KR20020049659A - add modular multiplication - Google Patents

Abstract

PURPOSE: A method and an apparatus for performing a modular multiplication using a modular result value estimated are provided to perform a modular power calculation at high speed by completing a modular multiplication through an addition of an estimated modular value calculated in case that the modular multiplication is performed. CONSTITUTION: Each calculation of multiplier is expressed in the form of a binary number. An S*S mod N form of calculation can be performed according to each characteristic of binary bit. Or, an S*S mod N and an S*M mod N form of calculation can be performed. These ways of calculation are repeatedly performed. Therefore, all modular power calculation is completed. The S*S mod N and the S*M mod N calculation are effectively performed. According to that, the time for calculation can be reduced.

Description

Modular multiplication method and apparatus thereof using calculated modular results {add modular multiplication}

The present invention improves the computational speed and the computational performance through the result of high speed calculation by increasing the computational speed of the modular multiplication used in the fast multiplication method using the common multiplicative multiplication. It's about using.

In a calculation used in a public key encryption system, a large number of modular power multiplication calculations and modular multiplications constituting the same are required. However, since modular multiplication calculation is a calculation structure of multiplication and division, it is important to solve this problem because the calculation amount is large and time consuming.

The most prominent technique proposed and used to solve this calculation is the Montgomery Modular method and the common Montgomery Modular method to which it is applied. This method has recently been patented in Korea as patent 10-256776-0000. In the calculation method, each modular multiplication is converted into a Montgomery type, and the multiplication and addition are repeated to reduce the number of digits and calculate the calculation. Basically, it is composed of a power calculation through repetition of.

The technical problem to be achieved by the present invention is to complete all the modular multiplication calculation by the addition of a predetermined part of the modular expected value during the modular multiplication calculation, thereby providing a fast modular power multiplication method.

Fig. 1 is a block diagram showing the configuration of a method for calculating a reduction from the higher value in the present invention.

FIG. 2 is a block diagram illustrating an apparatus of a method of modular reduction through parallel addition according to the present invention.

FIG. 3 shows a computational aspect in the modular reducer of the device of FIG. 1.

4 is a block flow diagram of a Montgomery modular apparatus, which was previously considered to be the most outstanding.

<Explanation of symbols for the main parts of the drawings>

Enter input value of 1 ... of FIG.

1 of 2 ... Input to Modular Reducer of Values

To the modulator reducer of FIG. Value input

4 to the high-speed memory device Enter a value for

To the 5 ... modular reducer of FIG. enter mod N value

Output of 6 ... result of FIG.

1 of FIG. Enter value into fast memory

2 of FIG. Enter value into fast memory

3 of FIG. Enter value into fast memory

4. of FIG. Enter the following value

5 ... pulled from the addition result Input the value of type into high speed memory

In the addition result of FIG. Enter less than value only with lower adder

Output the 7 ... temporary result value of FIG.

The present invention, in order to achieve the above technical problem, for a given number T, M, S, N, (a) modular multiplication = S * M mod N, = S * S mod N Deforming the radix b of the form

S * S mod N = S ( + + ...... + ) mod N

S * S = S ( + + ...... + )

S * S = ( + + ...... + ) * ( + + ...... + ) =

S * S == * * + * * + * * + * * + ..... + * *

S * S mod N = mod N

S * M mod N = S ( + + ...... + ) mod N

S * M = S ( + + ...... + )

S * M = ( + + ...... + ) * ( + + ...... + ) =

S * M == * * + * * + * * + * * + ..... + * *

S * M mod N = mod N

(b) In modular multiplication, converting S * S calculation to common multiplication part by one multiplication, and S * M calculation by multiplying all the results and adding the result as follows.

S * S = ( * * ) + 2 * ( * * )

S * M = ( * * )

(c) multiplier of smallest b greater than N Computing a part of the expected modular value for and storing in memory in advance

Q ( ) = mod N

(d) repeating integer calculation by converting the modular reduction calculation to addition using the expected modular value using the value.

for i = 2n-1 to i = k step -1

{

U = T /

T = T mod

T = T + Q (U) *

}

(e) T, the result of (d) Substituting (TN) results into T for greater than

(f) If all modular power calculations have been completed, and the result T is T> N, calculate T mod N again to get the result.

(g) Modular multiplication as shown in FIG. 1 which calculates S * S and S * M by multiplication and adder consisting of multiplication and addition; Device

(h) multiplier of smallest b greater than N How to calculate for

T = + + ...... + + + + ..... +

T mod N = ( + + ...... + mod N + mod N

+ mod N + ..... + mod N) mod N

(i) A modular reduction apparatus having a configuration as shown in FIG. 2, comprising a high-speed memory device storing an expected modular value calculated in advance, and adding them.

Hereinafter, the content and configuration of the present invention will be described in detail.

Currently used modular power calculations show the calculation for each multiplier in binary form, and only perform S * S mod N type calculations or S * S mod N and S * depending on the characteristics of each binary bit. It is widely used to complete all modular power calculations by rotating and repeatedly calculating two types of calculations, such as M mod N two calculations (see Patent 10-257124-0000).

The present invention relates to a technique for reducing the calculation time by efficiently calculating the calculation of S * S mod N, S * M mod N used in the calculation of the two types and a method of constructing a circuit that can implement the same. First, the present invention calculates separately the multiplication calculation of S * S and S * M and the calculation of mod N of the resulting value.

Since S * M can be calculated as in (b) above, it can be expressed as n * n multiplications and additions, and S * S multiplies n (n + 1) / 2 multiplications once the common calculation part is calculated. The calculations can be made with the addition, the addition calculations, and the calculations that double the result value of the common calculation part by bit shift.

In the mod N calculation of the present invention, the complex division calculation is transformed into addition through a pre-calculated modular expected value.

When the calculation result of S * S and S * M type is T

T = + + ...... + + + + ..... +

Can be expressed as

Multiplier of smallest b greater than N Is present when:

T mod N = (( + + ......) mod N + mod N + mod N + mod N + ..... + mod N) mod N

At this time Just think about

mod N = (( mod N) * b) mod N

Becomes This converts the number of high digits

mod N = (( mod N) * ) mod N

...........

mod N = (( mod N) * mod N

mod N = (( mod N) * b) mod N

Form mod N Should be less than Can be reduced by b digits by taking the mod N calculation. mod N <N < <= < Only 1 < <b)

This shows that the equation below is correct,

( mod N + mod N) mod N = ( + ( mod N) * b) mod N = ( + ( mod N) * ) mod N

From the top b multiplier Use mod N calculation to reduce the number of digits in base b and add the result 3, the modular multiplication calculation can be completed.

However, there are some issues to think about in this calculation.

The first problem is that one modular multiplication calculation is N < Since this decreases only as much as satisfying, this reduced value becomes T mod N + K * N, but it seems to be a problem (where K is an arbitrary number). Since the value expanded by N can be reduced, there is no big problem.

The second problem is The problem is how to get mod N each time. But that part is all in advance There is no difficulty because the value calculated for is stored in memory and used for calculation.

The third problem is that when the last modular reduction calculation is completed, The question is what to do when a larger number becomes the result. At this time Clear the bit corresponding to Just add -N. At this time, no single digit rise occurs.

If the result of the last modular reduction calculation is called TM,

<TM <= ( -1) + (N-1)

(TM- + mod N) <= (TM- + -N) <= -2

With all these calculations, if there are only S * S mod N calculations in the modular power calculation, and there are two calculations, S * S mod N and S * M mod N, both Compared to the conventional method, if only S * S mod N type calculations exist, as described above, multiplying the common calculation once requires n (n + 1) / 2 multiplication and subsequent addition and modular reduction. It consists of addition. This is the Montgomery calculation method, which is the most advanced method of the conventional method, which is 2n * n + n multiplications as shown in FIG. Unlike other devices that require a large amount of calculation, which is difficult to make with hardware, it takes a lot of computation time and has a disadvantage in that hardware design is difficult, and thus, the method and the device according to the present invention are more effective.

In the case of calculations with both S * S mod N and S * M mod N, the Montgomery calculation method omits the common calculation part, and in the case of calculation, 3n * n + 3n multiplication calculation is performed through the calculation as shown in FIG. In the present invention, all calculations are completed by multiplying n (n + 1) / 2 + n * n times, adding accordingly, and adding for modulus. In this calculation, the Montgomery Modular method yields more benefits than multiplying 3n * n + 3n times, but adds more and reduces computational time. However, in the modular powering method used for encryption, there are many cases where only S * S mod N calculation is more than the calculations that exist in both S * S mod N and S * M mod N, thereby improving performance.

(G) related to the structure of the modular multiplication calculator using this calculation method is explained in detail. The multiplication device composed of one or more multipliers and adders forming a multiplication calculation as shown in (b) and the result of multiplication are calculated in advance. Stored in fast memory It is a modular multiplication calculation device as shown in Figure 1, which consists of a modular reducer that adds and modifies a mod N type of calculation. In this case, the conventional Montgomery modular multiplication calculator is composed of sequential multiplication and addition, and thus cannot be calculated in parallel. However, the device of the present invention can perform parallel calculations that calculate other calculation blocks through a modular reducer while the multiplication device calculates, thereby enabling a faster calculation by efficiently designing a calculator.

(H), which is a method of making a high-speed large-scale modular reducer through more parallel calculations applying the above-described calculation method, is implemented as a method of reducing the size by adding from a large number. The method is as shown below.

T = + + ...... + + + + ..... +

T mod N = + + ...... + mod N + mod N

+ mod N + ..... + mod N

The type, that is, the value of the multiplier for all radix b

T mod N = ( mod N) mod N = ( + mod N) mod N

Calculate in the form

At this time

Q ( , k) = mod N

Q ( , k + 1) = mod N

Q ( , k + 2) = mod N

............

Q ( , 2n-1) = mod N

In this way each The above value is separated for each multiplier of b, and the modulated calculation is stored in a high speed memory, which is obtained by adding the following values.

+ mod N

This result is the maximum (N-1) * n value. Again, from that result Q () , k) = Get the modula in mod N form and store it in memory, All the values below are added to this value and the result is obtained. If there is a lift at this time, Clear the bit corresponding to -If N is added, it becomes a reducer that can make one modular reduction.

The device can create a parallel modular reducer that performs modular calculations of different blocks during one stage of addition, as shown in Figure 2, designed with n + 1 adders and a large amount of high-speed memory. It is faster than existing modular reducers and consists of adders, which enables the construction of simplified parallel modular reducers.

Referring to the embodiment of the present invention with reference to Fig. 1, (g) consisting of a 32-bit multiplier, an adder, a multiplier with a bit shifter, and a modular reducer with a 64-bit adder in the calculation for RSA encryption processing of 1024 bits. For the device of S * S, the calculation of S * S is 32 * 33/2 multiplication and subsequent addition, In the case of S * M calculation, the multiplication calculation is completed by 32 * 32 multiplications and the addition. In other words, S * S needs 528 multiplications and the addition and bit calculation. S * M calculation consists of 1024 multiplications and the addition. If you say that the base is 16 bits, All calculations are completed with 1024/8 bytes of memory, 16 MB of high speed memory, and (1024/16) * (1024/64) + 1 addition and its carry addition. This means that it consists of 1025 additions and calvary additions.

If there is no memory available, 8-bit b can be determined and calculated, where the addition consists of (1024/8) * (1024/64) +1 addition calculations, its carrybit addition, and 64KB of memory. This means that it consists of 2049 additions and their kerry additions. In this case, while the multiplier multiplies one cipher block, the modular reducer is highly available because it can calculate another cipher block.

A description will be given of a 1024-bit RSA encryption processing unit having the same structure as (h).

If you configure the circuit as shown in the figure that determines the b in 16-bit units and arranges the adder and memory, the modular reducer can be configured with 8MB * (1024/16) of memory and (1024/16) + 1 adder.

As described above, the present invention provides a method of performing a modular reduction calculation by adding a modular reduction part by using a modular expected value by separating the multiplication part and the modular reduction part from the modular multiplication used in the calculation for encryption. Through this, the computational speed is higher than that of the existing technology, and the hardware is used to industrialize it. Therefore, the present invention can be effectively used in encryption systems such as RSA.

Claims (4)

S * used for modular multiplication in the multiplier circuit of the low-key cryptographic IC card or the main computer of the public key cryptosystem used for cryptography, identity authentication, digital signature, electronic commerce, etc. to perform confidential communication while protecting user information and keeping it safe. In operations of type S mod N, S * M mod N (a) modular multiplication = S * S mod N, Separating the calculation of S * S, S * M type and mod N calculation from S * M mod N (b) calculating the calculations of S * S, S * M types as follows for radix b (radix), which is a multiplier of 2, as follows: S = M = S * S = ( + ) S * M = (c) multiplier of smallest b greater than N Is present Q ( ) = mod N (where 0 <= Any integer <2 * b) Phosphorus all Precomputation and entering into memory before calculation for (d) When the result value of (b) is T, the following integer calculation step is used for modular reduction to pre-calculated value as in (c). for i = 2n-1 to k step = -1 { U = T / T = T mod T = T + Q (T) * } (e) the result of (d) At greater than T Clear the bit and press T + ( -N) to get the result by addition through calculation Modular reduction using a multiplier consisting of an adder, a multiplier and a bit shifter, which implements paragraph (b), and a high-speed memory device that stores the result of paragraph (c), and an adder that functions as paragraph (d). Modular multiplier consisting of modular reducers When the result of S * S, S * M is T, the following method is obtained for radix b. T = + ...... + + ..... + + T mod N = ( + ...... + mod N + ..... + mod N + mod N) mod N Each of paragraph 3 A device that inputs a value obtained for mod N into a high speed memory device and implements the result through n + 1 adders as in claim 3