WO2015164996A1 - 椭圆域曲线运算方法和椭圆域曲线运算器 - Google Patents

椭圆域曲线运算方法和椭圆域曲线运算器 Download PDF

Info

Publication number
WO2015164996A1
WO2015164996A1 PCT/CN2014/001172 CN2014001172W WO2015164996A1 WO 2015164996 A1 WO2015164996 A1 WO 2015164996A1 CN 2014001172 W CN2014001172 W CN 2014001172W WO 2015164996 A1 WO2015164996 A1 WO 2015164996A1
Authority
WO
WIPO (PCT)
Prior art keywords
point
multiplication
naf
initial
elliptic
Prior art date
Application number
PCT/CN2014/001172
Other languages
English (en)
French (fr)
Inventor
刘奇浩
刘大铕
高美洲
Original Assignee
山东华芯半导体有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 山东华芯半导体有限公司 filed Critical 山东华芯半导体有限公司
Publication of WO2015164996A1 publication Critical patent/WO2015164996A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Definitions

  • the invention relates to an elliptical domain curve operation method and an elliptical domain operator.
  • Encrypting data is a common and effective information security strategy.
  • ECC Erriptic Curve Cryptography
  • elliptic curve cryptosystems have the advantages of fast calculation speed, small storage space, and low bandwidth requirements.
  • the elliptic curve public key cryptography algorithm as one of the ECC algorithms, has an encryption strength of 256 bits, high security, small storage space, and can quickly complete signature, key exchange, and encryption applications.
  • the arithmetic logic related to the elliptic curve public key cryptography algorithm can be designed as an independent unit, and can be divided into a finite field operation layer and an elliptic curve operation layer by hierarchical division.
  • the main function of the finite field operation layer is to provide the number theory operation support required by the ellipse encryption algorithm, including 256-bit large integer modulus addition, modulus subtraction, modular multiplication, modular inverse, modular exponentiation, and comparison operation.
  • the elliptic curve operation layer is composed of various basic operations of the finite field operation layer according to a certain rule, and includes operations such as point addition, double point, point multiplication, and coordinate conversion.
  • Point multiplication The operation is realized on the basis of point addition and double point, and requires the support of finite field operation. Therefore, the speed of the point multiplication determines the operation speed of the encryption mechanism.
  • the overall operation of the lifting system can be realized by two methods: First, the basic operation speed of the finite field operation layer is improved.
  • the invention application disclosed in Chinese Patent No. CN101782845A discloses a modified Jacobian coordinate point for the point addition and double point algorithm.
  • the dot addition and multiplication operation sequences propose a new method for implementing the point addition operation and the double point operation.
  • the Chinese Patent Application No. CN101221491A discloses the calculation formula of the elliptic curve points in the Jacobian coordinate system, and extracts mutually independent operations to construct a three-stage pipeline circuit structure.
  • optimize the basic operation call mode of the point multiplication circuit such as the Chinese CN1822539A invention application discloses the use of 32 sub-registers to form a register file as a data temporary storage unit, to alleviate the reuse problem of the register file in the process of large digital-to-analog operation.
  • the object of the present invention is to provide an elliptic domain curve operation method and improve the operation speed.
  • the present invention also provides an elliptic domain curve operator.
  • An elliptic domain curve operation method is used for an elliptic curve public key cryptographic algorithm of a cardinality in a Jacobian weighted projective coordinate system in a prime field, which is based on a modulo operation and simultaneously based on a point operation;
  • NAF (kp) (kpm-1...kp1kp0), where m is the bit width of the NAF expression;
  • n is a natural number greater than or equal to 8 and less than or equal to 17;
  • the NAF (kp) is multiplied by the generated multiplier until the operation is completed, and the operation result is output.
  • the initial multiplication point of the logic is directly called to perform the operation. If the remaining multiple points are logically generated, the corresponding multiplication point is generated and then the point multiplication operation is performed. Until the operation is completed.
  • An elliptic domain curve operator is an elliptic curve public key cryptographic algorithm for a cardinality in a Jacobian weighted projective coordinate system in a prime domain, comprising a modulo operator and a point based operator;
  • the operator of the point further includes a multiplier, which multiplies the initial point P, and generates a multiplier: 1P, 2P, ... np; n is a natural number greater than or equal to 8 and less than or equal to 17;
  • the operations involved are relatively comprehensive, and new ones using the number of times k are used.
  • the NAF representation method reduces the number of non-zero elements in the binary representation of k, thereby reducing the number of dot addition operations, thereby reducing the overall computation time of dot multiplication, and having relatively high computational efficiency.
  • Figure 1 is a block diagram showing the structure of an elliptical domain computing device in accordance with the present invention.
  • FIG. 2 is a state transition diagram of a point multiplication operation based on an ellipse encryption algorithm.
  • Figure 3 is a state transition diagram of the non-proximity expression NAF(k) operation.
  • Figure 4 is a pre-calculated state transition diagram.
  • FIG. 1 it is a basic configuration of an elliptical domain computing device, which is composed of five parts, namely a system bus data interface module, a configuration interface module, a configuration register module, an arithmetic unit module, and a data storage unit module.
  • the elliptical domain computing device shown in FIG. 1 appears in the system as a system bus slave device, and is hung on the bus of the application system to form a slave device of the system bus.
  • the auxiliary interface and operation type are configured by configuring the interface module, and the interrupt information is read after the operation is completed.
  • the operands are configured through the system bus data interface module.
  • the arithmetic unit module is responsible for performing various operations, including modulo-based addition, subtraction, multiplication, inversion, exponentiation, point-based addition, multiplication, and generating an interrupt flag after the operation is completed, constituting the interrupt information.
  • modulo-based addition including modulo-based addition, subtraction, multiplication, inversion, exponentiation, point-based addition, multiplication, and generating an interrupt flag after the operation is completed, constituting the interrupt information.
  • the data storage unit module is composed of four single-port RAMs, and is responsible for storing the initial operands and operation results, and coordinating with the arithmetic unit to complete the correct transfer of data.
  • the operands therein can be constructed as a multiple of the points described below.
  • an elliptic domain curve operator is used for the elliptic curve public key cryptosystem of the base in the Jacobian weighted projective coordinate system in the prime domain, including a modulo operator and a point based operator;
  • the operator of the point further includes a multiplier, which multiplies the initial point P, and generates a multiplier: 1P, 2P, ... np; n is a natural number greater than or equal to 8 and less than or equal to 17;
  • the entire point multiplication phase is divided into three parts, namely the NAF expression calculation of the scalar k, the initial pre-calculation, and the class iterative multiplication calculation.
  • the signed binary coding is used to reduce the number of non-zero elements in the binary coding, which can effectively reduce the number of point addition operations in the point multiplication operation, and achieve the purpose of improving the efficiency of the point multiplication algorithm.
  • the NAF expression calculation circuit of k proposed by the present invention encodes the NAF by using a non-adjacent signed binary representation in the signed coding, so that the number of non-zero elements in the binary representation of k is reduced, the number of times added is reduced, and the number of times is reduced.
  • the point multiplication operation step, the circuit operation state transition diagram is shown in FIG.
  • NAF_IDME k NAF expression calculation initialization phase, waiting for the NAF calculation start signal, given by the configuration interface module, after startup, proceeds to the next step, namely NAF_RK;
  • NAF_RK the scalar k is read from the lower position in the storage unit 3, enters the cyclic adder for calculation, and after the end of the read operation, enters NAF_K;
  • NAF_K2KP Performs the conversion of NAF(k) to NAF(kp), and enters NAF_DONE after the conversion is completed;
  • NAF_DONE The NAF calculation of k is completed, and the operation completion interrupt is generated. After the interrupt is cleared to 0, it enters NAF_IDME and waits for the next operation in response to the new request.
  • the algorithm 1 for calculating the NAF (non-contiguous form) expression of the scalar k is as follows:
  • the temporary variable c ⁇ k, the NAF expression of k is the bit width m ⁇ 0; the left arrow indicates the assignment, that is, setting a temporary variable c whose initial value is k, and the initial bit width of the NAF expression of k 0, m represents the bit width of the NAF expression of k.
  • the pre-calculation process is shown in Figure 3.
  • the initial point P is multiplied and added, and any point of 1P, 2P...13P can be obtained. Due to the limited available RAM capacity, the 1P, 5P, 9P, and 13P points are temporarily stored. The point is dynamically generated in the subsequent operation process, and the state transition diagram of the operation process is as shown in FIG. 4.
  • PRE_IDME Pre-calculation process initialization phase, waiting for pre-calculation start signal, enter PRE_RM.
  • PRE_RM The point P(x p , y p , z p ) is read from the storage unit 3 into the storage unit 1 and the storage unit 2, and the Montgomery multiplication auxiliary operator R is read from the storage unit 4 to the storage unit 2 In the middle, after the read operation is completed, enter PRE_DP.
  • PRE_DP Perform double-point operation on the data in the storage unit 1. After the operation is completed, determine the multi-point operation number pre_dp_cnt. If it is the initial operation, it will enter the PRE_DPM after the 2P point; if it is the 2nd operation, the 4P point will be generated. Enter PRE_DPM; if it is 3 operations, it will enter PRE_MZ2B after 8P points; if it is 4 times, it will generate 12P points and enter PRE_MZ2B. Pre_dp_cnt performs an accumulation of 1 step.
  • PRE_MZ2B Judging the multi-point operation number signal pre_dp_cnt and the point addition operation number signal pre_ap_cnt.
  • Pre_dp_cnt is the second operation and pre_ap_cnt is the initial operation, enters PRE_AP, and otherwise enters PRE_M1P.
  • PRE_AP Adds the data in the storage unit 2, and after the operation is completed, judges the point plus operation number pre_ap_cnt. If it is the initial operation, it will enter the PRE_DPM after the 5P point; if it is the 2nd operation, the 6P point will be generated. Enter PRE_M6P; if it is 3 operations, it will enter PRE_CPA after 8P point; if it is 4 times, it will generate 12P point and enter PRE_CPA.
  • PRE_M1P P point is read from the storage unit 3 to the storage unit 1, and is added to the xP point in the storage unit 2 to generate a P+xP point. After the calculation is completed, the process proceeds to PRE_MZ2B.
  • PRE_M6P The 6P point in the storage unit 2 is read into the storage unit 1, and the 12P point calculation is prepared. After the reading is completed, the PRE_DP is entered.
  • PRE_CPA Determines the read count signal pre_rd_cnt. If pre_rd_cnt is 0, enter PRE_DPM; if pre_rd_cnt is 1, enter PRE_M4P; if pre_rd_cnt is 2, enter PRE_DPM. After the judgment is completed, pre_rd_cnt performs an accumulation of 1 step.
  • PRE_DPM The result in the storage unit 2 is read into the storage unit 3. After the reading is completed, the multiplier operation number signal pre_dp_cnt and the point addition operation number signal pre_ap_cnt are determined.
  • Pre_dp_cnt is 2 operations, pre_ap_cnt is the initial operation, enters PRE_DP; pre_dp_cnt is 3 operations, while pre_ap_cnt is the initial operation, enters PRE_M1P; pre_dp_cnt is 3 operations, while pre_ap_cnt is 2 operations, enters PRE_MZ2B; pre_dp_cnt is 4 times Operation, while pre_ap_cn is 4 The second operation, and pre_rd_cnt is 1, enters PRE_CPA; pre_dp_cnt is 4 operations, while pre_ap_cnt is 4 operations, and pre_rd_cnt is 2 to enter PRE_DONE.
  • PRE_DONE The pre-calculation is completed, and the operation completion interrupt is generated. After the interrupt is cleared to 0, it enters PRE_IDME and waits for the next operation.
  • the overall system algorithm 2 is as follows:
  • Input scalar k, each word occupies a width w, point P.
  • This method is applicable to the elliptic curve public key cryptography algorithm based on the Jacobian weighted projective coordinate system in the prime domain.
  • the elliptical encryption algorithm is implemented by using the software and hardware to work together, and the time-consuming key operation is straightened by the method.
  • the implementation is implemented, and the rest is implemented using software from an external controller.
  • This method utilizes a new NAF representation method of the number of times k, so that the number of non-zero elements in the binary representation of k is reduced, so the number of times of adding points is reduced, and the overall operation of dot multiplication is reduced. time;
  • the method uses a 4-point calculation method to ensure that the subsequent calculation points are completed in the shortest time without occupying too much data storage space.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Computational Mathematics (AREA)
  • Computing Systems (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Mathematical Physics (AREA)
  • General Engineering & Computer Science (AREA)
  • Complex Calculations (AREA)

Abstract

一种椭圆域曲线运算方法和椭圆域曲线运算器，涉及到的运算比较全面，采用点乘次数k的新的NAF表示方法，使得k的二进制表示中的非零元素的个数减少，从而减少了点加运算的次数，进而减少了点乘的整体运算时间，而具有比较高的运算效率。

Description

椭圆域曲线运算方法和椭圆域曲线运算器 技术领域
本发明涉及一种椭圆域曲线运算方法和椭圆域运算器。
背景技术
对数据进行加密是一种常用且行之有效的信息安全策略。目前基于有限域上椭圆曲线离散对数问题的非对称密码算法ECC(Emmiptic Curve Cryptography，椭圆曲线密码)被公认为是最高比特强度的公钥密码体制，广泛应用于快速加密、密钥交换、身份验证、数字签名、保密通信等领域，是1985年分别由Mimmer和Kobmitz独立提出的。相对于其他的公钥密码系统(如RSA和EmGamam)，椭圆曲线密码系统具有计算速度快、存储空间小、带宽要求低等优点。
椭圆曲线公钥密码算法作为ECC算法中的一种，加密强度为256位，安全性高、存储空间小、可以快速完成签名、密钥交换以及加密应用。
椭圆曲线公钥密码算法相关的运算逻辑可以做为独立的单元进行设计，并且采用层次化的划分方式可以分为有限域运算层以及椭圆曲线运算层。
有限域运算层的主要功能是提供椭圆加密算法所需要的数论运算支持，包括256位大整数模加、模减、模乘、模逆、模幂、比较运算。
椭圆曲线运算层由有限域运算层的各种基础运算按照一定的规则进行排序后构成，包括点加、倍点、点乘、坐标转换等运算。点乘 运算是在点加、倍点的基础上实现的，同时需要有限域运算的支持，因此点乘运算速度决定了加密机制运算速度。
当前，提升系统整体运算可以通过两种方法来实现：一、提升有限域运算层的基础运算速度，如中国第CN101782845A号发明申请公开针对点加和倍点算法，重新排列了修改的Jacobian坐标点的点加和倍点运算序列，提出了一种实现点加运算和倍点运算的新方法。
再如中国第CN101221491A号发明专利申请公开利用Jacobian坐标系下椭圆曲线点加的计算公式，提取出相互独立的操作，构造三级流水线电路结构。
二、优化点乘运算电路的基础运算调用方式，如中国第CN1822539A发明申请公开采用32个子寄存器构成寄存器堆作为数据暂存单元，缓解大数模运算过程中寄存器堆的复用问题。
但是上述发明专利申请公开的方案均受运算所限制，只能支持模(Mod)运算，对上层运算产生的中间变量则无能为力。
发明内容
本发明的目的在于提供一种椭圆域曲线运算方法，提高运算速度，本发明还提供了一种椭圆域曲线运算器。
依据本发明的一个方面的一种椭圆域曲线运算方法，用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法，该方法基于模的运算，并同时基于点的运算；
其中基于点的运算为对初始点P的运算，并对给定的标量k采用有符号编码中的非相邻有符号二进制编码生成k的NAF表达式：NAF (kp)＝(kpm-1……kp1kp0)，其中m为NAF表达式的位宽；
并对初始点P进行倍点，生成的倍点：1P、2P、……np；n为大于等于8小于等于17的自然数；
对NAF(kp)与生成的倍点进行点乘，直到运算完成，输出运算结果。
根据权利要求1所述的椭圆域曲线运算方法，其特征在于，对生成的倍点采用给定的数列通式选择出初始倍点，用于初始的点乘运算，并在后续的点乘运算中，给出点乘运算逻辑；
若按照点乘运算逻辑的路径若逻辑出初始倍点，则直接调用该逻辑出的初始倍点进行运算，若逻辑出其余的倍点，则生成逻辑出的相应倍点后进行点乘运算，直到的运算完成。
依据本发明的另一个方面的一种椭圆域曲线运算器，用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法，包括模的运算器和基于点的运算器；
其中点的运算器为对初始点P的运算器，并对给定的标量k采用有符号编码中的非相邻有符号二进制编码生成k的NAF表达式：NAF(kp)＝(kpm-1……kp1kp0)，其中m为NAF表达式的位宽；
该点的运算器还包括倍点运算器，对初始点P进行倍点，生成的倍点：1P、2P、……np；n为大于等于8小于等于17的自然数；
以及点乘运算器，对NAF(kp)与生成的倍点进行点乘，直到运算完成，输出运算结果。
依据本发明，涉及到的运算比较全面，采用点乘次数k的新的 NAF表示方法，似的k的二进制表示中的非零元素的个数减少，从而减少了点加运算的次数，进而减少了点乘的整体运算时间，而具有比较高的运算效率。
附图说明
图1为依据本发明的一种椭圆域运算装置的结构框图。
图2为基于椭圆加密算法的点乘运算状态转移图。
图3为非临接表达式NAF(k)运算状态转移图。
图4为预计算状态转移图。
具体实施方式
如图1所示，为椭圆域运算装置的基本配置，它由五个部分构成，分别是系统总线数据接口模块、配置接口模块、配置寄存器模块、运算单元模块、数据存储单元模块。
基于所述系统总线数据接口模块，图1所示的椭圆域运算装置在系统中以系统总线从设备的形式出现，挂在应用系统的总线上，构成系统总线的从设备。
通过配置接口模块对辅助操作数、运算类型进行配置，运算完成后读出中断信息。
通过系统总线数据接口模块配置操作数。
运算单元模块负责完成各种运算，包括基于模的加法、减法、乘法、取逆、取幂运算，基于点的加法、乘法运算，并在运算完成后产生中断标志位，构成所述中断信息，以使配置接口模块能够读取运算单元模块的运行状态。
数据存储单元模块由4块单口RAM构成，负责存储初始操作数及运算结果，配合运算单元调度完成数据的正确转移。
其中的操作数可以构成为如下所述的倍点。
在这样的一个实施例中，椭圆域曲线运算器，用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法，包括模的运算器和基于点的运算器；
其中点的运算器为对初始点P的运算器，并对给定的标量k采用有符号编码中的非相邻有符号二进制编码生成k的NAF表达式：NAF(kp)＝(kpm-1……kp1kp0)，其中m为NAF表达式的位宽；
该点的运算器还包括倍点运算器，对初始点P进行倍点，生成的倍点：1P、2P、……np；n为大于等于8小于等于17的自然数；
以及点乘运算器，对NAF(kp)与生成的倍点进行点乘，直到运算完成，输出运算结果。
如图2所示，整个点乘运算阶段分为三部分，分别为标量k的NAF表达式计算，初始预计算，类迭代乘法计算。
通过对标量k进行重新编码，采用有符号二进制编码来减少二进制编码中的非零元个数，能够有效减少点乘运算中的点加运算次数，达到提升点乘算法效率的目的。
本发明所提出的k的NAF表达式计算电路，采用有符号编码中的非相邻有符号二进制表示编码NAF，使得k的二进制表示中的非零元素的个数减少，减少点加次数，减少点乘运算步骤，电路运算状态转移图如图3所示。
具体如下：
NAF_IDME：k的NAF表达式计算初始化阶段，等待NAF计算启动信号，由所述配置接口模块给出，启动后，进入下一步骤，即NAF_RK；
NAF_RK：将标量k从存储单元3中从低位开始读出，进入循环加法器进行计算，读操作结束后，进入NAF_K；
NAF_K：生成NAF(k)＝(km-1...k1k0)，进入NAF_K2KP；
NAF_K2KP：进行NAF(k)向NAF(kp)的转换，转换完成后进入NAF_DONE；
NAF_DONE：k的NAF计算完成，产生运算完成中断，中断被清0后，进入NAF_IDME，等待下一次运算，以响应新的请求。
计算标量k的NAF(非邻接形式)表达式的算法1如下：
输入：k
输出：NAF(kp)。
1.临时变量c←k，k的NAF表达式位宽m←0；向左的箭头表示赋值，即设定一个临时变量c，其初始值是k，而k的NAF表达式的初始位宽为0，m表示k的NAF表示式的位宽。
2.当c＞0时，重复执行：
2.1  如果c％2＝＝1，则km←2-(c mod 4)，c←c-km；否则km←0；“％”表示数学运算“除法运算后取余数”，“＝”表示数学运算符“等于”。
2.2  c←c/2，m←m+1。“/”表示数学运算“除法运算后取整数”
3.生成NAF(k)＝(km-1...k1k0)。
4.i从m-1到0，重复执行
如果ki＝＝1&&ki-1＝＝0&&ki-2＝＝-1则kpi＝0，kpi-1＝kpi-2＝1，i←i-3；
否则如果ki＝＝-1&&ki-1＝＝0&&ki-2＝＝1则kpi＝0，kpi-1＝kpi-2＝-1，i←i-3；
否则kpi＝ki，i←i-1。
5.生成NAF(kp)＝(kpm-1...kp1kp0)
预计算过程如图3所示，对初始点P进行倍点、点加运算，可得到1P、2P…13P中任意一点，由于可用RAM容量有限，暂存1P、5P、9P、13P点，剩余点则在后续运算过程中动态生成，运算过程状态转移图如图4所示。
PRE_IDME：预计算过程初始化阶段，等待预计算启动信号，进入PRE_RM。
PRE_RM：将点P(xp，yp，zp)从存储单元3中读入到存储单元1和存储单元2中，将蒙哥马利乘法辅助算子R，从存储单元4读入到存储单元2中，读操作结束后，进入PRE_DP。
PRE_DP：对存储单元1中的数据进行倍点运算，运算完成后，判断倍点运算次数信号pre_dp_cnt，若为初次运算，则产生2P点后进入PRE_DPM；若为2次运算，则产生4P点后进入PRE_DPM；若为3次运算，则产生8P点后，进入PRE_MZ2B；若为4次运算，则产生12P点后，进入PRE_MZ2B。pre_dp_cnt进行步长为1的累加。
PRE_MZ2B：判断倍点运算次数信号pre_dp_cnt与点加运算次数信号pre_ap_cnt。pre_dp_cnt为2次运算同时pre_ap_cnt为初次运算，进入PRE_AP，其它情况则进入PRE_M1P。
PRE_AP：对存储单元2中的数据进行点加运算，运算完成后，判断点加运算次数信号pre_ap_cnt，若为初次运算，则产生5P点后进入PRE_DPM；若为2次运算，则产生6P点后进入PRE_M6P；若为3次运算，则产生8P点后，进入PRE_CPA；若为4次运算，则产生12P点后，进入PRE_CPA。
PRE_M1P：将P点从存储单元3中读入到存储单元1，与存储单元2中的xP点进行加法运算，生成P+xP点，运算完成后进入PRE_MZ2B。
PRE_M6P：将存储单元2中的6P点读入到存储单元1中，准备进行12P点计算，读入完成后，进入PRE_DP。
PRE_CPA：判断读次数信号pre_rd_cnt，若pre_rd_cnt为0，进入PRE_DPM；若pre_rd_cnt为1，进入PRE_M4P；若pre_rd_cnt为2，则进入PRE_DPM。判断完成后，pre_rd_cnt进行步长为1的累加。
PRE_DPM：将存储单元2中的结果读入到存储单元3中，读出完成后，判断倍点运算次数信号pre_dp_cnt与点加运算次数信号pre_ap_cnt。pre_dp_cnt为2次运算，同时pre_ap_cnt为初次运算，进入PRE_DP；pre_dp_cnt为3次运算，同时pre_ap_cnt为初次运算，进入PRE_M1P；pre_dp_cnt为3次运算，同时pre_ap_cnt为2次运算，进入PRE_MZ2B；pre_dp_cnt为4次运算，同时pre_ap_cn为4 次运算，且pre_rd_cnt为1，进入PRE_CPA；pre_dp_cnt为4次运算，同时pre_ap_cnt为4次运算，且pre_rd_cnt为2进入PRE_DONE。
PRE_DONE：预计算完成，产生运算完成中断，中断被清0后，进入PRE_IDME，等待下一次运算。
系统整体算法2如下：
输入：标量k，每个字所占位宽w，点P。
输出：Q＝kP。
1.预计算：
对i从1到2w-3，计算Pi←iP。
2.Q←0。
3.i从m-1到0，重复执行
3.1 若kpi＝0，则t←1，u←0；
否则，寻找一个最大的t≤w使得u←kpi，...，kpi-t+1是奇数。
3.2  Q←2tQ
3.3  若u＞0，则Q←Q+Pu；
否则，若u＜0，则Q←Q+P-u。
4.4  i←i-t。
5.返回Q。
从上述方案可以看出：
本方法适用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法。为了满足椭圆加密算法性能的要求，采用软硬件协同工作的方式实现椭圆加密算法，将耗时的关键运算用本方法直 接实现，其余部分用外部控制器的软件实现。采用本方法，有以下有益效果：
1、涉及运算全面，可以实现基于模的加法、减法、乘法、取逆、取模、取幂运算；可以实现基于点的加法、乘法运算；同时可以进行RSA相关的基于模的2048位的加法、减法、比较、乘法运算，所有运算接口向外开放，可以通过总线寄存器接口进行配置，灵活性大；
2、本方法利用了点乘次数k的新的NAF表示方法，使得k的二进制表示中的非零元素的个数减少，所以进行点加运算的次数就会减少，减少了点乘的整体运算时间；
3、本方法在预计算阶段，采用4点计算法，可保证后续运算点在最短时间内完成，同时又不占用过多的数据存储空间。
关于倍点的个数，在前述的预计算中有所体现，其数量的多寡跟硬件配置和加密的复杂程度相关，本领域的技术人员据此可进行选择，推荐8～17个，在硬件有更好的配置时，可以选择更多的个数。

Claims (7)

  1. 一种椭圆域曲线运算方法，用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法，其特征在于，该方法基于模的运算，并同时基于点的运算；
    其中基于点的运算为对初始点P的运算，并对给定的标量k采用有符号编码中的非相邻有符号二进制编码生成k的NAF表达式：NAF(kp)＝(kpm-1……kp1kp0)，其中m为NAF表达式的位宽；
    并对初始点P进行倍点，生成的倍点：1P、2P、……np；n为大于等于8小于等于17的自然数；
    对NAF(kp)与生成的倍点进行点乘，直到运算完成，输出运算结果。
  2. 根据权利要求1所述的椭圆域曲线运算方法，其特征在于，对生成的倍点采用给定的数列通式选择出初始倍点，用于初始的点乘运算，并在后续的点乘运算中，给出点乘运算逻辑；
    若按照点乘运算逻辑的路径若逻辑出初始倍点，则直接调用该逻辑出的初始倍点进行运算，若逻辑出其余的倍点，则生成逻辑出的相应倍点后进行点乘运算，直到的运算完成。
  3. 根据权利要求2所述的椭圆域曲线运算方法，其特征在于，所述数列通式采用等差数列通式。
  4. 根据权利要求2或3所述的椭圆域曲线运算方法，其特征在于，点乘运算逻辑采用倍点运算次数和点加运算次数，给出不同倍点运算次数和点加运算次数的组合，以适配于各倍点，并在相应的倍点运算或者点加运算完成后，相应的次数加一。
  5. 根据权利要求1至3任一所述的椭圆域曲线运算方法，其特征在于，所述倍点的个数为13。
  6. 根据权利要求2所述的椭圆域曲线运算方法，其特征在于，将初始倍点存放到存储单元，其余的倍点在点乘运算逻辑中生成。
  7. 一种椭圆域曲线运算器，用于基数在素域中Jacobian加重射影坐标系下的椭圆曲线公钥密码算法，其特征在于，包括模的运算器和基于点的运算器；
    其中点的运算器为对初始点P的运算器，并对给定的标量k采用有符号编码中的非相邻有符号二进制编码生成k的NAF表达式：NAF(kp)＝(kpm-1……kp1kp0)， 其中m为NAF表达式的位宽；
    该点的运算器还包括倍点运算器，对初始点P进行倍点，生成的倍点：1P、2P、……np；n为大于等于8小于等于17的自然数；
    以及点乘运算器，对NAF(kp)与生成的倍点进行点乘，直到运算完成，输出运算结果。
PCT/CN2014/001172 2014-04-28 2014-12-25 椭圆域曲线运算方法和椭圆域曲线运算器 WO2015164996A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410171041.7A CN103942031B (zh) 2014-04-28 2014-04-28 椭圆域曲线运算方法
CN201410171041.7 2014-04-28

Publications (1)

Publication Number Publication Date
WO2015164996A1 true WO2015164996A1 (zh) 2015-11-05

Family

ID=51189711

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/001172 WO2015164996A1 (zh) 2014-04-28 2014-12-25 椭圆域曲线运算方法和椭圆域曲线运算器

Country Status (2)

Country Link
CN (1) CN103942031B (zh)
WO (1) WO2015164996A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110460443A (zh) * 2019-08-09 2019-11-15 南京秉速科技有限公司 椭圆曲线密码的高速点加运算方法和装置
CN112685758A (zh) * 2020-12-31 2021-04-20 南方电网科学研究院有限责任公司 基于椭圆曲线加密算法的数据加密系统
CN113014388A (zh) * 2021-03-30 2021-06-22 浙江萤火虫区块链科技有限公司 一种椭圆曲线密码算法中标量乘的加速系统
CN113783702A (zh) * 2021-09-28 2021-12-10 南京宁麒智能计算芯片研究院有限公司 一种椭圆曲线数字签名与验签的硬件实现方法和系统
CN115495764A (zh) * 2022-09-29 2022-12-20 中金金融认证中心有限公司 点加运算模块以及应用其的公钥生成方法和加密解密方法

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103942031B (zh) * 2014-04-28 2017-07-04 山东华芯半导体有限公司 椭圆域曲线运算方法
CN104503730A (zh) * 2014-10-24 2015-04-08 山东华芯半导体有限公司 一种基于指令的大数点加、倍点运算电路及实现方法
CN107026873B (zh) * 2017-05-31 2019-09-24 重庆大学 一种基于椭圆曲线算法的加解密方法及系统
CN108306735A (zh) * 2017-12-29 2018-07-20 成都锐成芯微科技股份有限公司 椭圆曲线点乘运算的硬件实现方法及其系统
CN109379191B (zh) * 2018-09-07 2021-12-07 创新先进技术有限公司 一种基于椭圆曲线基点的点乘运算电路和方法
CN109933304B (zh) * 2019-03-20 2022-06-21 成都三零嘉微电子有限公司 适用于国密sm2p256v1算法的快速蒙哥马利模乘器运算优化方法
CN115913556B (zh) * 2022-12-28 2024-01-26 声龙(新加坡)私人有限公司 加速椭圆曲线标量点乘计算的装置、方法及存储介质

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030048631A (ko) * 2001-12-12 2003-06-25 한국전자통신연구원 타원곡선 암호화 장치
CN1625104A (zh) * 2004-12-09 2005-06-08 中国电子科技集团公司第三十研究所 一种用于椭圆曲线密码算法芯片的倍点运算电路
KR20060068177A (ko) * 2004-12-16 2006-06-21 고려대학교 산학협력단 부채널 공격을 방지할 수 있는 타원곡선 암호화 방법 및 그 시스템
CN101547089A (zh) * 2008-03-28 2009-09-30 上海爱信诺航芯电子科技有限公司 集成电路中素数域椭圆曲线密码算法的实现方法
CN101782845A (zh) * 2009-01-20 2010-07-21 北京华大信安科技有限公司 一种椭圆曲线密码的高速运算装置和方法
CN102387015A (zh) * 2011-09-14 2012-03-21 中国矿业大学 一种提高椭圆曲线标量乘法计算效率的方法
CN102393812A (zh) * 2011-09-20 2012-03-28 四川卫士通信息安全平台技术有限公司 椭圆曲线密码体制中的快速点乘算法的实现方法
CN103078732A (zh) * 2013-01-08 2013-05-01 武汉大学 一种素域椭圆曲线加密的点乘加速电路
CN103942031A (zh) * 2014-04-28 2014-07-23 山东华芯半导体有限公司 椭圆域曲线运算方法和椭圆域曲线运算器

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20030048631A (ko) * 2001-12-12 2003-06-25 한국전자통신연구원 타원곡선 암호화 장치
CN1625104A (zh) * 2004-12-09 2005-06-08 中国电子科技集团公司第三十研究所 一种用于椭圆曲线密码算法芯片的倍点运算电路
KR20060068177A (ko) * 2004-12-16 2006-06-21 고려대학교 산학협력단 부채널 공격을 방지할 수 있는 타원곡선 암호화 방법 및 그 시스템
CN101547089A (zh) * 2008-03-28 2009-09-30 上海爱信诺航芯电子科技有限公司 集成电路中素数域椭圆曲线密码算法的实现方法
CN101782845A (zh) * 2009-01-20 2010-07-21 北京华大信安科技有限公司 一种椭圆曲线密码的高速运算装置和方法
CN102387015A (zh) * 2011-09-14 2012-03-21 中国矿业大学 一种提高椭圆曲线标量乘法计算效率的方法
CN102393812A (zh) * 2011-09-20 2012-03-28 四川卫士通信息安全平台技术有限公司 椭圆曲线密码体制中的快速点乘算法的实现方法
CN103078732A (zh) * 2013-01-08 2013-05-01 武汉大学 一种素域椭圆曲线加密的点乘加速电路
CN103942031A (zh) * 2014-04-28 2014-07-23 山东华芯半导体有限公司 椭圆域曲线运算方法和椭圆域曲线运算器

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110460443A (zh) * 2019-08-09 2019-11-15 南京秉速科技有限公司 椭圆曲线密码的高速点加运算方法和装置
CN112685758A (zh) * 2020-12-31 2021-04-20 南方电网科学研究院有限责任公司 基于椭圆曲线加密算法的数据加密系统
CN112685758B (zh) * 2020-12-31 2024-02-06 南方电网科学研究院有限责任公司 基于椭圆曲线加密算法的数据加密系统
CN113014388A (zh) * 2021-03-30 2021-06-22 浙江萤火虫区块链科技有限公司 一种椭圆曲线密码算法中标量乘的加速系统
CN113014388B (zh) * 2021-03-30 2022-06-28 浙江萤火虫区块链科技有限公司 一种椭圆曲线密码算法中标量乘的加速系统
CN113783702A (zh) * 2021-09-28 2021-12-10 南京宁麒智能计算芯片研究院有限公司 一种椭圆曲线数字签名与验签的硬件实现方法和系统
CN115495764A (zh) * 2022-09-29 2022-12-20 中金金融认证中心有限公司 点加运算模块以及应用其的公钥生成方法和加密解密方法

Also Published As

Publication number Publication date
CN103942031A (zh) 2014-07-23
CN103942031B (zh) 2017-07-04

Similar Documents

Publication Publication Date Title
WO2015164996A1 (zh) 椭圆域曲线运算方法和椭圆域曲线运算器
US8862651B2 (en) Method and apparatus for modulus reduction
CN109145616B (zh) 基于高效模乘的sm2加密、签名和密钥交换的实现方法及系统
US20220166614A1 (en) System and method to optimize generation of coprime numbers in cryptographic applications
CN113010142A (zh) 一种新型脉动结点式标量点乘的双域实现系统及方法
JP4351987B2 (ja) モンゴメリ変換装置、演算装置、ｉｃカード、暗号装置、復号装置及びプログラム
US8582758B2 (en) Apparatus and a method for calculating a multiple of a point an elliptic curve
CN116527274B (zh) 基于多标量乘快速计算的椭圆曲线验签方法及系统
CN114840174B (zh) 一种使用多乘法器快速实现蒙哥马利模乘的系统及方法
CN111897578A (zh) 一种特征为2的椭圆曲线上标量乘的并行处理方法及装置
US8626811B2 (en) Method and apparatus for providing flexible bit-length moduli on a block Montgomery machine
WO2019120066A1 (zh) 一种适合sm2算法的快速模约减方法和介质
KR101977873B1 (ko) 하드웨어 구현된 모듈러 역원 모듈
Rezai et al. A new finite field multiplication algorithm to improve elliptic curve cryptosystem implementations
US20240220201A1 (en) A method and architecture for performing modular addition and multiplication sequences
CN114527956A (zh) 抗spa攻击的国密sm2算法中非定点标量乘法的计算方法
JP6457911B2 (ja) スカラー倍算装置
CN114238205A (zh) 一种抗功耗攻击的高性能ecc协处理器系统
TW201802666A (zh) 非模數乘法器、用於非模數乘法的方法及計算裝置
CN114510273B (zh) 一种实现椭圆曲线密码的标量乘运算的处理器和方法
Li et al. Low complexity bit-parallel $ GF (2^ m) $ multiplier for all-one polynomials
Knezevic et al. Modular reduction without precomputational phase
CA2738606C (en) Method and apparatus for providing flexible bit-length moduli on a block montgomery machine
Bala et al. Optimized elliptic curve cryptography for wireless sensor networks
JP3966714B2 (ja) 暗号処理方法、そのプログラム及びその記録媒体

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14890571

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 21.02.2017)

122 Ep: pct application non-entry in european phase

Ref document number: 14890571

Country of ref document: EP

Kind code of ref document: A1