KR20020086005A - Inverse operator for elliptic curve cryptosystems - Google Patents

Abstract

PURPOSE: An inverse element operator for elliptic curve cryptosystem is provided to perform a high-speed operation for a point on an elliptic curve by using a processor for performing a high-speed operation. CONSTITUTION: The first multiplexer(100) outputs selectively input data of m bits and feedback data. The first rotation portion(110) rotates output data of the first multiplexer(100) according to a rotation number control signal and outputs the rotated data. The second multiplexer(140) outputs selectively the input data of m bits and the feedback data. The first multiplication circuit(130) outputs a result of m bits by performing a basis multiplication operation for output signals of the second multiplexer(120) and the first rotation portion(110). The second rotation portion(140) rotates an output of the first multiplication circuit(130). The second multiplication circuit(150) outputs a result by performing the basis multiplication operation for an output of the second rotation portion(140) and the input data of m bits. The third multiplexer(160) outputs selectively outputs of the first multiplication circuit(130) and the second multiplication circuit(150). A register(170) stores output data of the third multiplexer(160). The third rotation portion(180) outputs inverse element data of the input data by rotating an output of the register(170). A control portion(190) outputs control signals for controlling the first to the third multiplexers(100,120,160) and the first rotation portion(110) according to input clocks.

Description

INVERSE OPERATOR FOR ELLIPTIC CURVE CRYPTOSYSTEMS} for Elliptic Curve Cryptography

The present invention relates to an elliptic curve cryptographic system, and more particularly to an inverted operator for an elliptic curve cryptographic system.

Recently, as the security of the communication network has become an important factor for building a smooth information communication world, information encryption technology has also gradually developed.

Early cryptographic techniques used simple substitution and transposition, but the cryptography that has been proposed to maintain the desired level of security due to the dramatic increase in computational power of computers and the emergence of new algorithms and mathematical theories that can decrypt them. The way is getting more complicated. However, as the complexity of cryptography increases, the realization of cryptographic algorithms for applying and using them has become another problem. In other words, the computational amount is large, the encryption / decryption time is long, and the high specification hardware is needed to implement the system.

Elliptic Curve Cryptosystems (ECC), independently proposed by N. Kobiltz and V. Miller, respectively, in 1985, has the advantage of maintaining the same level of security as other public key systems with shorter bit length keys. It is also portable to memory such as IC cards and hardware with limited processing capacity [Working Draft IEEE P1363, Part 6]. In addition, it is possible to select another elliptic curve while using the same finite field arithmetic, so that additional security is possible.

Elliptic curve encryption is already recognized as the next-generation encryption technique, and major IT companies such as HP, Motorola, NTT, and Fujitsu are developing new standard encryption technology based on elliptic curve encryption technology. In addition, many studies, software, and hardware implementation related to elliptic curve cryptography have been conducted abroad.

However, in Korea, studies on elliptic curve cryptography are still insufficient, and there are no hardware implementation cases. Therefore, by developing a dedicated processor that can perform calculations on a base body with an elliptic curve defined at high speed, ECC is used to enable applications in various fields requiring strong security even on low-spec hardware such as IC cards and mobile communication terminals. The development of a base body calculator for this is urgent.

Accordingly, an object of the present invention is to provide a dedicated inverted operator capable of computing a point on an elliptic curve at high speed as part of implementing an elliptic curve cryptographic system.

It is still another object of the present invention to provide an inverted operator that can be easily extended to various applications using finite bodies.

1 is a block diagram of an inverted operator according to an embodiment of the present invention.

Inverse operator according to an aspect of the present invention for achieving the above object;

a first multiplexer for selectively outputting one of m-bit input data and feedback data;

A first rotation unit configured to rotate and output the output data of the first multiplexer according to a rotation number control signal;

A second multiplexer for selectively outputting one of the m-bit input data and feedback data;

A first multiplier circuit for receiving the output signals of the second multiplexer and the first rotation unit and performing an operation according to a base multiplication operation for an elliptic curve cryptography to output an m-bit result;

A second rotation unit configured to rotate and output the output of the first multiplication circuit;

A second multiplication circuit configured to perform arithmetic operation on the output of the second rotation unit and the m-bit input data according to a base body multiplication operation for an elliptic curve encryption;

A third multiplexer for selectively outputting one of the outputs of the first multiplication circuit and the second multiplication circuit;

A register for storing output data of the third multiplexer;

A third rotation unit rotating the output of the register to output inverse data of the input data;

And a controller for generating and outputting signals for controlling the multiplexers and the first rotation unit according to an input clock.

In the following, the mathematical background of the elliptic curve cryptography is first described in order to facilitate understanding of the present invention, and then, the analysis of the base body operations, which are the core of the implementation, and the differences in the calculation methods according to the representation method of the body elements. First, the algorithm and methodology for efficient implementation in hardware obtained through such analysis will be described, and then the configuration and operation of the present invention produced based on the finally derived theory will be described.

First of all, in order to apply the elliptic curve to the cryptographic system, we first need to select an appropriate elliptic curve and obtain a group of elliptic curves accordingly. Various coordinate systems can be used to represent the elliptic curve on the base body, but the Affine coordinate system or the projective coordinate system is mainly used. Using the Affine coordinate system reduces the number of multiplications and additions during point operations, but requires the inverse process. Projective coordinate systems, on the other hand, do not have inverse operations but increase the number of multiplications and additions. In representing an elliptic curve, the choice of coordinate system depends on how efficiently the inverse can be found. The process of finding the inverse also consists of several stages of multiplication and addition, so it is advisable to select a coordinate system after comparing the overall computation. Recently, a number of efficient algorithms for obtaining inverses on a finite body have been recently published, and since the present invention proposes an efficient hardware algorithm for obtaining inverses, the method of representing an elliptic curve in the Affine coordinate system is selected.

The method of obtaining an elliptic curve group is as follows. First, if K is an arbitrary sieve, a solution satisfying the non-homogeneous (affine) Weierstrass equation And the point at infinity O define an elliptic curve on K.

only,

If the surface of sieve K is not 2 We can transform into (if surface number K> 3 Can be transformed into). And when the number of sieves K is 2, Equation 1 may be converted to either Equation 2 or 3.

If E is a set of points on this curve, by defining the addition operation well, the set E ∪ {O} can be an abelian group, denoted by E (K). This Gahwan group becomes an elliptic curve group with infinite origin O, the identity.

Hereinafter, the additive operation between points on an elliptic curve is defined. If you define the additive operation as follows, the set of points on the elliptic curve constitutes the test group.

Definition E is called the real elliptic curve, and P and Q are the two points on the elliptic curve E. Here, the negative P of P and the sum P + Q are defined by the following method.

① If P is infinite point O, -P is defined as O and P + Q is defined as Q. In other words, it can be considered that the infinite point O corresponds to the zero circle, which is a unit member of the additive in the group of points considered here. In the following description, it is assumed that neither of the two points P and Q is an infinite origin.

② -P has the same x-coordinate value as P and negative value of y-coordinate of P. That is,-(x, y) = (x, -y). If point (x, y) is a point on the curve, it is obvious that point (x, -y) also becomes a point on the curve.

③ If two points P and Q have different x coordinates, It is clear that the and curves must always have another intersection point R, unless the straight line is in contact with the curve at point P. If it is in contact with point P, R = P, If any, R = Q). In this case, P + Q is defined as -R, that is, a symmetric image about the x-axis of the third intersection point.

If Q = -P (that is, Q has the same x coordinate for P and has a negative y coordinate), it is defined as P + Q = O (infinity).

(5) The other thing to think about is when P = Q. In this case, let l be the tangent at the point P on the curve, and if R is the only intersection point between the curve and the tangent l, then define P + Q = -R. Where P is the point of inflection, R is called P).

Based on this definition, let's derive the coordinates of P + Q when K is not 2 and 3. If the surface of the base K is neither 2 nor 3, the elliptic curve satisfies the infinite zero point O and the following Equation 4. Represents a set of points (x, y).

first, Let be the coordinate values of P, Q, and P + Q, respectively. Wow To In this case, the coordinate value of P + Q is obtained. Is the equation of a straight line passing through two points P and Q (the straight line ③ is not parallel to the y-axis). At this time Im obvious. A point on a straight line by two points P and Q on a curve, that is, a point ( )silver Is satisfied, and only then on the curve. Cubic equation from this It can be seen that as many intersection points exist as the roots of. now, Wow We know that are two points on the curve, P and Q, so two of the roots of the equation It can be seen that. Also, the sum of the solutions of the moniker polynomials is equal to the negative value of the coefficient of the second highest order term in the polynomial, so in this case the third solution Becomes From this about It is possible to obtain using Is also obtained. As a result, P + Q becomes as shown in Equation 5 below.

Also in the case of P = Q in the definition (5) above, α is the same except that the differential coefficient dy / dx of the point P is used. Equation from Implicit Differentiation of Elliptic Curve Equation Is derived, and the following equation (6) representing the coordinate value twice P is derived.

Similarly, in the case where the number of K's surface is 2, a coordinate value of P + Q is derived.

The equation for the coordinates of the derived P + Q is for the case where the number of K's surface is 2 and the elliptic curve is a non-supersingular curve. In the present invention, since it is intended to be implemented in hardware, the base body K is represented by GF ( ) or Think in form.

Hereinafter, an example of an encryption system using elliptic curve encryption will be briefly described.

First basement Select. The elliptic curve of the phase is represented by E, and one point P of the E phase is selected. The rank of P is represented by n. And system parameters , Elliptic curve E, point P, order n and all are public information.

Key generation

Each entity performs the following operations.

1. Select a random integer d between intervals [1, n-1].

2. Calculate point Q: = dP.

3. The entity's public key consists of point Q.

4. The private key of the entity is the integer d.

Encryption process

Assuming that entity B sends message M to entity A, entity B does the following:

1. Check A's public key Q.

2. The message M is based on the element ). only, to be.

3. Select a random integer k between the intervals [1, n-1].

4. points ( ): = compute kP.

5. Point ( ): = compute kQ.

6. Basal body element by predetermined calculation method To With and and Obtain only and Must be included in the element of the base body.

7. Data c: = ( ) To A.

Decryption process

Ciphertext received from B by entity c: = ( ) Is the process of deciphering. Entity A does the following:

1. a dot using his private key d Calculate

2. From and Restore it.

Finite field Explaining Optimal Normal Bases (ONB) in

When designing an encryption system using an elliptic curve, the most basic operation is additive operation between points on the elliptic curve. However, the additive operation defined so that the points on the elliptic curve on the finite body can form a group consists of a base body operation, that is, a finite body operation in which an elliptic curve is defined as described above. Therefore, the performance of the encryption system using the elliptic curve, that is, the encryption / decryption speed, is determined by the performance of the base body calculator. The operations on the finite field are essentially the same, but the details of the calculation differ depending on the elemental representation of the body. The elemental representation of the sieve is largely polynomunal basis representation and normal basis representation. In hardware implementation, a normal basis representation on a sieve of 2 is more suitable, which simplifies bitwise operation. Finite body The elements of the phase can be expressed using an ONB expression. ONB It exists only at the specific m value in. There are two types of ONB, see Working Draft IEEE P1363, Part 6 and Michael Rosing, "Implementing Elliptic Curve Cryptography", Manning pub., 1999. Details of ONB are as follows.

1. If If you only have this type I ONB This is called. other If you have this Type II ONB, use the following ignition Calculate

Is the coefficient Is a polynomial of order m and order m. Set of polynomials { }silver On To form the basis of. This basis is called the normal basis.

2. Polynomial Mod f (x) to form the m × m matrix A using the i-th column as the binary vector. only, to be. Each entry in A is It consists of elements of.

3. Inverse of A Obtain

4. Polynomial Is a binary vector generated by mod f (x) Let's do it. Let m be the i-th column to form the m × m matrix T.

5. It is called. only, to be. From here Of t ( Indicates an entry. Each Is It consists of elements of. if i is 0 for only one j This holds true, i For exactly 2 j This holds true. Therefore, in matrix T Of 2 entries, only 2m-1 entries are 1, all others are 0. For this reason, this normal basis is specifically called ONB.

E.g, If you look at the operation using the ONB expression The element of is a set of 4-tuple

(0000) (0001) (0010) (0011) (0100) (0101) (0110) (0111)

(1000) (1001) (1010) (1011) (1100) (1101) (1110) (1111)

The addition and multiplication are then as follows.

Field additive: to be. only, Is Is an element of. In other words, the additive operation is an XOR (exclusive or) of a vector representation.

Field multiplication: The preparation process for multiplication is as follows.

One. to be.

2. Calculating matrix A gives the following result.

3. The inverse of A is

4. The result of calculating the matrix T is as follows.

5. Being 1 Term to be.

Therefore The result of is defined as in Equation 9 below. only, to be.

The definition of the operation satisfies the properties of the sieve. Furthermore, the identity for the defined multiplication operation is (1111) and Equation 10 is established.

That is, the square of an element is rotated. Also Source of Is (1100).

This representation is called the optimal normal basis representation and is a finite field. It is a mathematical basis for efficiently implementing arithmetic operators in.

As we have seen above, using ONB expressions The additive operation between any two elements of is simply a bitwise XOR, and the squared operation is rotated. Also Wow To Is an element of When m is a result of the multiplication operation, m-tuple c is expressed as in Equation 11 below.

Where each subscript takes the modular m.

Based on Equation 11, there are two methods of designing a multiplier operator in hardware. The first is to design serially and the second is to design parallel. The former method is "Sarwono Sutikno, Ronny Effendi, Andy Surya, 'Design and Implementation of Arithmetic Processor' for Elliptic Curve Cryptosystems', IEEE APCCAS, 1998, Pages: 647-650. The multiplication operator is designed in parallel combination circuit to improve the performance in terms of speed and simplify the control circuit to improve the overall performance in consideration of trade-off.

Hereinafter, the hardware configuration for the inverse of the multiplication operation,

First, the inverse for the multiplication operation defined in any sieve K can be represented by Equation 12 below.

So a Equation 12 may also be applied to the element. In this case, however, the multiplication operation follows the above definition, and the identity "1" for the multiplication operation is m-tuple (11..1). When Fermat's theorem is applied to Equation 12,

Becomes At this time, only the exponent is expressed by Equation 13 below.

If the right side of Equation 13 can be factored, the inverse operation may be calculated by square and multiplication. Factorization process is as shown in Equation 14.

This factoring process is in accordance with "Michael Rosing," Implementing Elliptic Curve Cryptography ", Manning pub., 1999, and this factoring is applicable repeatedly for each term. In particular, in a hardware implementation, the power of 2 power can be handled simply by rotation, so the above factorization to maximize the power of power of 2 is highly desirable. But even if these factors are factored, moving this formula to hardware is another matter. In other words, if all the terms are simply calculated in parallel using the parallelism, which is a characteristic and advantage of the hardware implementation, the area and delay of the hardware are excessively large due to the characteristics of inverse arithmetic, and it is not suitable to implement all of them in parallel.

In fact, in order to discuss the design of the inverse operator, it is necessary to consider the trade-off between the number of multiplier operators and the execution time. Obviously, the more multiplication operators you use, the less computation time you need to find the inverse. In other words, as the unit term of the operation to be performed in one clock is divided into larger portions, the number of multiplication operators required increases, and the time required for inverse operation decreases. In designing the inverted operator, the gate count of the multiplier operator occupies most of the total circuit size. Therefore, only the gate count of the multiplier operator may be considered to estimate the gate count of the inverted operator.

On the other hand, the number of multiplication operations required to find the inverse varies nonlinearly depending on the choice of the base body. Basal body In this case, the number of times required multiplication can be expressed by the following equation (15).

And the time taken to perform the operation is as follows.

In order to design the inverted operator into the actual circuit, the unit term may be divided and applied to the application purpose in consideration of the delay of the multiplication operator, the complexity of the control circuit, and the available devices.

In the present invention, in order to design an inverse operator optimized for speed using an FPGA device, the unit terms are divided into the following forms as described above.

By designing an operator that can calculate the derived unit term and using it repeatedly, inverse computation can be performed. Basal body The equation derived for the hardware implementation of the inverse operator is given by

If we derive the unit term as above, the result of inverse operation Becomes Each unit term Means an operation to be performed in parallel, and when implemented as a circuit, it consists of two multiplication circuits, three rotation circuits, three MUXs, and one register. Each bit size is determined by m, and the time it takes to calculate the inverse Since there are n terms, it takes a total of n × (clock cycles needed for one multiplication). For example, if the basal body The inverse can be calculated for 7x (clock cycles needed for one multiplication). Looking at the configuration of the inversion operator of the present invention designed based on the derived equation,

1 illustrates a configuration of an inverted operator according to an exemplary embodiment of the present invention, including three multiplexers 100, 120, and 160, three rotation units 110, 140, and 180, two multiplication circuits 130 and 150, It consists of a register 170 and a controller 190.

Referring to FIG. 1, the first multiplexer 100 selectively outputs one of m-bit input data A and m-bit feedback data according to a selection signal input from the controller 190. The first rotation unit 110 rotates the output data of the first multiplexer 100 according to the rotation number control signal output from the controller 190 and outputs the rotated data. If you look at the elliptic curve cryptography standards set by the IEEE, If you use, the power of 2 is defined as bit rotation. Therefore, the rotation unit 110 performs a left rotation of the input m-bit value when the left side is the MSB. According to the rotation number control signal, it is possible to rotate m-bit data from zero rotation to m-1 times.

Meanwhile, the second multiplexer 120 selectively outputs one of the m-bit input data A and feedback data. Meanwhile, the first multiplication circuit 130 receives the output signals of the second multiplexer 120 and the first rotation unit 110 and performs operations according to the base multiplication operation for the elliptic curve encryption defined in IEEE 1363. Output the bit result. The second rotation unit 140 rotates the output of the first multiplication circuit 130 once, and the output of the second rotation unit 140 together with the m-bit input data A is a second multiplication circuit. Inputted to 150 is performed according to the base multiplication operation for the elliptic curve cryptography. Accordingly, one of the outputs of the first multiplication circuit 130 and the second multiplication circuit 150 is output from the third multiplexer 170 by selection of the controller 190, and the output of the third multiplexer 170 is output. After being stored in the register 170 and inputted to the third rotation unit 180 again, it is rotated once and output as inverse data of the input data A. In the inverse calculator of the above-described configuration, the controller 190 generates signals for controlling the multiplexers 100, 120, 160 and the first rotation unit 110 according to an input clock clk, thereby sequentially inputting unit terms to the calculator. It controls the change of operation form.

The speed of the inverse operator having the above-described configuration is known as "Design and Implementation of Arithmetic Processor". for Elliptic Curve Cryptosystems ", the reference compares 23 multiplications and 23 to find the inverse. The time required (the number of clocks required to perform one multiplicative operation) is required. On the contrary, the present invention requires 10 multiplication processes and the time required to obtain the inverse. It is only (the number of clocks required to perform one multiplicative operation).

Therefore, if the unit term is derived as in the present invention and the inverse operator is implemented, the execution time of the inverse operation is independent of the speed of the multiplication operator. X (the number of clocks required to perform one multiplicative operation), the result is that the multiplicative operation speed and the inverse calculation speed become faster.

As described above, the present invention provides the execution time of the inverse operation regardless of the speed of the multiplication operator. Since it can be shortened to × (clock cycle in one multiplication operation), there is an advantage that a high-speed inverse operator can be provided.

The inverse operator according to the present invention can be any finite field Because it can be applied to, there is an advantage that it can be extended to various applications using the fins.

Claims (2)

In inverse operator for elliptic curve cryptosystem, a first multiplexer for selectively outputting one of m-bit input data and feedback data; A first rotation unit configured to rotate and output the output data of the first multiplexer according to a rotation number control signal; A second multiplexer for selectively outputting one of the m-bit input data and feedback data; A first multiplier circuit for receiving the output signals of the second multiplexer and the first rotation unit and performing an operation according to a base multiplication operation for an elliptic curve cryptography to output an m-bit result; A second rotation unit configured to rotate and output the output of the first multiplication circuit; A second multiplication circuit configured to perform arithmetic operation on the output of the second rotation unit and the m-bit input data according to a base body multiplication operation for an elliptic curve encryption; A third multiplexer for selectively outputting one of the outputs of the first multiplication circuit and the second multiplication circuit; A register for storing output data of the third multiplexer; A third rotation unit rotating the output of the register to output inverse data of the input data; And a controller configured to generate and output a signal for controlling the multiplexers and the first rotation unit according to an input clock. The method of claim 1, wherein the control unit is a unit term of the input data derived as follows ( An inverted calculator characterized in that each part of the calculator is controlled to perform a calculation for each unit. ;