KR20100067590A - Method for evaluating elliptic curve cryptosystem - Google Patents

Abstract

PURPOSE: A method for calculating elliptic curve cryptogram is provided to simplify operation of prime finite field, thereby improving operation function by minimizing implementation area of encryption processor. CONSTITUTION: A controller transmits A0 unit bit of A register(110) and B4 unit bit of B register to multiplier(130). A operation result value of the multiplier is outputted to Mul_h, Mul_l. The Mul_h is added in C4 unit bit and adder(141). The Mul_l is added in C5 unit bit and adder(142). An output of a multiplier is stored in C4 and C5 of the C register. A multiple result of A0 and B3 is respectively added with storage values of C3 and C4 in the adders.

Description

Method for evaluating Elliptic Curve Cryptosystem

Embodiments of the present invention relate to a multiplication and inverse multiplication method of prime finite bodies on GF (P) among finite bodies for elliptic curve encryption.

The present invention is derived from the research conducted as part of the IT growth engine technology development of the Ministry of Knowledge Economy and the Ministry of Information and Telecommunication Research and Development. [Task Management Number: 2005-S-088-04, Title: Information Protection for Secure RFID / USN] Technology development].

The Elliptic Curve Cryptosystem (ECC), proposed by Victor Miller and Neal Kobliz in the mid-1980s, uses the same level of security (approximately one-sixth) while using significantly smaller keys than other cryptographic systems such as RSA and ElGamal. Have Using a smaller key means less computation time, less power, and less storage space.

As the elliptic curve encryption system, the prime finite field elliptic curve encryption system of GF (p) and the binary finite field elliptic curve encryption system of GF (2 ^m ) are mainly used. These two elliptic curve cryptosystems have the same security depending on the bit length used, but the characteristics of the finite field operations used in each cryptosystem are different and are implemented in different forms depending on the type of finite field.

In other words, an elliptic curve cryptosystem using GF (2 ⁿ ) binary finite bodies is easier to implement in hardware, while an elliptic curve cryptosystem using GF (P) fractional finite bodies is implemented in software. This is easier. In particular, the GF (p) elliptic curve cryptographic system is considered to be implemented in software form in the microcontroller unit (MCU) of the resource constrained device.

The implementation of the GF (p) elliptic curve cryptographic system in software form is inevitably finite field computation for the handling of carry in the process of multiplication and inverse multiplication of prime finite field. This is because there is a problem that the implementation area of the device becomes large.

An object of the present invention is to provide an elliptic curve encryption method apparatus that simplifies the multiplication and inverse multiplication operations of prime finite bodies and simplifies the processing of the carry occurring in each operation.

One aspect of the present invention for solving the above problems relates to a finite field multiplication method for the operation of the elliptic curve cryptography, multiplying the multiplicand multiplied by a predetermined size bit unit, and previously stored the multiplication result Adding to the finite field result of the step and reducing the addition result.

Here, the multiplying step may perform partial multiplication of the least significant bit unit of the multiplier in the order of the upper bit unit with respect to one bit unit of the multiplicand, wherein the partial multiplication is performed in the order of the most significant bit unit of the multiplier in the lower bit unit. Is performed.

The addition may include adding an upper bit unit of the multiplication result and a predetermined bit unit of the finite field operation result of the previous step, and a predetermined bit unit of the multiplication result and the finite field operation result of the previous step. Adding bit units.

The reduction may include temporarily storing the most significant bit unit of the finite field operation result, shifting the most significant bit unit of the finite field operation result one bit to the right, and storing the temporarily stored value and the shifted value. Adding step.

Another aspect of the present invention relates to a finite-body inverse multiplication method of an elliptic curve cryptographic apparatus, comprising: a first step of initializing an intermediate value and a final value; If the median value is even, steps 2-2 of halving the median value; and if the median value is not even, step 2-2 of the median and the sum of the decimals halved; A second step of repeating the steps while the multiplicand is even, a third step of halving the final value, a third step of halving the final value if the final value is even, and A third step of repeating the third to third steps, wherein the final value is a value obtained by halving the sum of the final value and the prime number, if the final value is not even; If the fractional number is greater than or equal to, the multiplier subtracted from the multiplier is the multiplicand and the final value is obtained from the intermediate value. Step 4-1, wherein the value is the intermediate value; otherwise Step 4-2, where the decimal value is obtained by subtracting the multiplier by the decimal number and the final value is obtained by subtracting the intermediate value from the final value. And a fifth step of outputting a result of performing the modular operation on the final value by the decimal number, wherein the second to fifth steps are repeated while the dead multiplier is not zero.

According to the embodiment of the present invention, the operation performance of the encryption processing apparatus can be minimized by simplifying the operation of the decimal finite field.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "electrically connected" with another element in between. .

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

An embodiment of the present invention relates to a calculation method for a prime finite field on GF (P) among finite bodies for elliptic curve encryption, and a computing device therefor.

Finite field multiplication and inverse multiplication are the major part of the elliptic curve encryption using the finite field on GF (P). Therefore, hereinafter, the finite field multiplication operation and the inverse multiplication operation will be described in detail with reference to the accompanying drawings.

GF (P) finite field multiplication

FIG. 1 is a block diagram schematically illustrating a configuration of a finite field multiplication apparatus according to an embodiment of the present invention.

The finite field arithmetic apparatus according to the present embodiment includes an A register 110 for storing a multiplier, a B register 120 for storing a multiplier, a multiplier 130, two adders 141, 142, 2 carry registers 151 and 152, a C register 160 for storing the result of the operation, and a controller for controlling the components so that the finite field operation apparatus of the present embodiment performs a multiplication operation (as shown in the drawing). Not shown).

1 shows an example of an arithmetic device that performs multiplication on a 160 bit finite field in particular. That is, the computing device of FIG. 1 does not compute the entire finite field of 160 bits at once, but divides them into 32 bit units. For this purpose, 160 bits of registers 110, 120, 160, 32 bits of multiplier 130, and 32 bits of adders 141, 142 are used. In addition, multiplexers 181 to 184 for selecting 32-bit unit bits in each register 110, 120, and 160 may be further included in the computing device of the present embodiment. Here, the 32-bit operation unit will be referred to as 'unit bit'.

Hereinafter, the finite field multiplication operation will be described in detail with reference to FIG. 1.

In the finite field multiplication operation according to an embodiment of the present invention, the 32-bit unit bits of the A register 110 are multiplied by the 32-bit unit bits of the B register 120, and the multiplication result is divided into 32 bits and the C register. Summing up with the predetermined unit bits of 160 and reducing to adjust the summing result to 160 bits.

The operation rule of the unit bits in the multiplication step is as follows. 2 is a conceptual diagram illustrating an operation order between unit bits of a finite field multiplication operation according to an exemplary embodiment of the present invention.

As shown in FIG. 2, the most significant unit bit A0 of the A register 110 and each of the unit bits B4 to B0 of the B register 120 are calculated in order from the lowest to the highest, and the next rank of the A register 110 is calculated. The unit bits A1 and the respective unit bits B4 to B0 of the B register 120 are again calculated from the lowest to the highest directions. This process is repeatedly performed on the next rank unit bits A2 to A5 of the A register 110.

Referring back to FIG. 1, a process of calculating the A0 unit bits of the A register 110 and the respective unit bits B4 to B0 of the B register 120 will be described in detail.

The controller controls the multiplexers 115 and 125 to select the A0 unit bits of the A register 110 and the B4 unit bits of the B register 120 to transmit to the multiplier 130.

The operation result of the multiplier 130 is divided into 32 bits and output as Mul_h and Mul_l. Mul_h is added in the C4 unit bit of the C register 160 and the adder 141, and Mul_l is added in the C5 unit bit of the C register 160 and the adder 142, respectively, and C4 and C4 of the C register 160 are added. It is stored back in C5. In this process, MUL_h and C_h (C4) are input to the adder 141 and MUL_l and C_l (C5) are input to the adder 142. The carry value CL of the adder 142 is input to the adder 141 as a carry.

Initially, since the value of C register 160 is '0', the output of multiplier 130 is stored in C4 and C5 of C register 160 as it is. Then, the multiplication result of A0 and B3 is added to the stored values of C3 and C4 in the adders 141 and 142, respectively, and stored in C3 and C4 of the C register 160 again. If this process is repeated up to B0, the result of operation A0 * B is eventually stored in the C register 160.

When the operation of A0 * B is completed, the controller performs reduction operation on the value stored in the C register. 3 is a conceptual diagram briefly illustrating the principle of reduction operation.

As shown in FIG. 3, a reduction operation is a process of converting a value exceeding 160 bits into a finite field value within 160 bits as a result of a certain operation, and obtaining a residual value obtained by dividing a target value by p (x), which is a finite minimum polynomial. Operation.

Returning to FIG. 1 and explaining the reduction operation, the controller can select a special polynomial (e.g., a finite minimum polynomial) and perform the reduction operation accordingly, for example the shifted values of C0 and C0 (C0 [31). Reduction can be performed by summing: 1] and C0 [0]). This reduction operation is repeatedly performed until the carry values of C0 and the adders become '0'.

The arithmetic unit according to the embodiment of the present invention for the reduction operation may further include a register 170 for temporarily storing the stored value of C0, and a multiplexer 171 for shifting the stored value of C0, The adder 141 may further include a function of adding the temporarily stored value and the shifted value.

The above multiplication step, addition step and reduction step are similarly performed for A1 * B, A2 * B, A3 * B and A4 * B.

GF (P) finite Inverse odds

The following algorithm 1 may be used to perform a finite field inverse multiplication operation according to an embodiment of the present invention.

Algorithm 1

INPUT: Prime p, a ∈ [0, p-1]

OUTPUT: a ^-1 mod p

U <-a, v <-p, A <-0, C <-0

While u ≠ 0 do

   2.1 While u is even do:

       u <-u / 2, If A is even then A <-A / 2; else A <-(A + p) / 2

   2.2 While v is even do:

       v <-v / 2, If C is even then C <-C / 2; else C <-(C + p) / 2

   2.3 If u≥v then: u <-u-v, A <-A-C; else v <-v-u, C <-C-A

3.Return (C mod p)

As shown in Algorithm 1, the inverse multiplication operation according to the present embodiment consists of repetition of a half operation, an addition operation, and a subtraction operation.

The computing device that performs the finite field inverse multiplication according to Algorithm 1 is as follows. 4 is a block diagram briefly illustrating a configuration of a finite body multiplication apparatus according to an embodiment of the present invention.

In the finite field calculation apparatus according to the present exemplary embodiment, the A register 210 for storing the variable u, the B register 220 for storing the variable v, and the C register 230 for storing the variable C in Algorithm 1 are described. D register 240 for storing variable A, two multiplexers 251 and 252 for subtraction operation, two adders 261 and 262, multiplexer for performing 1/2 operation 271 to 274, and a controller (not shown in the figure) for controlling the components so that the finite field apparatus of the present embodiment operates according to Algorithm 1.

FIG. 4 illustrates an arithmetic unit that performs inverse multiplication on a 160-bit finite field, and illustrates an example for calculating the entire finite field of 160 bits at once instead of calculating them in 32-bit units. do. For this purpose, 160-bit registers 210, 220, 230, and 240, 32-bit adders 261 and 262, and 32-bit multiplexers 251 to 252 and 271 to 274 are used. In addition, multiplexers 281-285 for selecting 32-bit unit bits from each register 210, 220, 230, and 240 may be additionally included in the computing device of the present embodiment.

For inverse multiplication of the finite body a, first, the inverse multiplier a and the modular constant p are stored in the A register 210 and the B register 220, respectively, and initialized to the C register 230 and the D register 240 as initial values. 0 and 1 are stored respectively (S201).

If the stored value of the A register 210 is not 0 (S202) and the A register 210 is an even number, the controller stores the value 1/2 of the u in the A register 210 (S203). If the stored value of the A register 210 is an even number, the corresponding stored value is 1/2 and stored in the A register 210 again (S204). Otherwise, the sum of the stored value of the A register 210 and p is calculated. The half value is stored in the A register 210 (S205).

In addition, if the stored value of the A register 210 is not 0 (S202) and the B register 220 is an even number, the controller stores a value of 1/2 of the value in the B register 220 (S206). If the stored value of the B register 220 is an even number, the stored value is half stored in the C register 220 (S207). Otherwise, the sum of the stored value of the C register 230 and p is calculated. The half value is stored in the C register 230 (S208).

Subsequently, if the stored value of the A register 210 is not 0 (S202) and the stored value of the A register 210 is greater than or equal to the stored value of the B register 220, The value obtained by subtracting the stored value of the B register 220 is stored in the A register 210 again (S209).

If the stored value of the A register 210 is not 0 (S202) and the stored value of the A register 210 is smaller than the stored value of the B register 220, the controller determines that the stored value of the B register 220 is A. The value obtained by subtracting the stored value of the register 210 is stored in the B register 220 (S210).

Steps S202 to S210 are repeatedly performed until the stored value of the A register 210 becomes 0, and the controller p stores the stored value of the C register 230 when the stored value of the A register 210 becomes 0. Outputs the result of the modular operation as the final result.

Meanwhile, in the inverse multiplication operation of the present embodiment, the half operation is performed by a method of simply shifting the registers 210 to 240 using the multiplexers 271 to 274.

In addition, in the inverse multiplication operation of the present embodiment, the addition and subtraction operations are performed from the lower 32-bit unit bits of each register 210 to 240.

Looking at the adding process of step S205 in detail.

The controller selects the C4 unit bits of the C register 230 using the multiplexer 285, selects the B4 unit bits of the B register 220 using the multiplexer 282, and then adds the two output values 262. Send to). As a result of the summation in the adder 262, the generated carry is stored in the carry register 262-1 to reflect the sum of the unit bits of the next step, and the summation value is calculated 1/2 through the multiplexer 273. Again stored in the C register 230. This process is the same for C3 to C0 and B3 to B0.

Looking at the addition process of step S208 in detail.

The controller selects the D4 unit bits of the D register 240 using the multiplexer 285, selects the B4 unit bits of the B register 220 using the multiplexer 282, and then adds the two output values 262. Send to). As a result of the summation in the adder 262, the generated carry is stored in the carry register 262-1 to reflect the sum of the unit bits of the next step, and the sum value is 1/2 calculated by the multiplexer 274. Again stored in the D register 240. This process is repeated for D3 to D0 and B3 to B0 in the same manner.

Next, the subtraction process of step S209 will be described in detail.

If the stored value of the A register 210 is not 0 and the stored value of the A register 210 is greater than or equal to the stored value of the B register 220, the controller selects the selected A register 210 using the multiplexer 281. Sends the A4 unit bits of the B4 unit bits of the selected B register 220 using the multiplexer 232 to the adder 261 and then sends the resultant to the adder 261. Do this. The controller then sends the C4 unit bits of the selected C register 230 to the adder 262 using the multiplexer 284 and multiplexes the B4 unit bits of the selected D register 240 using the multiplexer 235. A NOT operation is performed through the device 252 and then sent to the adder 262 to perform a subtraction operation.

The subtraction process of step S210 is also performed similarly to step S209.

That is, if the stored value of the A register 210 is not 0 and the stored value of the A register 210 is smaller than the stored value of the B register 220, the controller selects the A register 210 selected using the multiplexer 281. NOT operation through the multiplexer 251 to the A4 unit bit, and then to the adder 261. The B4 unit bit of the selected B register 220 is sent to the adder 261 using the multiplexer 232. Perform the operation. Subsequently, the controller performs a NOT operation on the multiplexer 284 and selects the C4 unit bits of the selected C register 230 through the multiplexer 252 to the adder 262, and then selects the multiplexer 235. The B4 unit bits of the D register 240 are sent to the adder 262 to perform a subtraction operation.

In subtraction operations S209 and S210, the initial values of the carry registers 261-1 and 262-1 are set to 1, and the carry generated through the operation is stored in the carry registers 261-1 and 262-1 again. This is reflected in the next bitwise operation.

The result of the addition operation and the subtraction operation described above may be adjusted through a comparison operation with p. That is, the controller performs the operation of subtracting p from the result value if the result of the comparison between the result of the addition operation and the subtraction operation and p and the addition or subtraction result is larger than p so that the result becomes a value within the finite field. .

Meanwhile, in order to determine whether the stored values of the registers 210 to 240 are even, the least significant bit unit (or bit value) of the corresponding stored value may be used. In addition, the carry output values CH and CL of the adders 261 and 262 are used to determine whether or not a carry is generated according to the operation result. In addition, in order to determine whether the stored value of the A register 210 is 0, each unit bit of a 32-bit unit may be or operated. If the or operation result is 0, the C register 230 is a final operation result value. Output the stored value of.

FIG. 5 is a block diagram schematically illustrating a configuration of an elliptic curve cryptographic apparatus that simultaneously performs the aforementioned finite field multiplication and finite field multiplication operations.

In the finite field multiplication operation, the plurality of registers 310 to 330 included in the computing device of the present embodiment correspond to the registers 110, 120, and 160 of FIG. 1, and the multiplier 350 is a multiplier of FIG. 1. Corresponding to 130, two adders 361 and 362 correspond to adders 141 and 142 in FIG. 1, and two carry registers 361 and 362-1 correspond to carry registers 151 in FIG. 152, the temporary register 370 corresponds to the temporary register 170 of FIG. 1, and the plurality of multiplexers 381 to 384 correspond to the multiplexers 181 to 184 of FIG. 1.

In addition, in the finite field multiplication operation, the plurality of registers 310 to 340 included in the computing device of the present embodiment correspond to the registers 210 to 240 of FIG. 4, and two adders 361 and 362. Corresponds to the adders 261 and 262 of FIG. 4, the two carry registers 361-1 and 362-1 correspond to the carry registers 261-1 and 262-1 of FIG. 4, and a plurality of multiplexers. 381 to 384, 391 to 394, and 3010 to 3020 correspond to the multiplexers 281 to 284, 271 to 274, and 251 to 252 of FIG. 4.

In the finite field multiplication operation and the finite field inverse multiplication operation, the calculation process by the corresponding configuration is the same as that of FIGS. 1 and 4, respectively.

In the above description, a case of performing a multiplication operation and an inverse multiplication operation by separating a 160-bit finite field into 32-bit operation units as an example of an operation device is not limited thereto. In other words, the operation unit may be set to a multiple of 16 bits, 32 bits, or 64 bits, such as 16 bits, 32 bits, 48 bits, 64 bits, and so the number of configuration bits of the finite body may be determined as a multiple of the set operation unit. .

Meanwhile, the embodiments of the present invention described above are not implemented only through an apparatus or a method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiments of the present invention or a recording medium on which the program is recorded. .

In addition, the embodiments of the present invention have been described in detail above, but the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of the present invention.

FIG. 1 is a block diagram schematically illustrating a configuration of a finite field multiplication apparatus according to an embodiment of the present invention.

2 is a conceptual diagram illustrating an operation order between unit bits of a finite field multiplication operation according to an exemplary embodiment of the present invention.

3 is a conceptual diagram briefly illustrating the principle of reduction operation.

4 is a block diagram briefly illustrating a configuration of a finite body multiplication apparatus according to an embodiment of the present invention.

FIG. 5 is a block diagram schematically illustrating a configuration of an elliptic curve cryptographic apparatus that simultaneously performs the aforementioned finite field multiplication and finite field multiplication operations.

Claims (6)

In the finite field multiplication method for elliptic curve cryptography, Dividing the multiplicand and the multiplier by a predetermined bit unit; Adding the multiplication result to a prestored finite field calculation result; And Reducing the addition result Elliptic curve encryption method comprising a. The method of claim 1, wherein the multiplication step Partial multiplication is performed for one bit unit of the multiplicant in order of least significant bit unit to upper bit unit of the multiplier, And the partial multiplication is performed in the order of the most significant bit unit to the least significant bit unit of the multiplicand. The method of claim 1, wherein the adding step Adding an upper bit unit of the multiplication result and a predetermined bit unit of the finite field operation result of the previous step; And And adding a lower bit unit of the multiplication result and a predetermined bit unit of the finite field operation result of the previous step. The method of claim 3, wherein the reduction step Temporarily storing the most significant bit unit of the finite field calculation result; Shifting the most significant bit unit of the result of the finite field operation one bit to the right; And And adding the temporarily stored value and the shifted value. In the finite field inverse multiplication method of an elliptic curve cryptographic device, A first step of initializing the intermediate value and the final value; Step 2-1 of halving the multiplicative multiplier; Step 2-2 of halving the median if the median is even; and Sum of the median and decimal if the median is not even. A second step of repeating steps 2-3, wherein the half value is the intermediate value while the multiplicand is even; Step 3-1 of halving the final value; step 3-2 of halving the final value if the final value is even; and sum of the final value and the prime number if the final value is even A third step of repeating the third and third steps of setting the half value to be the final value while the decimal number is even; Step 4-1, if the multiplicand is greater than or equal to the prime number, subtracting the prime number from the multiplier to be the multiplier and subtracting the final value from the intermediate value to the intermediate value; otherwise, the prime number A step 4-2 in which the value obtained by subtracting the multiplicand multiplied by a number is made a decimal number and the value obtained by subtracting the intermediate value from the final value is the final value; And A fifth step of outputting a result of performing a modular operation on the final value to the decimal; Elliptic curve encryption method comprising a. The method of claim 5, And the second to fifth steps are repeated while the dead multiplier is not zero.

Images