processing value of each operation expression included in the combination operation expression to be within a range of a prime field (prime field) selected as a prime number for the elliptic curve.

For example, the processing unit 130 may select '2 ²⁵⁵ -19' as a prime number (P) for the prime field for the elliptic curve 'curve 25519'. In the GPU environment, It is possible to process the combination expression expression on the basis of a prime field so that the processing value of each expression expression falls within a range from '0' to (2 ²⁵⁵ -19) '. For example, processor 130 is processed values of each operation expression ^"(2255-19) + 1 ', back to the process to" 0 ", and the process value of each operation expression" ^(2255-19) + 2 ', it can be processed as'1'.

The processing unit 130 converts each of the variables x, z, x ', z' constituting the arbitrary two points Q (x, z) and Q '(x', z ' (X ₂ , z ₂ , x ' ₃ , z' ₃ ) encrypted by scalar multiplication may be output as the resultant value.

For example, referring to FIG. 3, the processing unit 130 may calculate an equation (12) '(x + z) x (x + z)} x { Can be output as the variable x _{2 obtained} by encrypting the variable x.

Further, the processing unit 130 may calculate an equation (17) '(((x + z) x (x + z)) + (121665 x ) - ((xz) x))}) ', which is a function of the variable x (xz) x z as an encrypted variable z ₂ .

In addition, the processing unit 130 may calculate the value of the expression (14) '((xz) x (x' + z ')) + ((x + z) x the processing value of {((xz) x (x '+ z')) + ((x + z) x (x'-z '))}' is output as the variable x ' _{3 obtained} by encrypting the variable x' .

In addition, the processing unit 130 may calculate the expression (18) '(((xz) x (x' + z ')) - ((x + z) x ('bp_x')} 'to a variable z' ((xz) × (x '+ z')) - And output it as an encrypted variable z ' ₃ .

As described above, according to an embodiment of the present invention, when the scalar multiplication process is performed according to the Montgomery ladder method, operation expressions using the same operator are grouped into the same group, and each expression in the group is divided into a plurality of processors 4 ') in order to increase the processing speed and improve the performance.

In addition, according to an embodiment of the present invention, a Montgomery ladder-type scalar multiplication processing speed which is calculated by an existing single processor through parallel processing using a plurality of processors is improved, and a GPGPU Can be used to further enhance immunity to existing subchannel attacks.

2 is a diagram illustrating an example of a scalar operation expression in an elliptic curve encryption system according to an embodiment of the present invention.

Referring to FIG. 2, the elliptic curve encryption system according to an embodiment of the present invention includes a total of 18 arithmetic expressions (1 to 18) in scalar multiplication using the Montgomery ladder scheme, Can be created.

Specifically, the elliptic curve encryption system includes a plurality of variables (x, z, x ', z') constituting arbitrary two points (Q (x, z) and Q ' (1, 2, 3, 4) relating to at least one of addition (+), subtraction (-) and multiplication have.

In addition, the elliptic curve cryptosystem is configured such that each of the processing values (x + z), (x '+ z'), (xz) and (x'- The second arithmetic expression can be formed including the arithmetic expressions (5, 6, 12, 13) so as to be the input values of the expressions (5, 6, 12, 13).

The elliptic curve encryption system also includes arithmetic expressions (7 to 11 and 14 to 18) having input values of the processing values in the previous arithmetic expression or predefined constants ('(A-2) / 4' and 'bp_x') A third calculation expression can be created. Since the variable A is '486662' in the Montgomery ladder system, the constant '121665' is input to the equation (16), and the constant '9' is input to the variable x ₁ as the base point (bp_x).

The elliptic curve cryptosystem includes the first to the third computational expressions ('18 computational expressions') to encrypt any two points (Q, Q') on the elliptic curve ('curve 25519') The scalar multiplication processing expression and the scalar expression expression 200 can be generated.

3 is a diagram illustrating an example of a combination operation expression in an elliptic curve encryption system according to an embodiment of the present invention.

Referring to FIG. 3, the elliptic curve encryption system according to the embodiment of the present invention includes 18 operation expressions (1 to 18) included in the scalar operation expression 200 shown in FIG. 2, Groups, and each group can be rearranged into the combination expression 300 by arranging the groups in consideration of the processing order of the respective arithmetic expressions (1 to 18).

The elliptic curve encryption system can classify each of the operation expressions by operators (+, -, ×), and group at least one operation expression classified by the same operator into the same group.

The elliptic curve cryptosystem can group up to p operation expressions into the same group when p number of processors (p is a natural number equal to or larger than 4) capable of simultaneous processing of operations are grouped.

The elliptic curve encryption system groups the operation expressions (1, 3) having the same operator (+) among the operation expressions (1 to 18) in the scalar operation expression (200) shown in FIG. 2 into one group Grouping the operation expressions (2 and 4) having the operator (-) into the second group and grouping the operation expressions (5, 6, 12, 13) having the same operator (X) into the third group, (7) are grouped into groups of 4, the operation equations (8, 15) having the same operator (-) are grouped into groups of 5 and the operation equations (9, Grouping the operation formulas 17 having the operator (+) into the group No. 7 and grouping the operation formulas (18) having the operator (X) into the 8 groups can do.

The elliptic curve encryption system arranges eight groups (1 to 8) in consideration of the processing order of the arithmetic expressions (1 to 18) in the scalar arithmetic expression (200) As shown in Fig.

As described above, the elliptic curve encryption system rewrites the scalar operation expression 200, which can be processed 18 times in total by a single processor, into a combination operation expression 300 that can be processed in parallel by four processors, Conferencing can handle scalar multiplication with fewer processing times.

4 to 5, the operation flow of the elliptic curve cryptosystem 100 according to the embodiments of the present invention will be described in detail.

4 is a flowchart illustrating a procedure of a scalar multiplication processing method in an elliptic curve encryption system according to an embodiment of the present invention.

The scalar multiplication processing method according to the present embodiment can be performed by the elliptic curve encryption system 100 described above.

Referring to FIG. 4, in step 410, the elliptic curve encryption system 100 creates a scalar operation expression for performing scalar multiplication on any two points on an elliptic curve.

The elliptic curve cryptosystem 100 may generate a scalar expression including at least one of addition, subtraction, and multiplication based on an elliptic curve (curve 25519) based on the Montgomery double & add scheme or the Montgomery ladder scheme Can be created.

For example, referring to FIG. 2, the elliptic curve encryption system 100 can generate a scalar expression 200 including a total of 18 arithmetic expressions when performing a scalar multiplication using the Montgomery ladder method.

In step 420, the elliptic curve encryption system 100 groups each of the arithmetic expressions constituting the scalar expression expression according to a predetermined criterion (e.g., an operator, a processing order, an input value, etc.) Is rewritten as a combination operation expression.

For example, the elliptic curve cryptosystem 100 can use the fact that only one type of operation can be performed, one of addition, subtraction and multiplication per cycle, so that each operation expression in the scalar operation expression is grouped into the same operation Group to belong to the group.

2 and 3, for example, the elliptic curve encryption system 100 divides 18 operation expressions (1 to 18) included in the scalar operation expression 200 into 8 groups Grouping, and arranging each group in consideration of the processing order of each of the arithmetic expressions (1 to 18), and rewriting them into the combination arithmetic expression (300) as shown in FIG.

In step 430, the elliptic curve encryption system 100 uses the plurality of processors to parallel-process the combination formula for each group.

The elliptic curve cryptosystem 100 may include a plurality of processors, such as a GPGPU with command parallelism, and while one processor is processing the addition, it may not simultaneously process subtraction in the other processor, It is possible to wait for the subtraction processing during the progress.

For example, the elliptic curve encryption system 100 processes the combination expression 300 shown in FIG. 3 in the order in which the groups 1 to 8 are arranged, Can be processed at the same time.

Accordingly, the elliptic curve encryption system 100 processes the scalar expression (200 in FIG. 2) formed by including 18 arithmetic expressions over a total of 18 arrays in a single processor. However, When the prepared combination expression (300 in FIG. 3) is parallel-processed for each group with, for example, "four" processors, the processing can be completed eight times in total.

In step 440, the elliptic curve encryption system 100 outputs the result of encrypting the two arbitrary points as a result of the parallel processing.

That is, the elliptic curve cryptosystem 100 determines the variables (x, z, x ', z') constituting the arbitrary two points Q (x, z) and Q ' , may each output a variable _{(x 2, z 2, x} '3, z' 3) encrypted by the scalar multiplication processing in accordance with the combination of an expression, as the return value.

As described above, the elliptic curve cryptosystem 100 performs a parallel processing of a plurality of processors (for example, four or more) by grouping the same operations into the scalar multiplication processing according to the Montgomery ladder system, thereby dramatically shortening the number of processing The processing speed can be increased and the encryption processing performance of the elliptic curve can be improved.

5 is a detailed flowchart specifically illustrating step 430 shown in FIG.

FIG. 5 shows a concrete procedure of processing the rewritten combination formula (300 in FIG. 3) on a group-by-group basis using a plurality of processors.

Referring to FIG. 5, when the same operation is grouped in step 420 in FIG. 4 to rewrite the combination operation expression, the elliptic curve encryption system 100, in step 510, The equations (1, 2) are processed in parallel.

(1) (x + z)

(2) (x '+ z')

In step 520, the elliptic curve encryption system 100 parallelizes the computation equations (3, 4) in the second group performing the - computation.

(3) (x-z)

(4) (x'-z ')

In step 530, the elliptic curve encryption system 100 uses the process values in steps 510 and 520 to parallelize the operation expressions 5 to 8 in the third group for performing the x operation.

(5) (x + z) x (x + z)

(6) (x-z) x (x-z)

(7) (x-z) x (x '+ z')

(8) (x + z) x (x'-z ')

In step 540, the elliptic curve cryptographic system 100 processes the computation equation 9 in the fourth group performing the + computation, using the process values in step 530.

(9) {(x-z) x (x '+ z')} + {(x + z) x

In step 550, the elliptic curve cryptosystem 100 uses the process values in step 530 to parallelize the computation equations 10, 11 in the fifth group performing the - computation.

(10) {(x + z) x (x + z)} - {(x-z) x

(11) {(x-z) x (x '+ z')} - {(x + z) x

In step 560, the elliptic curve cryptosystem 100 uses the process value in step 530 to 550 and the constant ('121665' 15) are processed in parallel.

(12) {(x + z) x (x + z)} x (x-z) x

(13) 121665 x {((x + z) x (x + z)) - ((xz) x

Z '))} x {(xz) x (x' + z ')) + (x' ((x + z) x (x'-z '))}

Z '))} x {(xz) x (x' + z ')) - ((xz) ((x + z) x (x'-z '))}

At step 570, the elliptic curve encryption system 100 processes the equation 16 in group 7 to perform the + operation using the process values at steps 530 and 560.

(16) {((x + z) x (x + z))} + {121665 x ((x + z) x + z)

In step 580, the elliptic curve encryption system 100 uses the processing value and the constant bp_x in steps 550 to 570 to calculate the arithmetic expressions 17 and 18 in the group 8 that performs the x operation. And returns to step 440 of FIG.

(17) {((x + z) x (x + z)) + 121665 x ((x + z) x + z) X {((x + z) x (x + z)) - ((xz) x (xz))}

(18) {((xz) x (x '+ z')) - ((xz z) (x + z) x (x'-z '))} x {constant (' bp_x ')}

The method according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Elliptic Curve Encryption System
110:
120:
130:

Claims (15)

Creating a scalar operation expression for performing scalar multiplication on arbitrary two points on an elliptic curve;
Grouping each of the arithmetic expressions constituting the scalar arithmetic expression according to a predetermined criterion and rewriting the scalar arithmetic expression into a combinatorial arithmetic expression;
Parallel processing the combination expression by groups using a plurality of processors; And
As a result of the parallel processing, outputting a result value obtained by encrypting the arbitrary two points
Lt; / RTI >
If the elliptic curve is 'Curve 25519 (Curve 25519)',
The step of generating the scalar expression may include:
Based on the curve 25519, the step of creating the scalar expression expression based on the Montgomery double-and-add method or the Montgomery ladder method
Lt; / RTI >
The step of performing parallel processing for each group includes:
The processing value of each of the operation formulas included in the combination expression is set to be within a predetermined prime field as a prime number for the curve 25519
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. The method according to claim 1,
Wherein the step of rewriting with the combination formula includes:
Grouping the arithmetic expressions of each of the arithmetic expressions into the same group, and grouping the arithmetic expressions of at most p (where p is a natural number of 4 or more) according to the number of processors among the arithmetic expressions classified by the same operator into the same group; And
Arranging each group generated in accordance with the grouping according to a processing order among the computing equations belonging to the group, and re-creating the combining equations
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. 3. The method of claim 2,
Wherein the step of rewriting with the combination formula includes:
Grouping into different groups according to at least one of a processing order of an operation expression, a processing value input from a previous operation expression, and a base pointer, even if a plurality of operation expressions classified by the same operator are included; And
Arranging each group generated according to the different grouping so as to output the same result value as the scalar operation expression, and rewriting the combination operation expression
Wherein the scalar multiplication in the elliptic curve encryption system further comprises: The method according to claim 1,
Wherein the step of rewriting with the combination formula includes:
grouping the scalar operation expressions including m arithmetic expressions of m (where m is a natural number of 2 or more) into n groups (where n is a natural number) smaller than m, and rewriting the combination operation expressions
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. The method according to claim 1,
The step of performing parallel processing for each group includes:
Simultaneously processing one or more operation expressions grouped into the same group in the combination operation expression using the plurality of processors
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. The method according to claim 1,
When the elliptic curve encryption system includes p processors (p is a natural number of 4 or more) in consideration of the number of variables constituting the arbitrary two points,
The step of performing parallel processing for each group includes:
Processing the maximum of p operations belonging to each group simultaneously using the p processors
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. The method according to claim 6,
when a scalar expression expression including m arithmetic expressions of m (where m is a natural number of 2 or more) is grouped into n (n is a natural number) group smaller than m and rewritten into the combination operation expression,
The step of performing parallel processing for each group includes:
Processing the combination expression expression n times smaller than m using the p processors,
Wherein the scalar multiplication in the elliptic curve encryption system further comprises: The method according to claim 1,
When the scalar expression expression is rewritten into a combination operation expression having a plurality of groups sequentially including the first group and the second group,
The step of performing parallel processing for each group includes:
Processing one or more operations belonging to the first group at the same time using the plurality of processors, while processing for the first group is performed, processing of one or more operations belonging to a second group different from the first group Steps to wait
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. The method according to claim 1,
The step of generating the scalar expression may include:
Generating a first calculation expression including an operation expression related to at least one operator among addition, subtraction, and multiplication with an initial input value of each of the plurality of variables constituting the arbitrary two points;
Creating a second computation expression such that each processed value of the computation expression using the initial input value is an input value of a next computation expression; And
Generating the scalar expression for outputting a result obtained by encrypting the arbitrary two points including the first expression and the second expression;
Wherein the scalar multiplication is performed in an elliptic curve cryptosystem. delete A generating unit for generating a scalar operation expression for scalar multiplying an arbitrary two points on an elliptic curve;
A grouping unit for grouping each of the arithmetic expressions constituting the scalar arithmetic expression according to a predetermined criterion and rewriting the scalar arithmetic expression into a combinatorial expression; And
A processing unit for performing parallel processing of the combination expression equations by groups using a plurality of processors and outputting result values obtained by encrypting the arbitrary two points as a result of the parallel processing;
Lt; / RTI >
If the elliptic curve is 'Curve 25519 (Curve 25519)',
Wherein the creating unit comprises:
Based on the curve 25519, the scalar expression is generated based on the Montgomery double-and-add method or the Montgomery ladder method,
Wherein,
Wherein the processing value of each of the operation formulas included in the combination expression is in a range within a predetermined prime field as a prime number for the curve 25519. [ 12. The method of claim 11,
The grouping unit,
Grouping the arithmetic expressions of a maximum number p (where p is a natural number of 4 or more) according to the number of processors among the arithmetic expressions classified by the same operator into the same group,
Arranging the groups generated in accordance with the grouping in accordance with the order of processing among the groups of calculation expressions belonging to the group to rewrite the combination expression
Elliptic Curve Encryption System. 12. The method of claim 11,
The grouping unit,
grouping the scalar operation expressions including m arithmetic expressions of m (where m is a natural number of 2 or more) into n groups (n is a natural number) smaller than m, and rewriting the combination expression expressions
Elliptic Curve Encryption System. 12. The method of claim 11,
Wherein,
One or more operation expressions grouped into the same group in the combination operation expression are simultaneously processed using the plurality of processors
Elliptic Curve Encryption System. 12. The method of claim 11,
When the scalar expression expression is rewritten into a combination operation expression having a plurality of groups sequentially including the first group and the second group,
Wherein,
Processing one or more operations belonging to the first group at the same time using the plurality of processors, while processing for the first group is performed, processing of one or more operations belonging to a second group different from the first group Waiting
Elliptic Curve Encryption System.

Images