KR19990003678A - Montgomery Modular Multiplication Apparatus and Method - Google Patents

Abstract

A Montgomery modular multiplication apparatus and method are disclosed. The apparatus includes first through n + 1 processors, and the p + 1 processor responds to a control signal input from the p processor, so that the first data Ai of the n + 1 bit string input from the p processor is input. using the second data Bi of the m + 2 bit stream, the third data Ni consisting of the m + 2 bit stream and the result data Ti, the temporary variable M and the first carry C = C. ₁ C ₀ ) and store the Ai, M and C, or the second carry (C '= C) using the stored A, M and C and Ai, Bi, Ni and previous results from the p processor. ₁ 'C ₀ ') and the current result value (Ti ') are calculated, and the previous result value (Ti) or the current result value (Ti') and the input Ai are output to the p + 2 processor and the control signal, Bi and After the predetermined time delay, the N bits are output to the p + 2 processor, and the bits except for the least significant bit of the control signal and the previous result value T input to the first processor are all bits at a low logic level. The processor inputs a control signal from an external source, outputs from an n + 1 processor, and the present result values consisting of n + m + 1 bit strings are the result of multiplying the first data and the second data by Montgomery Modular N. do. Therefore, Montgomery modular multiplication can be performed at high speed, and hardware design cost is low.

Description

Montgomery Modular Multiplication Apparatus and Method

The present invention relates to modular multiplication for systems that require protection of information, such as systems that perform encryption and decryption, and more particularly, to a Montgomery modular multiplication apparatus and method, which is a type of modular multiplication.

Modular multiplication is mainly used in encryption and decryption systems. In particular, the Montgomery modular multiplication method, which is much faster than other modular multiplication methods, is used to encrypt and decrypt a lot of data.

Meanwhile, the above-described modular multiplication method or Montgomery modular multiplication method may be performed in software and hardware. When performing the Montgomery modular multiplication in software, it takes much longer than performing in hardware. In systems that require speed, Montgomery's modular multiplication is done in hardware.

However, the conventional Montgomery modular multiplication apparatus is inferior in terms of processing speed because the Montgomery modular multiplication is performed by a sequential method, and the cost of the Montgomery modular multiplication apparatus is expensive because several processors are required for this purpose. There was a problem.

An object of the present invention is to provide a Montgomery modular multiplication apparatus capable of performing the Montgomery modular multiplication in parallel in an optimal time using the parallelism of Montgomery modular multiplication.

Another object of the present invention is to provide a Montgomery modular multiplication method performed in the Montgomery modular multiplication apparatus.

1 is a block diagram of a Montgomery modular multiplication apparatus according to the present invention.

2 is a block diagram according to the present invention of each processor shown in FIG.

FIG. 3 is a flowchart for explaining a Montgomery modular multiplication method according to the present invention performed in the apparatus shown in FIG. 1.

In order to achieve the above object, the Montgomery modular Ni (here, Montgomery modular multiplication apparatus according to the present invention multiplied by N is the third data consisting of m + 2 bit strings,

And a p + 1 (where 1 ≦ p (integer) ≦ n + 1) processor is input from the pth processor in response to a control signal input from the pth processor. Using the Ai, Bi, Ni and the previous result value Ti, the temporary variable M and the first carry C = C ₁ C ₀ are calculated according to the following equation, and Ai is stored as A and the M And a second carry (C '= C ₁ ' C ₀ ') using the stored A, M, and C, and the Ai, Bi, Ni, and the previous result value input from the p processor. ) And the current result value Ti 'are calculated according to the following equation, and the previous result value Ti or the current result value Ti' and the input Ai are outputted to the p + 2 processor and the control signals Bi and Output Nis to the p + 2 processor after a predetermined time delay;

The bits except for the previous result T and the least significant bit of the control signal are input to the first processor, all bits are at a low logic level, and the first processor inputs the control signal from the outside, and the nth Preferably, the current result values, which are output from a +1 processor and consist of n + m + 1 bit strings, are the result of Montgomery's modular N multiplication of the first data and the second data.

M = (Ti + Ai × Bi) MOD r

(Where r is a predetermined number)

C = Ti + Ai × Bi + M × Ni

Where C ₀ is C DIV r MOD r and C ₁ is C DIV r DIV r.

C '= Ti + A × Bi + M × Ni + C ₀ + C ₁ × r

(Wherein C ₀ 'is C' DIV r MOD r and C ₁ 'is C' DIV r DIV r)

Ti '= (Ti + A × Bi + M × Ni + C ₀ ') MOD r

Herein, the p + 1 processor comprises temporary variable calculating means for calculating the temporary variable by inputting the first and second data and the previous result value from the r, the p processor, and in response to a selection signal. A third carry C using the temporary variable, the first carry and the storage means for storing or reading first data as A, and the first carry stored in the r and the storage means. First carry calculation means for calculating in accordance with,

C = C ₀ + C ₁ × r

First selection means for selectively outputting the low logic level and the third carry in response to the selection signal, the temporary variable, the first, second and third data in response to the selection signal, the The first carry is calculated using the previous result and the output of the first selection means and output to the storage means, or the stored temporary variable and the A and the first carry, the second and third data, Second carry calculation means for calculating the second carry using the transfer result value and the r, the r, the A and the temporary variables stored in the storage means, and the transfer result output from the p processor. A result value calculating means for calculating the current result value using a value and the second and third data, the second carry output from the second carry calculation means, and the result value system Second selection means for selectively outputting the current result value input from the means or the previous result value input from the p-processor in response to the selection signal, the input control signal, the second and third And buffers for buffering data to be output to the p + 2 processor, and comparing means for comparing the control signal with the low logic level and outputting the selection signal in response to the comparison result.

In order to achieve the above object, the first data (Ai, where i is the number of bits) consisting of n + 1 bit strings and the second data Bi consisting of m + 2 bit strings, each of n + m N + 1 to multiply Montgomery modular Ni (where N is third data consisting of m + 2 bitstreams) using control data (CTi) consisting of +1 bit strings and result data (Ti) The Montgomery modular multiplication method according to the present invention performed in the Montgomery modular multiplication apparatus having two processors comprises the steps of: (a) determining whether the control data is '1', and if the control data is '1', the first (B) fetching second and third data and the result data from a previous processor, and using the first and second data and the result data to generate a temporary variable M according to (C) to obtain,

M = (Ti + Ai × Bi) MOD r

(Where r is a predetermined number)

(D) obtaining a first carry (C = C ₁ C ₀ ) using the temporary variable, the first, second and third data and the result data according to the following equation,

C = Ti + Ai × Bi + M × Ni

Where C ₀ is C DIV r MOD r and C ₁ is C DIV r DIV r.

(E) storing said first data as said temporary variable and said first carry and A, sending said first data and said result data to a next processor, said second and third data and said control data (F) sending to the next processor after a predetermined time delay, and if the control data is not '1', the first, second and third data and the result data are retrieved from the previous processor and stored. (G) reading the A, M and C, and using the second and third data and the A, M and C and the result data, a second carry (C ′ = C ₁ 'C _0). Step (h), where

C '= Ti + A × Bi + M × Ni + C ₀ + C ₁ × r

(Wherein C ₀ 'is C' DIV r MOD r and C ₁ 'is C' DIV r DIV r)

(I) obtaining current result data Ti ′ using the stored A and M, the second carry, the second and third data, and the result data according to the following equation;

Ti '= (Ti + A × Bi + M × Ni + C ₀ ') MOD r

(J) sending first data and the current result data as result data of the next processor and sending the control data, the second and third data to the next processor after a predetermined time delay, and have all result data obtained? (K) proceeding to step (a) if all the result data is not obtained and determining all the result data as the Montgomery modular multiplied result if all the result data is obtained (l). It is preferred that the step).

Hereinafter, with reference to the accompanying drawings, the configuration and operation of the Montgomery modular multiplication apparatus according to the present invention will be described.

1 is a block diagram of a Montgomery modular multiplication apparatus according to the present invention, wherein the first, second, ..., p, ... and n + 1 processors 10, 12, ..., 14, ... and 16).

The first processor 10 illustrated in FIG. 1 inputs the first data Ai, the second data Bi, the third data Ni, the result data Ti, and the control data CTi to input a temporary variable ( M) and the first carry (C = C ₁ C ₀ ) are calculated and then the first data Ai and the calculated M and C are stored as A, or the second carry (C ′ = C ₁ 'C ₀ ') And calculating the current result value Ti ', outputting the previous result value Ti or the current result value Ti' and externally input first data Ai to the second processor 12 and controlling the control data ( CTi) and second and third data Bi and Ni are output to the second processor 12 after a predetermined time delay. At this time, the control data (CTi, where i is the number of bits) is composed of n + m + 1 bit string, that is, CT ₀ CT ₁ CT ₂ ... CT _{n + m} CT _{n + m + 1} , the least significant bit The data is input to the first processor 10 in order from (CT ₀ ) to most significant bit (CT _{n + m + 1} ). In a preferred embodiment of the present invention, the control data is input to the first processor 10 in the order of 0 0 ... 0 0. In addition, the result data Ti input to the first processor 10 is composed of n + m + 1 bit strings, that is, T ₀ T ₁ T ₂ ... T _{n + m} T _{n + m + 1} and is the lowest. It is input to the first processor 10 in order from bit T ₀ to most significant bit T _{n + m + 1} . In a preferred embodiment of the present invention, the result data is input to the first processor 10 in the order of 0 0 0 ... 0 0.

The second processor 12 receives the first, second and third data Ai, Bi, and Ni and control data CTi input to the first processor 10 from the outside through the first processor 10. On the other hand, the same result as the first processor 10 is performed by inputting the current result data CTi calculated by the first processor 10 as result data. The p-th processor 14 includes first, second and third data (Ai, Bi, and Ni) and control data (CTi) output from the p-th processor, and a current result calculated by the p-1 processor. Data is input as the result data Ti to perform the same operation as that of the second processor 12.

The n + 1th processor 16 performs the same operation as that of the first processor 10 by using the first, second and third data and control data and the result data input from the nth processor, and the calculated result. Output the current result data through the output terminal OUT. At this time, the result data output through the output terminal OUT, that is, T ₀ T ₁ T ₂ ... T _n T _{n + 1} is composed of the first data consisting of the n + 1 bit string and the m + 2 bit string Montgomery modular N multiplication result of the second data.

Hereinafter, the detailed operation of each processor shown in FIG. 1 will be described as follows.

FIG. 2 is a block diagram according to the present invention of each processor shown in FIG. 1, and includes a temporary variable calculator 40, first and second carry calculators 42 and 46, a first selector 44, and storage. The unit 50, the comparison unit 48, the result value calculation unit 52, the second selection unit 54 and the buffer 56.

The temporary variable calculator 40 shown in FIG. 2 has a predetermined value r and first, second and third data Ai, Bi and Ni, result data Ti and control data CTi from a previous processor. ) To calculate the temporary variable (M) as shown in the following equation 1, and outputs the calculated temporary variable to the second carry calculation unit 46.

M = (Ti + Ai × Bi) MOD r or M = (Ti + Ai × Bi × X) MOD r

Where X is (r-No) 'MOD r, where No represents the least significant bit of the third data.

The temporary variable calculation unit 40 obtains M without using X when r is a binary number, and calculates M using X when r is a general number except binary, such as hexadecimal and octal.

On the other hand, the comparator 48 compares the control data CTi input from the previous processor with the data of the low logic level, and transmits the selection signal SC in response to the result of the comparison. 2 outputs to the second selectors 44 and 54 and the second carry calculator 46, respectively. For example, the comparator 48 outputs a low logic level selection signal SC when the control data CTi is at a low logic level, and a high selection logic signal when the control data CTi is at a high logic level. SC).

The first carry calculation unit 42 calculates the third carry C by using the predetermined value r and the first carry C = C ₁ C ₀ stored in the storage unit 50 as shown in Equation 2 below. The calculated third carry C is output to the first selector 44.

C = C ₀ + C ₁ × r

The first selector 44 selects one of the third carry C and the low logic level data output from the first carry calculator 42 in response to the selection signal SC. Optionally print with). That is, when the high level selection signal SC is input, the low logic level data is selected and output to the second carry calculation unit 46. When the low level selection signal SC is input, the first carry calculation unit 42 is selected. The third carry C inputted from) is selected and output to the second carry calculation unit 46.

In response to the selection signal SC, the second carry calculation unit 46 uses the temporary variable, the first, the second and the third data, the previous result and the first carry using the output of the first selection unit 44. (C) is calculated and output to the storage unit 50, or the second and third data (Bi and Ni), the result data (Ti), the predetermined value (r) and the temporary variables stored in the storage unit 50 ( It calculates the second carry (C ') using M), A and the first carry (C). That is, when the high level selection signal SC is input, the second carry calculation unit 46 outputs the result data Ti, first, second and third data Ai, Bi, and Ni as shown in Equation 3 below. ) And the temporary variable M output from the temporary variable calculator 40 to calculate the first carry C, and output the calculated first carry C to the storage 50.

C = Ti + Ai × Bi + M × Ni

Wherein C ₀ is C DIV r MOD r and C ₁ is C DIV r DIV r.

That is, C ₀ is the remainder obtained by dividing the first carry C divided by r again by r, and C ₁ is the share obtained by dividing the first carry C divided by r again by r.

However, when the low level selection signal is input, the second carry calculation unit 46 receives the result data Ti, the first data A, the temporary variable M, the second and the second, as shown in Equation 4 below. The second carry C 'is calculated using the three data Bi and Ni, the predetermined value r, and the first carry C stored in the storage 50, and the calculated second carry C' ) Is output to the result calculator 52.

C '= Ti + A × Bi + M × Ni + C ₀ + C ₁ × r

Here, C ₀ ′ is C ′ DIV r MOD r and C ₁ ′ is C ′ DIV r DIV r.

On the other hand, the storage unit 50, in response to the selection signal SC output from the comparator 48, the temporary variable M, the first data Ai, and the second data output from the temporary variable calculator 40. The first carry C outputted from the carry calculation unit 46 is stored or read. Here, the first data Ai is stored as a. That is, when the high level selection signal SC is inputted, M, Ai, and C are stored, and when the low level selection signal SC is inputted, the stored M, Ai, and C are read out to the corresponding block.

The result value calculator 52 shown in FIG. 2 includes a predetermined value r, A and temporary variables M stored in the storage 50, result data Ti output from the previous processor, and second and second values. Using the third data Bi and Ni and the second carry C '= C ₁ ' C ₀ 'output from the second carry calculation unit 46, the current result data Ti' as shown in Equation 5 below. Is calculated and the calculated current result data is output to the second selector 54.

Ti '= (Ti + A × Bi + M × Ni + C ₀ ') MOD r

The second selector 54 outputs one of the current result data Ti 'calculated by the result value calculator 52 and the result data Ti input from the previous processor in response to the selection signal SC. Optionally output as result data of the next processor through OUT1. That is, when the high level selection signal SC is input, the result data Ti input from the previous processor is output through the output terminal OUT1 as the result data of the next processor, and when the low level selection signal SC is input, the result data is output. The current result data calculated by the value calculator 52 is output through the output terminal OUT1 as the result data of the next processor.

Meanwhile, the buffer 56 buffers the control data CTi, the second and third data Bi and Ni input from the previous processor, and outputs the buffered control data, the second and third data to the next processor. do. That is, it serves to output the control data, the second and the third data input from the previous processor after a predetermined time delay.

FIG. 3 is a flowchart illustrating a Montgomery modular multiplication method according to the present invention performed in the apparatus shown in FIG. 1. Determination steps (100 and 102).

In the Montgomery modular multiplication method according to the present invention, first, it is determined whether control data input from a previous processor or external device is '1' (step 80). If the control data is '1', Ai, Bi, Ni and Ti are retrieved from the previous processor or the outside (step 82). After step 82, a temporary variable is calculated using Equation 1 using the first and second data Ai and Bi and the result data Ti (step 84).

After step 84, the first carry (C = C ₁ C ₀ ) is calculated using the temporary variable M, the first, second and third data Ai, Bi and Ni and the resultant data Ti. Obtained as in Equation 3 (Step 86). After step 86, the first data Ai is stored as the calculated temporary variable M, the first carry C, and A (step 88). This is for use when obtaining the second carry C 'when the control data is zero.

After operation 88, the first data Ai and the result data Ti input from the previous processor are sent to the next processor, and the second and third data Bi and Ni and the control data CTi are delayed by a predetermined time. After that, the process is sent to the next processor (step 90).

However, if the control data is not '1' and '0', each processor shown in Fig. 2 transfers the first, second and third data Ai, Bi and Ni and the result data Ti to the previous processor. Alternatively, the stored A, M and C are read from the outside (step 92). After step 92, the second carry (C '= C ₁ ' C ₀ ') is calculated using the second and third data Bi and Ni, and the stored A, M and C, and the resultant data Ti. Obtained as in Equation 4 (Step 94).

After operation 94, the current result data Ti ′ is calculated using the stored A and M, the second carry, the second and third data Bi and Ni and the result data Ti input from the previous processor. Obtained as in Equation 5 (Step 96). After step 96, the first data Ai obtained from the previous processor and the current result data obtained in step 96 are sent to the next processor as the result data of the next processor, and the control data CTi, the second and third data ( Bi and Ni) are sent to the next processor after a predetermined time delay (step 98).

After step 90 or 98, it is determined whether all result data have been obtained (step 100). That is, it is determined whether all result data are output from the n + 1th processor 16 shown in FIG. If all the result data is not obtained, the process proceeds to step 80 to obtain the remaining result data. If all the result data is obtained, all the result data output from the n + 1 processor 16 is first checked. The result is determined as the result of the Montgomery modular N multiplication of the data and the second data (step 102).

As described above, the Montgomery modular multiplication apparatus and method according to the present invention can perform Montgomery modular multiplication at high speed by using the parallelism of the Montgomery modular multiplication, and the number of processors is smaller than that of the conventional Montgomery modular multiplication apparatus. The hardware design cost is low.

Claims (4)

Montgomery modular Ni (where N is m + 2 pieces of first data (Ai, where i is the number of bits) and m + 2 pieces of bit data) is composed of n + 1 bit strings. A Montgomery modular multiplication apparatus for multiplying a third data comprising a bit string, comprising: first to n + 1 processors, and a p + 1 (where 1 ≦ p (integer) ≦ n + 1) processor In response to the control signal input from the p processor, the temporary variable M and the first carry C = C ₁ C using the Ai, Bi, Ni and the previous result value Ti input from the p processor. ₀ ) is calculated according to the following equation and stores Ai as A and stores the M and C, or the A, M and C stored and the Ai, Bi, Ni and the previous input from the p processor using the results to a second carry _{(C '= C 1' C} 0 ') , and the current result value (Ti') and calculating by the following equation and the previous result value (Ti) or Prefecture The result value Ti 'and the input Ai are output to the p + 2 processor, and the control signals, Bi and Ni are output to the p + 2 processor after a predetermined time delay, and the previous input is input to the first processor. The bits except for the result value T and the least significant bit of the control signal are all bits at a low logic level, and the first processor inputs the control signal from the outside, is output from the n + 1 processor, and is n + m. And the current result values comprising a +1 bit string are a result of multiplying the first data with the second data by Montgomery Modular N. M = (Ti + Ai × Bi) MOD r (Where r is a predetermined number) C = Ti + Ai × Bi + M × Ni Where C ₀ is C DIV r MOD r and C ₁ is C DIV r DIV r. C '= Ti + A × Bi + M × Ni + C ₀ + C ₁ × r (Wherein C ₀ 'is C' DIV r MOD r and C ₁ 'is C' DIV r DIV r) Ti '= (Ti + A × Bi + M × Ni + C ₀ ') MOD r 2. The Montgomery modular multiplication apparatus according to claim 1, wherein the temporary variable (M) is calculated according to the following equation instead of M = (Ti + Ai × Bi) MOD r. M = (Ti + Ai × Bi × X) MOD r Where X = (r-No) 'MOD r. The processor of claim 1 or 2, wherein the p + 1 processor inputs the first, second and third data and the previous result from the r and p processors to determine the temporary variable. A temporary variable calculating means for calculating, in response to a selection signal, storage means for storing or reading first data as the temporary variable, the first carry and the A, and the first carry stored in the r and the storage means. First carry calculation means for calculating the third carry C using the following equation, C = C ₀ + C ₁ × r First selection means for selectively outputting the low logic level and the third carry in response to the selection signal, the temporary variable, the first, second and third data in response to the selection signal, the transfer The first carry is calculated using a result value and the output of the first selection means and output to the storage means, or the stored temporary variable and the A and the first carry, the second and third data, the Second carry calculation means for calculating the second carry using the previous result value and the r, the r, the A and the temporary variable stored in the storage means, and the previous result value output from the p processor; Result value calculating means for calculating the current result value using the second and the third data, the second carry output from the second carry calculation means, and the result value calculating means Second selection means for selectively outputting the current result value inputted from or the previous result value inputted from the p processor in response to the selection signal, the input control signal, the second and third data; And a buffer which buffers and outputs the buffer to the p + 2 processor, the control signal and the low logic level, and outputs the selection signal in response to the result of the comparison. . First data consisting of n + 1 bit strings (Ai, where i is a bit digit) and second data Bi consisting of m + 2 bit strings, each of n + m + 1 bit strings Montgomery modular multiplication with n + 1 processors to multiply Montgomery modular Ni (where N is third data consisting of m + 2 bitstreams) using the resultant control data CTi and result data Ti In the Montgomery modular multiplication method performed in the device, (a) determining whether the control data is '1', (b) if the control data is '1', fetching the first, second and third data and the result data from a previous processor, (c) obtaining a temporary variable M using the first and second data and the result data according to the following equation, M = (Ti + Ai × Bi) MOD r (Where r is a predetermined number) (d) obtaining a first carry (C = C ₁ C ₀ ) using the temporary variable, the first, second and third data and the result data according to the following equation, C = Ti + Ai × Bi + M × Ni Where C ₀ is C DIV r MOD r and C ₁ is C DIV r DIV r. (e) storing the first data as the temporary variable and the first carry and A, (f) sending the first data and the result data to a next processor and sending the second and third data and the control data to the next processor after a predetermined time delay; (g) if the control data is not '1', fetching the first, second and third data and the result data from the previous processor and reading the stored A, M and C, (h) obtaining a second carry (C '= C ₁ ' C ₀ ') using the second and third data, the A, M and C, and the result data according to the following equation: C '= Ti + A × Bi + M × Ni + C ₀ + C ₁ × r (Wherein C ₀ 'is C' DIV r MOD r and C ₁ 'is C' DIV r DIV r) (i) obtaining current result data Ti ′ using the stored A and M, the second carry, the second and third data and the result data according to the following equation, Ti '= (Ti + A × Bi + M × Ni + C ₀ ') MOD r (j) sending first data and the current result data as result data of a next processor, and sending the control data, the second and third data to the next processor after a predetermined time delay, (k) determining whether all result data have been obtained, and if all the result data have not been obtained, proceeding to step (a); and (l) if all the result data is obtained, determining all the result data as the Montgomery modular multiplication result.