KR20050101003A - Modular exponentiation operation method - Google Patents

Abstract

The modular power calculation method of the present invention sets the maximum size of the scan window, generates a random number within the set maximum size range, and sets the size of the scan window as the generated random number. In the present invention as described above, since the size of the window is changed frequently in the multiplication operation, data may be protected from an external attack.

Description

Modular power calculation method {MODULAR EXPONENTIATION OPERATION METHOD}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptography system for data security, and more particularly to a method for calculating exponents for modular multiplication in an encryption system.

In an information communication environment in which various data are exchanged through a computer network or wired or wireless communication, the importance of an encryption system for maintaining data security is increasing day by day. In particular, in electronic payment or authentication systems, it is essential to secure security by applying encoding and decryption techniques. Encryption techniques can be largely classified into a secret key (symmetric key or common key; secret key, symmetric key, private key, common key) method and public key (asymmetric key; public key, asymmetric key).

The secret key method is the DES (Data Encryption System) encryption algorithm by the US Department of Commerce's National Standards Bureau (NBS), and the former Soviet Union's GOST (Government STandard) and Switzerland's International Data Encryption Algorithm (IDEA) have. In the secret key encryption method, since the same secret key must be shared between the information exchange parties, a separate secure channel is required, and in particular, when a user exchanges information with several people, one user must maintain and manage many secret key channels.

On the other hand, public key cryptography is a system that makes it difficult to know the corresponding key even if one of them is known because the key to encrypt and the key to decrypt are different. In public key cryptography, one secret key and another public key are used to scramble / descramble information. Public key cryptography is easier to manage keys because it does not require a separate channel for sharing keys and improves security compared to the private key method, but mathematical operation to generate two different keys and restore information through them. It is known that there is a limitation in the high speed processing due to the complicated process.

Public key cryptographic algorithms, since they were first proposed by Diffie and Helman in 1976, are now RSA (RLRivest, A.Shamir, and L. Adelman; "A method for obtaining digital signatures and public-key cryptosyatems"; Commun ACM, Vol. 21, pp. 120-126, Feb. 1978, or US Pat. No. 4,405,829) algorithms are known as representative methods. This RSA method uses modular multiplication as a basic operation like Diffie-Hellman method or Digital Signature Algorithm (DSA) method, which is another kind of public key encryption system.

The RSA algorithm is especially performed by modulo operations based on large integers of more than 1024 bits and is based on the safety of the prime factorization of large integer coefficients.

The RSA encryption / decryption algorithm uses a modular exponentiation operation as the default operation. Equation C = M using public keys e (encryption index or encryption key) and N (modulus) consisting of two positive integers to encrypt plaintext M into ciphertext C Generate ciphertext C by ^e mod N In decryption of the ciphertext C into the plaintext M ', the plaintext is obtained by using the secret key d (decryption index) by the formula M' = C ^d mod N (the remainder of C multiplied by d times N divided by N). Find M ' That is, in order for Alice to send an encrypted message to Bob, she encrypts the message with Bob's public key e, which is open to everyone, and then sends the message to Bob via an unsecure channel (password C). Send) Bob then reads the original message (plain text M ') by decrypting the encrypted message using only the private key d.

 To select a key for encryption / decryption, first select two very large prime numbers p and q to calculate M = p × q, gcd [D, (p-1) (q-1 )] = 1 is the decryption key d. The encryption key e obtains an encryption key e that satisfies e × d = 1 mod [(p-1) (q-1)].

Binary method, the most basic operation principle of RSA, is an algorithm that performs a power operation through repeated square and multiple operations. It expresses n as a binary number, g for 1 of its most significant digit, and squares this value repeatedly, multiplying by g if the corresponding bit is 1. Equation 1 shows a binary algorithm.

Binary_Exp (g, n)

A: = g;

for i = k-2 to 0 by -1

A: = A * A;

if n _i = 1 then

A: = A * g;

return A;

In Equation 1, n is a binary number, n = (n _k-1 , n _k-2 ,..., N ₁ , n ₀ ) ₂ , and n _k-1 is 1.

In the binary operation, if the exponent is k bits, the k-1th square calculation except for the first calculation and W _{H <1>} (n) -1 multiplication processes, when the bit is 1, are required. In general, the Hamming weight is about (log ₂ n) / 2 because WH (n) is not known beforehand in the power operation and the probability that 0 and 1 appear in the bit is 1/2. Binary operations require up to 2k-2, average (3/2) * (k-1) multiplications. The binary operation requires only space to store only the intermediate value A. However, since the exponent must be scanned every bit, the computational speed is slow.

In order to improve the slow operation speed, a sliding window method has been proposed. The sliding window calculation method and the binary calculation method are different from the scan method for exponential bits. That is, the binary arithmetic method scans bits one by one, but the sliding window arithmetic method can scan bits that are variable within a preset window size at a time. In addition, additional memories are needed to store pre-constant values to improve computation speed.

Equation 2 shows an algorithm of a sliding window calculation method.

Input: M, e, n

Output: C = M ^e mod n

1.Calculate and save M ^w , which results in

 w = 2, 3,... , maximum window

2 Divide e into variable sized windows Fi (within maximum window)

   The length of Fi is L (Fi) for i = 0, 1, 2,... , p-1

^3.C : = M ^Fk-1 mod n

4.for k = p-2 down to 0

4a. C: = C ^{2L (Fi)} mod n

4b. If Fi 0, then C: = C * M ^Fi (mod n)

5. Return C

The sliding window calculation algorithm of Equation 2 is disclosed in Centin Kaya Koc, High-Speed RSA Implemnation 1994, pp16.

In RSA operation, the power calculation differs depending on the bits of the public and private keys. That is, the operation time is different when the bit of the key is '1' and when the bit is '0'. Therefore, the internal operation information may be obtained by monitoring the RSA operation through simple power analysis or differential power analysis. This can be fatal to a system where security is a concern.

Accordingly, an object of the present invention is to provide a modular power calculation method with improved security.

According to one aspect of the present invention for achieving the object as described above, the modular power operation method includes: setting the maximum size of the scan window, and any value within the set maximum size range of the size of the scan window It includes the step of setting.

In a preferred embodiment, the method further comprises calculating a power of one of the possible exponential bit combinations within the set maximum magnitude.

In this embodiment, the calculation method further comprises performing a modular exponential calculation from the calculated power of the exponent bits for the exponent bits corresponding to the size of the set scan window.

According to another aspect of the present invention, a modular power calculation method comprises: setting a maximum size of a scan window, calculating a power for possible exponential bit combinations within the set maximum size, and within the set maximum size range Generating a random number at and setting the size of the scan window using the generated random number.

In a preferred embodiment, the calculation method further comprises performing a modular exponential calculation from the calculated power of the exponent bits corresponding to the size of the set scan window.

(Example)

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Modular power calculation method according to a preferred embodiment of the present invention is a variable length window (VLM), which scans exponent bits from the most significant bit (MSB) to the least significant bit (LSB), but the size of the \ scan window to the hardware in the smart card Various changes can be made using the random number generator.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart showing a modular power calculation method according to a preferred embodiment of the present invention.

Referring to FIG. 1, in step S10, the maximum size of a scan window is set. That is, it sets up to how many bits of the n-bit exponent to scan.

In step S20, the power of the possible exponential bit combinations within the set maximum size of the scan window is calculated. For example, if the set maximum size of the scan window is 3 bits, 000, 001,... Calculate the power of each of the two points. Power values are stored in memory. For example, eight powers may be stored in different memories.

In step S30, any value within the set maximum size is set to the scan window size. In a preferred embodiment of the present invention, any value is obtained by random number generation. The random number is equal to or less than the set maximum size.

In step S40, the modular exponent is calculated from the calculated power of the exponent bits of the size of the set scan window. Earlier, in step S20, power values for the possible exponential bit combinations within the scan window maximum size are already calculated and stored in the memory. Therefore, the modular exponent is calculated by reading a power value corresponding to the exponent bits corresponding to the scan window size among the exponent bits from the memory.

In step S50, the modular exponential calculation is terminated if the scan for the exponent bits is completed, and if there is an exponent bit that has not yet been scanned, the control returns to step S30.

For example, if the exponent value is 1110100110101000000011 ₂ and the random number generated is 3, 3, 2,1, 2, 1, 3, 3, 3, and 2, the most significant bit of the exponent value is 111, 010, 00, 1, 10, 1, 010, 000, 000 and 11 are sequentially scanned.

While the invention has been described using exemplary preferred embodiments, it will be understood that the scope of the invention is not limited to the disclosed embodiments. Rather, the scope of the present invention is intended to include all of the various modifications and similar configurations. Accordingly, the claims should be construed as broadly as possible to cover all such modifications and similar constructions.

According to the present invention as described above, since the size of the window is changed at any time in the power multiplication process, data can be protected from an external attack. That is, security is improved.

1 is a flowchart showing a modular power calculation method according to a preferred embodiment of the present invention.

Claims (6)

Setting a maximum size of the scan window; And And setting a size of the scan window to any value within the set maximum size range. The method of claim 1, And calculating a power for a possible exponential bit combination within the set maximum size. The method of claim 2, And performing a modular exponent calculation from the calculated power value for exponent bits corresponding to the size of the set scan window. The method of claim 1, And the random value set to the size of the scan window is less than or equal to the set maximum size. Setting a maximum size of the scan window; Calculating powers for possible exponential bit combinations within the set maximum magnitude; Generating a random number within the set maximum size range; And And setting the size of the scan window as the generated random number. The method of claim 5, And performing a modular exponent calculation from the calculated power value for exponent bits corresponding to the size of the set scan window.