Processor with elliptic curve cryptography algorithm and processing method thereof

Abstract

A processor with elliptic curve cryptography algorithm and a processing method thereof, wherein a first register stores a hash value pointer, a second register stores a public key pointer, a third register stores a signature pointer, and a fourth register stores a verification result. In response to a first elliptic curve cryptography instruction of an instruction set architecture, the processor obtains a hash value of data to be verified through the first register, obtains a public key of a signer through the second register, and obtains a signature through the third register. The processor performs a signature verification operation of the elliptic curve cryptography algorithm on the hash value with the public key and the signature to generate the verification result for storage.

Description

TECHNICAL FIELD

[0001] The present application relates to a processor with a cryptographic algorithm and a processing method thereof. BACKGROUND

[0002] The SM2 cryptographic algorithm is an elliptic curve public key cryptographic algorithm, but is different from the international standards such as ECDSA (abbreviation of Elliptic Curve Digital Signature Algorithm), ECDH (abbreviation of Elliptic-curve Diffie-Hellman) and the like in terms of signature and key exchange, and adopts a more secure mechanism. The SM2 cryptographic algorithm involves digital signature, signature verification, key exchange protocol and the like in addition to encryption and decryption operations.

[0003] The SM3 cryptographic algorithm is a hash (or called as a hybrid or a hash) cryptographic algorithm. In particular, part of the functions of the SM3 cryptographic algorithm is frequently used by the SM2 cryptographic algorithm.

[0004] In the known technology, the SM2 cryptographic algorithm is implemented by using software and / or special hardware (such as an external cryptographic card and the like). The use of software cannot effectively guarantee the security of data, and the use of special hardware requires the purchase of special hardware in deployment, so as to increase the deployment cost.

[0005] How to efficiently and more securely complete the SM2 cryptographic algorithm is a major issue in the technical field. SUMMARY

[0006] In order to effectively guarantee the security of data and reduce the deployment cost, the present application provides a processor with an elliptic curve cryptographic algorithm (SM2) and a processing method thereof.

[0007] The processor implemented according to an embodiment of the present application comprises a first register, a second register, a third register and a fourth register. The first register stores a hash value pointer pointing to a first memory space, and the first memory space stores a hash value (e') of to-be-verified data. The second register stores a public key pointer pointing to a public key of a signer. The third register stores a signature pointer pointing to a to-be-verified signature. The fourth register stores a verification result. In response to a first elliptic curve cryptographic algorithm instruction of an instruction set architecture, the processor obtains the hash value of the to-be-verified data from the first memory space through the first register, obtains the public key through the second register, obtains the signature through the third register, performs signature verification operation of the elliptic curve cryptographic algorithm on the hash value by using the public key and the signature, generates the verification result, and writes the verification result into the fourth register.

[0008] The processing method of the processor according to an embodiment of the present application comprises: in response to a first elliptic curve cryptography algorithm instruction of an instruction set architecture, obtaining a hash value of to-be-verified data from the first memory space, obtaining a public key, obtaining a signature, performing a signature verification operation of the elliptic curve cryptography algorithm on the hash value by using the public key and the signature, generating the verification result, and writing the verification result into the fourth register.

[0009] The processor with the elliptic curve cryptography algorithm (SM2) and the processing method thereof provided by the present application can store the intermediate data generated in the process of implementing the elliptic curve cryptography algorithm in the internal hardware storage space of the processor, so that the intermediate data cannot be accessed outside the processor, and the security is greatly improved. In addition, no special hardware needs to be additionally purchased when deployed, so the deployment cost is reduced.

[0010] The present application is described in detail below with reference to the specific embodiments and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0011] Figure 1 Fig. 1 is a block diagram illustrating a processor 100 according to an embodiment of the present application;

[0012] Figures 2A-2D Fig. 2 illustrates the format of the SM3 cryptographic algorithm instruction of the ISA and the related microcode ucode design according to different embodiments of the present application;

[0013] Figure 3 Fig. 3 illustrates an embodiment of the ISA instruction writing;

[0014] Figure 4 Fig. 4 is a flowchart illustrating the step procedure triggered by the SM3 cryptographic algorithm instruction of the ISA and the plurality of microinstructions converted by the corresponding SM3 cryptographic algorithm instruction according to an embodiment of the present application;

[0015] Figure 5 Fig. 5 illustrates an SM3 engine 500 according to an embodiment of the present application;

[0016] Figure 6 Fig. 6 is a block diagram illustrating a processor 600 according to an embodiment of the present application;

[0017] Figure 7 Fig. 7 illustrates the format 702 of the SM2 cryptographic algorithm instruction of the ISA according to an embodiment of the present application;

[0018] Figure 8 Fig. 8 illustrates the microcode ucode design of the corresponding cryptographic operation in a table 804, and shows how to interpret the content of the architecture register 124 by the generated microinstruction;

[0019] Figure 9A ,9B FIG. 6 is a flowchart illustrating encryption operations initiated by a single SM2 cryptographic algorithm instruction of an ISA, in accordance with an embodiment of the present application, in terms of multiple microinstructions that are translated from the SM2 cryptographic algorithm instruction;

[0020] Figure 10 Table 1004 illustrates ucode design for the corresponding decryption operations, showing how the resulting microinstructions interpret the contents of architectural registers 124;

[0021] Figure 11A 11B FIG. 7 is a flowchart illustrating decryption operations initiated by a single SM2 cryptographic algorithm instruction of an ISA, in accordance with an embodiment of the present application, in terms of multiple microinstructions that are translated from the SM2 cryptographic algorithm instruction;

[0022] Figure 12 Table 1204 illustrates ucode design for the corresponding signature operations, showing how the resulting microinstructions interpret the contents of architectural registers 124;

[0023] Figure 13 FIG. 8 is a flowchart illustrating signature operations initiated by a single SM2 cryptographic algorithm instruction, in accordance with an embodiment of the present application, in terms of multiple microinstructions that are translated from the SM2 cryptographic algorithm instruction;

[0024] Figure 14 Table 1404 illustrates ucode design for the corresponding signature verification operations, showing how the resulting microinstructions interpret the contents of architectural registers 124;

[0025] Figure 15 FIG. 9 is a flowchart illustrating signature verification operations initiated by a single SM2 cryptographic algorithm instruction, in accordance with an embodiment of the present application, in terms of multiple microinstructions that are translated from the SM2 cryptographic algorithm instruction;

[0026] Figure 16 Table 1604 illustrates ucode design for the corresponding first procedure of a key exchange, showing how the resulting microinstructions interpret the contents of architectural registers 124 for the first SM2 cryptographic algorithm instruction;

[0027] Figure 17 FIG. 10 is a flowchart illustrating first procedure operations of a key exchange initiated by a single SM2 cryptographic algorithm instruction, in accordance with an embodiment of the present application, in terms of multiple microinstructions that are translated from the SM2 cryptographic algorithm instruction;

[0028] Figure 18 Table 1804 illustrates ucode design for the corresponding second procedure of a key exchange, showing how the resulting microinstructions interpret the contents of architectural registers 124 for the second SM2 cryptographic algorithm instruction; ​

[0029] Figure 19A 、 19B FIG. 4 is a flowchart illustrating a key exchange second procedure operation triggered by an SM2 cryptographic algorithm instruction, according to an embodiment of the present application, and a plurality of microinstructions converted from the SM2 cryptographic algorithm instruction;

[0030] Figure 20 FIG. 5 is a table 2004 illustrating a microcode ucode design for the corresponding key exchange third procedure operation, showing how the microinstructions generated in response to the third SM2 cryptographic algorithm instruction interpret the contents of the architectural registers 124;

[0031] Figure 21A 、 21B FIG. 6 is a flowchart illustrating a key exchange third procedure operation triggered by an SM2 cryptographic algorithm instruction, according to an embodiment of the present application, and a plurality of microinstructions converted from the SM2 cryptographic algorithm instruction;

[0032] Figure 22 FIG. 7 illustrates how an initiator and a responder can use the key exchange first to third procedure operations proposed by the present application to achieve a key exchange, according to an embodiment of the present application. The initiator and the responder can communicate with each other, and each has a processor (600);

[0033] Figure 23 FIG. 8 is a table 2304 illustrating a microcode ucode design for the corresponding first pre-processing operation, showing how the microinstructions generated in response to the single SM2 cryptographic algorithm instruction interpret the contents of the architectural registers 124;

[0034] Figure 24 FIG. 9 is a flowchart illustrating a first pre-processing operation triggered by an SM2 cryptographic algorithm instruction, according to an embodiment of the present application, and a plurality of microinstructions converted from the SM2 cryptographic algorithm instruction;

[0035] Figure 25 FIG. 10 is a table 2504 illustrating a microcode ucode design for the corresponding second pre-processing operation, showing how the microinstructions generated in response to the single SM2 cryptographic algorithm instruction interpret the contents of the architectural registers 124;

[0036] Figure 26 FIG. 11 is a flowchart illustrating a second pre-processing operation triggered by an SM2 cryptographic algorithm instruction, according to an embodiment of the present application, and a plurality of microinstructions converted from the SM2 cryptographic algorithm instruction;

[0037] Figure 27 FIG. 12 illustrates the detailed hardware architecture of the SM2 engine 626, according to an embodiment of the present application;

[0038] Figure 28According to one embodiment of the present invention, the dot multiplication hardware 2704 driven by a dot multiplication hardware operation microinstruction is illustrated.

[0039] Figure 29 According to one embodiment of the present invention, a preprocessing hardware 2706 driven by a preprocessing hardware operation microinstruction is illustrated.

[0040] Figure 30 According to one embodiment of the present invention, a modular multiplication hardware 2708 driven by a modular multiplication hardware operation microinstruction is illustrated; and

[0041] Figure 31 According to one embodiment of the present invention, the analog reverse hardware 2710 driven by a microinstruction of analog reverse hardware operation is illustrated. Detailed Implementation

[0042] The following description illustrates various embodiments of the present invention. This description introduces the basic concepts of the invention and is not intended to limit its scope. The actual scope of the invention should be defined in accordance with the claims.

[0043] One embodiment of this invention discloses a processor equipped with a hash cryptography algorithm (SM3 cryptography algorithm), including a single hash cryptography algorithm instruction (SM3 cryptography algorithm instruction) for designing an instruction set architecture (ISA) for the SM3 cryptography algorithm. In one embodiment, corresponding to the SM3 cryptography algorithm instruction, this invention designs the processor's microcode and adds a hash cryptography algorithm accelerator (SM3 engine) to the processor's cryptographic execution unit. When processing the SM3 cryptography algorithm instruction, the processor generates multiple microinstruction definitions, uses, and manages the contents of architecture registers based on the microcode to operate the cryptographic execution unit (including the SM3 engine) to perform the SM3 cryptography algorithm on an input data stream m, transforming an initial hash constant V(0) into a transformed hash value V(n). The process includes message padding, grouping (making it include n groups of messages B(0),..., B(n-1)), and message expansion (expanding B(i) to W0). i …W 67 i and W0 i '…W 63 i '), Iterative compression (based on the B(i) expansion result, transforming the hash value from V(i) to V(i+1)). The processor-supported instruction set may include the x86 instruction set. The intermediate value from the initial hash constant V(0) to the transformed hash value V(n) (e.g., W0) i …W 67i With W0 i '…W 63 i '、V(1)…V(n-1)…etc.) can be properly hidden in the cryptographic execution unit and not exposed on the architecture register.

[0044] Figure 1 The diagram is a block diagram illustrating a processor 100 according to one embodiment of the present invention. According to the branch predictor 102, the instruction is loaded into the instruction cache 104 based on the translation lookaside buffer (ITLB) translation result. After being cached in the instruction buffer (XIB) 106, it is pushed into the format instruction queue (FIQ) 108 and handed over to the decoder 110 to decode it into multiple pipeline-recognizable microinstructions based on the microcode (stored in a microcode storage). These microinstructions are then pushed into the instruction queue (XIQ) 112 and then stored in the corresponding reservation station (RS) through the rename unit 114. This drives the arithmetic logical unit (ALU), the address generating unit (AGU) of the memory order buffer 116, and the corresponding hardware Fadd, Fmul, Fmisc, MMX, or cryptographic execution unit 118 for various instructions. The data required for computation can be loaded into the data cache 120 based on the translation result of the data translation lookaside buffer (DTLB), and then cached in the sequential memory cache 116. The processor 100 also includes a reorder buffer (ROB) 122 and architecture registers 124 to implement computation.

[0045] The cryptographic execution unit 118 includes an SM3 engine 126. The microcode (ucode) includes an architecture register 124 for accessing the SM3 cryptographic algorithm instructions of the corresponding ISA. Specifically, it includes registers storing the preprocessing method of input data m (e.g., whether message padding is required), an input data size register, and even an input data m pointer register and a hash value pointer register. The decoder 110 decodes the SM3 cryptographic algorithm instructions of the ISA of this invention into multiple micro-instructions recognizable by the processor 100 pipeline based on the microcode (ucode). These micro-instructions are used to interpret the contents of the architecture register 124, obtain the initial hash constant V(0) and the input data m, and then drive the SM3 engine 126 to perform hash value conversion, generating the converted hash value V(n). The decoded multiple micro-instructions include an accelerator operation micro-instruction (SM3 engine micro-instruction), which is responsible for driving the SM3 engine 126. The decoded multiple micro-instructions also include accessing and managing the contents of the architecture register 124, and operating the cryptographic execution unit 118 to perform a hash cryptographic algorithm on the input data m.

[0046] Figures 2A-2D This invention illustrates the format of the SM3 cryptographic algorithm instructions for ISA and the related microcode design according to different embodiments. Besides the illustrated embodiments, the format content (e.g., numerical opcode) and register applications mentioned in this invention can also have various variations.

[0047] Figure 2A The diagram illustrates the format 202 of the ISA's SM3 cryptographic algorithm instructions, and Table 204 describes the related microcode design. The prefix, opcode, and ModR / M field of format 202 are: 0xF3 0x0F 0xA6 0xE8 (other values ​​are also possible). The SIB, Displacement, and Immediate fields are left blank (non-filled). After the decoder 110 recognizes the code "0xF3 0x0F 0xA6 0xE8", it generates multiple microinstructions according to the microcode, including defining, using, and managing the architecture register 124 to operate the cryptographic execution unit 118 to perform the SM3 cryptographic algorithm on the input data m.

[0048] First, referring to Table 204, we discuss how the microcode corresponds to the SM3 cryptographic algorithm instruction definition input registers of the ISA, using registers EAX, ECX, ESI, and EDI in architecture register 124.

[0049] The EAX register carries a message padding flag, indicating whether the input data m requires message padding to meet the input bit length of the SM3 cryptographic algorithm. EAX=0 indicates that the input data m requires message padding. EAX=-1 indicates that the input data m does not require message padding. When the message padding flag indicates that padding is required, the multiple microinstructions pad the input data m to a multiple of the size of an input message block. In one embodiment, the size of the input message block is 512 bits. When EAX=0, the multiple microinstructions pad the input data m, and the padded data is m', where m'=m, 1, k{0}, 64{len}. len is the bit length of the input data m. The padded data m' includes the input data m, 1 high-order bit '1', k low-order bits '0', and len represented by 64 bits. The value k makes the remainder of (len+1+k) divided by 512 448. According to these multiple micro-instructions, the input data m, which is a multiple of 512 bits long, or the padded data m', is grouped into n groups of 512-bit input messages, including B(0), ..., B(n-1), where n is an integer.

[0050] The ECX register stores the length of an input data (m). If EAX=0, the length of the input data stored in the ECX register is counted in bytes. If EAX=-1, the length of the input data stored in the ECX register is counted in 64-byte blocks.

[0051] The ESI register stores an input data pointer, pointing to a memory space that stores the input data m. The memory space described in this invention can be a system memory (such as RAM) space coupled to the processor, and can follow the ES segmentation technique. The EDI register stores a hash value pointer, pointing to a memory space that stores the initial hash constant V(0) (which can also follow the ES segmentation technique).

[0052] In addition, Table 204 shows how the microcode corresponds to the SM3 cryptographic algorithm instruction definition output registers of the ISA; after the SM3 cryptographic algorithm is completed and the converted hash value V(n) is obtained, the registers EAX, ECX, ESI, and EDI are set as follows.

[0053] The input data pointer maintained in register ESI is incremented by one offset. When register EAX is "0", this offset is the length of the input data managed by register ECX. When register EAX is "-1", this offset is the size of the input data carried in register ECX multiplied by 64. The hash pointer in register EDI remains unchanged, allowing the converted hash value V(n) generated by the SM3 cryptographic algorithm to overwrite the initial hash constant V(0).

[0054] In addition, registers EAX and ECX can be adjusted as follows after the SM3 cryptographic algorithm is completed. If register EAX is set to "0" during input, register ECX remains unchanged, and register EAX is updated to the same value as register ECX. If register EAX is set to "-1" during input, register ECX is reset to zero, and register EAX remains unchanged.

[0055] Figure 2B The diagram illustrates the format 212 of the ISA's SM3 cryptographic algorithm instructions, and Table 214 describes the related microcode design. Format 212 is the same as format 202. After the decoder 110 identifies the code "0xF3 0x0F 0xA6 0xE8", it generates multiple microinstructions according to the microcode, including defining, using, and managing the architecture register 124, to operate the cryptographic execution unit 118 to perform the SM3 cryptographic algorithm on the input data m.

[0056] Unlike the microcode design shown in Table 204, which provides register ESI for the input data pointer and register EDI for the hash value pointer, Figure 2B The microcode ucode design shown in Table 214 uses the ESI register to store an information pointer, which points to a memory space containing an input data pointer and a hash value pointer. The memory space pointed to by the input data pointer stores the input data m, while the memory space pointed to by the hash value pointer stores the initial hash constant V(0). Correspondingly, regarding the output register settings of the SM3 cryptographic algorithm, the microcode ucode design shown in Table 214 does not change the ESI register.

[0057] Figure 2C The diagram illustrates the format 222 of the ISA's SM3 cryptographic algorithm instructions, and Table 224 describes the related microcode design. Format 222 is the same as formats 202 and 212. After the decoder 110 identifies the code "0xF3 0x0F 0xA6 0xE8", it generates multiple microinstructions according to the microcode, including defining, using, and managing the architecture register 124, to operate the cryptographic execution unit 118 to perform the SM3 cryptographic algorithm on the input data m.

[0058] and Figure 2AIn contrast, unlike the microcode design shown in Table 204, which provides a register EDI for the hash value pointer, Figure 2C The microcode ucode design shown in Table 224 sets the EDI register to 0 at the start of the SM3 cryptographic algorithm, and configures it to store the converted hash value V(n) in an internal register within the execution unit 118. Regarding the output register settings for the SM3 cryptographic algorithm, the microcode ucode design shown in Table 224 sets the EDI register to store the execution unit register number of this internal register. By accessing the EDI register again via microinstruction, the internal register of the execution unit can be located based on the execution unit register number, and the converted hash value V(n) can be obtained and used as the initial hash constant for the next input data.

[0059] Figure 2D The diagram illustrates format 232 of the SM3 cryptographic algorithm instruction in ISA, and table 234 describes the related microcode design. Unlike formats 202, 212, and 222, format 232 has InPointer and OutPointer fields, which store an input data pointer and a hash value pointer, respectively, pointing to the input data m stored in system memory and the initial hash constant V(0). This saves the use of the architecture register 124. In one embodiment, the InPointer and OutPointer fields of format 232 of the SM3 cryptographic algorithm instruction are each 32 bits. After the decoder 110 identifies the code "0xF3 0x0F 0xA6 0xE8", it generates multiple microinstructions according to the microcode, including defining, using, and managing the architecture register 124, without using registers ESI and EDI.

[0060] Figure 3 The diagram also illustrates one implementation of ISA instruction writing. Program code 300 may include SM3 cryptographic algorithm instructions 302 in the above formats 202, 212, 222, or 232. This SM3 cryptographic algorithm instruction 302 may be preceded by at least one register setting instruction 304, used to fill the architecture register 124, in preparation for the execution of the SM3 cryptographic algorithm instruction 302.

[0061] Figure 4 The flowchart illustrates the steps initiated by the SM3 cryptographic algorithm instruction of the ISA according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM3 cryptographic algorithm instruction.

[0062] Step S402 checks the length of the input data (m), for example, by reading the ECX register. If the ECX register is 0, the process proceeds to step S404, and the execution of the SM3 cryptographic algorithm instruction ends. If the ECX register is not 0, the process proceeds to step S406.

[0063] Step S406 checks the EAX register to determine if there is a message stuffing requirement (stuffing must be a multiple of 512 bits). If the EAX register is 0, step S408 performs message stuffing. The input data m is stuffed into m' (=m, 1, k{0}, 64{len}). If the EAX register is not 0, the message stuffing step S408 is omitted. The input data m, which is a multiple of 512 bits long, or the stuffed data m', is grouped into n groups of input messages in 512-bit units, including B(0), ..., B(n-1), where n is an integer. Then, the processor 100 gradually converts the hash value V(n) of a specific length through steps S410, S412, and S414. First, the process proceeds to step S410, starting to operate the SM3 engine 126 according to an SM3 engine microinstruction.

[0064] In step S410, the initial hash constant V(0) and the first group of 512-bit input messages B(0) are input from the system memory space into the SM3 engine 126, causing the SM3 engine 126 to operate according to the initial hash constant V(0) and the group of input messages B(0). In step S412, the SM3 engine 126 converts to an intermediate hash value V(1). In step S414, it checks whether the operation has been completed for all groups of input messages to continue or stop the loop. In one embodiment, the number of loops can be managed by a register temp_gpr inside the cryptographic execution unit 118, the initial value of which is related to the input values ​​of registers EAX and ECX. The number of loops managed by register temp_gpr will decrease as the operation of each group of input messages is completed, which can be used to determine whether the input messages B(0),..., B(n-1) of the input data m have all been operated on, thus achieving the SM3 cryptographic algorithm for the input data m. If there are still unprocessed input messages, the process returns to step S410, causing the SM3 cryptographic algorithm engine 126 to operate based on the intermediate hash value (e.g., V(1)) and the next set of input messages (e.g., B(1)), and to convert it to obtain the next intermediate hash value (e.g., V(2)) in step S412. This process continues, with the processor 100 processing each set of input messages step by step until all sets of input messages have been processed to obtain a converted hash value V(n) of a specific length. In one embodiment, the specific length is 256 bits.

[0065] If all input messages B(0), ..., B(n-1) have completed their computation, meaning the SM3 cryptographic algorithm for the input data m is complete, the process proceeds to step S416, where the transformed hash value V(n) is stored. If using... Figure 2A , 2BIn a 2D design, the SM3 engine 126 fills the converted hash value V(n) into system memory; for example, it overwrites the initial hash constant V(0) in memory based on the hash value index. If using... Figure 2C In the design, the SM3 engine 126 fills the converted hash value V(n) into an internal register of the cryptographic execution unit 118, which can then be read out using microinstructions. Step S418 marks the end of the execution of the SM3 cryptographic algorithm instructions.

[0066] The aforementioned SM3 engine microinstructions, corresponding to steps S410 and S412, repeatedly drive the SM3 engine 126 to complete the hash value transformation (V(i)) of each group of input messages B(i). V(i+1)) transforms the initial hash constant V(0) into the hash value V(n) after the transformation.

[0067] The calculations implemented by SM3 engine 126 are as follows:

[0068] V(i+1) = CF(V(i), B(i))

[0069] CF is the compression function: each 512-bit input message B(i) is expanded and then compressed in 64 rounds (j=0~63) to produce a 256-bit hash value V(i+1). The initial hash constant V(0) is converted into the hash value V(n) after all input messages B(0)~B(n-1) have been processed.

[0070] Figure 5 According to one embodiment of the present invention, an SM3 engine 500 is illustrated for processing a set of input messages (e.g., B(i)), wherein the hardware is used for: message expansion 502, iterative compression 504, and includes an accelerator internal storage space M1. The accelerator internal storage space M1 stores constants used by the iterative compression 504.

[0071] After receiving a 512-bit input message B(i), the SM3 engine 500 expands the input message B(i) into 132 words using message extension 502, including... ,as well as Then, the iteration is compressed to 504 and performed for 64 rounds to convert it into a hash value V(i+1), which is used by another set of 512-bit input messages B(i+1).

[0072] Iterative compression of 504 implements the following operations:

[0073] ABCDEFGH V(i)

[0074] FOR j=0 TO 63

[0075] SS1 ((A <<< 12) + E + (Tj <<< j)) <<< 7

[0076] SS2 SS1 ^ (A <<< 12)

[0077] TT1 FFj(A, B, C) + D + SS2 + Wj′

[0078] TT2 GGj(E, F, G) + H + SS1 + Wj

[0079] D C

[0080] C B <<< 9

[0081] B A

[0082] A TT1

[0083] H G

[0084] G F <<< 19

[0085] F E

[0086] E P0(TT2)

[0087] ENDFOR

[0088] V(i+1) ABCDEFGH ^ V(i)

[0089] Here, FFj and GGj are Boolean functions, and P0(.) is the permutation function. The iterative compression 504 hardware includes accelerator internal storage spaces M2 and M3, and function hardware 506. Accelerator internal storage space M2 caches the hash value V(i) of the first 64 rounds of compression operations, which is used as parameters A~H. After being processed by the functions FFj, GGj, and P0(.) provided by function hardware 506, parameters A~H are updated, cached in accelerator internal storage space M3, and then converted into hash value V(i+1) for use by the next group of 512-bit input messages B(i+1). After all input messages B(0)...B(n-1) have been processed, the contents of accelerator internal storage space M3 are used to store the converted hash value V(n).

[0090] The initial hash constant (V(0)) 508 shown in the diagram is obtained from system memory based on the aforementioned hash value pointer and is used to fill the 132 words (including) of the first set of input messages B(0) in the internal storage space M2 of the accelerator. ,as well as Iterative compression is used.

[0091] In one implementation, the transformed hash value V(n) generated after all input messages B(0)...B(n-1) have been processed can be stored in the internal space of the cryptographic execution unit 118, to be retrieved by subsequent microinstructions. In another implementation, the transformed hash value V(n) is overlaid on the system memory space indicated by the hash value pointer.

[0092] This invention securely protects the intermediate hash values ​​V(1)…V(n-1) within the SM3 engine 500. This invention is designed to provide cryptographic algorithm hardware with higher security.

[0093] In one implementation, the cryptographic execution unit 118 does not specifically design the SM3 engine 126. Instead, it plans the microcode content to convert a single ISA SM3 cryptographic algorithm instruction into multiple microinstruction operation logic units (ALUs), thus completing the SM3 cryptographic algorithm for the input data m. In particular, this embodiment also protects the intermediate data of the SM3 cryptographic algorithm within the processor's internal storage space, providing high security.

[0094] In one implementation, the SM3 engine has fewer functional modules than the SM3 engine 500, and the missing functional modules (e.g., message extension 502) are implemented using microcode to configure the microinstruction operation logic unit (ALU). This embodiment also has the ability to protect intermediate data in the processor's internal storage space.

[0095] In summary, according to one embodiment of the present invention, a processor responds to a single hash cryptographic algorithm instruction of an instruction set architecture (ISA). The processor retrieves input data of a finite length from a first memory space, performs a hash cryptographic algorithm (SM3 cryptographic algorithm) on the input data, and converts it into a converted hash value of a specific length. The present invention completes the SM3 cryptographic algorithm with a single ISA instruction. Using the SM3 engine 126 to implement SM3 cryptographic operations can improve both computational speed and security. Besides implementation with special hardware (SM3 engine 126), there are also embodiments implementing it entirely in microcode.

[0096] This invention also applies the SM3 engine 126 to the elliptic curve public key cryptography algorithm (SM2 cryptography algorithm). The following describes a processor equipped with the SM2 cryptography algorithm.

[0097] Figure 6This is a block diagram illustrating a processor 600 according to one embodiment of the present invention. Figure 1 In comparison, the cryptographic execution unit 618 includes not only the SM3 engine 126, but also an SM2 engine 626 (i.e., an elliptic curve cryptography accelerator), which will be discussed later. Figure 27 This describes the detailed hardware architecture of the SM2 engine 626. The microcode (ucode) also contains the corresponding SM2 cryptographic algorithm instructions (i.e., elliptic curve cryptography instructions) for the ISA. The decoder 110... Figure 6 The microcode (ucode) decodes the SM2 cryptographic algorithm instructions of the ISA of this invention into multiple microinstructions recognizable by the processor 100 pipeline. It defines, uses, and manages the architecture register 124 to operate the cryptographic execution unit 618, including the SM2 engine 626 and the SM3 engine 126, to perform operations such as encryption, decryption, signing, signature verification, and key exchange of the SM2 cryptographic algorithm. In particular, this invention properly hides the key intermediate variables of the SM2 cryptographic algorithm within the processor, resulting in a very high level of security. Intermediate variables with lower security requirements can be temporarily stored in system memory (e.g., RAM outside the processor) to save internal processor storage space.

[0098] Figure 7 According to one embodiment of the present invention, the format 702 of the SM2 cryptographic algorithm instruction of ISA is illustrated. The prefix, opcode, and ModR / M field of format 702 are: 0xF2 0x0F 0xA6 0xC0. The fields SIB, Displacement, and Immediate are left blank (non). After the decoder 110 identifies the encoding "0xF2 0x0F 0xA6 0xC0", it generates multiple microinstructions according to the microcode ucode, including querying a control word stored in one of the registers EDX of the architecture register 124 to determine which operation of the SM2 cryptographic algorithm is being performed. This control word can be represented by 6 bits, and the corresponding operation is as follows:

[0099]

[0100] First, we will discuss the encryption operations of the SM2 cryptographic algorithm.

[0101] Figure 8Table 804 illustrates the microcode design for the corresponding encryption operation, showing how the generated microinstructions interpret the contents of architecture register 124. The aforementioned control word 6'b 000001(cw) is pre-stored in the input register EDX to indicate that it is used for encryption. In addition to the input register EDX, Table 804 also lists the input registers EAX, EBX, ECX, ESI, and EDI, all of which serve as input registers for initiating encryption operations. The completion of an encryption operation indicated by an ISA SM2 cryptographic algorithm instruction includes filling the output registers EAX, ECX, and EDI. Other implementations are also possible for the use of input or output registers.

[0102] When used as an input register, register EAX stores a pointer to a plaintext input M, pointing to a memory space that stores a plaintext input M (which can be provided by system memory coupled to the processor, such as RAM, and can follow ES segmentation technology). Register EBX stores a public encryption key P. B A pointer to a stored public key P. B The system uses a memory space (which can follow ES segmentation technology). Register ECX stores the number of bytes of the plaintext input M. Register EDX stores the control word cw, which specifies the encryption code (6'b 000001). Register ESI stores a pointer to an intermediate variable, pointing to a memory space (also called scratch space, which can temporarily store existing high-security intermediate variables; it can be 8KB in size, follows ES segmentation technology, can be initialized to all zeros, and can be obtained by the software requesting system memory from the operating system). In one implementation, the intermediate variable is a parameter used in the calculation. For example, intermediate variables involved in the dot product function include the coordinates of a point after coordinate system transformation, or intermediate values ​​involved in coordinate system transformation, etc. Register EDI stores a pointer to a ciphertext output C, pointing to a memory space (which can follow ES segmentation technology), specifying the storage location of the ciphertext output C.

[0103] As the encryption operation indicated by the SM2 cryptographic algorithm instruction of the ISA ends, the adjustment of the output register includes: increasing the pointer stored in register EAX by a displacement equal to the number of bytes of the plaintext input M; storing the number of bytes of the ciphertext output C in register ECX; and increasing the pointer stored in register EDI by a displacement equal to the number of bytes of the ciphertext output C.

[0104] Figure 9A , 9B The flowchart illustrates, according to one embodiment of the present invention, the encryption operation triggered by a single SM2 cryptographic algorithm instruction of the ISA, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0105] Beginning Figure 9A In step S902, a hardware operation control word (taken from the input register EDX) is input into the SM2 engine 626. Using the point multiplication hardware of the SM2 engine 626, an elliptic curve point C1 is calculated, where C1 = [k]G, k is a random number. [1, n-1]. G is one of the elliptic curve parameters, provided by the microcode ucode, and is the base point of the elliptic curve. The SM2 engine 626 returns the elliptic curve point C1. Step S902 may include the execution of a dot multiplication hardware operation microinstruction. The cryptographic execution unit 618 may include a random number generator that generates a random number k from a microinstruction operation.

[0106] Step S904 transmits the hardware operation control word and the encryption public key P. B (Based on the pointer stored in the input register EBX) Input to the SM2 engine 626, using the dot multiplication hardware, calculate an elliptic curve point S, where S = [h] P B h is one of the parameters of the elliptic curve, and is the cofactor of the elliptic curve. The SM2 engine 626 returns the elliptic curve point S. Step S904 may include the execution of a point multiplication hardware operation microinstruction.

[0107] Step S906 checks whether point S on the elliptic curve is a zero point (a zero point is a special point on an elliptic curve, also known as the point of infinity). If yes, the process proceeds to step S908, and the processor generates an encryption failure message. If no, the process proceeds to step S910, where the hardware operation control word and the encryption public key P are... B Inputting the SM2 engine 626, using the dot product hardware, calculates the point (x2, y2) = [k] on an elliptic curve P. B The SM2 engine 626 returns the elliptic curve point (x2, y2). Step S910 may include the execution of a point multiplication hardware operation microinstruction.

[0108] Step S912 performs key derivation based on the one-bit length klen of the plaintext input M (obtained from the plaintext input M pointer stored in the input register EAX), and calculates: t=KDF(x2||y2,klen), where KDF is the key derivation function (i.e., the key derivation function), and x2||y2 represents the concatenation of x2 and y2.

[0109] Step S914 checks if the key t derived from the value is zero (i.e., determines if t is a string of all zero bits). If yes, the process returns to step S902, updates the random number k, and recalculates the elliptic curve point C1 and S. If no, the process continues. Figure 9BIn step S916, the plaintext input M is loaded from the system memory into the processor 600, and an XOR operation is performed to generate partial ciphertext C2: C2=M⊕t.

[0110] Step S918 inputs the hardware operation control word and the completed message filling value (x2||M||y2) into the SM2 engine 626. Using a preprocessing unit of the SM2 engine 626, the value (x2||M||y2) is preprocessed, such as grouped, before being input into the SM3 engine 126 (the process of using the SM3 engine is described above). Figure 4 Steps S410, S412, and S414 implement the hash operation: C3 = Hash(x2||M||y2), where Hash is the cryptographic hash function, and x2||M||y2 represents the concatenation of x2, M, and y2. The SM2 engine 626 returns a portion of the ciphertext C3. Step S918 may include the execution of a preprocessing hardware operation microinstruction, or even an SM3 engine microinstruction.

[0111] Step S920 loads the ciphertext output C into the system memory according to the ciphertext output C pointer stored in the input register EDI, where C = C1||C2||C3, and C1||C2||C3 represents the concatenation of C1, C2, and C3. Step S922 ends the encryption operation triggered by this SM2 cryptographic algorithm instruction. In another embodiment, C = C1||C3||C2.

[0112] In summary, in response to a single elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a plaintext input M from a first memory space and uses a public key P obtained through a register (e.g., EBX). B An elliptic curve cryptography (SM2) algorithm is applied to the plaintext input M, encrypting the plaintext input M into a ciphertext output C, which is then written to a second memory space. This invention completes the SM2 encryption operation with a single ISA instruction. Compared to using only the SM2 engine 626 to implement the elliptic curve cryptography algorithm, using both the SM2 engine 626 and the SM3 engine 126 simultaneously improves both speed and security. Besides implementation with specialized hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0113] Next, we will discuss the decryption operation of the SM2 cryptographic algorithm.

[0114] Figure 10Table 1004 illustrates the microcode design for the corresponding decryption operation, showing how the generated microinstructions interpret the contents of architecture register 124. The aforementioned control word 6'b 000010(cw) is pre-stored in the input register EDX to indicate that a decryption operation is being performed. In addition to the input register EDX, Table 1004 also lists the input registers EAX, EBX, ECX, ESI, and EDI, all of which serve as input registers for initiating decryption operations. The completion of a decryption operation indicated by an ISA SM2 cryptographic algorithm instruction includes filling the output registers EAX, ECX, and EDI. Other implementations are also possible for the use of input or output registers.

[0115] When used as an input register, register EAX stores a pointer to a ciphertext input C, pointing to a memory space that stores the ciphertext input C (following the ES segmentation technique), where, as mentioned earlier, the ciphertext C = C1||C2||C3 (in another embodiment, C = C1||C3||C2). Register EBX stores a decryption private key d. B A pointer to a stored private key d. B The system uses a memory space (which can follow ES segmentation technology). Register ECX stores the number of bytes of the ciphertext input C. Register EDX stores the control word cw, indicating the decryption code (6'b 000010). Register ESI stores a pointer to an intermediate variable, pointing to a memory space (also known as scratch space, which can temporarily store highly secure intermediate variables, can be 8KB in size, can follow ES segmentation technology, can be initialized to all zeros, and can be allocated memory by the software from the operating system). Register EDI stores a pointer to a plaintext output M', pointing to a memory space (which can follow ES segmentation technology), specifying the storage location of the plaintext output M'.

[0116] As the decryption operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the adjustment of the output register includes: increasing the pointer stored in register EAX by a displacement equal to the number of bytes of the ciphertext input C; increasing the pointer stored in register ECX by the number of bytes of the plaintext output M'; and increasing the pointer stored in register EDI by a displacement equal to the number of bytes of the plaintext output M'.

[0117] Figure 11A , 11B The flowchart illustrates, according to one embodiment of the present invention, the decryption operation triggered by a single ISA SM2 cryptographic algorithm instruction, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0118] Beginning Figure 11AStep S1102 loads a portion of the ciphertext C1 (C1 being an elliptic curve point, also referred to as point C1 below) from system memory into the processor 600 based on the ciphertext input pointer C stored in the input register EAX (i.e., retrieving C1 from the ciphertext and then loading C1 into the processor 600). Step S1104 verifies whether point C1 conforms to an elliptic curve equation. If not, the process proceeds to step S1106, the processor outputs a decoding failure message, reports an error, and exits the decryption operation. Conversely, if C1 conforms to the elliptic curve equation, the process proceeds to step S1108.

[0119] Step S1108 inputs a hardware operation control word (taken from the input register EDX) and point C1 into the SM2 engine 626, uses the dot multiplication hardware to calculate an elliptic curve point S, where S = [h]C1. The SM2 engine 626 returns the elliptic curve point S. Step S1108 may include the execution of a dot multiplication hardware operation microinstruction.

[0120] Step S1110 verifies whether the elliptic curve point S is a zero. If so, decoding fails, and the process proceeds to step S1106, where the processor outputs a decoding failure message. If the elliptic curve point S is not a zero, the process proceeds to step S1112, and the hardware operation control word and decryption private key d are... B Inputting the SM2 engine 626, using the dot product hardware, calculates the point (x2, y2) = [d] on an elliptic curve. B C1. The SM2 engine 626 returns the elliptic curve point (x2, y2). Step S1112 may include the execution of a dot product hardware operation microinstruction.

[0121] Step S1114 performs key derivation based on a one-bit length klen of a portion of the ciphertext C2 (i.e., C2 in the ciphertext, obtained from system memory according to the ciphertext input C pointer stored in the input register EAX): t=KDF(x2||y2, klen).

[0122] Step S1116 checks if the derived key t is zero (i.e., determines if t is a string of all zero bits). If yes, step S1106 determines that decoding has failed, and the processor outputs a decoding failure message. If no, the process continues. Figure 11B In step S1118, the ciphertext C2 is loaded from system memory into processor 600 and XORed: M'=C2⊕t.

[0123] Step S1120 inputs the hardware operation control word and the value (x2||M'||y2) for completing message filling into the SM2 engine 626. Using the preprocessing hardware, the value (x2||M'||y2) is preprocessed, such as grouped, and then input into the SM3 engine 126 (the process of using the SM3 engine is described above). Figure 4Steps S410, S412, and S414 implement the hash operation: u = Hash(x2||M'||y2), where Hash is the cryptographic hash function, and x2||M'||y2 represents the concatenation of x2, M', and y2. The SM2 engine 626 returns the hash value u. Step S1120 may include the execution of a preprocessing hardware operation microinstruction, or even an SM3 engine microinstruction.

[0124] Step S1122 verifies whether the hash value u is equal to a portion of the ciphertext C3 (obtained from system memory based on the ciphertext input C pointer stored in the input register EAX). If not, decoding fails, and the process proceeds to step S1106, with the processor outputting a decoding failure message. If the hash value u is equal to a portion of the ciphertext C3, step S1124 loads the plaintext output M' into system memory based on the plaintext output M' pointer stored in the input register EDI. Step S1126 terminates the decryption operation triggered by this single SM2 cryptographic algorithm instruction.

[0125] In summary, in response to a single elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a ciphertext input C from a first memory space and uses the private key d obtained through the first register. B An elliptic curve cryptography (ECC) decryption operation is performed on the ciphertext input C, decrypting the ciphertext input C into a plaintext output M', and writing the plaintext output M' into a second memory space. This invention completes the decryption operation of the SM2 cryptographic algorithm with a single ISA instruction. Compared to using only the SM2 engine 626 to implement the decryption operation of the elliptic curve cryptography algorithm, using both the SM2 engine 626 and the SM3 engine 126 simultaneously can improve both the operation speed and security. Besides implementation with special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0126] The signature operation of the SM2 cryptographic algorithm will then be discussed, which uses a hash value calculated by a first preprocessing operation and a second preprocessing operation. The first and second preprocessing operations will be discussed in detail in later paragraphs.

[0127] Figure 12Table 1204 illustrates the microcode design for the corresponding signature operation, showing how the generated microinstructions interpret the contents of architecture register 124. The aforementioned control word 6'b 000100(cw) is pre-stored in the input register EDX to indicate that it is used for signature operations. In addition to the input register EDX, Table 1204 also lists the input registers EAX, EBX, ESI, and EDI, all of which serve as input registers for initiating signature operations. The completion of a signature operation indicated by an ISA's SM2 cryptographic algorithm instruction includes filling the output registers ECX and EDI. Other implementations are also possible for the use of input or output registers.

[0128] When used as an input register, register EAX stores a pointer to a hash value e, pointing to a memory space where that hash value e is stored (following the ES segmentation technique); the hash value e is generated by a first preprocessing operation and a second preprocessing operation on a piece of data M to be signed, and is pre-stored in that memory space. Register EBX stores a private key d. A A pointer to the storage of the signer's private key d. A A memory space (which may follow ES segmentation technology). The EDX register stores the control word cw, which specifies the signature code (6'b 000100). The ESI register stores a pointer to an intermediate variable, pointing to a memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables; it can be 8KB in size, may follow ES segmentation technology, can be initialized to all zeros, and can be requested by the software from the operating system). The EDI register stores a signature (r, s) pointer, pointing to a memory space (which may follow ES segmentation technology), specifying the storage location of the signature (r, s).

[0129] As the signature operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the adjustments to the output register include: making the ECX register store the number of bytes of the signature (r, s); and increasing the signature pointer stored in the EDI register by a displacement equal to the number of bytes of the signature (r, s).

[0130] Figure 13 The flowchart illustrates a signature operation triggered by an SM2 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0131] Step S1302 inputs a hardware operation control word (taken from the input register EDX) into the SM2 engine 626, and uses the dot multiplication hardware to calculate an elliptic curve point (x1, y1) = [k]G. The SM2 engine 626 returns the elliptic curve point (x1, y1). k is a random number. G is the base point of the elliptic curve. Step S1302 may include the execution of a dot multiplication hardware operation microinstruction.

[0132] Step S1304 loads the hash value e from the system memory into the processor 600 based on the pointer to the hash value e stored in the input register EAX, and calculates a value r = (e + x1) mod n. n is one of the parameters of the elliptic curve and is the order of the base point G.

[0133] Step S1306 verifies whether the value r is zero, or whether r+k is n. If r is zero, or / and r+k is n, the process returns to step S1302, and the dot product is performed on the hardware again with a new random number k. If r is not zero and r+k is not n, the process proceeds to step S1308.

[0134] Step S1308 uses the private key d stored in the input register EBX. A The pointer retrieves the signer's private key from system memory. A Loaded into the processor 600, the value (1+d) is calculated. A ) -1 The SM2 engine 626 is used to calculate a value s' = (1 + d) using its modular inverse hardware, with the input of order n. A ) -1 mod n. Based on the numerical value s', the SM2 engine 626 performs a modular multiplication hardware calculation to produce a numerical value s = (s' * (kr * d). A Modulo inversion hardware can receive a first modular inversion input and a second modular inversion input, and generate a modular inversion output. Modulo multiplication hardware can receive a first modular multiplication input, a second modular multiplication input, and a third modular multiplication input, and generate a modular multiplication output. When r is not zero and r+k is not n, the processor executes the modular inversion hardware operation microinstruction and the modular multiplication hardware operation microinstruction provided by the multiple microinstructions. In response to the modular inversion hardware operation microinstruction, the modular inversion hardware performs a modular inversion operation, s'=(1+d A ) -1 mod n, (1+d) A Let s' be the first modular inverse input, n be the second modular inverse input, and s' be the modular inverse output. Responding to the modular multiplication hardware operation microinstruction, the modular multiplication hardware performs a modular multiplication operation s = (s' * (kr * d)). A)) mod n, s' is the first modular multiplication input, (kr*d A ) is the second modular multiplication input, n is the third modular multiplication input, and s is the modular multiplication output.

[0135] Step S1310 verifies whether the value s is zero. If so, the process returns to step S1302, and the dot product is performed again using a new random number k. If s is not zero, in step S1312, the processor loads the signature (r,s) into the system memory based on the signature (r,s) pointer stored in the input register EDI, and loads the length of the signature (r,s) into the register ECX. Step S1314 ends the signature operation triggered by the SM2 cryptographic algorithm instruction.

[0136] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic algorithm instruction) of an instruction set architecture (ISA), a processor retrieves a hash value (e) of data to be signed (M) from a first memory space via a first register (EAX), and retrieves the signer's private key (d) via a second register. A ), with the private key (d A The hash (e) value is processed by an elliptic curve cryptography algorithm to generate a signature (r, s), and this signature (r, s) is written to a second memory space. This invention completes the above signature operation of the SM2 cryptographic algorithm with this single ISA instruction. Using the SM2 engine 626 to implement the elliptic curve cryptography algorithm signature operation can improve both the operation speed and security. Besides implementation with special hardware (SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0137] Next, we will discuss the signature verification operation of the SM2 cryptographic algorithm, which also uses the first preprocessing operation and the second preprocessing operation, which will be discussed in detail later. The first and second preprocessing operations are used to calculate a hash value e' for a piece of data M' to be verified.

[0138] Figure 14 Table 1404 illustrates the microcode design for the corresponding signature verification operation, showing how the generated microinstructions interpret the contents of architecture register 124. The aforementioned control word 6'b 001000(cw) is pre-stored in the input register EDX to indicate that it is used for signature verification. In addition to the input register EDX, Table 1404 also lists the input registers EAX, EBX, ESI, and EDI, all of which serve as input registers for initiating the signature verification operation. The completion of a signature verification operation indicated by an ISA's SM2 cryptographic algorithm instruction includes filling the output register ECX. Other implementations are also possible for the use of input or output registers.

[0139] When used as an input register, register EAX stores a pointer to a hash value e', pointing to a memory space that stores the hash value e' (following ES segmentation techniques). This hash value e' is generated by the first and second preprocessing operations based on data M' to be verified. Register EBX stores a public key P. A A pointer to the public key P of the signer. A A memory space (which may follow ES segmentation technology). The EDX register stores the control word cw, indicating the verification signature code (6'b001000). The ESI register stores a pointer to an intermediate variable, pointing to a memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables, can be 8K in size, may follow ES segmentation technology, can be initialized to all zeros, and can be requested by the software from the operating system). The EDI register stores a signature (r', s') pointer, pointing to a memory space (which may follow ES segmentation technology) storing a signature (r', s').

[0140] As the signature verification operation indicated by the SM2 cryptographic algorithm instruction of this ISA ends, the output register is adjusted as follows: the ECX register is filled, with "1" indicating that the signature verification is successful and "0" indicating that the signature verification is unsuccessful.

[0141] Figure 15 The flowchart illustrates a signature verification operation triggered by an SM2 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0142] Step S1502 loads the signature (r', s') from system memory into the processor 600 based on the signature (r', s') pointer stored in the input register EDI. Step S1504 checks two conditions: r' [1, n-1]; and s' [1, n-1]. The value n is the order of the base point G of the elliptic curve. If any condition is not met, step S1506 determines that the signature verification operation has failed (e.g., register ECX is filled with 0). If both conditions are met, step S1508 calculates the value t = (r' + s') mod n. Step S1510 checks whether the value t is zero. If yes, step S1506 determines that the signature verification operation has failed. If no, the process proceeds to step S1512.

[0143] Step S1512 inputs a hardware operation control word (taken from register EDX), a value t, and a signature s' into the SM2 engine 626. Using the dot multiplication hardware, an elliptic curve point (x1', y1') = [s']G + [t]P is calculated. AThe SM2 engine 626 returns the elliptic curve point (x1', y1'). Step S1512 may involve two dot product hardware operation microinstructions. The first operation allows the SM2 engine 626 to calculate [s']G. The second operation allows the SM2 engine 626 to calculate [t]P. A .

[0144] Step S1514: Based on the hash value e' pointer stored in the input register EAX, load the hash value e' of the data to be verified M' (which is calculated by the first and second preprocessing operations and stored in the system memory) from the system memory into the processor 600, and calculate a signature R=(e'+ x1')mod n.

[0145] Step S1516 verifies whether signature R is equal to signature r'. If not, step S1506 determines that the signature verification operation has failed and fills the output register ECX with 0. If yes, step S1518 determines that the signature verification operation has succeeded and fills the output register ECX with 1. In another embodiment, filling the output register ECX with 1 indicates that the signature verification operation has failed, while filling the output register ECX with 0 indicates that the signature verification operation has succeeded. In summary, the present invention is not limited to specific numerical values ​​used to indicate the success or failure of the signature verification operation. Step S1520 ends the signature verification operation triggered by the SM2 cryptographic algorithm instruction.

[0146] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic algorithm instruction) of an instruction set architecture (ISA), a processor obtains a hash value e' of the data to be verified M' through a first register (EAX) and obtains the signer's public key P through a second register (EBX). A A signature (r', s') is obtained through a third register. Using the public key and the signature, an elliptic curve cryptography (ECC) signature verification operation is performed on the hash value, and the verification result is stored. This invention completes the above signature verification operation using the SM2 cryptographic algorithm with this single ISA instruction. Using the SM2 engine 626 to implement the elliptic curve cryptography signature verification operation can improve both the operation speed and security. Besides implementation with special hardware (SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0147] Next, the key exchange function of the SM2 cryptographic algorithm is discussed, which uses a first key exchange procedure, a second key exchange procedure, and a third key exchange procedure. The second and third key exchange procedures each have versions involving hash values ​​and versions that do not. One embodiment of this invention designs an instruction set architecture with three elliptic curve cryptography instructions (three SM2 cryptographic algorithm instructions). The initiating processor generates a key pair (r) using the first elliptic curve cryptography instruction. A , R A Based on the first temporary public key RA and its own generated second temporary public key R B The responder processor executes the second elliptic curve cryptography instruction to generate the responder's shared public key K. B Based on temporary private key r A and temporary public key R A With R B The initiator executes the third elliptic curve cryptography algorithm instruction to generate the initiator's shared public key K. A .

[0148] Figure 16 Table 1604 illustrates the microcode design for the corresponding first key exchange procedure, showing how the microinstructions generated by the first SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word 6'b 010000(cw) is pre-stored in the input register EDX to indicate that a first key exchange procedure operation is being performed. In addition to the input register EDX, Table 1604 also lists the input registers ESI and EDI, both serving as input registers for initiating the first key exchange procedure operation. The completion of the first key exchange procedure operation indicated by an ISA's SM2 cryptographic algorithm instruction includes filling the output register EDI. Other implementations are also possible for the use of input or output registers.

[0149] When used as an input register, register EDX stores the control word cw, which indicates the first program code for key exchange (6'b 010000). Register ESI stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratchspace, which can temporarily store existing high-security intermediate variables, up to 8KB in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by software from the operating system). Register EDI stores an output key pair (r A , R A ) pointer, indicating the key pair (r A , R A Storage can be moved to a single memory location (which may follow ES segmentation technology).

[0150] Once the first key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, has ended, the output register ECX remains unchanged.

[0151] Figure 17 This is a flowchart illustrating the first procedure operation of key exchange triggered by an SM2 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple microinstructions converted from the corresponding SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the initiator of the key exchange.

[0152] Step S1702 inputs a hardware operation control word (taken from the input register EDX) into the SM2 engine 626, and uses the dot multiplication hardware to calculate an elliptic curve point R. A =[r A G = (x1, y1). A R is a random number, used as the initiator's temporary private key. A This is the first temporary public key. Step S1702 may include the execution of a dot multiplication hardware operation microinstruction, and may also include a random number generation microinstruction to operate a random number generator within the cryptographic execution unit 618 to generate a random number as the temporary private key r. A .

[0153] Step S1704 checks two conditions: x1 [1, p-1], and y1 [1, p-1], where p is a 256-bit prime number. If any condition is not met, the process returns to step S1702, updating the key pair (r) with a new random number. A ,R A If both conditions are met, step S1706 checks the first temporary public key R. A Does it conform to an elliptic curve (i.e., does it satisfy the equation of an elliptic curve, the same below)? If not, the process returns to step S1702, updating the key pair (r) with a new random number. A , R A If so, step S1708 determines the output key pair (r) stored in the input register EDI. A , R A The pointer will hold the key pair (r) A , R A Load the key into memory. Step S1710 ends the first program operation of key exchange for the SM2 cryptographic algorithm. Key pair (r A , R A The key K is retained by the initiator and will be used later to generate the initiator's shared key K. A Used at that time. First temporary public key R A It also needs to be transmitted (e.g., via a network) to the responder so that the responder can perform the second procedure operation of key exchange.

[0154] Figure 18Table 1804 illustrates the microcode design for the corresponding second key exchange procedure, showing how the microinstructions generated by the second SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b010001 (without hash value) or 6'b 010101 (with hash value) is pre-stored in the input register EDX to indicate whether the second key exchange procedure involves a hash value or not. Besides the input register EDX, Table 1804 lists the input registers EAX, ECX, ESI, and EDI, all serving as input registers for initiating the second key exchange procedure. The completion of the second key exchange procedure indicated by an ISA's SM2 cryptographic algorithm instruction includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0155] When used as an input register, register EAX stores a key exchange information pointer, pointing to a memory-stored key exchange information (which may follow ES segmentation technology). This key exchange information includes: the initiator's first temporary public key R. A ; Responder's private key d B Response party public key P B Initiator's public key P A Initiator's Identifier (i.e., the distinguishing identifier, the same below) Bit Length ID A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID B The ECX register stores the shared key bit length (klen). The shared key bit length klen depends on the intended use of the key by both communicating parties; for example, for SM4 encryption, the shared key bit length klen can be 128 bits / 192 bits / 256 bits. The EDX register stores one of two control words cw indicating the second key exchange procedure (one of two types of second key exchange procedure codes: 6'b 010001 without hash value, or 6'b010101 with hash value). The ESI register stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratchspace, which can temporarily store existing high-security intermediate variables, can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by software from the operating system). The EDI register stores a shared key pointer, indicating the shared key K generated by the responder. B The second temporary public key R B Even hash values ​​S2 and S B(Optional; not used when hash values ​​are not involved, but used when hash values ​​are involved) to the memory storage (can follow ES segmentation technology).

[0156] Once the second key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, is completed, the output register EDI remains unchanged.

[0157] Figure 19A , 19B This is a flowchart illustrating a second program operation for key exchange triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention. The flowchart describes multiple microinstructions derived from the SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the responding party in the key exchange.

[0158] Beginning Figure 19A In step S1902, a hardware operation control word (taken from the input register EDX) is input into the SM2 engine 626. Using this dot multiplication hardware, a point R on an elliptic curve is calculated. B =[r B G = (x2, y2). B R is a random number, used as the temporary private key for the responder. B This is the second temporary public key. Step S1902 may include the execution of a multiplication hardware operation microinstruction, and may also include a random number generation microinstruction to operate a random number generator within the cryptographic execution unit 618 to generate a random number as the temporary private key r. B .

[0159] Step S1904: Calculate the numerical value =2 w +(x2&(2 w -1)), t B =(d B + * r B ) mod n, where w is a constant.

[0160] Step S1906: Determine the initiator's first temporary public key R. A Does the responder also conform to an elliptic curve, where the first temporary public key R... A The key exchange information pointer is retrieved from system memory based on the key exchange information pointer stored in the input register EAX. If not, proceed to step S1908, and the processor outputs a key exchange negotiation failure message. If yes, step S1910 loads the first temporary public key R from memory. A Find the x-coordinate x1 and calculate a numerical value. =2 w +(x1&(2 w -1)).

[0161] Step S1912 will change the value t B , Initiator's public key P A and the first temporary public key R A Inputting the SM2 engine 626, using the dot product hardware, calculates the point V=[h*t on an elliptic curve. B ]( P A +[ R A ) =(x V , y V Step S1912 may include the execution of two dot product hardware operation microinstructions, one of which calculates […]. R A The other one calculates [h*t] B ]( P A +[ R A ).

[0162] Step S1914 determines whether point V on the elliptic curve is an infinite point (also known as the point of infinity or zero). If yes, proceed to step S1908, where the responding party outputs a key exchange negotiation failure message. If no, the process continues... Figure 19B Step S1916.

[0163] Step S1916: Based on the key exchange information pointer stored in the input register EAX, retrieve the initiator's identity identifier (bit length ID) from system memory. A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID B Loaded into processor 600, the identity hash value Z is calculated. A and Z B Then, key derivation is performed to calculate the responder's shared key K. B =KDF(x V ||y V ||Z A ||Z B (klen). In one implementation, the identity hash value Z A and Z B It was calculated using the first preprocessing operation.

[0164] Step S1918 checks the control word cw stored in register EDX to determine whether to output the hash value calculation result. If not (6'b 010001), step S1920 sends the responder's shared key K. B and the second temporary public key R BThe key is loaded into system memory, and then the second program operation of key exchange triggered by an SM2 cryptographic algorithm instruction ends in step S1922. Otherwise (cw=6'b 010101), the process proceeds to steps S1924 and S1926.

[0165] Step S1924: Calculate hash value S2.

[0166] S2=Hash(0x03||y V ||Hash(x V ||Z A ||Z B ||x1||y1||x2||y2)).

[0167] Step S1926: Calculate the hash value S B ,

[0168] S B =Hash(0x02||y V ||Hash(x V ||Z A ||Z B ||x1||y1||x2||y2)).

[0169] Step S1928: Based on the shared key pointer stored in the input register EDI, the responder's shared key K... B Second temporary public key R B Hash value S2 and S B The key is loaded into system memory, and then step S1922 terminates the second program operation of key exchange triggered by an SM2 cryptographic algorithm instruction. The second temporary public key R... B It also needs to be transmitted (e.g., via a network) to the initiator so that the initiator can perform the third-party program operation of key exchange.

[0170] Figure 20 Table 2004 illustrates the microcode design for the corresponding third key exchange procedure, showing how the microinstructions generated by the corresponding third SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b010010 (without hash value) or 6'b 010110 (with hash value) is pre-stored in the input register EDX to indicate whether the third key exchange procedure involves a hash value or not. In addition to the input register EDX, Table 2004 also lists the input registers EAX, ECX, ESI, and EDI, all of which serve as input registers for initiating the third key exchange procedure. The completion of the third key exchange procedure indicated by an ISA's SM2 cryptographic algorithm instruction includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0171] When used as an input register, register EAX stores a key exchange information pointer, pointing to the key exchange information stored in memory. This key exchange information includes: the initiator's temporary private key r. A The initiator's first temporary public key R A The second temporary public key R provided by the responder B Response party public key P B Initiator's private key d A Initiator's public key P A Initiator Identifier Length (ID) A _len, Initiator Identifier ID A Length of responder identifier (ID) B _len, and the responder's identifier ID B Register ECX stores the bit length (klen) of a shared key. Register EDX stores one of two control words (cw) indicating the second key exchange procedure (one of two types of code for the second key exchange procedure: 6'b 010010 without hash value, or 6'b 010110 with hash value). Register ESI stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables, can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by software from the operating system). Register EDI stores a shared key pointer, indicating the shared key K generated by the initiator. A Even hash values ​​S1 and S A (Optional; not used when hash values ​​are not involved, but used when hash values ​​are involved) to the memory storage (can follow ES segmentation technology).

[0172] Once the third key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, has finished, the output register EDI remains unchanged.

[0173] Figure 21A , 21B This is a flowchart illustrating a third-stage key exchange operation triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention. The flowchart shows multiple micro-instructions derived from the SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the initiator of the key exchange.

[0174] Beginning Figure 21A In step S2102, the first temporary public key R is retrieved from system memory based on the key exchange information pointer stored in the input register EAX. A The x-coordinate x1 is loaded into processor 600 for calculation. =2 w+(x1&(2 w -1)). Step S2104 retrieves the initiator's private key d from system memory. A Loaded to processor 600, calculate t A =(d A + * r A )mod n. Step S2106 determines the second temporary public key R provided by the responder. B Does it conform to the initiator's elliptic curve? If not, step S2108 causes the processor to output a key exchange negotiation failure message. Otherwise, step S2110 uses the second temporary public key R... B Calculate the x2 coordinate value =2 w +(x2&(2 w -1)).

[0175] Step S2112 will change the value t A , Response party public key P B Second temporary public key R B Inputting the SM2 engine 626, using the dot product hardware, calculates the point U=[h*t on an elliptic curve. A ]( P B +[ R B ) =(x U , y U ). The SM2 engine 626 returns the elliptic curve point U. Step S2112 may include the execution of two dot product hardware operation microinstructions, one of which calculates [ R B The other one calculates [h*t] A ]( P B +[ R B ).

[0176] Step S2114 determines whether point U on the elliptic curve is an infinite point. If yes, step S2108 causes the processor to output a key exchange negotiation failure message. If no, the process continues. Figure 21B Step S2116.

[0177] Step S2116: Based on the key exchange information pointer stored in the input register EAX, retrieve the initiator's identity identifier (bit length ID) from system memory. A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID BLoaded into processor 600, the identity hash value Z is calculated. A and Z B Then, key derivation is performed to calculate the initiator's shared key K. A =KDF(x U ||y U ||Z A ||Z B (klen). In one implementation, the identity hash value Z A and Z B It was calculated using the first preprocessing operation.

[0178] Step S2118 checks the control word cw stored in register EDX to determine whether to output the hash value calculation result. If not (6'b 010010), step S2120 sends the initiator's shared key K. A The key is loaded into system memory, and then the third program operation of key exchange triggered by an SM2 cryptographic algorithm instruction ends in step S2122. If (cw=6'b 010110), the process proceeds to steps S2124 and S2126.

[0179] Step S2124 Calculate the hash value S A ,

[0180] S A =Hash(0x03||y U ||Hash(x U ||Z A ||Z B ||x1||y1||x2||y2)).

[0181] Step S2126 calculates the hash value S1.

[0182] S1=Hash(0x02||y U ||Hash(x U ||Z A ||Z B ||x1||y1||x2||y2)).

[0183] Step S2128: Based on the shared key pointer stored in the input register EDI, the initiator's shared key K is... A Hash value S A And S1 is loaded into the system memory, and then the third program operation of key exchange triggered by the SM2 cryptographic algorithm instruction is ended by step S2122.

[0184] Taking an example that considers hash values, the initiator's S A And S1 will interact with the responder's S2 and S BThe comparison is used to determine whether the key exchange negotiation was successful.

[0185] Figure 22 This invention illustrates how an initiator and a responder achieve key exchange using the first to third key exchange procedures proposed in this invention, according to one embodiment. The initiator and the responder can communicate with each other. In one embodiment, each of the initiator and the responder has a processor (600). In another embodiment, the processors of the initiator and the responder are the same (e.g., processor 600). In yet another embodiment, the initiator and / or the responder is an encryption card. In summary, this invention does not limit the specific form of the initiator and the responder.

[0186] Step S2202 enables the initiator to prepare the raw data, including: elliptic curve system parameters, identity hash value Z. A Z B Initiator's private key d A Initiator's public key P A and the responder's public key P B Step S2204 prepares the raw data for the responder, including: elliptic curve system parameters, identity hash value Z. A Z B Response party's private key d B Response party public key P B and the initiator's public key P A .

[0187] Step S2206 involves the initiator executing the first SM2 cryptographic algorithm instruction, where the EDX register is marked with the control word cw as the first procedure for key exchange. The calculated first temporary public key R... A It is sent to the responder via communication.

[0188] Step S2208: The responder uses the first temporary public key R sent by the initiator. A The second SM2 cryptographic algorithm instruction is executed, where the EDX register is marked with the control word cw as performing the second procedure operation for key exchange. The responder calculates the second temporary public key R. B The message is sent to the initiator via communication. Additionally, the responder uses this second SM2 cryptographic algorithm instruction to compute a responder's shared key K. B and hash values ​​S2 and S B Hash value S2 and S B This is used to confirm whether the negotiation was successful.

[0189] Step S2210: The initiator uses the second temporary public key R sent by the responder. BThe third SM2 cryptographic algorithm instruction is executed, where the EDX register is marked with the control word cw as the third procedure operation for key exchange. The initiator uses this third SM2 cryptographic algorithm instruction to obtain the initiator's shared key K. A and hash value S A With S1. Hash value S A The hash value S1 is used to confirm whether the negotiation was successful.

[0190] Step S2212 checks whether hash value S1 is equal to hash value S. B (Initiator's judgment), and whether hash value S2 is equal to hash value S. A (Response party judgment). If both conditions are met, step S2214 causes the processor to determine that the key exchange between the initiator and the responder has been successfully confirmed. If either condition is not met, step S2216 causes the processor to output a key exchange negotiation failure message.

[0191] In summary, the initiator designed according to one embodiment of the present invention uses a first register (EDI) and a second register (EAX). For a first elliptic curve cryptography instruction of an instruction set architecture (ISA), the first register (EDI) stores a key pair (r). A , R A ) pointer, indicating the key pair (r A , R A The processor stores the data in memory. In response to the first elliptic curve cryptography instruction, the processor performs a key exchange first procedure operation of the elliptic curve cryptography algorithm, generating a random number as a temporary private key r. A and with the temporary private key r A Generate a first temporary public key R by processing an elliptic curve base point G. A And through the first register, the temporary private key r A and the first temporary public key R A Write to this memory. The second register (EAX) stores a key exchange information pointer, pointing to the key exchange information stored in the memory, which includes the temporary private key r. A The first temporary public key R A and a second temporary public key R B The second temporary public key R B It is provided by the responder in the key exchange, whose processor executes a second elliptic curve cryptography instruction to perform a second key exchange procedure operation of the elliptic curve cryptography algorithm, generating the second temporary public key R. B And based on the first temporary public key R A And the second temporary public key R B And generate a shared key K for the responders.B For a third elliptic curve cryptography instruction, the first register (EDI) is updated to store a shared key pointer, indicating an initiator's shared key K. A The processor stores the key in memory. In response to the third elliptic curve cryptography instruction, it performs a key exchange operation for the elliptic curve cryptography algorithm, obtaining the second temporary public key R through the second register (EAX). B Based on this temporary private key r A The first temporary public key R A and the second temporary public key R B Generate the initiator's shared key K A And through this first register (EDI) the initiator's shared key K A Write to this memory.

[0192] In summary, the responder designed according to one embodiment of the present invention uses a first register (EDI) and a second register (EAX). The second register (EAX) stores a key exchange information pointer, pointing to key exchange information stored in memory, the key exchange information including a first temporary public key R. A The first temporary public key R A The first temporary public key R is provided by the initiator of the key exchange. The initiator's processor executes the first elliptic curve cryptography instruction of an instruction set architecture to perform a first program operation of a key exchange using an elliptic curve cryptography algorithm to generate the first temporary public key R. A The first register stores a shared key pointer, indicating a responder's shared key K. B and a second temporary public key R B The processor stores the data in memory. In response to a second elliptic curve cryptography (ECC) instruction, it performs a second key exchange operation for the ECC algorithm, generating a random number as a temporary private key r. B With the temporary private key r B The second temporary public key R is generated by processing an elliptic curve base point G. B The first temporary public key R is obtained through the second register (EAX). A Based on the first temporary public key R A And the second temporary public key R B And generate a shared key K for the responders. B And through the first register (EDI) the second temporary public key R B and the responder's shared key K B Store it in this memory. The second temporary public key R... BThe processor supplied to the initiator executes a third elliptic curve cryptography (ECC) instruction, performs a key exchange operation of the ECC algorithm, and generates an initiator shared key K. A .

[0193] This invention completes key exchange for the SM2 cryptographic algorithm with just three simple ISA instructions. Compared to using the SM2 engine 626 alone to implement key exchange operations for elliptic curve cryptography, using both the SM2 engine 626 and the SM3 engine 126 simultaneously improves both computational speed and security. Besides implementations assisted by specialized hardware (SM3 engine 126 and SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0194] The following paragraphs detail the first and second preprocessing operations applied to hash value calculation.

[0195] Figure 23 Table 2304 illustrates the microcode design for the corresponding first preprocessing operation, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b 100000 is pre-stored in the input register EDX to indicate that the single SM2 cryptographic algorithm instruction performs the first preprocessing operation. In addition to the input register EDX, Table 2304 also lists registers EAX, EBX, ECX, ESI, and EDI, all of which serve as input registers for the first preprocessing operation. The completion of the first preprocessing operation indicated by an ISA's SM2 cryptographic algorithm instruction also includes managing the output register EDI. Other implementations are also possible for the use of input or output registers.

[0196] When used as an input register, register EAX stores a user identifier ID. A A pointer that points to a storage location for a user identifier ID. A A memory space (which may follow ES segmentation technology). Register EBX stores a public key (x). A , y A A pointer to a public key (x) is provided. A , y A A memory space (which may follow ES segmentation technology). The ECX register stores the user identifier ID. A Bit length ENTL AThe EDX register stores the control word cw (6'b100000) indicating the first preprocessing operation code. The ESI register stores a pointer to an intermediate variable, pointing to a memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables, can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by the software from the operating system). The EDI register stores a preprocessing hash value Z. A A pointer to a memory space (which may follow Elasticsearch segmentation techniques) for storing a preprocessed hash value Z. A .

[0197] As the first preprocessing operation indicated by the SM2 cryptographic algorithm instruction of this ISA is completed, the output register EDI is incremented by one displacement, which is the preprocessed hash value Z. A The number of 32-byte blocks.

[0198] Figure 24 The flowchart illustrates, according to one embodiment of the present invention, the first preprocessing operation triggered by an SM2 cryptographic algorithm instruction, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0199] Step S2402: Based on the user identifier ID stored in the input register EAX A The pointer retrieves the user identifier ID from memory. A Loaded into processor 600 and user identifier ID A Length ENTL A Load data from input register ECX into processor 600. Step S2404 assembles the data S.

[0200] S=ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A

[0201] a and b are elliptic curve parameters, (x G , y G Let G be the base point of an elliptic curve, and (x) A , y A ) is the public key, and S is a one-bit string.

[0202] Step S2406 performs message stuffing on the bit string S. Step S2408 inputs the hardware operation control word, the cycle size (number of bytes in bit string S), and the stuffed value of bit string S into the SM2 engine 626, using its preprocessing hardware, and performs preprocessing hash value calculation through the SM3 engine 126.

[0203] Z A =Hash(ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A ),

[0204] The formula for calculating the loop size is: 2 + ECX / 8 + 32 + 32 + 32 + 32 + 32 + 32, where ECX is the user identifier ID. A Bit length ENTL A .

[0205] Step S2408 may include a preprocessed hardware operation microinstruction, or even an SM3 engine operation microinstruction. In step S2410, the SM2 engine 626 returns the preprocessed hash value Z. A Step S2412 uses the preprocessed hash value Z stored in the input register EDI. A The pointer will hold the preprocessed hash value Z A Load into memory. Step S2414 completes the first preprocessing operation triggered by an SM2 cryptographic algorithm instruction.

[0206] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor obtains a user identifier ID through a first register (EAX). A The public key (x) is obtained through a second register (EBX). A , y A ), for the public key (x) A , y A ), the user identifier ID A and a user identifier length ENTL A A preprocessed hash value Z is generated by performing a first preprocessing operation of an elliptic curve cryptography algorithm. A And the preprocessed hash value Z A The data is written into memory for use in subsequent second preprocessing operations. This invention completes the first preprocessing operation of the SM2 cryptographic algorithm with a single ISA instruction. Besides implementations assisted by special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0207] Figure 25Table 2504 illustrates the microcode design for the corresponding second preprocessing operation, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b100001 is pre-stored in the input register EDX to indicate its use in the second preprocessing operation. In addition to the input register EDX, Table 2504 also lists the input registers EAX, EBX, ECX, and EDI, all of which serve as input registers for the second preprocessing operation. The completion of the second preprocessing operation indicated by an ISA's SM2 cryptographic algorithm instruction also includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0208] When used as an input register, register EAX stores a preprocessed hash value Z. A The pointer points to the preprocessed hash value Z generated and stored in the earlier first preprocessing operation. A Register EBX records a pointer to input data M, pointing to a memory space (following ES segmentation techniques) that stores the input data M (e.g., data to be signed in a signature operation, or signed data in a signature verification operation). Register ECX records the number of bytes of the input data M. Register EDX stores the control word cw (6'b 100001) indicating the code for the second preprocessing operation. Register EDI stores a pointer to a hash value e, indicating a memory space (following ES segmentation techniques) used to store the hash value e.

[0209] As the second preprocessing operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the output register EDI is incremented by one displacement, which is the number of 32-byte blocks of hash value e.

[0210] Figure 26 The flowchart illustrates a second preprocessing operation triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention, and the multiple micro-instructions converted from the SM2 cryptographic algorithm instruction.

[0211] Step S2602: Based on the preprocessed hash value Z stored in the input register EAX... A The pointer will retrieve a preprocessed hash value Z from system memory. A And input data M is loaded into processor 600. Step S2604 assembles preprocessed data. (=Z A ||M). Step S2606 preprocesses the data. Populate the message.

[0212] Step S2608 will use a hardware operation control word and a cycle size (preprocessed data) (number of bytes), and preprocessed data The padded result is input into the SM2 engine 626, where the preprocessing hardware is used to implement the hash value e=Hash( using the SM3 engine 126). The operation involves calculating the loop size as 32 + ECX, where ECX is the number of bytes in the input data M. Step S2608 may include a preprocessing hardware operation microinstruction or even an SM3 engine operation microinstruction. In step S2610, the SM2 engine 626 returns the hash value e. Step S2612 loads the hash value e into system memory based on the pointer to the hash value e stored in the input register EDI. Step S2614 terminates the second preprocessing operation triggered by the SM2 cryptographic algorithm instruction.

[0213] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a preprocessed hash value Z from memory via a first register (EAX). A An input data M is retrieved from memory via a second register (EBX), and the preprocessed hash value Z is... A The input data M undergoes a second preprocessing operation using the elliptic curve cryptography algorithm to generate preprocessed data. And based on this preprocessed data The hash value e is converted and stored in memory. This invention completes the second preprocessing operation of the SM2 cryptographic algorithm with a single ISA instruction. In addition to implementation with special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0214] The above preprocessing design implements the hash value operation using two SM2 cryptographic algorithm instructions, converting the input data M into a hash value e. The first SM2 cryptographic algorithm instruction performs this first preprocessing operation, generating a preprocessed hash value Z associated with the user's identity. A =Hash(ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A The second SM2 cryptographic algorithm instruction performs the second preprocessing operation, based on the input data M and the preprocessed hash value Z. A Generating the hash value e includes the following operations: =Z A ||M, and e = Hash ( Before the signature operation, a hash value can be prepared for the data to be signed using the first and second preprocessing operations. Before the signature verification, a hash value can also be prepared for the data to be verified using the first and second preprocessing operations.

[0215] Furthermore, taking key exchange as an example, the aforementioned first preprocessing operation can also be used to implement the identity hash value Z. B The calculation of the identity hash value Z. A Unlike other methods, the identity hash value Z is calculated using the first preprocessing operation. B At that time, the EAX register contains a user identifier ID. B A pointer to a location that stores a user identifier ID. B A memory space (which may follow ESsegmentation technology). Register EBX stores a public key (x... B , y B A pointer to a public key (x) is used to point to a location where a public key is stored. B , y B A memory space (which may follow ES segmentation technology). The ECX register stores the user identifier ID. B Bit length ENTL B The EDI register stores a preprocessed hash value Z. B A pointer to a memory space (which may follow ES segmentation techniques) used to store the preprocessed hash value Z. B Furthermore, in Figure 24 The flowchart shown also uses steps to calculate the preprocessed hash value Z. B The relevant data will not be elaborated here.

[0216] The following paragraphs describe in detail the hardware implementation of the present invention.

[0217] Figure 27 The present invention illustrates a detailed hardware architecture of an SM2 engine 626 according to one embodiment, including a control logic hardware 2702, a dot multiplication hardware 2704, a preprocessing hardware 2706, a modular multiplication hardware 2708, and a modular inverse hardware 2710. The cryptographic execution unit 618 further includes a random number generator 2712. The SM2 engine 626 is also coupled to the random number generator 2712 and the SM3 engine 126.

[0218] According to a hardware operation control word 2714, the control logic hardware 2702 outputs a control signal pnt_mul to drive the dot multiplication hardware 2704, or outputs a control signal pre_process to drive the preprocessing hardware 2706, or outputs a control signal modular_mul to drive the modular multiplication hardware 2708, or outputs a control signal modular_inverse to drive the modular inverse hardware 2710. Input data 2716 can be obtained based on the contents of the input registers for each operation. The return data for each operation of the SM2 engine 626 is output data 2718.

[0219] Figure 28 According to one embodiment of the present invention, a dot product hardware 2704 driven by a microinstruction for hardware operation is illustrated, wherein a first coordinate system transformation hardware 2802, a multi-point calculation hardware 2804, and a second coordinate system transformation hardware 2806 are implemented. The dot product hardware 2704 is also coupled to modular multiplication hardware 2708 and modular inverse hardware 2710. After an elliptic curve input point 2808 and an input large number 2810 are input into the dot product hardware 2704, an elliptic curve output point 2812 is generated by using the modular multiplication hardware 2708 and modular inverse hardware 2710.

[0220] In one embodiment, the first coordinate system conversion hardware 2802 converts the elliptic curve input point 2808, which is an affine coordinate point, into a first intermediate point, which is an emphasized projective coordinate point. The multiplier point calculation hardware 2804 performs multiplier point calculation on the first intermediate point using the input large number 2810 to generate a second intermediate point. The second coordinate system conversion hardware 2806 converts the second intermediate point, which is an emphasized projective coordinate point, into the elliptic curve output point 2812. The elliptic curve output point 2812 is an affine coordinate point.

[0221] Figure 29 According to one embodiment of the present invention, a preprocessing hardware 2706 driven by a preprocessing hardware operation microinstruction is illustrated. Message grouping is performed, converting an input data 2902 after message padding into n groups of input messages B(0)...B(n-1), which are then sequentially passed to the SM3 engine 126 for message expansion and iterative compression, generating instantaneous hash values ​​sequentially, ultimately resulting in a converted hash value 2904. Specifically, the preprocessing hardware 2706 passes the first group of input messages B(0) and the initial hash constant V(0) to the SM3 engine 126 to generate an instantaneous hash value V(1), then passes the second group of input messages B(1) and the instantaneous hash value V(1) to the SM3 engine 126 to generate an instantaneous hash value V(2), and so on, until a converted hash value V(n) is generated.

[0222] Figure 30According to one embodiment of the present invention, a modular multiplication hardware 2708 driven by a hardware operation microinstruction is illustrated, which performs the operation based on hardware input:

[0223] Output product = (Input multiplier #1) * (Input multiplier #2) mod (Input modulus)

[0224] Input multiplier #1, input multiplier #2, and input modulus can be referred to as the first, second, and third modular multiplication inputs, respectively. The output product is the modular multiplication output.

[0225] Figure 31 According to one embodiment of the present invention, the analog inverse hardware 2710 driven by a microinstruction of analog inverse hardware operation is illustrated, which performs operations based on hardware input:

[0226] Modulo inverse output = (input large number) -1 mod(input modulus)

[0227] Inputting a large number can be called the first modulo inverse input. Inputting a modulus can be called the second modulo inverse input.

[0228] The hardware and microcode design of this invention may have many variations.

[0229] In one implementation, the cryptographic execution unit 118 does not specifically design the SM2 engine 626. Instead, it plans the microcode content to convert a single ISA SM2 cryptographic algorithm instruction into multiple microinstruction operation logic units (ALUs), thereby completing the SM2 cryptographic algorithm.

[0230] In one implementation, the SM2 engine has fewer functional modules than the SM2 engine 626, and the missing functional modules (e.g., the modular multiplication hardware 2708) are implemented using microcode to configure the microinstruction operation logic unit (ALU).

[0231] As can be seen from the above, in known technologies, the SM2 cryptographic algorithm is implemented using software and / or specialized hardware (such as external cryptographic cards). Software implementation cannot effectively guarantee data security, while specialized hardware implementation requires the purchase of additional hardware during deployment, thus increasing deployment costs. However, the processor and processing method for the elliptic curve cryptography algorithm (SM2) provided by this invention can implement the elliptic curve cryptography algorithm using only a single instruction set architecture. Intermediate data generated during the implementation of the elliptic curve cryptography algorithm can be stored in the processor's internal hardware storage space, making this intermediate data inaccessible from outside the processor, greatly improving security. Furthermore, since no additional specialized hardware needs to be purchased during deployment, deployment costs are reduced.

[0232] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

[0233] [Symbol Explanation]

[0234] 100: Processor;

[0235] 102: Branch predictor;

[0236] 104: Instruction cache;

[0237] 106: Instruction Buffer (XIB);

[0238] 108: Formatted Instruction Queue (FIQ);

[0239] 110: Decoder;

[0240] 112: Instruction Queue (XIQ);

[0241] 114: Rename the unit;

[0242] 116: Sequential memory cache;

[0243] 118: Cryptographic Execution Unit;

[0244] 120: Data cache;

[0245] 122: Reorder the cache;

[0246] 124: Architecture register;

[0247] 126: SM3 engine (hash cryptography algorithm accelerator);

[0248] 202, 212, 222, 232: Format of SM3 cryptographic algorithm instructions;

[0249] 204, 214, 224, 234: Tables, with corresponding microcode designs in formats 202, 212, 222, and 232;

[0250] 300: Program code;

[0251] 302: SM3 cryptographic algorithm instruction;

[0252] 304: At least one register set instruction;

[0253] 500: SM3 engine;

[0254] 502: Hardware used for message extension;

[0255] 504: Hardware used for iterative compression;

[0256] 506: Function hardware, implementing Boolean functions FFj and GGj, and the permutation function P0(.);

[0257] 508: Initial hash value V(0);

[0258] 600: Processor;

[0259] 618: Cryptographic Execution Unit;

[0260] 626: SM2 engine;

[0261] 702: Format of SM2 cryptographic algorithm instructions;

[0262] 804: Table, corresponding encryption operations of the SM2 cryptographic algorithm;

[0263] 1004: Table, corresponding to the decryption operations of the SM2 cryptographic algorithm;

[0264] 1204: Table, corresponding to the signature operation of the SM2 cryptographic algorithm;

[0265] 1404: Table, corresponding to the signature verification operation of the SM2 cryptographic algorithm;

[0266] 1604: Table, corresponding to the first procedure operation of key exchange for the SM2 cryptographic algorithm;

[0267] 1804: Table, corresponding to the second procedure operation of key exchange for the SM2 cryptographic algorithm;

[0268] 2004: Table, corresponding SM2 cryptographic algorithm key exchange third procedure operation;

[0269] 2304: Table, corresponding to the first preprocessing operation of the SM2 cryptographic algorithm;

[0270] 2504: Table, corresponding to the second preprocessing operation of the SM2 cryptographic algorithm;

[0271] 2702: Control logic hardware;

[0272] 2704: Dot product hardware;

[0273] 2706: Preprocessing hardware;

[0274] 2708: Analog multiplication hardware;

[0275] 2710: Analog Reverse Hardware;

[0276] 2712: Random number generator;

[0277] 2714: Hardware operation control word;

[0278] 2716: Input data;

[0279] 2718: Output data;

[0280] 2802: First coordinate system transformation hardware;

[0281] 2804: Multi-point computing hardware;

[0282] 2806: Second coordinate system conversion hardware;

[0283] 2808: Elliptic curve input point;

[0284] 2810: Enter a large number;

[0285] 2812: Elliptic curve output point;

[0286]

[0287] 2904: The converted hash value;

[0288] A…H: Parameters;

[0289] AGU: Address Generation Unit;

[0290] ALU: Arithmetic Logic Unit;

[0291] DTLB: Data Translation Backup Buffer;

[0292] EAX, ECX, ESI, EDI registers;

[0293] Fadd, Fmul, Fmisc, MMX: The corresponding hardware for various instructions;

[0294] ITLB: Instruction Translation Backup Buffer;

[0295] M1…M3 ~ Accelerator internal storage space;

[0296] Opcode, ModR / M, SIB, Displacement, and Immediate:

[0297] Format fields of SM3 cryptographic algorithm instructions;

[0298] pnt_mul, pre_process, modular_mu, modular_inverse: Hardware control signals;

[0299] RS: Reserved Station;

[0300] S402… S418, S902… S920, S1102… S1126, S1302… S1314, S1502… S1520, S1702… S1710, S1902… S1928, S2102… S2128, S2202… S2216, S2402… S2414, S2602… S2614: Steps;

[0301] ucode: microcode;

[0302] V(i+1): Hash value;

[0303] ,as well as : 132 words extended from each input message B(i).

Claims

1. A processor with elliptic curve cryptography (ECC) algorithm, comprising: a first register storing a hash pointer pointing to a first memory space storing a hash value of data to be verified; and a second register storing a public key pointer pointing to a public key of a signer; a third register storing a signature pointer pointing to a signature to be verified; a fourth register storing a verification result; wherein, in response to a first ECC instruction of an instruction set architecture, the processor fetches the hash value of the data to be verified from the first memory space via the first register, fetches the public key via the second register, fetches the signature via the third register, performs a signature verification operation on the hash value with the public key and the signature to generate the verification result, and writes the verification result into the fourth register.

2. The processor with ECC algorithm as claimed in claim 1, wherein: parameters of the first ECC instruction include the hash pointer, the public key pointer, and the signature pointer.

3. The processor with ECC algorithm as claimed in claim 1, further comprising: a fifth register storing an intermediate variable pointer pointing to a second memory space; wherein, an intermediate variable generated by the processor in the signature verification operation on the hash value is temporarily stored in the second memory space according to the intermediate variable pointer stored in the fifth register.

4. The processor with ECC algorithm as claimed in claim 3, wherein: before the signature verification operation on the hash value, the processor stores a first address of the second memory space into the fifth register, and sets all bytes in the second memory space to zero.

5. The processor with ECC algorithm as claimed in claim 4, wherein: the second memory space is applied for from an operating system by software.

6. The processor with ECC algorithm as claimed in claim 1, further comprising: a sixth register storing a control word indicating that the first ECC instruction performs the signature verification operation.

7. The processor with ECC algorithm as claimed in claim 1, further comprising: a cryptographic execution unit; a set of architectural registers including the first register, the second register, the third register, and the fourth register; a microcode storage storing microcode; and a decoder decoding a plurality of microinstructions from the microcode in response to the first ECC instruction; wherein, the plurality of microinstructions generated in response to the first ECC instruction include accessing and managing contents of the set of architectural registers, and when a control word read from one of the set of architectural registers indicates a signature verification code, operating the cryptographic execution unit to perform the signature verification operation on the hash value with the public key and the signature.

8. The processor with ECC algorithm as claimed in claim 7, wherein: the signature is (r', s'), r' is a first part of the signature, and s' is a second part of the signature; t = (r' + s') mod n n is an order of an elliptic curve base point, t is a judgment number; and ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The plurality of micro-instructions include checking whether r' ∈ [1,n-1], and s' ∈ [1,n-1] are true, making the verification result fail in any of them is not true, and performing the operation when both of them are true. ​ ​ The plurality of micro-instructions includes checking whether t is zero, and making the verification result as failed when t is zero.

9. The processor with elliptic curve cryptography as claimed in claim 8, wherein: The cryptographic execution unit includes an elliptic curve cryptography accelerator, wherein the point multiplication hardware receives an elliptic curve input point and an input large number, and generates an elliptic curve output point therefrom; The plurality of micro-instructions includes a first point multiplication hardware operation micro-instruction, and a second point multiplication hardware operation micro-instruction, which are executed when t is not zero; In response to the first point multiplication hardware operation micro-instruction, the point multiplication hardware operates [s']G, s' being the input large number, and G being the elliptic curve base point of the elliptic curve input point; In response to the second point multiplication hardware operation micro-instruction, the point multiplication hardware operation yields [t]P A , t as the input large number, P as the elliptic curve input point A as the public key; The plurality of micro-instructions includes performing an operation, (x1 ’ ,y1 ’ ) = [s'] G + [t] P A , (x1 ’ ,y1 ’ ) being an elliptic curve point; The plurality of micro-instructions includes performing a modulo operation, R = (e' + x1 ’ ) mod n, e' is the hash value, and R is the modulo result. The plurality of micro-instructions includes checking whether R is r', and making the verification result as failed when R is not r', and making the verification result as succeeded when R is r'.

10. The processor with elliptic curve cryptography as claimed in claim 9, wherein the point multiplication hardware includes: first coordinate system conversion hardware for converting the elliptic curve input point which is an affine coordinate point into a first intermediate point which is a weighted projective coordinate point; multiple point calculation hardware for performing multiple point calculation on the first intermediate point by the input large number to generate a second intermediate point; and second coordinate system conversion hardware for converting the second intermediate point which is a weighted projective coordinate point into the elliptic curve output point which is an affine coordinate point.

11. The processor with elliptic curve cryptography as claimed in claim 1, wherein: The processor further executes a second elliptic curve cryptography instruction prior to the first elliptic curve cryptography instruction; The first register stores a user identifier pointer pointing to a third memory space storing a user identifier in response to the second elliptic curve cryptography instruction executed prior to the first elliptic curve cryptography instruction; The second register stores the public key pointer in response to the second elliptic curve cryptography instruction executed prior to the first elliptic curve cryptography instruction; The third register stores a pre-processing hash value pointer pointing to a fourth memory space for filling a pre-processing hash value in response to the second elliptic curve cryptography instruction executed prior to the first elliptic curve cryptography instruction; The fourth register stores a user identifier length in response to the second elliptic curve cryptography instruction executed prior to the first elliptic curve cryptography instruction; In response to the second elliptic curve cryptography instruction, the processor fetches the user identifier from the third memory space via the first register, fetches the public key via the second register, fetches the user identifier length via the fourth register, performs a first pre-processing operation of elliptic curve cryptography on the user identifier and the user identifier length with the public key to generate a pre-processing hash value, and writes the pre-processing hash value into the fourth memory space via the third register for subsequent conversion into the hash value for use by the first elliptic curve instruction.

12. The processor with elliptic curve cryptography as claimed in claim 11, wherein: ​ ​ The parameters of the second elliptic curve cryptography instruction include the user identifier pointer, the public key pointer, the user identifier length, and the pre-processed hash value pointer.

13. The processor with elliptic curve cryptography as recited in claim 11, further comprising: a fifth register storing an intermediate variable pointer pointing to a second memory space; wherein the intermediate variable generated by the processor during the first pre-processing operation is temporarily stored in the second memory space according to the intermediate variable pointer stored in the fifth register.

14. The processor with elliptic curve cryptography as recited in claim 11, wherein: the processor increases the content of the third register by one displacement after performing the first pre-processing operation; the displacement is the pre-processed hash value length.

15. The processor with elliptic curve cryptography as recited in claim 11, further comprising: a sixth register storing a control word indicating that the second elliptic curve cryptography instruction performs the first pre-processing operation.

16. The processor with elliptic curve cryptography as recited in claim 11, further comprising: a cryptographic execution unit; a set of architectural registers including the first register, the second register, the third register, and the fourth register; a microcode storage storing microcode; and a decoder decoding a plurality of microinstructions from the microcode in response to the second elliptic curve cryptography instruction; wherein the plurality of microinstructions generated in response to the second elliptic curve cryptography instruction includes accessing and managing the content of the set of architectural registers, and when a control word read from one of the set of architectural registers indicates a first pre-processing code, operating the cryptographic execution unit to perform the first pre-processing operation.

17. The processor with elliptic curve cryptography as recited in claim 16, wherein: the plurality of microinstructions includes an instruction operation.

18. The processor with elliptic curve cryptography as recited in claim 17, wherein: S = ENTL A || ID A || a || b || x G || y G || x A || y A ENTL A is the length of the user identifier, ID A is the user identifier, a, b are elliptic curve parameters, (x G ,y G ) is the base point of the elliptic curve, (x A ,y A ) are the coordinates of the public key, and S is a bit string. the cryptographic execution unit includes an elliptic curve cryptography accelerator having a pre-processing hardware; the cryptographic execution unit further includes a hash cryptography accelerator; the plurality of microinstructions further includes a pre-processing hardware operation microinstruction causing the pre-processing hardware to implement the grouping of S to provide a grouped message to the hash cryptography accelerator for hash value conversion after the message padding of S is completed; and the pre-processing hardware further has an internal storage space in the execution unit to temporarily store an initial hash value for use by the hash cryptography accelerator, which is updated by the hash cryptography accelerator until Hash(S) is filled in as the pre-processed hash value.

19. The processor with elliptic curve cryptography as recited in claim 11, wherein: the processor further executes a third elliptic curve cryptography instruction before the first elliptic curve cryptography instruction and after the second elliptic curve cryptography instruction; for the third elliptic curve cryptography instruction, the first register stores a pre-processed hash value pointer pointing to the fourth memory space; and ​ ​ For the third elliptic curve cryptography instruction, the second register stores a pointer to the data to be verified, pointing to a fifth memory space storing the data to be verified; For the third elliptic curve cryptography instruction, the third register stores a pointer to the hash value, pointing to the first memory space; For the third elliptic curve cryptography instruction, the fourth register stores the length of the data to be verified; In response to the third elliptic curve cryptography instruction, the processor obtains the pre-processed hash value from the fourth memory space through the first register, obtains the data to be verified from the fifth memory space through the second register, performs a second pre-processing operation of the elliptic curve cryptography algorithm on the pre-processed hash value and the data to be verified, generates pre-processed data, and converts the hash value based on the pre-processed data, and stores the hash value in the first memory space for use by the first elliptic curve instruction.

20. The processor with elliptic curve cryptography as claimed in claim 19, wherein: The parameters of the third elliptic curve cryptography instruction include the pointer to the pre-processed hash value, the pointer to the data to be verified, and the pointer to the hash value.

21. The processor with elliptic curve cryptography as claimed in claim 19, further comprising: a fifth register storing a pointer to an intermediate variable, pointing to a second memory space; wherein the intermediate variable generated by the processor in the second pre-processing operation is temporarily stored in the second memory space according to the pointer to the intermediate variable stored in the fifth register.

22. The processor with elliptic curve cryptography as claimed in claim 19, wherein: After the processor performs the second pre-processing operation, the content of the third register is increased by a bit displacement; The bit displacement is the length of the hash value.

23. The processor with elliptic curve cryptography as claimed in claim 19, further comprising: a sixth register storing a control word indicating that the third elliptic curve cryptography instruction performs the second pre-processing operation.

24. The processor with elliptic curve cryptography as claimed in claim 19, further comprising: a cryptographic execution unit; a set of architectural registers including the first register, the second register, the third register, and the fourth register; a microcode storage device storing microcode; and a decoder decoding a plurality of microinstructions from the microcode in response to the third elliptic curve cryptography instruction; wherein the plurality of microinstructions generated in response to the third elliptic curve cryptography instruction includes accessing and managing the content of the set of architectural registers, and when a control word read from one of the set of architectural registers indicates a second pre-processing code, operating the cryptographic execution unit to perform the second pre-processing operation.

25. The processor with elliptic curve cryptography as claimed in claim 24, wherein: The plurality of microinstructions includes an instruction operation. Z A For the pre-processed hash value, M' is the data to be verified, and is the pre-processed data.

26. The processor with elliptic curve cryptography as claimed in claim 25, wherein: The cryptographic execution unit includes an elliptic curve cryptography accelerator with pre-processing hardware; The cryptographic execution unit further includes a hash cryptography accelerator; The plurality of micro-instructions further includes a pre-processing hardware operation micro-instruction, in after the message padding is completed, causing the pre-processing hardware to implement a packet to provide a packet message to the hash cryptographic algorithm accelerator for hash value conversion; and The pre-processing hardware also has an execution unit internal storage space to temporarily store the initial hash value for use by the hash password algorithm accelerator, which is then updated by the hash password algorithm accelerator until the Hash is filled in as the hash value.

27. A processing method of a processor, comprising: in response to a first elliptic curve cryptography instruction of an instruction set architecture, retrieving a hash value of data to be verified, retrieving a public key, retrieving a signature, performing a signature verification operation of an elliptic curve cryptography algorithm on the hash value with the public key and the signature, generating a verification result, and writing the verification result into a register; in response to the first elliptic curve cryptography instruction, decoding a plurality of microinstructions from microcode; and in response to the plurality of microinstructions generated from the first elliptic curve cryptography instruction, performing the signature verification operation on the hash value with the public key and the signature when a control word indicates a signature verification code.

28. The processing method of claim 27, wherein: parameters of the first elliptic curve cryptography instruction include a hash value pointer pointing to the hash value, a public key pointer pointing to the public key, and a signature pointer pointing to the signature.

29. The processing method of claim 27, further comprising: temporarily storing intermediate variables generated from the signature verification operation on the hash value in a second memory space; and zeroing all bytes in the second memory space before performing the signature verification operation on the hash value.

30. The processing method of claim 29, wherein: the second memory space is requested from an operating system by software.

31. The processing method of claim 27, further comprising: the processor further executes a second elliptic curve cryptography instruction before the first elliptic curve cryptography instruction; and in response to the second elliptic curve cryptography instruction, retrieving a user identifier from a third memory space, retrieving the public key, retrieving a user identifier length, performing a first preprocessing operation of an elliptic curve cryptography algorithm on the user identifier and the user identifier length with the public key to generate a preprocessed hash value, and writing the preprocessed hash value into a fourth memory space for subsequent conversion into the hash value for use by the first elliptic curve instruction.

32. The processing method of claim 31, further comprising: in response to the second elliptic curve cryptography instruction, decoding a plurality of microinstructions from microcode; and in response to the plurality of microinstructions generated from the second elliptic curve cryptography instruction, performing the first preprocessing operation when a control word indicates a first preprocessing code.

33. The processing method of claim 31, further comprising: the processor further executes a third elliptic curve cryptography instruction before the first elliptic curve cryptography instruction and after the second elliptic curve cryptography instruction; and in response to the third elliptic curve cryptography instruction, retrieving the preprocessed hash value from the fourth memory space, retrieving the data to be verified, performing a second preprocessing operation of the elliptic curve cryptography algorithm on the preprocessed hash value and the data to be verified to generate preprocessed data and convert the hash value based on the preprocessed data, and storing the hash value in the first memory space for use by the first elliptic curve instruction.

34. The processing method of claim 33, further comprising: In response to the third elliptic curve cryptography algorithm instruction, a plurality of microinstructions are decoded from the microcode; And In response to the plurality of microinstructions generated by the third elliptic curve cryptography algorithm instruction, when the control word indicates the second pre-processing code, the second pre-processing operation is performed.

Images