WO2019242562A1 - 椭圆曲线多倍点运算方法和装置 - Google Patents

椭圆曲线多倍点运算方法和装置 Download PDF

Info

Publication number
WO2019242562A1
WO2019242562A1 PCT/CN2019/091161 CN2019091161W WO2019242562A1 WO 2019242562 A1 WO2019242562 A1 WO 2019242562A1 CN 2019091161 W CN2019091161 W CN 2019091161W WO 2019242562 A1 WO2019242562 A1 WO 2019242562A1
Authority
WO
WIPO (PCT)
Prior art keywords
point
equivalent
true
sub
elliptic curve
Prior art date
Application number
PCT/CN2019/091161
Other languages
English (en)
French (fr)
Inventor
于艳艳
甘杰
胡毅
金锐
杜鹏程
胡晓波
臧仕平
王喆
涂因子
Original Assignee
北京智芯微电子科技有限公司
国网信息通信产业集团有限公司
国家电网有限公司
国网辽宁省电力有限公司电力科学研究院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京智芯微电子科技有限公司, 国网信息通信产业集团有限公司, 国家电网有限公司, 国网辽宁省电力有限公司电力科学研究院 filed Critical 北京智芯微电子科技有限公司
Priority to US16/970,488 priority Critical patent/US11003769B2/en
Publication of WO2019242562A1 publication Critical patent/WO2019242562A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/556—Detecting local intrusion or implementing counter-measures involving covert channels, i.e. data leakage between processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • G06F7/724—Finite field arithmetic
    • G06F7/725—Finite field arithmetic over elliptic curves

Definitions

  • the present application relates to the field of cryptographic chips, and in particular, to an elliptic curve multiple point calculation method and device.
  • Elliptic curve multiple point operations can be implemented in many ways. Common multiple point operations include binary scanning and fixed window scanning.
  • the purpose of the embodiments of the present application is to provide an elliptic curve multiple point calculation method and device, which can effectively resist side channel analysis and security error attacks.
  • an embodiment of the present application provides a method for calculating multiple points of an elliptic curve.
  • the elliptic curve multiple point operation method is used in the elliptic curve cryptographic algorithm to resist attackers' side-channel analysis attacks and security error attacks on the password.
  • the elliptic curve multiple point calculation method includes: performing an ordered multiple point operation on point Q; performing a point addition operation on point Q; when the current bit of the scalar K is not 0, a true point addition is performed on point Q Operation, when the current bit of scalar K is scanned to 0, an equivalent point conversion operation is performed on point Q, where the scalar K is an integer in binary form or multi-ary form; the result of the addition of the true point and The result of the equivalent point conversion operation is stored in the same register file, and the register file includes multiple registers.
  • the true-point addition operation includes a plurality of true-point addition operation steps
  • the equivalent point conversion operation includes a plurality of equivalent-point conversion sub operation steps
  • the number of true point addition operation steps It is the same as the number of equivalent point conversion sub operation steps.
  • the true-point addition operation and the equivalent-point conversion operation when the true-point addition operation and the equivalent-point conversion operation perform the true-point adder operation and the equivalent-point conversion sub-operation respectively in the same step, the two in the same step All seed operations perform addition or subtraction operations or both perform multiplication operations.
  • the true-point addition operation and the equivalent-point conversion operation when the true-point addition operation and the equivalent-point conversion operation perform the true-point adder operation and the equivalent-point conversion sub-operation respectively in the same step, the two sub-steps of the same step are performed.
  • the operation result generated by the operation is stored in the same register in the register file.
  • An embodiment of the present application further provides an elliptic curve multiple point arithmetic device.
  • the elliptic curve multiple point calculation device adopts a binary scanning method to perform multiple point calculations.
  • the elliptic curve multiple point arithmetic device includes an ordered multiple point arithmetic module, a scanning module, a true point addition arithmetic module, and an equivalent point conversion arithmetic module.
  • the ordered double point operation module is used to perform an ordered double point operation on the point Q.
  • the scanning module is configured to scan a scalar K, which is an integer in binary form or multi-ary form.
  • a true-point addition operation module is coupled to both the scanning module and the ordered multiple-point operation module, and is configured to perform a true point addition operation on the point Q when the current bit of the scalar K is not zero.
  • the equivalent point conversion operation module is coupled to the scanning module and the ordered multiple point operation module, and is configured to perform an equivalent point conversion operation on the point Q when the current bit of the scalar K is scanned to 0.
  • the storage module is coupled to the ordered multiple point operation module, the true point addition operation module, and the equivalent point conversion operation module.
  • the storage module is configured to store a result of the true-point addition operation and a result of the equivalent-point conversion operation in the same register file, where there are multiple registers in the register file.
  • the true-point addition operation module includes N true-point addition operator operation units, which are respectively used to perform each sub-operation step of the true-point addition operation. When the N true-point addition operator operations units are all executed, The result of the true-point addition operation is generated after the corresponding sub-operation is completed.
  • the equivalent point conversion operation module includes N equivalent point conversion operator operation units, which are used to perform each sub-operation step of the equivalent point conversion operation. When the N equivalent point conversion operator operation units have completed execution of the corresponding The result of the equivalent point conversion operation is generated after the sub operation of.
  • both sub-operations of the same step perform addition-subtraction operations or both perform multiplication operations.
  • the operation results generated by the two sub-operations of the same step are stored in the same Register.
  • An embodiment of the present application further provides a computer-usable storage medium for storing a computer program, where the computer program enables a computer to perform the above-mentioned elliptic curve multiple point calculation method.
  • An embodiment of the present application further provides a processing device, including: a processor and a memory, where the memory is configured to store a computer program, and the processor is configured to call and run the computer program stored in the memory, and execute the elliptic curve described above. Double point calculation method.
  • FIG. 1 is a flowchart of a method for calculating multiple points of an elliptic curve according to an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of an elliptic curve multiple point arithmetic device according to an embodiment of the present application.
  • An elliptic curve over a finite field Fq is a set of points.
  • the elliptic curve over a finite field forms a finite commutative group under point addition.
  • P be a point on the elliptic curve.
  • the multiple point operation of the elliptic curve constitutes a one-way function.
  • the multiple point Q and the base point P are known, and the problem of solving the multiple k is called the elliptic curve discrete logarithm problem.
  • the elliptic curve discrete logarithm problem For the discrete logarithm problem of general elliptic curves, there is currently only a solution method for exponential computational complexity. Compared with the large number decomposition problem and the discrete logarithm problem over finite fields, the elliptic curve discrete logarithm problem is much more difficult to solve. Therefore, with the same security requirements, elliptic curve ciphers require much smaller key sizes than other public key ciphers.
  • Elliptic curve multiple point operations can be implemented in many ways. Common multiple point operations include binary scanning and fixed window scanning.
  • the embodiment of the present application proposes a method and device for calculating multiple points of an elliptic curve.
  • an equivalent point conversion operation is performed when the k i bit is 0, and the equivalent point is
  • Each sub-operation of the conversion operation and the real point addition operation executes the algorithm in the same operation mode, which is equivalent to a "pseudo" point addition.
  • An attacker cannot distinguish between the real point addition operation and the "pseudo" from side channel information such as power consumption. Point addition can effectively resist side channel attacks.
  • the equivalent point conversion operation result is updated to the real operation result register. There is no redundant operation in this process, which can effectively resist security error attacks.
  • FIG. 1 is a flowchart of a method for calculating multiple points of an elliptic curve according to an embodiment of the present application.
  • Elliptic curve multiple point calculation methods include:
  • the process includes:
  • a true point addition operation S201 is performed on the point Q, where the scalar K is an integer in binary or multi-ary form; when the current bit of the scalar K is 0 , An equivalent point conversion operation S202 is performed on the point Q.
  • the true-point addition operation S201 includes N sub-operation steps, and the results of the true-point addition operation are generated after the first step to the Nth step are completed.
  • the equivalent point conversion operation S202 also includes N sub-operation steps, and the results of the equivalent point conversion operation are generated after the first step to the Nth step are completed.
  • the multiple point algorithm based on the binary scanning method is as follows:
  • the multiple point algorithm based on the fixed window scanning method is as follows:
  • k k t-1 m t-1 + k t-1 m t-1 + ... + k 1 m + k 0 (0 ⁇ k i ⁇ 2 w )
  • FIG. 2 is a schematic structural diagram of an elliptic curve multiple point arithmetic device according to an embodiment of the present application.
  • the elliptic curve multiple point computing device includes: an ordered multiple point computing module 10, a scanning module 11, a true point addition computing module 12, an equivalent point conversion computing module 13, and a storage module 14.
  • the ordered multiple point operation module 10 is configured to perform an ordered multiple point operation on the point Q.
  • the scanning module 11 is configured to scan a scalar K, which is an integer in binary form or multi-ary form.
  • the true-point addition operation module 12 is coupled to the scanning module 11 and the ordered multiple-point operation module 10, and is configured to perform a real point addition operation on the point Q when the current bit of the scalar K is not zero.
  • the equivalent point conversion operation module 13 is coupled to the scanning module 11 and the ordered multiple point operation module 10, and is configured to perform an equivalent point conversion operation on the point Q when the current bit of the scalar K is scanned to 0.
  • the storage module 14 is configured to store the obtained true point addition operation result and the pseudo point addition operation result in the same register file.
  • the true-point addition operation module 12 includes N true-point addition operation units, which are used to perform each sub-operation step of the true-point addition operation, and are generated after the N true-point addition operation units have performed the corresponding sub-operations. A result of the true-point addition operation.
  • the equivalent point conversion operation module 13 also includes N equivalent point conversion operator operation units, which are used to perform each sub-operation step of the equivalent point conversion operation. When the N equivalent point conversion operator operation units are executed, After the corresponding sub-operation is completed, the result of the equivalent point conversion operation is generated.
  • both sub-operations of the same step perform addition-subtraction operations or both perform multiplication operations.
  • the sub-operation steps of the true-point addition operation and the equivalent-point conversion operation are the same, the operation results generated by the two sub-operations of the same step are stored in the same register in the register file.
  • the elliptic curve multiple point calculation method and device perform an equivalent point conversion operation when k i bits are 0.
  • the equivalent point conversion operation is the same as each sub operation of the real point addition operation, which is equivalent.
  • the attacker cannot distinguish between real point addition and “pseudo” point addition, which can effectively resist side channel attacks.
  • the equivalent point conversion operation result is updated to the real operation result register. There is no redundant operation in this process, which can effectively resist security error attacks.
  • an embodiment of the present application may be provided as a method, a system, or a computer program product. Therefore, this application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. Correspondingly, an embodiment of the present application further provides a computer-readable storage medium for storing a computer program, which causes the computer to execute the above-mentioned elliptic curve multiple point calculation method.
  • a processing device provided in an embodiment of the present application includes a processor and a memory, where the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory, and execute the elliptic curve multiple times described above. Point operation method.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a specific manner such that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, the instructions
  • the device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computational Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Computing Systems (AREA)
  • Executing Machine-Instructions (AREA)

Abstract

本申请公开了一种椭圆曲线多倍点运算方法和装置。该椭圆曲线多倍点运算方法包括有序的倍点和点加运算。在点加运算过程中，当扫描到标量K的当前位不为0时则执行真点加运算，当扫描到标量K的当前位为0时则执行等价点转换运算，将所述真点加运算的结果和所述等价点转换运算的结果存到相同的寄存器堆中，所述寄存器堆中包括多个寄存器。所述椭圆曲线多倍点运算方法和装置能够有效抵抗侧信道分析和安全错误攻击。

Description

椭圆曲线多倍点运算方法和装置
相关申请的交叉引用
本申请基于申请号为201810652042.1、申请日为2018年06月22日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请是关于密码芯片领域，特别是关于一种椭圆曲线多倍点运算方法和装置。
背景技术
自从1985年由Neal Koblitz和Victor Miller各自独立将椭圆曲线引入密码学以来，椭圆曲线在密码学中的作用越来越大。椭圆曲线多倍点运算的实现可以有多种方法，常见的多倍点运算包括二进制扫描法、固定窗口扫描法等。
随着测量技术和攻击技术的不断进步，对密码算法的各种分析和攻击方法不再局限于算法本身，出现了许多针对密码算法实现载体的攻击方法，侧信道攻击是其中威胁性较强的一种方法。攻击者利用密码设备在运行过程中泄露的侧信息如功耗、时间、电磁辐射等，对密码系统进行侧信道攻击。
公开于该背景技术部分的信息仅仅旨在增加对本申请的总体背景的理解，而不应当被视为承认或以任何形式暗示该信息构成已为本领域一般技术人员所公知的现有技术。
发明内容
本申请实施例的目的在于提供一种椭圆曲线多倍点运算方法和装置，其能够有效抵抗侧信道分析和安全错误攻击。
为实现上述目的，本申请实施例提供了一种椭圆曲线多倍点运算方法。该椭圆曲线多倍点运算方法用于椭圆曲线密码算法中来抵抗攻击者对密码的侧信道分析攻击和安全错误攻击。该椭圆曲线多倍点运算方法包括：对点Q执行有序的倍点运算；对点Q执行点加运算，当扫描到标量K的当前位不为0时，则对点Q执行真点加运算，当扫描到标量K的当前位为0时，则对点Q执行等价点转换运算，所述标量K是二进制形式或多进制形式的整数；将所述真点加运算的结果和所述等价点转换运算的结果存到相同的寄存器堆中，所述寄存器堆中包括多个寄存器。
在一些实施方式中，所述真点加运算包括多个真点加子运算步骤，所述等价点转换运算包括多个等价点转换子运算步骤，所述真点加子运算步骤的数目与所述等价点转换子运算步骤的数目相同。
在一些实施方式中，当所述真点加运算和所述等价点转换运算分别在执行同一个步骤下的真点加子运算和等价点转换子运算时，该同一个步骤下的两种子运算均执行加减运算或均执行乘法运算。
在一些实施方式中，当所述真点加运算和所述等价点转换运算分别在执行同一个步骤下的真点加子运算和等价点转换子运算时，将该相同步骤的两种子运算产生的运算结果存到所述寄存器堆中的相同寄存器中。
本申请实施例还提供了一种椭圆曲线多倍点运算装置。所述椭圆曲线多倍点运算装置采用二进制扫描法进行多倍点运算。所述椭圆曲线多倍点运算装置包括：有序倍点运算模块、扫描模块、真点加运算模块、等价点转换运算模块。有序倍点运算模块用于对点Q进行有序的倍点运算。扫描模块用于扫描标量K，所述标量K是二进制形式或多进制形式的整数。真 点加运算模块与所述扫描模块和所述有序倍点运算模块均相耦合，配置为当扫描到标量K的当前位不为0时，对点Q执行真实的点加运算。等价点转换运算模块与所述扫描模块和所述有序倍点运算模块均相耦合，配置为当扫描到标量K的当前位为0时，对点Q执行等价点转换运算。存储模块与所述有序倍点运算模块、所述真点加运算模块、所述等价点转换运算模块均相耦合。存储模块用于将所述真点加运算的结果和所述等价点转换运算的结果存到相同的寄存器堆中，所述寄存器堆中有多个寄存器。
在一些实施方式中，所述真点加运算模块包括N个真点加运算子运算单元，分别用于执行真点加运算的各个子运算步骤，当N个真点加运算子运算单元都执行完相应的子运算后产生所述真点加运算的结果。所述等价点转换运算模块包括N个等价点转换运算子运算单元，分别用于执行等价点转换运算的各个子运算步骤，当N个等价点转换运算子运算单元都执行完相应的子运算后产生所述等价点转换运算的结果。
在一些实施方式中，当所述真点加运算和所述等价点转换运算的子运算步骤相同时，该相同步骤的两种子运算均执行加减运算或均执行乘法运算。
在一些实施方式中，当所述真点加运算和所述等价点转换运算的子运算步骤相同时，将该相同步骤的两种子运算产生的运算结果存到所述寄存器堆中的相同的寄存器中。
本申请实施例还提供了一种计算机可用存储介质，用于存储计算机程序，所述计算机程序使得计算机执行上述的椭圆曲线多倍点运算方法。
本申请实施例还提供了一种处理设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行上述的椭圆曲线多倍点运算方法。
与现有技术相比，根据本申请实施例的椭圆曲线多倍点运算方法和装置，当标量K的当前位为0时执行等价点转换运算，等价点转换运算与真 实的点加运算的每一步子运算均按照相同的运算方式执行算法，相当于“伪”点加，攻击者无法从功耗等侧信道信息中区分真实点加运算和“伪”点加运算，可有效抵抗侧信道攻击。此外，等价点转换运算结果更新到真实运算结果寄存器中，此过程中没有冗余运算，可有效抵抗安全错误攻击。
附图说明
图1是根据本申请一实施方式的椭圆曲线多倍点运算的方法的流程；
图2是根据本申请一实施方式的椭圆曲线多倍点运算装置的结构示意图。
具体实施方式
下面结合附图，对本申请的具体实施方式进行详细描述，但应当理解本申请的保护范围并不受具体实施方式的限制。
除非另有其它明确表示，否则在整个说明书和权利要求书中，术语“包括”或其变换如“包含”或“包括有”等等将被理解为包括所陈述的元件或组成部分，而并未排除其它元件或其它组成部分。
为便于理解本申请实施例的技术方案，以下先对本申请实施例的相关技术进行说明。
有限域Fq上的椭圆曲线是由点组成的集合，有限域上椭圆曲线在点加运算下构成有限交换群，设k是一个正整数，P是椭圆曲线上的点，称点P的k次加为点P的k倍点运算，记为多倍点Q＝[k]P。
类似于有限域乘法群中的乘幂运算，椭圆曲线多倍点运算构成一个单向函数。在多倍点运算中，已知多倍点Q与基点P，求解倍数k的问题称为椭圆曲线离散对数问题。对于一般椭圆曲线的离散对数问题，目前只存在指数级计算复杂度的求解方法。与大数分解问题及有限域上离散对数问题相比，椭圆曲线离散对数问题的求解难度要大得多。因此，在相同安全 程度要求下，椭圆曲线密码较其它公钥密码所需的密钥规模要小得多。
椭圆曲线多倍点运算的实现可以有多种方法，常见的多倍点运算包括二进制扫描法、固定窗口扫描法等。
由于固定窗口扫描法与二进制扫描法的运算逻辑相似，下面以从左向右的二进制扫描法为例，介绍现有的多倍点算法，如下：
算法1：
输入：点P，整数k的二进制表示
Figure PCTCN2019091161-appb-000001
输出：Q＝[k]P.
步骤：
1)Q＝O；
2)i＝n-1 to 0执行
2.1)Q＝[2]Q；
2.2)if(k i＝1)，则Q＝Q+P；
3)返回Q.
以上述算法为例，由于只有在k i为1时才会执行点加运算，攻击者可以通过观察功耗曲线上是否执行点加运算判断当前密钥比特是1还是0。
目前，抵抗侧信道攻击可以通过消除条件分支的方法，不管当前比特是0还是1均执行倍点、点加运算，算法如下：
算法2：
输入：点P，整数k的二进制表示
Figure PCTCN2019091161-appb-000002
输出：Q＝[k]P.
步骤：
1)Q＝O；
2)i＝n-1 to 0执行
2.1)Q＝[2]Q；
2.2)if(k i＝1)，则Q＝Q+P；
else Q’＝Q+P；
3)返回Q.
算法2虽然无法从功耗曲线上区分出当前比特是0还是1，但是Q’＝Q+P这一步由于运算结果Q’不参与后续运算，相当于是冗余操作，无法抵抗安全错误攻击：如果攻击者通过故障注入改变Q’的值，然后观察最终运算结果是否正确，如果正确，说明Q’的改变不影响最终结果，当前比特为0，否则为1。
根据椭圆曲线的性质，对于雅克比射影坐标系下的两个点(x1,y1,z1)和(x2,y2,z2)，若存在某个有限域上的非零元素u使得x1＝u 2x2，y1＝u 3y2，z1＝u z2，则称这两个三元组等价，表示同一个点。据此，本申实施例请提出了一种椭圆曲线多倍点运算方法和装置，在进行椭圆曲线多倍点运算过程中，当k i比特为0时执行等价点转换运算，等价点转换运算与真实的点加运算的每一步子运算均按照相同的运算方式执行算法，相当于“伪”点加，攻击者无法从功耗等侧信道信息中区分真实点加运算和“伪”点加运算，可有效抵抗侧信道攻击。此外，等价点转换运算结果更新到真实运算结果寄存器中，此过程中没有冗余运算，可有效抵抗安全错误攻击。
图1是根据本申请一实施方式的椭圆曲线多倍点运算的方法的流程图。
椭圆曲线多倍点运算的方法包括：
s1，对点Q执行有序的倍点运算。
s2，对点Q执行点加运算。该过程包括：
当扫描到标量K的当前位不为0时，则对点Q执行真点加运算S201，所述标量K是二进制形式或多进制形式的整数；当扫描到标量K的当前位为0时，则对点Q执行等价点转换运算S202。
其中，所述真点加运算S201包括N个子运算步骤，从第一步到第N步执行完毕后产生所述真点加运算的结果。所述等价点转换运算S202也包括N个子运算步骤，从第一步到第N步执行完毕后产生所述等价点转换运 算的结果。当所述真点加运算S201和所述等价点转换运算S202的子运算步骤相同时，该相同步骤的两种子运算均执行加减运算或均执行乘法运算。将该相同步骤的两种子运算产生的运算结果存到所述寄存堆中的相同的寄存器中。
s3，存储运算结果。将所述真点加运算S201的结果和所述等价点转换运算S202的结果存到相同的寄存器堆中。
在一实施方式中，基于二进制扫描法的多倍点算法如下：
输入：点P，整数k的二进制表示
Figure PCTCN2019091161-appb-000003
输出：Q＝[k]P.
步骤：
1)Q＝O；
2)i＝n-1 to 0执行
2.1)Q＝[2]Q；
2.2)if(k i＝1)，则Q＝Q+P；
else Q＝Q；//等价点转换，相当于“伪”点加
3)返回Q.
在又一实施方式中，基于固定窗口扫描法的多倍点算法如下：
设窗口长度为w，m＝2 w，则标量k(多进制数)可以表示为
k＝k t-1m t-1+k t-1m t-1+…+k 1m+k 0(0≤k i<2 w)
从左向右的固定窗口扫描法如下：
输入：点P，整数k的m进制表示
Figure PCTCN2019091161-appb-000004
输出：Q＝[k]P.
步骤：
1)预计算：
1.1)P 1＝P；
1.2)for i＝2 to 2 w-1执行
P i＝P i-1+P；
2)Q＝O；
3)i＝t-1 to 0执行
3.1)Q＝[2 w]Q；
3.2)if(k i≠0)，则
Figure PCTCN2019091161-appb-000005
else Q＝Q；//等价点转换，相当于“伪”点加
4)返回Q.
图2是根据本申请一实施方式的椭圆曲线多倍点运算装置的结构示意图。
该椭圆曲线多倍点运算装置包括：有序倍点运算模块10、扫描模块11、真点加运算模块12、等价点转换运算模块13、存储模块14。
有序倍点运算模块10用于对点Q进行有序的倍点运算。扫描模块11用于扫描标量K，所述标量K是二进制形式或多进制形式的整数。真点加运算模块12与所述扫描模块11以及有序倍点运算模块10均相耦合，配置为当扫描到标量K的当前位不为0时，对点Q执行真实的点加运算。等价点转换运算模块13与所述扫描模块11以及有序倍点运算模块10均相耦合，配置为当扫描到标量K的当前位为0时，对点Q执行等价点转换运算。存储模块14用于将得到的真点加运算结果和伪点加运算结果存到相同的寄存器堆中。
真点加运算模块12包括N个真点加运算子运算单元，分别用于执行真点加运算的各个子运算步骤，当N个真点加运算子运算单元都执行完相应的子运算后产生所述真点加运算的结果。所述等价点转换运算模块13也包括N个等价点转换运算子运算单元，分别用于执行等价点转换运算的各个子运算步骤，当N个等价点转换运算子运算单元都执行完相应的子运算后产生所述等价点转换运算的结果。优选地，当所述真点加运算和所述等价点转换运算的子运算步骤相同时，该相同步骤的两种子运算均执行加减运 算或均执行乘法运算。当所述真点加运算和所述等价点转换运算的子运算步骤相同时，将该相同步骤的两种子运算产生的运算结果存到寄存器堆中的相同的寄存器中。
下面以素数域上的椭圆曲线点加及“伪点加”为一实施例进行详细说明。运算过程详见如下表1：
Figure PCTCN2019091161-appb-000006
Figure PCTCN2019091161-appb-000007
表1
从表中可以看出，点加和“伪”点加每一子运算步骤的运算方式相同(均执行乘法，或者均执行加/减法)。X1，Y1，Z1，X2，Y2都参与运算，而且每一子运算步骤的运算结果都更新到相同的寄存器变量V0，V1，V2，VA，VB，VC，VD或者X1，Y1，Z1中。
综上所述，该椭圆曲线多倍点运算方法和装置当k i比特为0时执行等价点转换运算，等价点转换运算与真实的点加运算的每个子运算的运算方式相同，相当于“伪”点加，攻击者无法区分真实点加运算和“伪”点加运算，可有效抵抗侧信道攻击。等价点转换运算结果更新到真实运算结果寄存器中，此过程中没有冗余运算，可有效抵抗安全错误攻击。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。相应地，本申请实施例还提供了一种计算机可读存储介质，用于存储计算机程序，所述计算机程序使得计算机执行上述的椭圆曲线多倍点运算方法。
本申请实施例提供的一种处理设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行上述的椭圆曲线多倍点运算方法。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中 的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
最后应当说明的是：以上实施例仅用于说明本申请的技术方案而非对其保护范围的限制,尽管参照上述实施例对本申请进行了详细的说明,所属领域的普通技术人员应当理解：本领域技术人员阅读本申请后依然可对申请的具体实施方式进行种种变更、修改或者等同替换，但这些变更、修改或者等同替换，均在申请待批的权利要求保护范围之内。

Claims (10)

  1. 一种椭圆曲线多倍点运算方法，该椭圆曲线多倍点运算方法用于椭圆曲线密码算法中来抵抗攻击者对密码的侧信道分析攻击和安全错误攻击，该椭圆曲线多倍点运算方法包括：
    对点Q执行有序的倍点运算；
    对点Q执行点加运算，当扫描到标量K的当前位不为0时，则对点Q执行真点加运算，当扫描到标量K的当前位为0时，则对点Q执行等价点转换运算，所述标量K是二进制形式或多进制形式的整数；
    将所述真点加运算的结果和所述等价点转换运算的结果存到相同的寄存器堆中，所述寄存器堆中包括多个寄存器。
  2. 如权利要求1所述的椭圆曲线多倍点运算方法，其中，
    所述真点加运算包括多个真点加子运算步骤，所述等价点转换运算包括多个等价点转换子运算步骤，所述真点加子运算步骤的数目与所述等价点转换子运算步骤的数目相同。
  3. 如权利要求2所述的椭圆曲线多倍点运算方法，其中，
    当所述真点加运算和所述等价点转换运算分别在执行同一个步骤下的真点加子运算和等价点转换子运算时，该同一个步骤下的两种子运算均执行加减运算或均执行乘法运算。
  4. 如权利要求2所述的椭圆曲线多倍点运算方法，其中，
    当所述真点加运算和所述等价点转换运算分别在执行同一个步骤下的真点加子运算和等价点转换子运算时，将该同一个步骤下的两种子运算产生的运算结果存到所述寄存器堆中的相同寄存器中。
  5. 一种椭圆曲线多倍点运算装置，其中，包括：
    有序倍点运算模块，配置为对点Q进行有序的倍点运算；
    扫描模块，配置为扫描标量K，所述标量K是二进制形式或多进制 形式的整数；
    真点加运算模块，与所述扫描模块和所述有序倍点运算模块均相耦合，配置为当扫描到标量K的当前位不为0时，对点Q执行真实的点加运算；
    等价点转换运算模块，与所述扫描模块和所述有序倍点运算模块均相耦合，配置为当扫描到标量K的当前位为0时，对点Q执行等价点转换运算；
    存储模块，与所述有序倍点运算模块、所述真点加运算模块、所述等价点转换运算模块均相耦合，该存储模块配置为将所述真点加运算的结果和所述等价点转换运算的结果存到相同的寄存器堆中，所述寄存器堆中有多个寄存器。
  6. 如权利要求5所述的椭圆曲线多倍点运算装置，其中，
    所述真点加运算模块包括N个真点加运算子运算单元，分别用于执行真点加运算的各个子运算步骤，当N个真点加运算子运算单元都执行完相应的子运算后产生所述真点加运算的结果；
    所述等价点转换运算模块包括N个等价点转换运算子运算单元，分别用于执行等价点转换运算的各个子运算步骤，当N个等价点转换运算子运算单元都执行完相应的子运算后产生所述等价点转换运算的结果。
  7. 如权利要求6所述的椭圆曲线多倍点运算装置，其中，
    当所述真点加运算和所述等价点转换运算的子运算步骤相同时，该相同步骤的两种子运算均执行加减运算或均执行乘法运算。
  8. 如权利要求6所述的椭圆曲线多倍点运算装置，其中，
    当所述真点加运算和所述等价点转换运算的子运算步骤相同时，将该相同步骤的两种子运算产生的运算结果存到所述寄存器堆中的相同寄存器中。
  9. 一种计算机可用存储介质，用于存储计算机程序，所述计算机程 序使得计算机执行如权利要求1至4中任一项所述的椭圆曲线多倍点运算方法。
  10. 一种处理设备，包括：处理器和存储器，该存储器用于存储计算机程序，所述处理器用于调用并运行所述存储器中存储的计算机程序，执行如权利要求1至4中任一项所述的椭圆曲线多倍点运算方法。
PCT/CN2019/091161 2018-06-22 2019-06-13 椭圆曲线多倍点运算方法和装置 WO2019242562A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/970,488 US11003769B2 (en) 2018-06-22 2019-06-13 Elliptic curve point multiplication operation method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810652042.1 2018-06-22
CN201810652042.1A CN108875416B (zh) 2018-06-22 2018-06-22 椭圆曲线多倍点运算方法和装置

Publications (1)

Publication Number Publication Date
WO2019242562A1 true WO2019242562A1 (zh) 2019-12-26

Family

ID=64340867

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/091161 WO2019242562A1 (zh) 2018-06-22 2019-06-13 椭圆曲线多倍点运算方法和装置

Country Status (3)

Country Link
US (1) US11003769B2 (zh)
CN (1) CN108875416B (zh)
WO (1) WO2019242562A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108875416B (zh) * 2018-06-22 2020-05-19 北京智芯微电子科技有限公司 椭圆曲线多倍点运算方法和装置
CN110048844B (zh) * 2019-03-29 2020-09-11 网御安全技术（深圳）有限公司 实现sm2算法的多倍点计算方法、装置
CN111966324B (zh) * 2020-08-19 2024-01-30 哈尔滨理工大学 面向多椭圆曲线标量乘法器的实现方法、装置及存储介质
CN113014388B (zh) * 2021-03-30 2022-06-28 浙江萤火虫区块链科技有限公司 一种椭圆曲线密码算法中标量乘的加速系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6738478B1 (en) * 1998-10-28 2004-05-18 Certicom Corp. Power signature attack resistant cryptography
CN101183945A (zh) * 2007-12-20 2008-05-21 上海交通大学 基于旁路算子的椭圆曲线抗旁路攻击方法
CN101562522A (zh) * 2009-05-06 2009-10-21 深圳先进技术研究院 抗侧信道攻击的椭圆曲线密码系统实现方法
CN104579651A (zh) * 2013-10-28 2015-04-29 上海复旦微电子集团股份有限公司 椭圆曲线密码点乘运算的方法和装置
US20180101362A1 (en) * 2016-10-07 2018-04-12 Idemia Identity & Security France Unknown
CN108875416A (zh) * 2018-06-22 2018-11-23 北京智芯微电子科技有限公司 椭圆曲线多倍点运算方法和装置

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4067818B2 (ja) * 2001-12-10 2008-03-26 富士通株式会社 楕円曲線暗号装置、楕円曲線暗号プログラム及び楕円曲線暗号の演算方法
FR2843506B1 (fr) * 2002-08-09 2004-10-29 Gemplus Card Int Procede de calcul universel applique a des points d'une courbe elliptique definie par une quartique, procede cryptographique et composant electronique associes
EP1548687B1 (en) * 2002-12-18 2013-01-09 Fujitsu Limited Tamper-resistant elliptical curve encryption using secret key
JP4284320B2 (ja) * 2003-08-06 2009-06-24 富士通株式会社 楕円曲線暗号装置，楕円曲線暗号方法および楕円曲線暗号プログラム
WO2006077651A1 (ja) * 2005-01-24 2006-07-27 Fujitsu Limited 電力解析攻撃に対する耐タンパ性を持った暗号化処理装置
WO2007048430A1 (en) * 2005-10-28 2007-05-03 Telecom Italia S.P.A. A method for scalar multiplication in elliptic curve groups over binary polynomial fields for side-channel attack-resistant cryptosystems
KR100850202B1 (ko) * 2006-03-04 2008-08-04 삼성전자주식회사 Ｅｃｃ 패스트 몽고매리 전력 래더 알고리즘을 이용하여ｄｆａ 에 대응하는 암호화 방법
KR100867989B1 (ko) * 2006-12-06 2008-11-10 한국전자통신연구원 단순전력분석에 안전한 Ｌｅｆｔ－ｔｏ－Ｒｉｇｈｔ방향으로 리코딩과 스칼라 곱셈을 동시에 수행하는 스칼라곱셈 방법
US20100150340A1 (en) * 2008-12-02 2010-06-17 Electronics And Telecommunications Research Institute Device and method for elliptic curve cryptosystem
CN102387015B (zh) * 2011-09-14 2014-08-06 中国矿业大学 一种应用于数字签名验证的提高椭圆曲线标量乘法计算效率的方法
FR3033965B1 (fr) * 2015-03-18 2018-12-07 Maxim Integrated Products, Inc. Systèmes et procédés de commande de dispositifs de cryptage sur courbe elliptique sécurisés
US10270598B2 (en) * 2016-08-26 2019-04-23 Intel Corporation Secure elliptic curve cryptography instructions
CN107425974B (zh) * 2017-05-18 2021-03-23 西安电子科技大学 一种FourQ椭圆曲线上KP运算的硬件实现方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6738478B1 (en) * 1998-10-28 2004-05-18 Certicom Corp. Power signature attack resistant cryptography
CN101183945A (zh) * 2007-12-20 2008-05-21 上海交通大学 基于旁路算子的椭圆曲线抗旁路攻击方法
CN101562522A (zh) * 2009-05-06 2009-10-21 深圳先进技术研究院 抗侧信道攻击的椭圆曲线密码系统实现方法
CN104579651A (zh) * 2013-10-28 2015-04-29 上海复旦微电子集团股份有限公司 椭圆曲线密码点乘运算的方法和装置
US20180101362A1 (en) * 2016-10-07 2018-04-12 Idemia Identity & Security France Unknown
CN108875416A (zh) * 2018-06-22 2018-11-23 北京智芯微电子科技有限公司 椭圆曲线多倍点运算方法和装置

Also Published As

Publication number Publication date
US11003769B2 (en) 2021-05-11
CN108875416A (zh) 2018-11-23
US20200380122A1 (en) 2020-12-03
CN108875416B (zh) 2020-05-19

Similar Documents

Publication Publication Date Title
WO2019242562A1 (zh) 椭圆曲线多倍点运算方法和装置
US9772821B2 (en) Cryptography method comprising an operation of multiplication by a scalar or an exponentiation
US8498411B1 (en) Using multiples above two with running totals and reference values other than 0 and 2 (window size) in elliptic curve cryptography scalar multiplication acceleration tables
Kasianchuk et al. Rabin's modified method of encryption using various forms of system of residual classes
US20220085999A1 (en) System and method to optimize decryption operations in cryptographic applications
US11902432B2 (en) System and method to optimize generation of coprime numbers in cryptographic applications
US9811318B2 (en) Montgomery multiplication method for performing final modular reduction without comparison operation and montgomery multiplier
US20220085998A1 (en) System and method to generate prime numbers in cryptographic applications
US8805913B2 (en) Method of evaluating a function and associated device
US11824986B2 (en) Device and method for protecting execution of a cryptographic operation
US9722773B2 (en) Method of determining a representation of a product of a first element and a second element of a finite set, method of evaluating a function applied to an element of a finite set and associated devices
Putranto et al. Another concrete quantum cryptanalysis of binary elliptic curves
Chen et al. Integer arithmetic over ciphertext and homomorphic data aggregation
Ding et al. A reconfigurable high-speed ECC processor over NIST primes
Nykolaychuk et al. Residue number system asymmetric cryptoalgorithms
Seo et al. MoTE-ECC based encryption on MSP430
Dąbrowski et al. Generation and Implementation of Cryptographically Strong Elliptic Curves
US9900154B2 (en) Optimized hardward architecture and method for ECC point addition using mixed affine-jacobian coordinates over short weierstrass curves
Gulen et al. Side-Channel Resistant 2048-Bit RSA Implementation for Wireless Sensor Networks and Internet of Things
KR20160017319A (ko) 연산 장치, 그것의 몽고메리 파라미터 계산 방법 및 모듈러 곱셈 방법
KR20050064645A (ko) 역원 계산 회로, 역원계산 방법 및 상기 역원계산 방법을실행시키기 위한 프로그램을 기록한 컴퓨터로 읽을 수있는 기록매체
WO2021027598A1 (zh) 模型参数确定方法、装置和电子设备
Saleh et al. Efficient elliptic curve cryptosystems
US9929862B2 (en) Optimized hardware architecture and method for ECC point doubling using Jacobian coordinates over short Weierstrass curves
Sinha et al. Exploring Bitslicing Architectures for Enabling FHE-Assisted Machine Learning

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19821688

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19821688

Country of ref document: EP

Kind code of ref document: A1