KR102006222B1 - Apparatus and Method for Integrated Hardware Implementation of Elliptic Curve Cryptography and RSA Public-key Cryptosystem - Google Patents

Abstract

The present invention relates to an arithmetic unit and method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem, and more particularly, to an arithmetic apparatus and method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem using scalar multiplication of elliptic curve cryptosystem and modular exponentiation operation of RSA (Rivest-Shamir-Adleman) A first memory for storing a modulo value necessary for a finite field operation; a second memory for storing parameters and intermediate result values used for elliptic curve cryptosystem and RSA cryptosystem; And a control unit for controlling the memory and the second memory.

Description

Technical Field [0001] The present invention relates to a computing device and a method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem, and an RSA public-key cryptosystem,

The present invention relates to a computing device and method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem, and more particularly, to a computing apparatus and a method for integrating elliptic curve cryptosystem and RSA public key cryptography into a single hardware system. will be.

In recent years, the diffusion of Internet (IoT) devices is rapidly spreading, and it is estimated that more than 30 billion objects Internet devices will be used by 2025. However, more than 70% of Internet devices are known to be connected to the network without encryption.

Objects Internet devices are vulnerable to security and can be used as a means of attack as well as being subject to cyber attacks. Therefore, various security enhancements such as authentication, confidentiality, and integrity verification are required.

 Digital Signature Algorithm, RSA Signature, and Elliptic Curve Digital Signature Algorithm.

The DSA is specified in FIPS 186 by the National Institute of Standards and Technology (NIST) and has a key length of 1,024 to 15,360 bits and is constructed using the message digest function SHA-256/384/512. RSA signatures are specified in ANSI X9.31 or PKCS # 1 v1.5 or later documents and the key length increases from 1,024-bits to 256-bits. ECDSA is a FIPS 186 DSA applied to an elliptic curve that is standardized in ANSI X9.62 and is the most widely used internationally. In Korea, the elliptic curve transformation of KCDSA, the existing electronic signature standard, was enacted as the TTA standard in 2006 under the name of EC-KCDSA. In addition, FIPS 186-2, established by NIST, follows the X9.62 standard and has a key length of at least 160 bits.

Conventionally, an arithmetic unit for encrypting an elliptic curve, such as a registered patent 10-1707334 (an efficient elliptic curve cryptographic computation unit and its method, registered on Feb. 9, 2017) A computer-readable medium having a program, a controller, a data processing device, a method of performing cryptographic computation, and a program). In order to process the elliptic curve cryptosystem and RSA signature, The system is complicated, inefficient, and expensive.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an apparatus and method for simultaneously processing an elliptic curve cipher and an RSA cipher using one hardware.

A computing device according to an aspect of the present invention relates to a computing device and method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem, and more particularly, to a computing apparatus and a method for integrating an elliptic curve cryptosystem and a RSA (Rivest-Shamir-Adleman) A first memory for storing a modulo value required for a finite field operation; a second memory for storing parameters used for elliptic curve cryptosystem and RSA cryptosystem and an intermediate result value; And a control unit for controlling the finite field arithmetic unit, the first memory, and the second memory.

According to another aspect of the present invention, there is provided an operation method comprising the steps of: a) inputting data at an initial stage; b) mapping the input data to data suitable for operation; c) An RSA encryption processing step of processing a Rivest-Shamir-Adleman (RSA) cipher by performing a modular exponentiation operation on data, and d) performing a scalar multiplication of data input according to the control of the controller or performing the c) An elliptic curve cryptographic processing step of processing the elliptic curve cryptosystem, and e) a data output step of outputting the data of step c) or d).

The present invention is capable of processing elliptic curve cryptosystem and RSA cryptosystem with a single hardware by using an integrated finite field arithmetic unit and a memory, thereby making hardware complexity wider than the conventional method of processing elliptic curve cryptosystem and RSA cryptosystem by independent hardware And the cost can be reduced.

1 is a block diagram of a computing device according to a preferred embodiment of the present invention.
2 is a detailed block diagram of the finite field arithmetic unit.
3 is a detailed circuit diagram of a finite-word-based Montgomery multiplier.
4 is an operation algorithm of a Montgomery multiplier based on a finite field word.
5 is a detailed circuit diagram of a finite subtractor and adder.
6 is an operation algorithm of a finite field subtractor and adder.
7 is a flowchart of a calculation method according to a preferred embodiment of the present invention.
Figure 8 is an illustration of mapping and remapping.
9 is a flowchart of the RSA encryption processing step.
10 is an algorithm of the RSA encryption processing step.
11 is a flowchart of the elliptic curve encryption processing step.
12 is an algorithm of the elliptic curve encryption processing step.
13 is a flowchart of a point addition operation and a point double addition operation (Doubling).

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a computing apparatus and a method for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem according to the present invention will be described in detail with reference to the accompanying drawings.

The embodiments of the present invention are provided to explain the present invention more fully to those skilled in the art, and the embodiments described below can be modified into various other forms, The scope of the present invention is not limited to the following embodiments. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an," and "the" include plural forms unless the context clearly dictates otherwise. Also, " comprise "and / or" comprising "when used herein should be interpreted as specifying the presence of stated shapes, numbers, steps, operations, elements, elements, and / And does not exclude the presence or addition of one or more other features, integers, operations, elements, elements, and / or groups. As used herein, the term "and / or" includes any and all combinations of one or more of the listed items.

Although the terms first, second, etc. are used herein to describe various elements, regions and / or regions, it is to be understood that these elements, parts, regions, layers and / . These terms do not imply any particular order, top, bottom, or top row, and are used only to distinguish one member, region, or region from another member, region, or region. Thus, the first member, region or region described below may refer to a second member, region or region without departing from the teachings of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings schematically showing embodiments of the present invention. In the figures, for example, variations in the shape shown may be expected, depending on manufacturing techniques and / or tolerances. Accordingly, embodiments of the present invention should not be construed as limited to any particular shape of the regions illustrated herein, including, for example, variations in shape resulting from manufacturing.

1 is a block diagram of a computing device for integrally implementing an elliptic curve cryptosystem and an RSA public key cryptosystem according to a preferred embodiment of the present invention.

1, a computing apparatus according to an exemplary embodiment of the present invention includes a finite-field arithmetic unit 100 having a 32-bit data throughput, a first memory 300 for storing a modulo value required for finite field computation, A second memory 400 for storing parameters and intermediate result values used in the elliptic curve cryptosystem and the RSA cryptosystem and a controller 400 for controlling the finite field arithmetic operator 100, the first memory 300 and the second memory 400, (200).

The finite field operator 100 includes a finite field subtracter and adder 110, a finite field word based Montgomery multiplier 120, and an internal memory 130.

Hereinafter, the configuration and operation of the computing device according to the preferred embodiment of the present invention will be described in detail.

First, the finite field operator 100 is capable of processing elliptic curve cryptosystem and RSA cryptosystem, and is an operator having a 32-bit data throughput. The finite field operator 100 can process data of a multiple of 32, so that even if there is a change in the key length of the elliptic curve cryptosystem and the RSA cryptosystem, all the keys having a length of a multiple of 32 can be processed .

2 is a specific block diagram of the finite field arithmetic unit 100. As shown in FIG.

2, the finite field operator 100 receives the first data, the second data, and the third data and performs a multiplication operation to output operation data and a control signal for controlling the internal memory 130 A finite field word-based Montgomery multiplier 120, a finite field multiplier 120 for receiving the first data, the second data, and the third data and performing subtraction or addition to output a control signal for controlling the calculation data and the internal memory 130 A first selector 140 for selectively outputting operation data and control signals of the finite-word-based Montgomery multiplier 120 or the finite field subtractor and adder 110, An internal memory 130 for storing operation data according to the selected control signal through the selection unit 140 and outputting the stored fourth data or the fifth data to the finite word based Montgomery multiplier 120, (130 And a second selector 150 for selecting and outputting the fourth data or the fifth data.

In the above description, the finite field operator 100 has been described as a 32-bit data throughput operator, but it is possible to design an operator having a data throughput such as 4, 8, 16, 32, The data can be processed.

The finite field subtractor and adder 110 may simultaneously output the operation result value on the integer and the result value on which the modular operation is performed. The internal memory 130 may store the operation result value And stores the result of the modular operation in the upper address.

In the multiplication operation, data is stored in the lower memory address of the internal memory 130.

3, the finite-word-based Montgomery multiplier 120 includes a 32-bit multiplier 121, a first adder 122, and a 33-bit second adder 123, The first register R1 and the second register R2 of the 32-bit are initialized to 0 and the third to fifth registers R3, R4 and R5 of the 1-bit and the sixth register (R6) are also initialized to zero.

In the first clock cycle, the multiplier 121 multiplies the second data stored in the internal memory 130 selected by the first selector M1 and the second data stored in the internal memory 130 selected by the second selector M2 3 data.

4 is an operation algorithm of the finite-word-based Montgomery multiplier 120. FIG.

Referring to FIG. 4, the finite-word-based Montgomery multiplier 120 calculates the same operation of the lines 8 to 13 and the lines 4 to 5 in one cycle when j of the word-based Montgomery multiplier algorithm on the finite field is 0 And outputs H value as 32-bit result data.

In the next clock cycle, M stored in the internal memory 130 is input through the terminal as fourth data, and H x N 'operation is performed to output the lower 32-bit data q _i , and the first adder 122 The multiplier 121 completes the calculation immediately without passing through the second adder 123 and is output as result data and stored in the internal memory 130. [

Then, q _i stored in the internal memory 130 is input as third data through the terminal, and the modulo P is input as the first data.

Then, the H value is input as the fifth data, and the arithmetic operations of the lines 15 to 17 are performed. The values of (S_msb, S | w-1 |) may be 32-bit or 33-bit, and the carry value cy2 generated at this time is Bit data according to the following equation.

For this reason, the operation result value of line 19 may be included in a range such as 0? (S_msb, S | w-1 |) <2p. If the modulo P is larger than P, subtraction operation must be performed as in line 21. However, The multiplication operation can be completed without using any additional comparator or subtractor.

As shown in FIG. 5, the finite subtractor and adder 110 includes a 32-bit third adder 111 and a fourth adder 112, a 1-bit eighth register R8, An adder R9, inverters I1, I2, and I3, and tenth through thirteenth selectors M10 through M13 to perform an add operation or a subtract operation on a finite field.

The configuration can be simplified by using simple selectors without using a comparator for modular operation.

In the case of performing an addition operation on a finite field, an inverted value 0 of a decremental selection signal having a value of 1 is input as a carry value of the third adder 111. [ Bit carry data is stored in the eighth register R8, and the second carry data is stored in the eighth register R8, and the second carry data is stored in the eighth register R8. .

The fourth adder 112 adds the 1's complement value of the modulo P input from the first data to the output value of the third adder 111. At this time, the carry value input to the fourth adder 112 is a value A value of 1, which is an acid selection signal, is input. That is, the third adder 111 performs addition operations such as the sum of the second data and the third data using the 32-bit input word data, and the fourth adder adds the sum of the second data and the third data And outputs the result of performing the modular operation through the operation of subtracting the first data from the first data.

On the other hand, when the finite field subtraction operation is performed using the finite field subtracter and adder 110, the third adder 111 performs an operation of subtracting the third data from the second data, 112 performs a modular operation of adding the first data to the difference between the second data and the third data. The output data second carry and third carry can be used as the selection signal SEL.

6 is an operation algorithm of the finite field subtractor and adder 110. FIG.

6, when a subtraction operation is performed using the finite subtractor and the adder 110, the third adder 111 performs an operation of subtracting the third data from the second data, and the fourth adder 112 performs a modular operation of adding the first data to the difference between the second data and the third data. The output data, the second carry and the third carry are used as the selection signal SEL as shown by line 14 in FIG. 6, and the final output value is determined according to the selection signal without using the comparator as shown in Table 1 below.

7 is a flowchart of a calculation method according to a preferred embodiment of the present invention.

7, the present invention includes an initialization step S10, a data input step S20, a mapping step S30, an RSA encryption processing step S40 or an elliptic curve encryption processing step S50, S60).

In the initialization step S10, 0 is input to each register as described above. When data is inputted in the data input step S20, mapping is performed in the mapping step S30.

The mapping is a process of performing preprocessing of the input data to use the finite-word-based Montgomery multiplier 120. When the data multiplied by the finite-word-based Montgomery multiplier 120 is A and B, the modulo value is N, and the length of the data A and B is R, the result of the finite-word-based Montgomery multiplier 120 ^Becomes Z = A * B * R- ¹ mod N including R- ¹ .

Therefore, as shown in FIG. 8, the data to be multiplied is pre-multiplied by R ² before preprocessing.

Referring to FIG. 8, the mapping of data A is MM (A, R ² ) = AXR ² XR ^-1 = AR mod N, and similarly the mapping of data B may be denoted by BR mod N.

The product of AR and BR processed in the finite word-based Montgomery multiplier 120 can be expressed as ABR mod N, and the remapping of ABR mod N can be expressed as MM (ABR, 1) = ABR X 1 XR ^-1 = AB mod N Can be indicated.

Next, steps S40 and S50 are selectively performed by the control unit 200, and a case where the RSA encryption processing step S40 is performed by the control unit 200 will be described first.

FIG. 9 is a detailed flowchart of the RSA encryption processing step (S40), and FIG. 10 is an algorithm of the key scanning step, the square processing step, and the multiplication processing step in FIG.

Referring to FIGS. 9 and 10, the RSA encryption processing step S40 includes an initial step S41, a key scanning step S42, a square processing step S43 for square-sum processing result values of the key scanning step, A multiplication processing step S44 for performing a multiplication operation when the processing result of the key scanning step is 1, and a remapping step S45 for removing R added in the mapping step.

After the initial step S41, a key scanning step S42 for modular exponentiation of the RSA cryptosystem is performed.

The key scanning step S42, the square processing step S43, and the multiplication processing step S44 are performed according to the algorithm of FIG.

In FIG. 10, T is mapped to 1 and M is mapped to perform a modular exponentiation operation.

The modular exponentiation operation performs a squaring operation (line 2) every scan once and a multiply operation (line 4) when the scanned data is 1 (line 3) by scanning the key from the most significant bit (line 1) .

At this time, the squaring operation of line 2 is performed in the square processing step S43, and the multiplication operation of line 4 is performed in the multiplication processing step S44.

After all operations are completed, a remapping step (S45) is performed to remove R from the resultant value, and the remapping is a step of multiplying the final result value by 1 as shown in FIG.

After the completion of the remapping, since all RSA cryptographic operations have been completed, the data output step (S60) of FIG. 7 is performed and the computed result is output.

The above description is the result of performing the RSA encryption processing step of step S40, and the controller 200 may perform the elliptic curve encryption processing step of step S50.

FIG. 11 is a detailed flowchart of the elliptic curve encryption processing step (S50), and FIG. 12 is an algorithm of the key scanning step (S52) in FIG.

11 and 12, the elliptic curve encryption processing step S50 includes an initial step S51, a key scanning step S52, an operation step S53 when the key scan result is k _i = 1, , An operation step (S54) when the key scan result is k _i = 0, a coordinate system conversion step (S55), and a remapping step (S56).

If the elliptic curve encryption process is selected by the control unit 200 after the mapping step S30 is performed, the elliptic curve encryption process S50 is performed after the initial stage S51 and then the scalar multiplication of the elliptic curve cryptosystem (S52). &Lt; / RTI &gt;

A key scanning step S52 and an operation step S53 when the key scan result is k _i = 1 and an operation step S54 when the key scan result k _i = 0 are performed according to the algorithm of Fig. 12 do. The scalar multiplication is performed by performing a point addition operation (lines 4 and 7) (the key scan result is calculated in S53 (step S53) in the case of k _i = 1) while scanning the key from the most significant bit (line 1, ) And a point doubling operation (lines 5 and 8) (an operation step (S54) in the case where the key scan result is k _i = 0), and the scanned key value is 0 or 1 The storage location of the second memory 400 is changed and stored.

When the key value scanned above is 1 (lines 4 and 5), an operation step (S53) in the case of ki = 1, an operation in the case where ki = 0 when the scanned key value is 0 (lines 7 and 8) Is performed in step S54.

In the embodiment of the present invention, the elliptic curve cryptosystem uses a Jacobian coordinate system which is a hydrophobic projection coordinate system. The point addition operation and the point doubling addition operation are performed according to the operation sequence shown in the table of FIG. 13, and the required multiplication, addition, or subtraction is performed step by step.

When the scalar multiplication operation is completed, a coordinate transformation step (S55) is performed to transform the Jacobian coordinate system (x, y, z) to the affine coordinate system (x, y), and the transformation process performs inverse transformation of z in the final output Jacobian coordinate system by calculating the z ^{-2, -3} z in the operation and generate inverse z ^-2, a result value obtained by multiplying the z ^-3 in the x, y coordinate system is affine each Jacobian (affine) coordinate system (x, y) is the value . That is, (x / z ² , y / z ³ ) = (x, y).

The inverse operation of z uses Fermat's predecessor and the algorithm can reduce the hardware complexity by using the algorithm of FIG. 8 used in the RSA cryptosystem finite exponentiation operation. The converted coordinate values are outputted through a data output step S60 after a remapping process through a remapping step S56.

As described above, the present invention can process RSA encryption and elliptic curve cryptosystem using one device, simplifying the configuration and reducing the cost.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention will be.

100: finite field arithmetic unit 110: finite field subtraction and adder
111: third adder 112: fourth adder
120: Montgomery multiplier based on finite cube word 121: Multiplier
122: first adder 123: second adder
130: internal memory 140: first selector
150: second selection unit 200:
300: first memory 400: second memory

Claims (9)

A finite field operator selectively performing a scalar multiplication of an elliptic curve cryptosystem and a modulo exponentiation operation of an RSA (Rivest-Shamir-Adleman) cryptosystem;
A first memory for storing a modulo value necessary for a finite field operation;
A second memory for storing parameters and intermediate result values used for elliptic curve cryptosystem and RSA cryptosystem; And
A finite field calculator, a first memory, and a second memory,
The finite-
A Montgomery multiplier based on a finite field word, which receives the first data, the second data, and the third data and performs a multiplication operation to output a control signal for controlling the operation data and the internal memory;
A finite subtractor and an adder for receiving the first data, the second data, and the third data and performing a subtraction or an addition to output operation data and a control signal for controlling the internal memory;
A first selector for selectively outputting operation data and a control signal of the finite-word-based Montgomery multiplier or finite field subtractor and adder;
An internal memory for storing operation data according to a control signal selected through the first selector and for outputting the stored fourth data or fifth data to the Montgomery multiplier based on the finite cube; And
And a second selector for selecting and outputting the fourth data or the fifth data of the internal memory. delete The method according to claim 1,
The Montgomery multiplier based on finite culert words,
A computing device comprising a 32 bit multiplier. The method according to claim 1,
The Montgomery multiplier based on finite culert words,
Key is scanned from the most significant bit. In RSA encryption processing, a multiplication operation is further performed when the value of the scanned key is 1 according to the result of the key scan after performing the square processing,
Performing multiplication and squaring operations for point addition and dot doubling addition in the elliptic curve encryption processing and changing the storage location of the second memory according to whether the scanned key value is 0 or 1 Characterized by: The method according to claim 1,
Wherein the finite field subtractor and the adder
Performs addition or subtraction operations on a finite field for point addition and doubling operations and stores the second memory in a different storage location depending on whether the key scan result is 0 or 1. 2. The method according to claim 1, Device. a) a data input step of receiving data at an initial stage;
b) mapping the input data to data suitable for operation;
c) an RSA encryption processing step of processing a Rivest-Shamir-Adleman (RSA) cipher by performing a modulo exponentiation operation on input data under the control of the controller;
d) performing an elliptic curve cryptographic process for performing an elliptic curve cryptosystem by performing the step c) or performing a scalar multiplication of input data under the control of the controller; And
e) outputting data of the step c) or d)
The step b)
multiplying the squared data length by the modulo exponentiation process in step c)
and multiplying the squared Jacobian coordinate value by the square of the data length to be subjected to the scalar multiplication operation in the step (d). delete The method according to claim 6,
The step c)
A key scanning step of scanning the key from the most significant bit;
A squaring step of squaring data;
A multiplication processing step of performing a multiplication operation when the processing result of the key scanning step is 1; And
And a remapping step for removing the data length value added in the step b). The method according to claim 6,
The step d)
A key scanning step of scanning the key from the most significant bit;
An operation step of performing point addition and double addition on a result of processing of the key scanning step;
An arithmetic operation step of changing the storage position according to the scanned key values 0 and 1, and storing the changed storage position;
An operation step of inversely transforming the scalar multiplication operation result from the Jacobian coordinate system to the affine coordinate system; And
And a remapping step for removing the data length value added in the step b).

Images