KR20040045152A - Apparatus for modular multiplication - Google Patents

Abstract

PURPOSE: A modular multiplying device is provided to successively perform a modular operation by removing the complexity and a delay, and removing or minimizing the delay due to a process inputting data to a modular multiplier from a memory as omitting a Montgomery correction factor calculation process needed during the operation process. CONSTITUTION: A CPU(120) is connected to a system bus(100). The memory(110) inputs/outputs the data needed for the modular multiplication operation. The 2-step registers(101-103) respectively store a multiplier, a multiplicand, and a modulus inputted from the system bus. An operation core(105) performs the modular operation by receiving the data stored in the 2-step registers, outputs a carry-out and a sum-out by dividing a result value, and stores the shift data and a Montgomery correction factor occurred during the operation process. A state register(107) stores/informs the outside of an operation state. A control register(108) receives/stores a control signal of the CPU. A register group(109) stores the partial multiplication during the multiplication operation, and stores/outputs the final result value.

Description

Modular multiplication unit {APPARATUS FOR MODULAR MULTIPLICATION}

FIELD OF THE INVENTION The present invention relates to a modular multiplication device, and in particular, protects and discloses the user's personal information in an IC card and a single chip type system incorporating such a central processing unit (CPU) and memory. Among the public key cryptographic algorithms used to provide security by providing security, the size of the operator is chosen to suit any system that can have modular multiplication operations used to perform RSA cryptographic algorithms that can have different ranges of required area limits. The present invention relates to a Montgomery modular multiplication device that enables design.

The RSA cryptographic algorithm is implemented by performing modular multiplication, which is possible through iterative modular multiplication. Montgomery's algorithm is mainly used to perform this modular multiplication quickly. However, the conventional Montgomery modular multiplication apparatus receives all the necessary inputs as an auxiliary operator and outputs the result. This method has the advantage of processing all the bits of the input requiring encryption at once, but the area is too large. It is difficult to apply to a system such as an IC card contemplated by the present invention because of the large problem. In addition, the method of performing a modular pipeline with a unit smaller than the total number of data bits can be advantageous in that it can select an appropriate area, but it is advantageous to a system operating in conjunction with a central processing unit. If applied, time is required for a new input for each operating clock, which delays the completion time of the entire modular multiplication. In addition, when modular multiplication is implemented by using a single arithmetic unit with fewer units than the total number of bits of data, an additional operation is required to calculate Montgomery correction factor for modulus, which increases the complexity of the operation This can cause a delay in operation. As in the aforementioned pipeline method, if only an operator is implemented in the form of an auxiliary operator without considering the interworking with the central processing unit, there is a problem that a time delay is caused when encrypting the entire data bit. .

In general, in implementing hardware such as a modular arithmetic unit, most implementation schemes often limit the scope to the arithmetic unit itself to improve performance. That is, instead of considering the linkage between the central processing unit and the calculator to be implemented and the corresponding input / output, it concentrates only on how fast the output is output for a given input and output and how much hardware requirements can be reduced. However, in the case of integrating such a module with the central processing unit, the lack of this part becomes a very big problem, and the performance of the implemented operator is drastically degraded. Will fall. Likewise, in the case of the modular multiplier, such a problem may occur. For example, in the case of implementing a modular operation by repeating an arbitrary word unit multiplication expressed in Equation 5, the core operation in which the third part is implemented in hardware It becomes a module, but there are a few things that must be considered in terms of interworking with the aforementioned central processing unit. First, N ₀ ^* must be input externally to find the Montgomery factor m to be multiplied by modulus N. It is up to the central processing unit to find N ₀ ^* , which requires extra software and execution time. Next, the problem of inputting data to perform the next multiplication after one word multiplication is performed. When implementing Equation 3 in hardware, consideration should be given not only to the performance improvement of the internal operation but also to how to receive the next input. In other words, if there is no consideration of these parts, the internal operation and the input / output of the central processing unit are completely separated from each word unit operation. In this case, the part that was not considered when implementing the operator may be a bigger problem than the expected performance improvement of the operator.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned shortcomings, and the size of a calculation module according to the limited details of the area required in a single chip type system such as an IC card including a central processing unit and an encryption device interoperating therewith. In implementing the Montgomery Modular Multiplier, which allows the user to select and design, we eliminate the calculation of the required Montgomery correction factor during the calculation process, eliminating the computational complexity and execution time delays, and the data input from the memory to the Modular Multiplier. It is an object of the present invention to provide a Montgomery modular multiplier that can continuously perform modular operations by eliminating or minimizing time delays.

The present invention for achieving the above object is a central processing unit connected to a predetermined system bus (system bus); A memory connected to the system bus for inputting / outputting data required for a modular multiplication operation; Two stage input registers A, B, and N each configured to store two multipliers A, a multiplier B, and a modulus N respectively inputted from the system bus; Receives data stored in the two-stage input registers A, B, and N, respectively, performs a modular operation, and outputs the result by dividing the result into a carry-out and a sum-out. And an arithmetic core for storing the Montgomery correction factor m; A status register connected to the system bus for storing and notifying a modular multiplication operation state; A control register for receiving and storing a control signal of the central processing unit through the system bus; A register group connected to the system bus, the register group comprising a plurality of registers for storing respective intermediate result values to store partial products during modular multiplication and to store and output a final result value; An adder for selectively carrying out two additions by receiving the carry out, sum out, shift data, and output of the register group output from the operation core unit; And control the input / output of the operation core and the input / output of the adder until they are connected to the system bus and receive control signals of the central processing unit from the control register to output the final result of the modular multiplication operation. And a controller for generating a signal for storing a new value.

1 is a block diagram showing an embodiment of a modular multiplication apparatus according to the present invention;

FIG. 2 is a circuit diagram illustrating an embodiment of the two-stage input registers N, A, and B shown in FIG. 1;

3 is a detailed view showing an embodiment of an operation core unit shown in FIG. 1;

4 is a detailed view of one embodiment of the adder shown in FIG.

<Explanation of symbols for the main parts of the drawings>

100: system bus 101, 102, 103: two-stage input register N, A, B

104 control unit 105 operation core unit

106: adder 107: status register

108: control register 109: word register

110: memory 119: multiplexer

120: central processing unit

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, the Montgomery modular multiplication algorithm handled by the present invention will be described. An operation for obtaining the resultant value R for the multiplier A, the multiplicand B, and the modulus N as in Equation 1 is called modular multiplication.

R = A * BmodN

Among the algorithms for efficient modular multiplication, the Montgomery algorithm does not use the classical division of the quotient and the remainder by using the modular multiplication algorithm with the surplus coefficient r to move the calculation from the integer Z _n area to the rZ _n area. Enables modular operations without having to In this case, an additional operation is required for moving the area, but modular multiplication through repetitive modular multiplication such as RSA is not a single modular multiplication but the main purpose of the modular multiplier. Instead, it only needs to be performed at the beginning and end of the total multiplication, and the movement of the region can be performed by Montgomery modular multiplication. Therefore, the Montgomery modular arithmetic method is very suitable for the implementation of the modular multiplier.

The surplus coefficient r has a value of 2 ⁿ for the number n of bits of data, and the result of the Montgomery modular multiplication algorithm is shown in Equation 2.

R = A * B * r ^-1 modN

Equation 3 shows a step-by-step process of performing a general Montgomery algorithm for implementing equation (2).

Step 1: R = 0

Step 2: R = R + A * B

Step 3: m = R * N ^* modr (where r * r ^-1 -N * N ^* = 1)

Step 4: R = (R + m * N) / r

Step 5: if (R> N) R = R-N

Step 6: return (R)

In Equation 3 above, the division operation of step 4 is simply implemented as a shift operation. As such, the Montgomery algorithm has the advantage of simplifying the division operation required for modular multiplication by only the multiplication operation and the shift operation. However, an operation process for obtaining the Montgomery correction factor m performed in step 3 must be additionally implemented, and additional operation time is required as much as this calculation amount.

Therefore, it is more efficient not to perform a separate calculation process for obtaining the factor m, and a basic method for performing modular multiplication without the Montgomery correction factor calculation performed in step 3 of Equation 3 is shown in Equation 4 below.

Step 1: R = 0

Step 2: for i = 0 to n-1 {

R = R + A _i * B

R = R + R ₀ * N

R = R / 2

}

Step 3: if (R> N) R = R-N

Step 4: return (R)

Equation (4) can perform all modular multiplications with only the procedure of step 2 without additional computation to find the arguments. It can be said that it is a representative operation method that is applied when processing the entire data input as it is, and there have been studies on the implementation of various modular operation methods and hardware applied based on this. However, since these methods basically consider the entire data at once, it is difficult to be applied to a system such as an IC card because the area of hardware is large to process data having more than 1024 bits.

Therefore, in a system such as an IC card, a method of operating by dividing the data to be processed into arbitrary word units without performing them all at once should be applied. Equation 5 is a formula expressing Montgomery modular multiplication for such word unit operations step by step. .

Step 1: R = 0

Step 2: for i = 0 to p-1 {

Step 3: R = R + A * B _i (B _i is w-bit word)

m = R ₀ * N ₀ ^* mod2 ^w (N ₀ * N ₀ ^* = -1mod2 ^w )

R = R + N * m

R = R / 2 ^w

}

Step 4: if (R> N) R = R-N

Step 5: return (R)

In Equation 5, a column A * B _i is performed by performing p-word multiplication by dividing p w-bit words having the same size as B _i (N * m) is also divided into p w-bit words and multiply by p word units. In general, the number of bits of a word is determined to be 32 bits or an integer multiple of the bits, considering the case that the data size of the system bus of a system such as an IC card is 32 bits.

Accordingly, since the hardware implemented apparatus using the Equation 5 is composed of a module that controls the w-bit word unit and controls it, the hardware area is reduced compared to when all the data bits are processed at once. However, if the above method is applied as it is, the calculation amount for calculating the Montgomery correction factor is naturally required as in the case of Equation 3, and the multiplication operation performed internally is the same as the partial multiplication process of general multiplication. Therefore, the result of multiplication in word has the size of 2 * w-bits, and the w-bit corresponding to carry must be passed to the next word unit multiplication to have the dependency of the operation that enables the next unit of word multiplication. do.

However, in the present invention, since each word unit operation is performed independently of the previous operation result, the result value can be obtained by storing the shifted value in each partial operation and adding it to the result of the previous word operation. The multiplication result in word units is always maintained at the size of w-bits, and the addition process for obtaining the result value in each partial operation can be independently implemented as a separate module. The equation for this is shown in Equation 6 below.

Step 1: R = 0, T = 0

Step 2: for i = 0 to p-1 {

Pre_c = 0, Next_c = 0

Step 3: for j = 0 to p-1 {

If (i == 0) R _j = 0 (R _j is the size of w + 1 bits)

Else R _j = T _j (T _j is the size of w bits)

Step 4: for b = 0 to w-1 {(where b is the order of bits)

R _j = R _j + A _jb * B _i

if (j == 0) m _b = R _j0 (m is the size of w bits)

else m _b = m _b

R _j = R _j + m _b * N _j

shift_data _b = R _j0 (shift_data is the size of w bits)

R _j = R _j / 2

} end for b

Step 5: (Pre_c, T _j ) = R _j + Pre_c

(Next_c, T _j-1 ) = T _j-1 + shift_data + Next_c

} end for j

} end for i

Step 6: If (T> N) T = T-N (where T is the size of n + 1 bits including the last Next_c)

Step 7: return (T)

In determining the arbitrary number of bits w in Equation 6, the number of bits n '(n' ≥ n + 2) greater than or equal to the total number of bits n may be implemented in the form of n '= w * p. To be able. At this time, p is an arbitrary integer and the value of the bit larger than n is set to 0. This means that the result of a modular operation is always less than 2N, so that the result can be represented within a given bit size. Considering that a modular multiplier is a device for modular multiplication only, if you perform a calculation with a bit number larger than 2 bits, If the result of a multiplication operation is greater than N, the result of the final modular multiplication always results in a value less than N, even if the comparison process is not subtracted from the result value each time. If a single result of modular multiplication is required, the comparison process can be performed outside of the proposed computing device. Therefore, Step 6 in Equation 6 may be omitted when implemented in hardware. As described above, the word unit is not necessarily limited to 32 bits, but may be an integer multiple of 32 bits. At this time, if the equation 5 is applied to the word unit, which is an integer multiple of 32 bits, the multiplication process is performed. As the number of bits increases, the complexity of the circuit and the delay of execution time increase. Therefore, when the number of bits increases, a problem arises in that the structure must be improved to solve this problem.

However, the structure proposed in the present invention can be used by extending the same structure irrespective of the increase of the bit. Therefore, when the hardware is implemented, the current structure can be designed in hardware according to the selected bit size.

In the above Equation 6, the addition process is performed in steps 4 and 5, respectively, and in the case of step 4, R _j is divided into a carry out and a sum out and performed by a carry storage adder. This not only has the effect of reducing the time delay that can occur when using a full adder, but also requires a carry bit adder to carry Rx in step 5 (Pre_c, T _j ) = R _j + Pre_c. Outputting the value of R _j out and sum out and in step 5 implements a w-bit adder that computes (Pre_c, T _j ) = carry out + sum out + Pre_c to obtain an efficient result. In addition, since step 4 and step 5 are performed independently, the step of performing the addition process with the result values of the previous operation in step 5 while step 4 performs the next word unit operation.

Therefore, the time required to perform step 4 by receiving inputs of one word unit requires w clock cycles. In other words, the time during which one word input set is maintained becomes w clock cycles. Thus, if the central processing unit can accept the next set of word units sent from the memory in advance during the w clock cycle during which the operation is performed on the current set of word inputs, then the data input in units of words during the modular operation of the entire data is performed. Only additional time is required when no additional time is required for the W clock cycle or longer, thereby reducing the execution time.

Figure 1 is a block diagram showing an embodiment of a modular multiplication apparatus according to the present invention, a system bus 100, two-stage input registers N, A, B (101, 102, 103), control unit 104, arithmetic core unit ( 105, adder 106, status register 107, control register 108, word register 109, memory 110, multiplexer 119, and central processing unit 120.

In the figure, the Montgomery modular multiplication apparatus according to the present invention performs a word unit modular operation process through the control unit 104, the calculation core unit 105, and the adder 106 for the addition operation. The two-stage input registers N (101) A (102) and B (103) receive and store the data of the next operation from the memory 110 through the system bus 100 in advance. The status register 107 informs the current operation state to the outside to cause the central processing unit 120 to perform the next operation. The control register 108 stores a signal that the central processing unit 120 provides for controlling the modular multiplication device. The word register 109 has a plurality of registers having a size of w bits to store partial values of each step generated during the operation process.

Referring to the overall operation based on the control signals generated by the operation of the control unit 104 as follows.

First, the central processing unit 120 transmits a value indicating the start of the operation to the control register 108 via the system bus 100. The control unit 104 receives a value indicating the start of the operation from the control register 108 to prepare for the operation. Thereafter, the controller 104 generates a first input control signal input_ctrl1 according to an address value transmitted through the system bus 100 to generate the two-stage input registers N, A, and B (101, 102, 103). In FIG. 2, data transmitted from the system bus 100 is stored in the register 1 200 as shown in FIG. 2. The controller 104 generates a second input control signal input_ctrl2 for informing the second stage input registers N, A, and B, 101, 102, and 103, after receiving all the data. , The value stored in the register 1 (200) is stored in the register 2 (201) by providing it to the lower end of the logical gate 203 in (103). At the same time, the control unit 104 causes the operation core unit 105 to start the operation. In the subsequent operation, after the register 2 201 receives the data from the register 1 200, the CPU 120 reads the value stored in the status register 107 and transmits the next data. Again, the controller 104 generates a first input control signal input_ctrl1 according to an address provided through the system bus 100 so that the register 1 200 may receive new data from the system bus 100. Register 2 (201) is the time point when the operation of the operation core unit 105 is terminated, that is, the b coefficient value (MM_count) generated by the controller 104 for the sequential operation of step 4 of the equation (6) is again 0 at w The new data is transferred from the register 1 200 by the second input control signal input_ctrl2 generated by the control unit 104 at the point of change to.

In addition to the second input control signal input_ctrl2 and the b-count value MM_count signal described above, the control unit 104 calculates another count value word_count and total_count. Send to the core 105. The b count value MM_count is the b count value in step 4 of Equation 6, the word count word_count is the j count value in step 3 and the total count is the i count value in step 2. The role of each count value is, firstly, the total count (total_count) indicates the number of words of the currently input B, the word count (word_count) indicates the word order of A, and the b count value (MM_count) indicates the current A _j value. The bit order is notified to control the operation of the operation core unit 105.

The operation core unit 105 outputs sumout, carry out, and shift data to the adder 106 after one operation of four operations, i.e., A _j and B _i . At this time, the control unit 104 generates an add_start signal for the operation of the adder 106 and simultaneously generates an add count signal, which is a coefficient indicating the number of additions, to sequentially perform two w-bit addition operations. To do it.

The adder 106 performs two additions and transfers two output values to the word register 109, which are word counts when the calculation core 105 calculates the value provided as the input of the adder 106. The two outputs of the adder 106 are stored in the word register 109 corresponding to the j th and the word register 109 corresponding to the j-1 th, respectively, for j in the (word_count) order. At this time, in order to select the word register 109 where the value is to be stored, the controller 104 generates a signal called an input cell (input_sel) toward the word register 109 using the word count word_count, and according to this value, an adder. The two outputs of 106 will be stored in the appropriate word register 109.

The value of the word register 109 is also used as an input of the operation core 105 and the adder 106. For this purpose, the controller 104 outputs a signal called an output cell (output_sel) for controlling the multiplexer 119. Generate. The operation core unit 105 does not need the value of the word register 109 when the current B word order total count (total_count) is 0 with respect to the current word count j as expressed in Step 3 of Equation 6. When the total_count is not 0, the value of the j-th word register 109 is input and used as the initial value of the calculation core unit 105. In addition, since the adder 106 needs to receive the value of the j-1 th word register 109 as one input, the control unit 104 may input the input cell (input_sel) so that the output of the word register 109 can be selectively performed. Will provide a signal.

In the operation process of the control unit 104 as shown in FIG. 1, a series of control signals are stored in the state register 107 to inform the central processing unit 120 of the current modular multiplication operation state, and at the same time, the control unit 104 again. It is provided as an input so that the controller 104 can determine the next control signal value. After performing all the modular multiplication processes, the central processing unit 120 transmits a value for stopping operation to the control register 108 and receives the control unit 104 to stop the operation.

FIG. 2 is a circuit diagram showing an embodiment of the two-stage input registers N, A, and B (101, 102, 103) shown in FIG. 1, with registers 1, 2 (200, 201), and AND gates 203. FIG. It is composed.

In the figure, the register 1 200 stores data provided from the system bus 100 according to the first input control signal Input_ctrl1. Register 2 201 stores the data provided from register 1 200 according to the output of the AND gate 203. The AND gate 203 provides a gate clock obtained by performing an AND operation on the clock and the second input control signal Input_ctrl2 to the register 2 201. In this way, the two-stage input registers N, A, and B (101, 102, 103) use the AND gate 203 to store data only when a new input value is required.

3 is a detailed view illustrating an embodiment of the calculation core unit 105 shown in FIG. 1.

In general, it is similar to the structure that processes all the data bits of Equation 4 at once, but there is an important difference between the m register 307 for storing the Montgomery correction factor m and the shift data register 310 for storing shift data. Referring to the operation of the operation core unit 105 in accordance with the operation procedure expressed in Equation 6, first of all the steps 3 and 4, the first operation of step 2, that is, the total count input from the control unit 104 (total_count) Input carry-in becomes 0 and sum-in is also inputted through multiplexer 0 (300) until the output value of the modular operation for A and B ₀ when) is 0. In the subsequent step 2, the value of the word register 109 that matches the current word operation order, j in step 3, among the values of the word registers 109 that store the result of the previous step 2 is input, and this value is Selected through the multiplexer 0 (300) to enter the island in.

Output and carry register of A _0b * B _i 305 with j = 0 during w clock cycles when performing the first step 3 for each step 2, i.e., A ₀ * B _i where word count is zero. 303 stores S um _ 0 in the m register among the outputs of the carry storage adder 1 306 having the value of the island register 304 as an input, and m _b * N _j 308 according to the bit order b. Perform and send this result to carry storage adder 2 309 together with the two outputs of carry storage adder 1 306. This is because the Montgomery correction factor is equal to the value stored in the m register 307 during step 3 after the first word operation A ₀ * B _i . As described above, the process of obtaining the Montgomery correction factor, which requires a separate calculation process in Equation 5, is simultaneously performed while performing the word operation process.

In the output of the carry storage adder 2 309, Sum _ 0 is shifted because its value always becomes 0 in the case of Equation 4, but in the present structure, the value is calculated in units of words instead of all at once. Save them and add them to the result of the previous block. Therefore, these values are stored in the shift data register 310.

During the process of step 4, arithmetic core 105 completes one word operation after w clock cycles and adds 106 to step 3 of three w-bit values, such as carry out, sum out, and shift data. To).

FIG. 4 is a detailed view showing one embodiment of the adder 106 shown in FIG. 1 and performs step 5 of Equation 6. FIG.

After one word operation, that is, step 4, is performed, three outputs are generated in the operation core unit 105 as described above with reference to FIG. 3. To obtain the result value of each word operation as an input, it should be added according to the procedure of step 5. The operation process is as follows. First, the controller 104 generates an add_start signal to notify the time at which the adder 106 is to operate and to perform an addition operation. The carry-out 400, the sum-out 402, the shift data 401, etc., output from the operation core unit 105 are received and stored, and the j-1 th word register 109 is stored with respect to j which is the currently completed word operation sequence. ) Can be selected as two inputs by the add_count signal through the multiplexer 1 403 and the multiplexer 2 404 as shown in FIG. 4. At this time, two carry values Pre_c 406 and Next_c 407 are selected through the multiplexer 3 (408). First carry out 400 and sum out 402 are added via w-bit adder 405. Then, the presum (Pre_sum) and the carry bit Pre_c (406) are output and stored for use as a carry input of the same operation of the next j + 1th operation core portion (105) output, where the calculated presum Pre_sum is stored in the word register 109 matching the word operation order j. In the second addition operation, one of the current word operation order j storing the shift data 401 and the pre-sum generated by the adder 106 after the operation of the previous j-1 th operation core unit 105 is stored. The next j-1 th word register 109 is added through the w-bit adder 405 to store the next island Next_sum and carry Next_c 407. In this case, Next_c 407 is stored for the second addition operation of step 5 to be performed after the next j + 1th word operation, and the next generated next sum (Next_sum) is provided as an input value of the word register 109, That is, it is stored back into the j-1 th word register 109, which is the result of the word modular operation on the inputs A _j-1 and B _i .

By repeating the above operation, the final result of Montgomery modular multiplication for all data inputs A, B, N is stored in the word register 109. This value may be transmitted to the system bus 100 by 32 bits according to a control signal of the central processing unit. Since the start of the add operation is performed after the operation core 105 is finished, the operation time can be specified through the clock branch in the controller 104. Also, the addition operation is independent of the operation core, so the next operation is not required to wait for the addition result. Operational core operations for the word data are performed. In addition, in the case of word units of 32 bits or more, it is more efficient to obtain a result by repeating the 32-bit adder rather than adding all the units at once.

As described above, according to the present invention, in order to apply an arbitrary word unit operation device to apply Montgomery modular multiplication to a single chip system such as an IC card having a limited area, data input may be sufficiently taken into consideration in connection with a central processing unit. It minimizes the time delay for the operation and can perform the calculation without the additional Montgomery correction factor calculation process, so that the separate operation process or time delay for this can be eliminated, so the entire operation is simplified and it is easy to implement and expand into hardware. .

Claims (9)

A central processing unit connected to a predetermined system bus; A memory connected to the system bus for inputting / outputting data required for a modular multiplication operation; Two stage input registers A, B, and N each configured to store two multipliers A, a multiplier B, and a modulus N respectively inputted from the system bus; Receives data stored in the two-stage input registers A, B, and N, respectively, performs a modular operation, and outputs the result by dividing the result into a carry-out and a sum-out. And an arithmetic core for storing the Montgomery correction factor m; A status register connected to the system bus for storing and notifying a modular multiplication operation state; A control register for receiving and storing a control signal of the central processing unit through the system bus; A register group connected to the system bus, the register group comprising a plurality of registers for storing respective intermediate result values to store partial products during modular multiplication and to store and output a final result value; An adder for selectively carrying out two additions by receiving the carry out, sum out, shift data, and output of the register group output from the operation core unit; And It is connected to the system bus and receives the control signal of the central processing unit from the control register and controls the input / output of the operation core and the input / output of the adder until the final result value of the modular multiplication operation is output and is added to the register group. And a control unit for generating a signal for storing a value. The modular multiplier of claim 1, wherein the multiplier A, the multiplicand B, and the modulus N are input from the system bus in word units. The modular multiplication apparatus of claim 1, wherein the operation core unit receives data stored in the two-stage input registers A, B, and N, respectively, and performs a modular operation in units of words. The modular multiplication apparatus of claim 1, wherein each intermediate result value is an intermediate result value in a word unit. The modular multiplication apparatus of claim 1, wherein the second addition is performed in units of words. The modular multiplier according to claim 1, wherein the two-stage input registers A, B, and N are composed of two registers having the same bit size as the input of a word unit. The method of claim 1, The second stage input registers A, B, and N may include a register 1 for storing data provided from the system bus according to a first input control signal Input_ctrl1 provided from the controller; An AND gate performing an AND operation on a clock and a second input control signal Input_ctrl2 provided from the controller; And And a register 2 for storing data provided from the register 1 according to the output of the AND gate. The method of claim 1, The operation core unit includes: a calculation module for multiplying a bit of A and a word of B according to a b coefficient value, a word count and a total count provided from the control unit with respect to data provided from the second stage input registers A and B; A multiplexer 0 for determining an input of the multiplexer 2 according to a total count provided from the control unit with respect to the word register and 0; A multiplexer 1 for determining the input of the carry register according to the b coefficient value for the carry out output from the external input and the carry storage adder 2; A multiplexer 2 for determining the input of the sum register according to the b coefficient value for the output of the multiplexer 0 and the sumout output from the carry storage adder 2; A carry register for storing a carry input value of the carry storage adder 1; An island register for storing an island input value of the carry storage adder 1; A carry storage adder 1 for outputting a result value in the form of a carry and an island by inputting the carry register, the island register, and an operation module that multiplies the bits of the A and the word B; An m register for storing the least significant bit of the island output of the carry storage adder 1 according to a word count; an arithmetic module for multiplying the bit in the order of matching the b coefficient value in the m register with the word value of N according to the word count provided from the controller for the two-stage input register N; A carry storage adder 2 that outputs a carry out and a sum out as result values of two outputs of the carry storage adder 1 and an output of an operation module that multiplies the bits of m and the word of N; And And a shift data register for storing the least significant bit of the sumout which is the output of the carry storage adder 2. The method of claim 1, The adder includes a carry out register, a shift data register and a sum out register for storing carry out, shift data and sumout and shift data, which are outputs of the core calculating unit, in accordance with an add start provided from the control unit; A multiplexer 1 for determining the input of the W-bit adder according to the add count signal provided from the control unit for the output of the carry out register and the output of the shift register; A multiplexer 2 for determining the input of the W-bit adder according to the add count signal provided from the control unit for the output of the sumout register and the output of the word register; A W-bit adder that receives the output of the multiplexer 1 and the output of the multiplexer 2, performs W-bit addition, and outputs the output twice as a result value of 1-bit carry and word size; A register for storing Pre_c, which is the first 1-bit carry output of the W-bit adder, and a register for storing Next_c, which is the second 1-bit carry output; And And a multiplexer 3 for determining the 1-bit carry input of the W-bit adder according to the add count for the output of the Pre_c register and the output of the Next_c register.