KR20020071327A - High-radix Modular Exponentiator for RSA using CRT - Google Patents

Abstract

PURPOSE: A high radix RSA modular exponentiation operation device is provided to horizontally map a data dependency graph of the Montgomery algorithm when a modular multiplier, a core operator of the RSA, is implemented so that it can make it easy controlling a data flow. CONSTITUTION: The device comprises a control block, 512 bit registers, and an RSA core. The control block generates a signal for controlling the 512 bit registers, the RSA core and an exponentiation operation process according to an encoding or decoding signal. The control block generates a control signal for enabling the 512 bit registers and the RSA core to perform a 1024 bit encoding operation at an encoding process, and enabling the 512 bit registers and the RSA core to perform a simultaneous parallel decoding operation at a decoding process. The device employs the Montgomery algorithm and a CRT(Chinese Remainder Theorem) in implementing a hardware in order to enhance an operation speed rather than a conventional binary operation method. The registers and the RSA core are flexibly arranged for being switched by one control signal. When data is decoded, the registers, allocated to P and Q, private keys of a data sender and a data receiver, offer key digits necessary for an operation while performing an independent shift operation, and the RSA also independently performs a modular exponentiation operation on 512 data. The operation results are stored at result registers allocated to the P and the Q. When data is encoded, the register allocated to the P plays a role of the lower 512 bit, and the register allocated to the Q plays a role of the upper 512 bit. The two registers are serially connected and perform a shift operation as a 1024 bit register. Then the RSA core performs a 1024 modular exponentiation operation.

Description

High-radix Modular Exponentiator for RSA using CRT}

The present invention relates to a new structure for improving the performance of the cryptographic algorithm in hardware, which is one of the core areas of security technology.

With the recent rapid development of computer-based technology and information and communication technology, the whole world is forming one information society, and with the advent of the Internet, almost all information is disclosed. Therefore, security in this information society is getting more and more important, and the study of technology for implementing security is essential.

Currently, there are many techniques for implementing security, but on the Internet, the implementation of cryptographic algorithm using software is generally used as one method. However, with the development of security technology, as opposed to the security of hackers, etc., as well as the development of security technology, security with software is under considerable threat.

As a solution for this, researches for implementing security techniques in hardware have been actively conducted around the world, and the present invention relates to a hardware implementation of a representative RSA algorithm of a public key cryptographic algorithm.

Since security in software has revealed its limitations as described above, the present invention proposes a new structure for improving the processing performance as a hardware implementation of RSA cryptography technology.

In particular, when implementing the modulo multiplier, which is the core operation of RSA, the data-dependent graph of the Montgomery algorithm is mapped horizontally to achieve 100% throughput and to easily control the data flow.

1 is an overall structure of a modular power booster proposed in the present invention.

Figure 2 is the Dependence Graph of the Hiradics Montgomery Algorithm.

Third Degree SFG of the Radix-16 Montgomery Algorithm

Figure 4 PE Structure of the Radix-16 Montgomery Algorithm

5 is a comparison of the data input and output flow of the vertical and horizontal mapping

6 is the overall timing diagram of the modulo power

7 is a finite state machine (FSM) in a control block during decoding.

8 FSM in Control Block in Encryption

The basic operation of RSA is:

C = M ^ E `(mod ~ N), ~ where ~ E = SUM from i = 0 to s-1 e_i times2 ^ i ~~~~~~~ <encryption>

M = C ^ D` (mod ~ N), ~ where ~ D = SUM from i = 0 to s-1 d_i times2 ^ i ~~~~~~~ <decoding>

The main operation of the above RSA algorithm is modulo power, which is performed by successive modulo multiplication. The Montgomery algorithm is mainly used as an algorithm for processing a modular multiplication. In the present invention, the DG for the Hiradics Montgomery algorithm is drawn as shown in FIG. 2 and then horizontally mapped to configure a 1D linear array structure. SFG (Signal Flow Graph) and PE (Processing Element) for this are the same as (Fig. 3), (Fig. 4). Since PE using Hyradics combines k bits into a block in the structure of binary operations, the clock period for multiplication operations increases, but the total clock count decreases to 1 / k and the delay time due to the reduction of pipelining flip-flops. Reduction reduces overall processing time.

In the RSA operation, since the sender does not know the receiver's private keys P and Q at the time of encryption, the modulo powers must be performed for the whole coefficient N. Therefore, the CRT method cannot be used. The use of the following small numbers is not a security problem, so a fast implementation is possible. In practice, the public key is a special type of number such as 3, 17, 216 + 1. On the other hand, since the exponent D value is larger than 1024 bits at the time of decryption, the speed is significantly lower than that of encryption. In order to overcome this, the CRT method can perform operations in parallel with two 512-bit multipliers, which can be four times faster with almost the same hardware resources as 1024-bit time. In this case, since all the keys are 512 bits, the multiplier, which was performed in parallel at the time of encryption, is connected in series so that it can be converted to 1024 bit operation.

When n = s / k + 2, Montgomery modulo multiplication MonPro (A, B) = AB 2-kn mod N, so multiplication of 2kn is needed as a post-processing to get the correct intermediate result. It is very inefficient to do it every time on, so it is convenient to premultiply the initial input value by 22kn as shown in (Equation 1). Since all intermediate results have a factor of 2kn, such as R * = MonPro (A *, B *) = A B 2kn mod N, simply multiply the final result by 1 to get the desired result. Modulo power calculation for this can be done as shown in (1).

/ * (z = r2 mod N) is precalculated * /

function MonExp (Cp, Dp, P) r = 2kn

Cp * = Cp r mod N = MonPro (Cp, z)

Xp * = 1 r mod N = MonPro (1, z)

for i = 0 to s-2 do

if ei = 1 then Xp * = MonPro (Cp *, Xp *)

Cp * = MonPro (Cp *, Cp *)

if es-1 = 1 then Xp * = MonPro (Cp *, Xp *)

Xp = MonPro (Xp *, 1)

Return Xp (Equation 1)

Based on the new linear modulator multiplier of FIG. 3 proposed in the present invention, a process of modulo power to efficiently process the power of Equation (Equation 1) is received until the result is output. Dividing by each section as the overall RSA operation process (Process) is as shown in (Fig. 6). During T1, each key data is loaded into a register and 2nk factor is added to the initial input data to eliminate the intermediate overhead as described above. T2 loads the result value of the preprocessing serially back into the register. The process of calculating T3 is the modulo power, the main operation. T4 is the process of multiplying the final result by 1 to get the desired result with post-processing, and the result is serialized to T5. It is important to note that the encryption chip's calculation module continues to receive and process data at almost 100% throughput.

So far, the overall structure of the power-giving machine implemented according to the above-described mapping process and process is shown in FIG. 1. The control block functions to generate a signal that controls the register and RSA cores and power-up process in accordance with the encrypted or decrypted signal. When encrypting, control signals are made to perform 1024 bit operations on 512-bit registers and RSA cores, and when decrypting, control signals are made to simultaneously execute 512-bit registers and RSA cores in parallel.

In the present invention, the hardware implementation of the RSA algorithm is implemented by applying the CRT method at the time of decoding and Hiradics Montgomery algorithm to achieve faster performance than the conventional binary operation method. In addition, the register and RSA computation core are flexibly configured to switch encryption and decryption with one control signal.

In decryption, the registers allocated to P and Q of FIG. 1 independently shift and provide a key necessary for operation from the lower digit, and the RSA core independently modulo-powers 512 bits. The final result is stored simultaneously in the Result registers assigned to P and Q respectively. When encrypting, the register assigned to P is the lower 512 bits, and the register assigned to Q plays the role of the upper 512 bits and is connected in series to perform a shift operation as a 1024-bit register. The RSA core is a power of 1024-bit modules.

The FSMs of Figs. 7 and 8 generate signals for controlling the multiplexer of Fig. 1 as described above, and control the flow of data according to the process of Fig. 6 during encryption and decryption. Each state is held for 2kn clocks, and in the main state, until all exponents have been scanned. A separate counter that counts the clock is generated whenever the clock in kn passes and toggles the new clocks lclk and oddclk. The FSMs of FIGS. 7 and 8 operate in synchronization with lclk, and the main state repeats squares and multiplications according to oddclk. In addition, address decoding for selecting each register is also performed in the control blocks of FIGS. 7 and 8.

In the present invention, the data dependent graph of the Montgomery algorithm is horizontally mapped. As shown in Fig. 5, when the modulo power is taken, the intermediate result can come out as a serial and enter the input for the next calculation, thereby achieving 100% throughput, which is half of the vertical mapping method. The operation can be performed by the number of clocks. When decrypted, two s / 2-bit modulator multipliers are used in parallel for the key size of k bits using CRT, which is four times faster than without CRT. Modules are connected in series to perform all s bits.

Claims (4)

Structure of RSA Computation Core and Register Operated in Parallel When Decrypting Control Signals and Serially in Encryption When the data-dependent graph of the Montgomery algorithm is vertically mapped, it is difficult to achieve 100% throughput because the input is taken in by one clock as shown in FIG. 5. For 100% throughput, the inputs need to be switched, requiring two registers with s bits to hold the input coming into the serial, and the outputs overlapping in parallel with a delay of one clock. By mapping the data dependent graph of the Montgomery algorithm horizontally, the input and output flowed through the serial, respectively, so that 100% throughput can be easily achieved in the pipeline structure. The way of horizontal mapping for DG of the multiplication algorithm such as Montgomery modulo SFG of Figure 3 implemented through the scheme of horizontal mapping and PE internal structure of Figure 4 The structure of the RSA operation process of FIG. 6 and the control block for controlling each mux, register, and RSA core accordingly, and the FSM of FIGS. 7 and 8