Processor with elliptic curve cryptography algorithm and processing method thereof

Abstract

A processor with elliptic curve cryptography algorithm and a processing method thereof, wherein a first register stores a hash value pointer and a second register stores a private key pointer. In response to a first elliptic curve cryptography instruction of an instruction set architecture, the processor obtains a hash value of data to be signed through the first register, obtains a private key through the second register, performs a signature operation of the elliptic curve cryptography algorithm on the hash value by using the private key to generate a signature, and writes the signature into a second memory space.

Description

TECHNICAL FIELD

[0001] The present application relates to a processor with a cryptographic algorithm and a processing method thereof. BACKGROUND

[0002] The State Cryptography Administration of China has published a variety of cryptographic algorithms, including SM2, SM3, and SM4…cryptographic algorithms, to replace RSA (abbreviation from Rivest-Shamir-Adleman), DES (abbreviation from Data Encryption Standard), 3DES (abbreviation from Triple Data Encryption Algorithm), SHA (abbreviation from Secure Hash Algorithm)…international standard cryptographic algorithms.

[0003] The SM2 cryptographic algorithm is an elliptic curve public key cryptographic algorithm, but it is different from the international standards such as ECDSA (abbreviation from Elliptic Curve Digital Signature Algorithm), ECDH (abbreviation from Elliptic-curve Diffie-Hellman)…in terms of signature and key exchange, and it adopts a more secure mechanism. In addition to encryption and decryption operations, the SM2 cryptographic algorithm also involves digital signature, signature verification, key exchange protocol…etc.

[0004] The SM3 cryptographic algorithm is a hash (or called as a hybrid, a hash) cryptographic algorithm. In particular, the SM3 cryptographic algorithm will be frequently used by the SM2 cryptographic algorithm for some functions.

[0005] In the known technology, the SM2 cryptographic algorithm is implemented using software and / or special hardware (such as an external cryptographic card, etc.). The use of software cannot effectively guarantee the security of data, and the use of special hardware requires the purchase of special hardware when deployed, so it will increase the deployment cost.

[0006] How to efficiently and more securely complete the SM2 cryptographic algorithm is a major issue in the technical field. SUMMARY

[0007] In order to effectively guarantee the security of data and reduce the deployment cost, the present application provides a processor with an elliptic curve cryptographic algorithm (SM2) and a processing method thereof.

[0008] The processor according to an embodiment of the present application comprises a first register and a second register. The first register stores a hash value pointer pointing to a first memory space storing a hash value (e) of data to be signed. The second register stores a private key pointer pointing to a private key of a signer. In response to a first elliptic curve cryptography instruction of an instruction set architecture, the processor obtains the hash value of the data to be signed from the first memory space via the first register, obtains the private key via the second register, performs a signature operation on the hash value using the private key to generate a signature, and writes the signature into a second memory space.

[0009] The processing method of the processor according to an embodiment of the present application comprises: in response to a first elliptic curve cryptography instruction of an instruction set architecture, the processor obtains a hash value of data to be signed from a first memory space, obtains a private key, performs a signature operation on the hash value using the private key to generate a signature, and writes the signature into a second memory space.

[0010] The processor with elliptic curve cryptography (SM2) and the processing method thereof provided by the present application can store intermediate data generated in the process of implementing the elliptic curve cryptography in the internal hardware storage space of the processor, so that the intermediate data cannot be accessed outside the processor, greatly improving the security. In addition, no special hardware needs to be purchased when deployed, reducing the deployment cost.

[0011] The embodiments are described below in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 FIG. 1 is a block diagram illustrating a processor 100 according to an embodiment of the present application;

[0013] Figures 2A-2D FIG. 2 illustrates the format of the SM3 cryptographic algorithm instruction of the ISA and the related microcode ucode design according to different embodiments of the present application;

[0014] Figure 3 FIG. 3 illustrates an embodiment of the ISA instruction writing;

[0015] Figure 4 FIG. 4 is a flowchart illustrating the step procedure triggered by the SM3 cryptographic algorithm instruction of the ISA and the plurality of micro instructions converted by the SM3 cryptographic algorithm instruction according to an embodiment of the present application;

[0016] Figure 5 FIG. 5 illustrates an SM3 engine 500 according to an embodiment of the present application;

[0017] Figure 6Fig. 6 is a block diagram illustrating a processor 600 according to an embodiment of the present application;

[0018] Figure 7 Fig. 7 illustrates a format 702 of an SM2 cryptographic algorithm instruction of an ISA according to an embodiment of the present application;

[0019] Figure 8 Fig. 8 illustrates a microcode ucode design for corresponding encryption operations, showing how the microinstructions generated correspondingly interpret the contents of the architectural registers 124, in a table 804;

[0020] Figure 9A 9B Fig. 9 is a flowchart illustrating encryption operations initiated by a single SM2 cryptographic algorithm instruction of an ISA according to an embodiment of the present application, and the multiple microinstructions that the SM2 cryptographic algorithm instruction is converted into accordingly;

[0021] Figure 10 Fig. 10 illustrates a microcode ucode design for corresponding decryption operations, showing how the microinstructions generated correspondingly interpret the contents of the architectural registers 124, in a table 1004;

[0022] Figure 11A 11B Fig. 11 is a flowchart illustrating decryption operations initiated by a single SM2 cryptographic algorithm instruction of an ISA according to an embodiment of the present application, and the multiple microinstructions that the SM2 cryptographic algorithm instruction is converted into accordingly;

[0023] Figure 12 Fig. 12 illustrates a microcode ucode design for corresponding signature operations, showing how the microinstructions generated correspondingly interpret the contents of the architectural registers 124, in a table 1204;

[0024] Figure 13 Fig. 13 is a flowchart illustrating signature operations initiated by a single SM2 cryptographic algorithm instruction according to an embodiment of the present application, and the multiple microinstructions that the SM2 cryptographic algorithm instruction is converted into accordingly;

[0025] Figure 14 Fig. 14 illustrates a microcode ucode design for corresponding signature verification operations, showing how the microinstructions generated correspondingly interpret the contents of the architectural registers 124, in a table 1404;

[0026] Figure 15 Fig. 15 is a flowchart illustrating signature verification operations initiated by a single SM2 cryptographic algorithm instruction according to an embodiment of the present application, and the multiple microinstructions that the SM2 cryptographic algorithm instruction is converted into accordingly;

[0027] Figure 16 Fig. 16 illustrates a microcode ucode design for corresponding key exchange first procedure operations, showing how the microinstructions generated correspondingly interpret the contents of the architectural registers 124, in a table 1604;​​

[0028] Figure 17 This is a flowchart illustrating the first program operation of key exchange triggered by an SM2 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0029] Figure 18 Table 1804 illustrates the microcode design of the corresponding key exchange second program operation, showing how the microinstructions generated by the corresponding second SM2 cryptographic algorithm instruction interpret the contents of architecture register 124;

[0030] Figure 19A , 19B This is a flowchart illustrating a second program operation for key exchange triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0031] Figure 20 Table 2004 illustrates the microcode design of the corresponding key exchange third program operation, showing how the microinstruction generated by the corresponding third SM2 cryptographic algorithm instruction interprets the contents of architecture register 124.

[0032] Figure 21A , 21B This is a flowchart illustrating a third program operation for key exchange triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0033] Figure 22 This invention illustrates, according to one embodiment, how an initiator and a responder utilize the first to third key exchange procedures proposed in this invention to achieve key exchange. The initiator and the responder can communicate with each other and each has a processor (600).

[0034] Figure 23 Table 2304 illustrates the design of the microcode ucode for the corresponding first preprocessing operation, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124;

[0035] Figure 24 This is a flowchart illustrating, according to one embodiment of the present invention, the first preprocessing operation triggered by an SM2 cryptographic algorithm instruction, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction;

[0036] Figure 25 Table 2504 illustrates the design of the corresponding second preprocessing operation's microcode, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124;

[0037] Figure 26 FIG. 4 is a flowchart illustrating a second preprocessing operation triggered by an SM2 cryptographic algorithm instruction, according to an embodiment of the present disclosure;

[0038] Figure 27 FIG. 5 illustrates a detailed hardware architecture of an SM2 engine 626, according to an embodiment of the present disclosure;

[0039] Figure 28 FIG. 6 illustrates a point multiplication hardware 2704 driven by a point multiplication hardware operation microinstruction, according to an embodiment of the present disclosure;

[0040] Figure 29 FIG. 7 illustrates a preprocessing hardware 2706 driven by a preprocessing hardware operation microinstruction, according to an embodiment of the present disclosure;

[0041] Figure 30 FIG. 8 illustrates a modular multiplication hardware 2708 driven by a modular multiplication hardware operation microinstruction, according to an embodiment of the present disclosure; and

[0042] Figure 31 FIG. 9 illustrates a modular inversion hardware 2710 driven by a modular inversion hardware operation microinstruction, according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] The following description sets forth numerous specific details such as examples of specific types of data, parameters, methods, and so forth. Although these details are set forth in connection with these examples, it will be understood that the description and examples are intended to be illustrative only and not limiting to the disclosed subject matter. The term "exemplary" used throughout this description means "serving as an example, instance, or illustration," and should not necessarily be construed as preferred or advantageous over other examples. The description set forth herein, in connection with the appended drawings, describes example configurations and does not represent that the disclosed subject matter can not be practiced with other configurations. The detailed description set forth herein does not represent that the disclosed subject matter can not be practiced with other configurations. At the very least, it will be appreciated that various configurations might be implemented or

[0044] An embodiment of the present disclosure discloses a processor with a hash cryptographic algorithm (SM3 cryptographic algorithm), which includes a single hash cryptographic algorithm instruction (SM3 cryptographic algorithm instruction) designed for an instruction set architecture (ISA) of the SM3 cryptographic algorithm. In an embodiment, according to the SM3 cryptographic algorithm instruction, the present disclosure designs a microcode (ucode) of the processor and further adds a hash cryptographic algorithm accelerator (SM3 engine) to a cryptographic execution unit of the processor. When processing the SM3 cryptographic algorithm instruction, the processor generates a plurality of microinstructions according to the ucode to define, use, and manage contents of architecture registers in order to operate the cryptographic execution unit (including the SM3 engine) to perform an SM3 cryptographic algorithm of an input data (input stream) m, convert an initial hash constant V(0) into a converted hash value V(n), wherein the process includes message padding and grouping (making n groups of messages B(0), …, B(n-1)), message expansion (expanding B(i) into W0 i …W67 i , and W0 i ’…W 63 i ), iterative compression (extending the result based on B(i), converting the hash value from V(i) to V(i+1)). The instruction set supported by the processor can include the x86 instruction set. The initial hash constant V(0) to the intermediate values (e.g., W0 i …W 67 i and W0 i ’…W 63 i ’, V(1)…V(n-1)…etc.) can be properly hidden in the crypto execution unit and not exposed on the architectural registers.

[0045] Figure 1As a block diagram, a processor 100 is illustrated according to an embodiment of the present application. According to a branch predictor 102, instructions are loaded into an instruction cache 104 according to the results of instruction translation lookaside buffer (ITLB) translation, buffered into an instruction buffer (XIB) 106, and pushed into a format instruction queue (FIQ) 108, which is decoded by a decoder 110 into a plurality of microinstructions recognizable by a pipeline according to ucode (stored in a ucode storage), pushed into an instruction queue (XIQ) 112, and stored in corresponding reservation stations (RS) via a rename 114, to drive an arithmetic logical unit (ALU), an address generating unit (AGU) of a memory order buffer 116, and a corresponding hardware of a plurality of instructions, such as a Fadd, Fmul, Fmisc, MMX, or a cipher execution unit 118. Data required for the operation can be loaded into a data cache 120 according to the results of data translation lookaside buffer (DTLB) translation, and buffered into the memory order buffer 116. The processor 100 further includes a reorder buffer (ROB) 122 and architecture registers 124 to implement the operation.

[0046] The cryptographic execution unit 118 includes an SM3 engine 126. The microcode ucode includes architecture registers 124 that access the SM3 cryptographic algorithm instruction of the corresponding ISA, specifically including registers that access the pre-processing mode of the input data m (e.g., whether padding of the message is required), the size of the input data register, and even the pointer registers of the input data m and the hash value. The decoder 110 decodes the SM3 cryptographic algorithm instruction of the present ISA into a plurality of microinstructions recognizable by the processor 100 pipeline according to the microcode ucode, for interpreting the contents of the architecture registers 124, obtaining the initial hash constant V(0) and the input data m, and driving the SM3 engine 126 to perform the hash value conversion to generate the converted hash value V(n). The decoded plurality of microinstructions includes an accelerator operation microinstruction (SM3 engine microinstruction) that is responsible for driving the SM3 engine 126. The decoded plurality of microinstructions also includes accessing and managing the contents of the set of architecture registers 124, and operating the cryptographic execution unit 118 to perform the hash cryptographic algorithm on the input data m.

[0047] Figures 2A-2D According to different embodiments of the present application, the format of the SM3 cryptographic algorithm instruction of the ISA and the related microcode ucode design are illustrated. In addition to the illustrated embodiments, the format contents (e.g., numerical opcode) and register applications mentioned in the present application can also have various variations.

[0048] Figure 2A The format 202 of the SM3 cryptographic algorithm instruction of the ISA is illustrated, and the related microcode ucode design is introduced in table 204. The prefix, opcode, and field ModR / M of the format 202 are: 0xF3 0x0F 0xA6 0xE8 (may also be other numerical values). The fields SIB, Displacement, and Immediate are non-filled (non). After the decoder 110 recognizes the code "0xF3 0x0F 0xA6 0xE8", it generates a plurality of microinstructions according to the microcode ucode, including defining, using, and managing the architecture registers 124 to operate the cryptographic execution unit 118 to perform the SM3 cryptographic algorithm on the input data m.

[0049] First, referring to table 204, how the microcode ucode defines the input registers of the SM3 cryptographic algorithm instruction of the ISA and uses the registers EAX, ECX, ESI, and EDI in the architecture registers 124 is discussed.

[0050] Register EAX carries a message padding flag to indicate whether the input data m needs message padding to meet the input bit length of SM3 cryptographic algorithm. EAX = 0 indicates that the input data m needs message padding. EAX = -1 indicates that the input data m does not need message padding. When the message padding flag indicates that the input data m needs padding, the plurality of microinstructions pad the input data m to a multiple of the input message single group size. In one embodiment, the input message single group size is 512 bits. When EAX = 0, the plurality of microinstructions pad the input data m to m' = m, 1, k{0}, 64{len}. len is the bit length of the input data m. The padded data m' includes the input data m, a 1-bit high '1', a k-bit low '0', and a 64-bit representation of len. The value k is such that (len + 1 + k) modulo 512 is 448. According to the plurality of microinstructions, the input data m of 512-bit multiple length, or the padded data m', is grouped into n groups of 512-bit input messages, including B(0), …, B(n-1), n being an integer, in units of 512 bits.

[0051] Register ECX stores the length of the input data (m). If EAX = 0, the length of the input data carried by register ECX is counted in bytes. If EAX = -1, the length of the input data carried by register ECX is counted in 64-byte blocks.

[0052] Register ESI stores an input data pointer pointing to a memory space storing the input data m. The memory space described in the present disclosure can be a system memory (e.g., RAM) space coupled to the processor, which can follow the ES segment segmentation technique. Register EDI stores a hash value pointer pointing to a memory space (which can follow the ES segment segmentation technique) storing the initial hash constant V(0).

[0053] In addition, table 204 also shows how the microcode ucode defines the output registers of the ISA SM3 cryptographic algorithm instruction. After the SM3 cryptographic algorithm is completed and the converted hash value V(n) is converted, the registers EAX, ECX, ESI, and EDI are set as follows.

[0054] The input data pointer maintained on the register ESI is increased by an offset. When the register EAX is "0", the offset is the length of the input data managed by the register ECX. When the register EAX is "-1", the offset is the size of the input data carried by the register ECX multiplied by 64. The hash value pointer on the register EDI is not changed, so that the converted hash value V(n) converted by the SM3 cryptographic algorithm is overwritten on the initial hash constant V(0).

[0055] In addition, the register EAX and the register ECX can be adjusted after the SM3 cryptographic algorithm is completed. If the register EAX is set to "0" at the input, the register ECX is not changed, and the register EAX is updated with the value of the register ECX. If the register EAX is set to "-1" at the input, the register ECX is zeroed, and the register EAX is not changed.

[0056] Figure 2B The format 212 of the SM3 cryptographic algorithm instruction of the ISA is illustrated, and the related microcode ucode design is introduced in a table 214. The format 212 is the same as the format 202. After the decoder 110 recognizes the code "0xF3 0x0F 0xA6 0xE8", a plurality of microinstructions are generated according to the microcode ucode, which include defining, using, and managing the architectural registers 124 to operate the cryptographic execution unit 118 on the input data m to perform the SM3 cryptographic algorithm.

[0057] Unlike the microcode ucode design shown in the table 204, which provides the register ESI and the register EDI for the input data pointer and the hash value pointer respectively, Figure 2B The microcode ucode design shown in the table 214 stores an information pointer in the register ESI, which points to a memory space storing an input data pointer and a hash value pointer. The memory space pointed to by the input data pointer stores the input data m, and the memory space pointed to by the hash value pointer stores the initial hash constant V(0). Correspondingly, the output register setting related to the SM3 cryptographic algorithm does not change the register ESI for the microcode ucode design shown in the table 214.

[0058] Figure 2C The format 222 of the SM3 cryptographic algorithm instruction of the ISA is illustrated, and the related microcode ucode design is introduced in a table 224. The format 222 is the same as the format 202 and 212. After the decoder 110 recognizes the code "0xF3 0x0F 0xA6 0xE8", a plurality of microinstructions are generated according to the microcode ucode, which include defining, using, and managing the architectural registers 124 to operate the cryptographic execution unit 118 on the input data m to perform the SM3 cryptographic algorithm.

[0059] With Figure 2AIn contrast, the microcode ucode design shown in table 204 provides register EDI as a hash value pointer, Figure 2C The microcode ucode design shown in table 224 is to fill register EDI with 0 at the beginning of the SM3 cryptographic algorithm, and to set an execution unit internal register inside the cryptographic execution unit 118 to store the converted hash value V(n). As for the output register setting of the SM3 cryptographic algorithm, the microcode ucode design shown in table 224 causes register EDI to store an execution unit register number of the execution unit internal register. As long as register EDI is accessed again by a microinstruction, the execution unit internal register can be found according to the execution unit register number, and the converted hash value V(n) can be obtained as the initial hash constant of the next input data.

[0060] Figure 2D The format 232 of the SM3 cryptographic algorithm instruction of the ISA is illustrated, and the related microcode ucode design is introduced in table 234. Different from the formats 202, 212, and 222, the format 232 has fields InPointer and OutPointer, which respectively store an input data pointer and a hash value pointer, pointing to the input data m and the initial hash constant V(0) stored in the system memory. In this way, the use of the set of architectural registers 124 can be saved. In an embodiment, the fields InPointer and OutPointer of the format 232 of the SM3 cryptographic algorithm instruction are respectively 32 bits. After the decoder 110 recognizes the code “0xF3 0x0F 0xA6 0xE8”, a plurality of microinstructions are generated according to the microcode ucode, including definition, use, and management of the architectural registers 124, among which the register ESI and the register EDI will not be applied.

[0061] Figure 3 An embodiment of the ISA instruction writing is also illustrated. The program code 300 can include the SM3 cryptographic algorithm instruction 302 of the above format 202, 212, 222, or 232. Before the SM3 cryptographic algorithm instruction 302, at least one register setting instruction 304 can be included, which is used to fill the architectural registers 124, to prepare for the execution of the SM3 cryptographic algorithm instruction 302.

[0062] Figure 4 As a flowchart, the step procedure triggered by the SM3 cryptographic algorithm instruction of the ISA according to an embodiment of the present application is illustrated, and a plurality of microinstructions converted according to the SM3 cryptographic algorithm instruction are illustrated.

[0063] Step S402 checks the length of the input data (m), for example, judges the register ECX. If the register ECX is 0, the flow enters step S404, and the execution of the SM3 cryptographic algorithm instruction ends. If the register ECX is not 0, the flow enters step S406.

[0064] Step S406 checks the register EAX to determine if there is a message padding requirement (padding to a multiple of 512 bits). If the register EAX is 0, step S408 performs message padding. The input data m is padded to m' (= m, 1, k{0}, 64{len}). If the register EAX is not 0, the flow skips the message padding step S408. The 512-bit multiple length input data m, or the padded data m', is grouped into n groups of input messages, including B(0), …, B(n-1), n being an integer, in units of 512 bits. Next, the processor 100 converts the specific length of the converted hash value V(n) step by step through steps S410, S412 and S414. First, the flow proceeds to step S410 to start operating the SM3 engine 126 according to an SM3 engine microinstruction.

[0065] Step S410, the initial hash constant V(0) and the first group of 512-bit input messages B(0) are input into the SM3 engine 126 from the system memory space, so that the SM3 engine 126 operates according to the initial hash constant V(0) and the group of input messages B(0). Step S412, the SM3 engine 126 converts an intermediate hash value V(1). Step S414 checks whether the operation on all groups of input messages is completed to continue or stop the loop. In an embodiment, a loop count can be managed by a register temp_gpr inside the password execution unit 118, and the initial value thereof is related to the input values of the registers EAX and ECX. The loop count managed by the register temp_gpr will decrease as the operation of each group of input messages is completed, which can be used to determine whether all input messages B(0), …, B(n-1) of the input data m have been operated to achieve the SM3 password algorithm of the input data m. If there are still input messages to be processed, the flow returns to step S410 to make the SM3 password algorithm engine 126 operate according to the intermediate hash value (e.g., V(1)) and the next group of input messages (e.g., B(1)), and convert to obtain the next intermediate hash value (e.g., V(2)) in step S412. In this way, the processor 100 processes each group of input messages step by step until all groups of input messages are processed to obtain the converted hash value V(n) of a specific length. In an embodiment, the specific length is 256 bits.

[0066] If all groups of input messages B(0), …, B(n-1) have been operated, i.e., the SM3 password algorithm of the input data m is completed, the flow proceeds to step S416 to store the converted hash value V(n). If a 2D design is adopted, the SM3 engine 126 fills the converted hash value V(n) into the system memory; for example, according to the hash value index to overwrite the initial hash constant V(0) in the memory. If a 2D design is adopted, Figure 2A 、 2B or a 2D design, the SM3 engine 126 fills the converted hash value V(n) into the system memory; for example, according to the hash value index to overwrite the initial hash constant V(0) in the memory. If aFigure 2C The SM3 engine 126 is designed to fill the converted hash value V(n) into an execution unit internal register of the password execution unit 118, which can be read out by a microinstruction. In step S418, the SM3 password algorithm instruction execution ends.

[0067] The SM3 engine microinstruction described above corresponds to steps S410 and S412, and repeatedly drives the SM3 engine 126 to complete the hash value conversion (V(i)→V(i+1)) of each group of input messages B(i), so that the initial hash constant V(0) is converted into the converted hash value V(n).

[0068] The operation implemented by the SM3 engine 126 is as follows:

[0069] V(i+1)=CF(V(i),B(i))

[0070] CF is a compression function: each group of 512-bit input messages B(i) is expanded after message expansion, and 64 rounds (j=0~63) of iterative compression are performed to convert a 256-bit hash value V(i+1). The initial hash constant V(0) is converted into the converted hash value V(n) after all groups of input messages B(0)~B(n-1) are operated.

[0071] Figure 5 According to an embodiment of the present application, an SM3 engine 500 is illustrated for implementing the processing of a group of input messages (such as B(i)), in which hardware is used for message expansion 502, iterative compression 504, and includes an accelerator internal storage space M1. The accelerator internal storage space M1 stores constants used by the iterative compression 504.

[0072] After the SM3 engine 500 receives a group of 512-bit input messages B(i), the message expansion 502 is used to expand the group of input messages B(i) into 132 words, including and Then, the iterative compression 504 is used to perform 64 rounds of iterative operations to convert a hash value V(i+1) for use by the next group of 512-bit input messages B(i+1).

[0073] The iterative compression 504 implements the following operation:

[0074]

[0075] where FFj and GGj are Boolean functions, and P0(.) is a permutation function. The iterative compression 504 hardware includes accelerator internal storage spaces M2 and M3, and function hardware 506. The accelerator internal storage space M2 caches the hash value V(i) at the beginning of the 64-round compression operation, i.e., as the parameters A-H. After the function FFj, GGj, P0(.) operations provided by the function hardware 506, the parameters A-H are updated, cached in the accelerator internal storage space M3, and the hash value V(i+1) is converted for use by the next set of 512-bit input messages B(i+1). After all of the input messages B(0)…B(n-1) are operated on, the accelerator internal storage space M3 content is used to store the converted hash value V(n).

[0076] The illustrated initial hash constant (V(0)) 508 is obtained from system memory according to the hash value pointer described above, and is used to fill in the accelerator internal storage space M2 for the first set of 132 words (including and of the iterative compression.

[0077] In one embodiment, the converted hash value V(n) converted after all of the input messages B(0)…B(n-1) are operated on can be stored in the internal space of the crypto execution unit 118 for later fetch by microinstructions. In another embodiment, the converted hash value V(n) is overwritten on the system memory space indicated by the hash value pointer.

[0078] The present application properly protects the intermediate hash values V(1)…V(n-1) in the SM3 engine 500. The present design provides a higher security level for the cryptographic algorithm hardware.

[0079] In one embodiment, the crypto execution unit 118 does not have a specially designed SM3 engine 126, but rather the microcode ucode content is planned so that a single ISA SM3 cryptographic algorithm instruction converts into multiple microinstruction operations on the logic operation unit ALU, i.e., completes the SM3 cryptographic algorithm for the input data m. In particular, this embodiment also protects the intermediate data of the SM3 cryptographic algorithm in the internal storage space of the processor, with high security.

[0080] In one embodiment, the SM3 engine has fewer functional modules than the SM3 engine 500, and the missing functional modules (e.g., the message expansion 502) are implemented using microcode ucode to configure the microinstruction operations on the logic operation unit ALU. This embodiment also has the ability to protect the intermediate data in the internal storage space of the processor.

[0081] In summary, according to one embodiment of the present invention, a processor responds to a single hash cryptographic algorithm instruction of an instruction set architecture (ISA). The processor retrieves input data of a finite length from a first memory space, performs a hash cryptographic algorithm (SM3 cryptographic algorithm) on the input data, and converts it into a converted hash value of a specific length. The present invention completes the SM3 cryptographic algorithm with a single ISA instruction. Using the SM3 engine 126 to implement SM3 cryptographic operations can improve both computational speed and security. Besides implementation with special hardware (SM3 engine 126), there are also embodiments implementing it entirely in microcode.

[0082] This invention also applies the SM3 engine 126 to the elliptic curve public key cryptography algorithm (SM2 cryptography algorithm). The following describes a processor equipped with the SM2 cryptography algorithm.

[0083] Figure 6 This is a block diagram illustrating a processor 600 according to one embodiment of the present invention. Figure 1 In comparison, the cryptographic execution unit 618 includes not only the SM3 engine 126, but also an SM2 engine 626 (i.e., an elliptic curve cryptography accelerator), which will be discussed later. Figure 27 This describes the detailed hardware architecture of the SM2 engine 626. The microcode (ucode) also contains the corresponding SM2 cryptographic algorithm instructions (i.e., elliptic curve cryptography instructions) for the ISA. The decoder 110... Figure 6 The microcode (ucode) decodes the SM2 cryptographic algorithm instructions of the ISA of this invention into multiple microinstructions recognizable by the processor 100 pipeline. It defines, uses, and manages the architecture register 124 to operate the cryptographic execution unit 618, including the SM2 engine 626 and the SM3 engine 126, to perform operations such as encryption, decryption, signing, signature verification, and key exchange of the SM2 cryptographic algorithm. In particular, this invention properly hides the key intermediate variables of the SM2 cryptographic algorithm within the processor, resulting in a very high level of security. Intermediate variables with lower security requirements can be temporarily stored in system memory (e.g., RAM outside the processor) to save internal processor storage space.

[0084] Figure 7According to an embodiment of the present application, the format 702 of the SM2 cryptographic algorithm instruction of the ISA is illustrated. The prefix, opcode, and field ModR / M of the format 702 are: 0xF2 0x0F 0xA6 0xC0. The fields SIB, Displacement, and Immediate are non. After the decoder 110 recognizes the code “0xF2 0x0F 0xA6 0xC0”, it generates a plurality of microinstructions according to the microcode ucode, including querying a control word stored in one of the architecture registers 124, the register EDX, to determine which operation of the SM2 cryptographic algorithm is being performed. The control word can be represented by 6 bits, and the corresponding operations are as follows:

[0085] • 6’b 000001: Encryption.

[0086] • 6’b 000010: Decryption.

[0087] • 6’b 000100: Signature.

[0088] • 6’b 001000: Verify signature.

[0089] • 6’b 010000: Key exchange 1.

[0090] • 6’b 010001: Key exchange 2, don’t calculate hash.

[0091] • 6’b 010101: Key exchange 2, calculate hash.

[0092] • 6’b 010010: Key exchange 3, don’t calculate hash.

[0093] • 6’b 010110: Key exchange 3, calculate hash.

[0094] • 6'b 100000: First preprocess operation (Preprocessl to calculate value Z of user's identification).

[0095] • 6'b 100001: Second preprocess operation (Preprocess2 to calculate hash value for Z and message M).

[0096] The encryption operation of the SM2 cryptographic algorithm is first discussed.

[0097] Figure 8 The microcode ucode design of the corresponding encryption operation is explained in Table 804, showing how the contents of the architectural registers 124 are interpreted for the microinstructions generated. The aforementioned control word 6'b 000001 (cw) is stored in the input register EDX in advance to indicate that an encryption operation is to be performed. In addition to the input register EDX, Table 804 also lists the input registers EAX, EBX, ECX, ESI, EDI as the input registers for the start of the encryption operation. The completion of the encryption operation indicated by an SM2 cryptographic algorithm instruction of the ISA includes filling the output registers EAX, ECX, EDI. The application of the input or output registers can also have other implementations.

[0098] As an input register, the register EAX stores a plaintext input M pointer pointing to a memory space (which can be provided by a system memory coupled to the processor, such as a RAM, and can follow the ES segment segmentation technique) storing a plaintext input M. The register EBX stores an encryption public key P B pointer pointing to a memory space (which can follow the ES segment segmentation technique) storing an encryption public key P B The register ECX stores the number of bytes of the plaintext input M. The register EDX stores the control word cw indicating the encryption code (6'b 000001). The register ESI stores an intermediate variable pointer pointing to a memory space (also referred to as a scratch space, which can store an intermediate variable with high security, can be 8K in size, can follow the ES segment segmentation technique, can be initialized to all 0, and can be obtained by requesting the system memory from the operating system by software). In one implementation, the intermediate variable is a parameter used in the calculation. For example, the intermediate variables involved in the point multiplication function include the point coordinates after coordinate system conversion, or the intermediate values involved in the coordinate system conversion, etc. The register EDI stores a ciphertext output C pointer pointing to a memory space (which can follow the ES segment segmentation technique) specifying the storage of a ciphertext output C.

[0099] After the encryption operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the adjustment of the output registers includes: increasing the pointer stored in the register EAX by a displacement, the displacement being the number of bytes of the plaintext input M; causing the register ECX to store the number of bytes of the ciphertext output C; and increasing the pointer stored in the register EDI by a displacement, the displacement being the number of bytes of the ciphertext output C.

[0100] Figure 9A 、 9B As shown in FIG. 6, the SM2 cryptographic algorithm instruction of the ISA triggers a plurality of microinstructions, which are converted from the SM2 cryptographic algorithm instruction, to perform the encryption operation.

[0101] Starting from Figure 9A Step S902 inputs a hardware operation control word (obtained from the input register EDX) into the SM2 engine 626, and uses a point multiplication hardware of the SM2 engine 626 to calculate an elliptic curve point C1, where C1 = [k]G, k is a random number, and k ∈ [1, n-1]. G is one of elliptic curve parameters, which is provided by microcode ucode, and is a base point of the elliptic curve. The SM2 engine 626 returns the elliptic curve point C1. Step S902 can include execution of a point multiplication hardware operation microinstruction. The cryptographic execution unit 618 can include a random number generator, which is operated by a random number generation microinstruction to generate the random number k.

[0102] Step S904 inputs the hardware operation control word and the encryption public key P B (obtained according to a pointer stored in the input register EBX) into the SM2 engine 626, and uses the point multiplication hardware to calculate an elliptic curve point S, where S = [h]P B . h is one of elliptic curve parameters, and is a cofactor of the elliptic curve. The SM2 engine 626 returns the elliptic curve point S. Step S904 can include execution of a point multiplication hardware operation microinstruction.

[0103] Step S906 checks whether the elliptic curve point S is a zero point (the zero point is a special point on the elliptic curve, also referred to as an infinitely far point). If yes, the flow proceeds to step S908, and the processor generates an encryption failure prompt. If no, the flow proceeds to step S910, and inputs the hardware operation control word and the encryption public key P B into the SM2 engine 626, and uses the point multiplication hardware to calculate an elliptic curve point (x2, y2) = [k]P B . The SM2 engine 626 returns the elliptic curve point (x2, y2). Step S910 can include execution of a point multiplication hardware operation microinstruction.

[0104] Step S912 performs key derivation based on the one-bit length klen of the plaintext input M (obtained from the plaintext input M pointer stored in the input register EAX), and calculates: t = KDF(x2||y2,klen), where KDF is the key derivation function (i.e., the key derivation function), and x2||y2 represents the concatenation of x2 and y2.

[0105] Step S914 checks if the key t derived from the value is zero (i.e., determines if t is a string of all zero bits). If yes, the process returns to step S902, updates the random number k, and recalculates the elliptic curve point C1 and S. If no, the process continues. Figure 9B In step S916, the plaintext input M is loaded from the system memory into the processor 600, and an XOR operation is performed to generate partial ciphertext C2: C2 = M⊕t.

[0106] Step S918 inputs the hardware operation control word and the completed message filling value (x2||M||y2) into the SM2 engine 626. Using a preprocessing unit of the SM2 engine 626, the value (x2||M||y2) is preprocessed, such as grouped, before being input into the SM3 engine 126 (the process of using the SM3 engine is described above). Figure 4 Steps S410, S412, and S414 implement the hash operation: C3 = Hash(x2||M||y2), where Hash is the cryptographic hash function, and x2||M||y2 represents the concatenation of x2, M, and y2. The SM2 engine 626 returns a portion of the ciphertext C3. Step S918 may include the execution of a preprocessing hardware operation microinstruction, or even an SM3 engine microinstruction.

[0107] Step S920 loads the ciphertext output C into the system memory according to the ciphertext output C pointer stored in the input register EDI, where C = C1||C2||C3, and C1||C2||C3 represents the concatenation of C1, C2, and C3. Step S922 ends the encryption operation triggered by this SM2 cryptographic algorithm instruction. In another embodiment, C = C1||C3||C2.

[0108] In summary, in response to a single elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a plaintext input M from a first memory space and uses a public key P obtained through a register (e.g., EBX). BAn encryption operation of the elliptic curve cryptography algorithm (SM2 cryptographic algorithm) is performed on the plaintext input M, and the plaintext input M is encrypted into a ciphertext output C, and the ciphertext output C is written into a second memory space. The encryption operation of the SM2 cryptographic algorithm is completed by a single ISA instruction. Compared with the encryption operation of the elliptic curve cryptography algorithm implemented by the SM2 engine 626 alone, the simultaneous use of the SM2 engine 626 and the SM3 engine 126 can improve the operation speed and security. In addition to being implemented with the assistance of special hardware (SM3 engine 126, SM2 engine 626), there are also full microcode implementation embodiments.

[0109] Then the decryption operation of the SM2 cryptographic algorithm is discussed.

[0110] Figure 10 The microcode ucode design of the corresponding decryption operation is illustrated in table 1004, which shows how to interpret the contents of the architecture register 124 corresponding to the generated microinstruction. The aforementioned control word 6'b 000010 (cw) is stored in the input register EDX in advance to indicate the decryption operation. In addition to the input register EDX, table 1004 also lists the input registers EAX, EBX, ECX, ESI, EDI as the input registers for the start of the decryption operation. The completion of the decryption operation indicated by the SM2 cryptographic algorithm instruction of the ISA includes filling the output registers EAX, ECX, EDI. The application of input or output registers can also have other implementation manners.

[0111] As an input register, the register EAX stores a ciphertext input C pointer pointing to a memory space (which can follow the ES segment segmentation technology) storing a ciphertext input C, wherein, as described above, the ciphertext C=C1||C2||C3 (in another embodiment, C=C1||C3||C2). The register EBX stores a decryption private key d B pointer pointing to a memory space (which can follow the ES segment segmentation technology) storing a decryption private key d B The register ECX stores the number of bytes of the ciphertext input C. The register EDX stores the control word cw indicating the decryption code (6'b 000010). The register ESI stores an intermediate variable pointer pointing to a memory space (also called scratch space, which can temporarily store intermediate variables with high security, can be 8K in size, can follow the ES segment segmentation technology, can be initialized to all 0, and can be requested by software to plan memory from the operating system). The register EDI stores a plaintext output M' pointer pointing to a memory space (which can follow the ES segment segmentation technology) specifying the storage of a plaintext output M'.

[0112] After the decryption operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the adjustment of the output registers includes: increasing the pointer stored in the register EAX by a displacement of the number of bytes of the ciphertext input C; causing the register ECX to store the number of bytes of the plaintext output M'; and increasing the pointer stored in the register EDI by a displacement of the number of bytes of the plaintext output M'.

[0113] Figure 11A 、 11B The flowchart illustrates the decryption operation triggered by the SM2 cryptographic algorithm instruction of a single ISA according to an embodiment of the present application, and a plurality of microinstructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0114] Starting from Figure 11A , step S1102 loads a part of the ciphertext C1 (C1 is an elliptic curve point, hereinafter also referred to as point C1) from the system memory to the processor 600 according to the ciphertext input C pointer stored in the input register EAX (i.e., C1 is taken from the ciphertext and then loaded to the processor 600). Step S1104 verifies whether the point C1 conforms to an elliptic curve equation. If not, the flow proceeds to step S1106, the processor outputs a decoding failure prompt, reports an error and exits the decryption operation. Otherwise, if C1 conforms to the elliptic curve equation, the flow proceeds to step S1108.

[0115] Step S1108 inputs a hardware operation control word (taken from the input register EDX) and the point C1 to the SM2 engine 626, uses the point multiplication hardware to calculate an elliptic curve point S, where S = [h]C1. The SM2 engine 626 returns the elliptic curve point S. Step S1108 can include the execution of a point multiplication hardware operation microinstruction.

[0116] Step S1110 verifies whether the elliptic curve point S is a zero point. If yes, it is determined that the decoding fails, and the flow proceeds to step S1106, the processor outputs a decoding failure prompt. If the elliptic curve point S is not a zero point, the flow proceeds to step S1112, the hardware operation control word and the decryption private key d B are input to the SM2 engine 626, and the point multiplication hardware is used to calculate an elliptic curve point (x2, y2) = [d B ]C1. The SM2 engine 626 returns the elliptic curve point (x2, y2). Step S1112 can include the execution of a point multiplication hardware operation microinstruction.

[0117] Step S1114 performs key derivation based on a bit length klen of a part of the ciphertext C2 (i.e., C2 in the ciphertext, obtained from the system memory according to the ciphertext input C pointer stored in the input register EAX): t = KDF(x2||y2, klen).

[0118] Step S1116 checks if the derived key t is zero (i.e., determines if t is a string of all zero bits). If yes, step S1106 determines that decoding has failed, and the processor outputs a decoding failure message. If no, the process continues. Figure 11B In step S1118, the ciphertext C2 is loaded from system memory into processor 600 and XORed: M' = C2 ⊕t.

[0119] Step S1120 inputs the hardware operation control word and the value (x2||M'||y2) for completing message filling into the SM2 engine 626. Using the preprocessing hardware, the value (x2||M'||y2) is preprocessed, such as grouped, and then input into the SM3 engine 126 (the process of using the SM3 engine is described above). Figure 4 Steps S410, S412, and S414 implement the hash operation: u = Hash(x2||M'||y2), where Hash is the cryptographic hash function, and x2||M'||y2 represents the concatenation of x2, M', and y2. The SM2 engine 626 returns the hash value u. Step S1120 may include the execution of a preprocessing hardware operation microinstruction, or even an SM3 engine microinstruction.

[0120] Step S1122 verifies whether the hash value u is equal to a portion of the ciphertext C3 (obtained from system memory based on the ciphertext input C pointer stored in the input register EAX). If not, decoding fails, and the process proceeds to step S1106, with the processor outputting a decoding failure message. If the hash value u is equal to a portion of the ciphertext C3, step S1124 loads the plaintext output M' into system memory based on the plaintext output M' pointer stored in the input register EDI. Step S1126 terminates the decryption operation triggered by this single SM2 cryptographic algorithm instruction.

[0121] In summary, in response to a single elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a ciphertext input C from a first memory space and uses the private key d obtained through the first register. B An elliptic curve cryptography (ECC) decryption operation is performed on the ciphertext input C, decrypting the ciphertext input C into a plaintext output M', and writing the plaintext output M' into a second memory space. This invention completes the decryption operation of the SM2 cryptographic algorithm with a single ISA instruction. Compared to using only the SM2 engine 626 to implement the decryption operation of the elliptic curve cryptography algorithm, using both the SM2 engine 626 and the SM3 engine 126 simultaneously can improve both the operation speed and security. Besides implementation with special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0122] The signature operation of the SM2 cryptographic algorithm is then discussed, in which a hash value is calculated using a first preprocessing operation and a second preprocessing operation. The first preprocessing operation and the second preprocessing operation will be discussed in detail later.

[0123] Figure 12 The microcode ucode design of the corresponding signature operation is illustrated in Table 1204, which shows how the contents of the architectural registers 124 are interpreted according to the microinstructions generated. The aforementioned control word 6’b 000100 (cw) is stored in the input register EDX in advance to indicate that the signature operation is performed. In addition to the input register EDX, Table 1204 also lists the input registers EAX, EBX, ESI, and EDI as the input registers for the initial signature operation. The completion of the signature operation indicated by the SM2 cryptographic algorithm instruction of the ISA includes filling the output registers ECX and EDI. The application of the input or output registers can also have other implementations.

[0124] As an input register, the register EAX stores a hash value e pointer, which points to a memory space (which can follow the ES segment segmentation technique) storing the hash value e generated by the first preprocessing operation and the second preprocessing operation on a data to be signed M and pre-stored in the memory space. The register EBX stores a private key d A pointer, which points to a memory space (which can follow the ES segment segmentation technique) storing a private key d A of a signer. The register EDX stores the control word cw indicating the signature code (6’b 000100). The register ESI stores an intermediate variable pointer, which points to a memory space (also referred to as a scratch space, which can store an intermediate variable with high security, can be 8K in size, can follow the ES segment segmentation technique, can be initialized to all 0, and can be requested by software to plan from the operating system). The register EDI stores a signature (r, s) pointer, which points to a memory space (which can follow the ES segment segmentation technique) specifying the storage of the signature (r, s).

[0125] After the completion of the signature operation indicated by the SM2 cryptographic algorithm instruction of the ISA, the adjustment of the output registers includes: storing the number of bytes of the signature (r, s) in the register ECX; and increasing the signature pointer stored in the register EDI by a displacement, which is the number of bytes of the signature (r, s).

[0126] Figure 13 The flowchart illustrates the signature operation triggered by an SM2 cryptographic algorithm instruction according to an embodiment of the present application, and a plurality of microinstructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0127] Step S1302 inputs a hardware operation control word (taken from the input register EDX) into the SM2 engine 626, and uses the dot multiplication hardware to calculate an elliptic curve point (x1, y1) = [k]G. The SM2 engine 626 returns the elliptic curve point (x1, y1). k is a random number. G is the base point of the elliptic curve. Step S1302 may include the execution of a dot multiplication hardware operation microinstruction.

[0128] Step S1304 loads the hash value e from the system memory into the processor 600 based on the pointer to the hash value e stored in the input register EAX, and calculates a value r = (e + x1) mod n. n is one of the parameters of the elliptic curve and is the order of the base point G.

[0129] Step S1306 verifies whether the value r is zero, or whether r+k is n. If r is zero, or / and r+k is n, the process returns to step S1302, and the dot product is performed on the hardware again with a new random number k. If r is not zero and r+k is not n, the process proceeds to step S1308.

[0130] Step S1308 uses the private key d stored in the input register EBX. A The pointer retrieves the signer's private key from system memory. A Loaded into the processor 600, the value (1+d) is calculated. A ) -1 The SM2 engine 626 is used to input a value of order n, and its modular inverse hardware is used to calculate a value s' = (1 + d). A ) -1 mod n. Based on the numerical value s', the SM2 engine 626 performs a modular multiplication hardware calculation to produce a numerical value s = (s' * (kr * d). A Modulo inversion hardware can receive a first modular inversion input and a second modular inversion input, and generate a modular inversion output. Modulo multiplication hardware can receive a first modular multiplication input, a second modular multiplication input, and a third modular multiplication input, and generate a modular multiplication output. When r is not zero and r+k is not n, the processor executes the modular inversion hardware operation microinstruction and the modular multiplication hardware operation microinstruction provided by the multiple microinstructions. In response to the modular inversion hardware operation microinstruction, the modular inversion hardware performs a modular inversion operation, s' = (1+d A ) -1 mod n, (1+d) A ) is the first modular inverse input, n is the second modular inverse input, and s' is the modular inverse output. Responding to the modular multiplication hardware operation microinstruction, the modular multiplication hardware performs a modular multiplication operation s = (s' * (kr * d)). A ))mod n, s' is the first modular multiplication input, (kr*dA ) is the second modular multiplication input, n is the third modular multiplication input, and s is the modular multiplication output.

[0131] Step S1310 verifies whether the value s is zero. If yes, the flow returns to step S1302 to operate the point multiplication hardware again with a new random number k. If s is not zero, in step S1312, the processor loads the signature (r, s) into the system memory according to the signature (r, s) pointer stored in the input register EDI, and loads the length of the signature (r, s) into the register ECX. Step S1314 ends the signature operation triggered by the SM2 cryptographic algorithm instruction.

[0132] In summary, in response to an elliptic curve cryptographic algorithm instruction (SM2 cryptographic algorithm instruction) of an instruction set architecture (ISA), a processor obtains a hash value (e) of a data to be signed (M) from a first memory space through a first register (EAX), obtains a private key (d A ) of a signer through a second register, performs a signature operation of an elliptic curve cryptographic algorithm on the hash value (e) with the private key (d A ) to generate a signature (r, s), and writes the signature (r, s) into a second memory space. The present application completes the signature operation of the SM2 cryptographic algorithm with the instruction of the ISA. Using the SM2 engine 626 to implement the signature operation of the elliptic curve cryptographic algorithm can improve the operation speed and security. In addition to being implemented with special hardware (SM2 engine 626), there are also embodiments implemented with full microcode.

[0133] Next, the signature verification operation of the SM2 cryptographic algorithm is discussed, in which the first preprocessing operation and the second preprocessing operation, which are discussed in detail later, are also used. The first preprocessing operation and the second preprocessing operation are used to calculate a hash value e' for a data to be verified M'.

[0134] Figure 14 The microcode ucode design corresponding to the signature verification operation is illustrated in table 1404, which shows how the generated microinstructions interpret the contents of the architecture registers 124. The aforementioned control word 6' b 001000 (cw) is stored in the input register EDX in advance to indicate that the signature verification operation is performed. In addition to the input register EDX, table 1404 also lists the input registers EAX, EBX, ESI, and EDI as the input registers for starting the signature verification operation. The completion of the signature verification operation indicated by an SM2 cryptographic algorithm instruction of an ISA includes filling the output register ECX. The application of the input or output registers can also have other implementations.

[0135] As an input register, register EAX stores a hash value e' pointer, pointing to a memory space (may follow ES segment segmentation technology) storing a hash value e'. The hash value e' is generated based on a to-be-verified data M' by the first preprocessing operation and the second preprocessing operation. Register EBX stores a public key P A pointer, pointing to a memory space (may follow ES segment segmentation technology) storing a public key P A of a signer. Register EDX stores a control word cw indicating a verification signature code (6'b001000). Register ESI stores an intermediate variable pointer, pointing to a memory space (also referred to as scratch space, which can temporarily store an existing high-security intermediate variable, can be 8K in size, can follow ES segment segmentation technology, and can be initialized to all 0s, and can be applied to an operating system by software). Register EDI stores a signature (r', s') pointer, pointing to a memory space (may follow ES segment segmentation technology) storing a signature (r', s').

[0136] With the end of the signature verification operation indicated by the SM2 cryptographic algorithm instruction of the ISA, the output register is adjusted to include filling register ECX with "1" to represent that the signature verification passes, or with "0" to represent that the signature verification fails.

[0137] Figure 15 As a flowchart, the signature verification operation triggered by an SM2 cryptographic algorithm instruction according to an embodiment of the present application is illustrated, and a plurality of microinstructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0138] Step S1502 loads the signature (r', s') from the system memory to the processor 600 according to the signature (r', s') pointer saved in the input register EDI. Step S1504 checks two conditions: r' ∈ [1, n-1]; and s' ∈ [1, n-1]. The value n is the order of the elliptic curve base point G. If either condition is not established, step S1506 determines that the signature verification operation fails (for example, register ECX is filled with 0). If both conditions are established, step S1508 calculates the value t = (r' + s') mod n. Step S1510 checks whether the value t is zero. If yes, step S1506 determines that the signature verification operation fails. If no, the flow proceeds to step S1512.

[0139] Step S1512 inputs a hardware operation control word (taken from the input register EDX), the value t, and the signature s' to the SM2 engine 626, and uses the point multiplication hardware to calculate an elliptic curve point (x1', y1') = [s']G + [t]P AThe SM2 engine 626 returns the elliptic curve point (x1', y1'). Step S1512 may involve two dot product hardware operation microinstructions. The first operation calculates [s']G using the SM2 engine 626. The second operation calculates [t]P using the SM2 engine 626. A .

[0140] Step S1514: Based on the hash value e' pointer stored in the input register EAX, load the hash value e' of the data to be verified M' (which is calculated by the first and second preprocessing operations and stored in the system memory) from the system memory into the processor 600, and calculate a signature R = (e' + x1') mod n.

[0141] Step S1516 verifies whether signature R is equal to signature r'. If not, step S1506 determines that the signature verification operation has failed and fills the output register ECX with 0. If yes, step S1518 determines that the signature verification operation has succeeded and fills the output register ECX with 1. In another embodiment, filling the output register ECX with 1 indicates that the signature verification operation has failed, while filling the output register ECX with 0 indicates that the signature verification operation has succeeded. In summary, the present invention is not limited to specific numerical values ​​used to indicate the success or failure of the signature verification operation. Step S1520 ends the signature verification operation triggered by the SM2 cryptographic algorithm instruction.

[0142] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic algorithm instruction) of an instruction set architecture (ISA), a processor obtains a hash value e' of the data to be verified M' through a first register (EAX) and obtains the signer's public key P through a second register (EBX). A A signature (r', s') is obtained through a third register. Using the public key and the signature, an elliptic curve cryptography (ECC) signature verification operation is performed on the hash value, and the verification result is stored. This invention completes the SM2 cryptographic algorithm signature verification operation with this single ISA instruction. Using the SM2 engine 626 to implement the elliptic curve cryptography signature verification operation can improve both speed and security. Besides implementation with special hardware (SM2 engine 626), there are also fully microcode implementations.

[0143] Next, the key exchange function of the SM2 cryptographic algorithm is discussed, which uses a first key exchange procedure, a second key exchange procedure, and a third key exchange procedure. The second and third key exchange procedures each have versions involving hash values ​​and versions that do not. One embodiment of this invention designs an instruction set architecture with three elliptic curve cryptography instructions (three SM2 cryptographic algorithm instructions). The initiating processor generates a key pair (r) using the first elliptic curve cryptography instruction. A ,R A Based on the first temporary public key RA and its own generated second temporary public key R B The responder processor executes the second elliptic curve cryptography instruction to generate the responder's shared public key K. B Based on temporary private key r A and temporary public key R A With R B The initiator executes the third elliptic curve cryptography algorithm instruction to generate the initiator's shared public key K. A .

[0144] Figure 16 Table 1604 illustrates the microcode design for the corresponding first key exchange procedure, showing how the microinstructions generated by the first SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word 6'b 010000(cw) is pre-stored in the input register EDX to indicate that a first key exchange procedure operation is being performed. In addition to the input register EDX, Table 1604 also lists the input registers ESI and EDI, both serving as input registers for initiating the first key exchange procedure operation. The completion of the first key exchange procedure operation indicated by an ISA's SM2 cryptographic algorithm instruction includes filling the output register EDI. Other implementations are also possible for the use of input or output registers.

[0145] When used as an input register, register EDX stores the control word cw, which indicates the first program code for key exchange (6'b010000). Register ESI stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratchspace, which can temporarily store existing high-security intermediate variables, up to 8KB in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by software from the operating system). Register EDI stores an output key pair (r A ,R A ) pointer, indicating the key pair (r A ,R A Storage can be moved to a single memory location (which may follow ES segmentation technology).

[0146] Once the first key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, has ended, the output register ECX remains unchanged.

[0147] Figure 17 This is a flowchart illustrating the first procedure operation of key exchange triggered by an SM2 cryptographic algorithm instruction according to one embodiment of the present invention, and the multiple microinstructions converted from the corresponding SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the initiator of the key exchange.

[0148] Step S1702 inputs a hardware operation control word (taken from input register EDX) into the SM2 engine 626, using the point multiplication hardware, to compute an elliptic curve point R A = [r A ] G = (x1, y1). r A is a random number, as the initiator's ephemeral private key. R A is the first ephemeral public key. Step S1702 can include execution of a point multiplication hardware operation microinstruction, and can also include a random number generation microinstruction that operates a random number generator within the cryptographic execution unit 618 to generate a random number as the ephemeral private key r A .

[0149] Step S1704 checks two conditions: x1∈[1, p-1], and y1∈[1, p-1], where p is a 256-bit prime number. If either condition is not satisfied, flow returns to step S1702 to update the key pair (r A , R A ) with a new random number. If both conditions are satisfied, step S1706 checks whether the first ephemeral public key R A satisfies an elliptic curve (i.e., whether it satisfies the elliptic curve equation, as follows). If not, flow returns to step S1702 to update the key pair (r A , R A ) with a new random number. If so, step S1708 loads the key pair (r A , R A ) into memory according to an output key pair (r A , R A ) pointer held in input register EDI. Step S1710 ends the first procedure operation of the SM2 cryptographic algorithm. The key pair (r A , R A ) is retained at the initiator for use in later generation of an initiator shared key K A . The first ephemeral public key R A is also to be communicated (e.g., over a network) to the responder, to enable the responder to perform the second procedure operation of the key exchange.

[0150] Figure 18Table 1804 illustrates the microcode design for the corresponding second key exchange procedure, showing how the microinstructions generated by the second SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b010001 (without hash value) or 6'b 010101 (with hash value) is pre-stored in the input register EDX to indicate whether the second key exchange procedure involves a hash value or not. Besides the input register EDX, Table 1804 lists the input registers EAX, ECX, ESI, and EDI, all serving as input registers for initiating the second key exchange procedure. The completion of the second key exchange procedure indicated by an ISA's SM2 cryptographic algorithm instruction includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0151] When used as an input register, register EAX stores a key exchange information pointer, which points to stored key exchange information in memory (following ES segmentation technology). This key exchange information includes: the initiator's first temporary public key R. A ; Responder's private key d B Response party public key P B Initiator's public key P A Initiator's Identifier (i.e., the distinguishing identifier, the same below) Bit Length ID A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID B The ECX register stores the shared key bit length (klen). The shared key bit length klen depends on the intended use of the key by both communicating parties; for example, for SM4 encryption, the shared key bit length klen can be 128 bits / 192 bits / 256 bits. The EDX register stores one of two control words cw indicating the second key exchange procedure (one of two types of second key exchange procedure codes: 6'b 010001 without hash value, or 6'b010101 with hash value). The ESI register stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratchspace, which can temporarily store existing high-security intermediate variables, can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by software from the operating system). The EDI register stores a shared key pointer, indicating the shared key K generated by the responder. B The second temporary public key R B Even hash values ​​S2 and S B(Optional; do not use if hash values ​​are not involved, use if hash values ​​are involved) to the memory storage (can follow ES segmentation technology).

[0152] As the second key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, ends, the output register EDI remains unchanged.

[0153] Figure 19A , 19B This is a flowchart illustrating a second program operation for key exchange triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention. The flowchart describes multiple microinstructions derived from the SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the responding party in the key exchange.

[0154] Beginning Figure 19A In step S1902, a hardware operation control word (taken from the input register EDX) is input into the SM2 engine 626. Using this dot multiplication hardware, a point R on an elliptic curve is calculated. B =[r B G = (x², y²). B R is a random number, used as the temporary private key for the responder. B This is the second temporary public key. Step S1902 may include the execution of a multiplication hardware operation microinstruction, and may also include a random number generation microinstruction to operate a random number generator within the cryptographic execution unit 618 to generate a random number as the temporary private key r. B .

[0155] Step S1904: Calculate the numerical value Where w is a constant.

[0156] Step S1906: Determine the initiator's first temporary public key R. A Does the responder also conform to an elliptic curve, where the first temporary public key R... A The key exchange information pointer is retrieved from system memory based on the key exchange information pointer stored in the input register EAX. If not, proceed to step S1908, and the processor outputs a key exchange negotiation failure message. If yes, step S1910 loads the first temporary public key R from memory. A Find the x-coordinate x1 and calculate a numerical value.

[0157] Step S1912 will change the value t B , Initiator's public key P A and the first temporary public key R A Inputting the SM2 engine 626, using the dot product hardware, calculates the points of an elliptic curve. Step S1912 may include the execution of two dot product hardware operation microinstructions, one of which calculates... Another calculation

[0158] Step S1914 determines whether point V on the elliptic curve is an infinite point (also known as the point of infinity or zero). If yes, proceed to step S1908, and the responding party outputs a key exchange negotiation failure message. If no, the process continues... Figure 19B Step S1916.

[0159] Step S1916: Based on the key exchange information pointer stored in the input register EAX, retrieve the initiator's identity identifier (bit length ID) from system memory. A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID B Loaded into processor 600, the identity hash value Z is calculated. A and Z B Then, key derivation is performed to calculate the responder's shared key K. B =KDF(x V ||y V ||Z A ||Z B (klen). In one implementation, the identity hash value Z A and Z B It was calculated using the first preprocessing operation.

[0160] Step S1918 checks the control word cw stored in register EDX to determine whether to output the hash value calculation result. If not (6'b 010001), step S1920 sends the responder's shared key K. B and the second temporary public key R B The key is loaded into system memory, and then the second program operation of key exchange triggered by an SM2 cryptographic algorithm instruction ends in step S1922. Otherwise (cw = 6'b010101), the process proceeds to steps S1924 and S1926.

[0161] Step S1924: Calculate hash value S2.

[0162] S2 = Hash(0x03||y V ||Hash(x V ||Z A ||Z B ||x1||y1||x2||y2)).

[0163] Step S1926: Calculate the hash value S B ,

[0164] S B =Hash(0x02||y V ||Hash(x V ||Z A ||Z B ||x1||y1||x2||y2)).

[0165] Step S1928: Based on the shared key pointer stored in the input register EDI, the responder's shared key K... B Second temporary public key R B Hash value S2 and S B The key is loaded into system memory, and then step S1922 terminates the second program operation of key exchange triggered by an SM2 cryptographic algorithm instruction. The second temporary public key R... B It also needs to be transmitted (e.g., via a network) to the initiator so that the initiator can perform the third-party program operation of key exchange.

[0166] Figure 20 Table 2004 illustrates the microcode design for the corresponding third key exchange procedure, showing how the microinstructions generated by the corresponding third SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b010010 (without hash value) or 6'b 010110 (with hash value) is pre-stored in the input register EDX to indicate whether the third key exchange procedure involves a hash value or not. In addition to the input register EDX, Table 2004 also lists the input registers EAX, ECX, ESI, and EDI, all of which serve as input registers for initiating the third key exchange procedure. The completion of the third key exchange procedure indicated by an ISA's SM2 cryptographic algorithm instruction includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0167] When used as an input register, register EAX stores a key exchange information pointer, pointing to the key exchange information stored in memory. This key exchange information includes: the initiator's temporary private key r. A The initiator's first temporary public key R A The second temporary public key R provided by the responder B Response party public key P B Initiator's private key d A Initiator's public key P A Initiator Identifier Length (ID) A _len, Initiator Identifier ID A Length of responder identifier (ID) B _len, and the responder's identifier ID BThe ECX register stores the bit length (klen) of a shared key. The EDX register stores one of two control words (cw) indicating the second key exchange procedure (one of two types of code names for the second key exchange procedure: 6'b 010010 without a hash value, or 6'b 010110 with a hash value). The ESI register stores a pointer to an intermediate variable, pointing to a system memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables; it can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by the software from the operating system). The EDI register stores a shared key pointer, indicating the shared key K generated by the initiator. A Even hash values ​​S1 and S A (Optional; do not use if hash values ​​are not involved, use if hash values ​​are involved) to the memory storage (can follow ES segmentation technology).

[0168] Once the third key exchange procedure, as indicated by the SM2 cryptographic algorithm instruction of this ISA, has finished, the output register EDI remains unchanged.

[0169] Figure 21A , 21B This is a flowchart illustrating a third-stage key exchange operation triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention. The flowchart shows multiple micro-instructions derived from the SM2 cryptographic algorithm instruction. This SM2 cryptographic algorithm instruction is executed by the initiator of the key exchange.

[0170] Beginning Figure 21A In step S2102, the first temporary public key R is retrieved from system memory based on the key exchange information pointer stored in the input register EAX. A The x-coordinate x1 is loaded into processor 600 for calculation. Step S2104 retrieves the initiator's private key d from system memory. A Loaded to processor 600, calculation Step S2106 determines the second temporary public key R provided by the responder. B Does it conform to the initiator's elliptic curve? If not, step S2108 causes the processor to output a key exchange negotiation failure message. Otherwise, step S2110 uses the second temporary public key R... B Calculate the x2 coordinate value

[0171] Step S2112 will change the value t A , Response public key P B Second temporary public key R BInputting the SM2 engine 626, using the dot product hardware, calculates the points of an elliptic curve. The SM2 engine 626 returns the elliptic curve point U. Step S2112 may include the execution of two dot product hardware operation microinstructions, one of which calculates... Another calculation

[0172] Step S2114 determines whether point U on the elliptic curve is an infinite point. If yes, step S2108 causes the processor to output a key exchange negotiation failure message. If no, the process continues. Figure 21B Step S2116.

[0173] Step S2116: Based on the key exchange information pointer stored in the input register EAX, retrieve the initiator's identity identifier (bit length ID) from system memory. A _len, Initiator Identifier ID A Response Identifier Bit Length (ID) B _len, and the responder's identifier ID B Loaded into processor 600, the identity hash value Z is calculated. A and Z B Then, key derivation is performed to calculate the initiator's shared key K. A =KDF(x U ||y U ||Z A ||Z B (klen). In one implementation, the identity hash value Z A and Z B It was calculated using the first preprocessing operation.

[0174] Step S2118 checks the control word cw stored in register EDX to determine whether to output the hash value calculation result. If not (6'b 010010), step S2120 sends the initiator's shared key K. A The key is loaded into system memory, and then the third program operation of key exchange triggered by an SM2 cryptographic algorithm instruction ends in step S2122. If (cw = 6'b 010110), the process proceeds to steps S2124 and S2126.

[0175] Step S2124 Calculate the hash value S A ,

[0176] S A =Hash(0x03||y U ||Hash(x U ||Z A ||Z B||x1||y1||x2||y2)).

[0177] Step S2126 calculates the hash value S1.

[0178] S1 = Hash(0x02||y U ||Hash(x U ||Z A ||Z B ||x1||y1||x2||y2)).

[0179] Step S2128: Based on the shared key pointer stored in the input register EDI, the initiator's shared key K is... A Hash value S A And S1 is loaded into the system memory, and then the third program operation of key exchange triggered by the SM2 cryptographic algorithm instruction is ended by step S2122.

[0180] Taking an example that considers hash values, the initiator's S A And S1 will interact with the responder's S2 and S B The comparison is used to determine whether the key exchange negotiation was successful.

[0181] Figure 22 This invention illustrates how an initiator and a responder achieve key exchange using the first to third key exchange procedures proposed in this invention, according to one embodiment. The initiator and the responder can communicate with each other. In one embodiment, each of the initiator and the responder has a processor (600). In another embodiment, the processors of the initiator and the responder are the same (e.g., processor 600). In yet another embodiment, the initiator and / or the responder is an encryption card. In summary, this invention does not limit the specific form of the initiator and the responder.

[0182] Step S2202 enables the initiator to prepare the raw data, including: elliptic curve system parameters, identity hash value Z. A Z B Initiator's private key d A Initiator's public key P A and the responder's public key P B Step S2204 prepares the raw data for the responder, including: elliptic curve system parameters, identity hash value Z. A Z B Response party's private key d B Response party public key P B and the initiator's public key P A .

[0183] Step S2206 involves the initiator executing the first SM2 cryptographic algorithm instruction, where the EDX register is marked with the control word cw as the first procedure for key exchange. The calculated first temporary public key R... A It is sent to the responder via communication.

[0184] Step S2208: The responder uses the first temporary public key R sent by the initiator. A The second SM2 cryptographic algorithm instruction is executed, where the EDX register is marked with the control word cw as performing the second procedure operation for key exchange. The responder calculates the second temporary public key R. B The message is sent to the initiator via communication. Additionally, the responder uses this second SM2 cryptographic algorithm instruction to compute a responder's shared key K. B and hash values ​​S2 and S B Hash value S2 and S B This is used to confirm whether the negotiation was successful.

[0185] Step S2210: The initiator uses the second temporary public key R sent by the responder. B The third SM2 cryptographic algorithm instruction is executed, where the EDX register is marked with the control word cw as the third procedure operation for key exchange. The initiator uses this third SM2 cryptographic algorithm instruction to obtain the initiator's shared key K. A and hash value S A With S1. Hash value S A The hash value S1 is used to confirm whether the negotiation was successful.

[0186] Step S2212 checks whether hash value S1 is equal to hash value S. B (Initiator's judgment), and whether hash value S2 is equal to hash value S. A (Response party judgment). If both conditions are met, step S2214 causes the processor to determine that the key exchange between the initiator and the responder has been successfully confirmed. If either condition is not met, step S2216 causes the processor to output a key exchange negotiation failure message.

[0187] In summary, the initiator designed according to one embodiment of the present invention uses a first register (EDI) and a second register (EAX). For a first elliptic curve cryptography instruction of an instruction set architecture (ISA), the first register (EDI) stores a key pair (r). A ,R A ) pointer, indicating the key pair (r A ,R A The processor stores the data in memory. In response to the first elliptic curve cryptography instruction, the processor performs a key exchange first procedure operation of the elliptic curve cryptography algorithm, generating a random number as a temporary private key r. Aand with the temporary private key r A Generate a first temporary public key R by processing an elliptic curve base point G. A And through the first register, the temporary private key r A and the first temporary public key R A Write to this memory. The second register (EAX) stores a key exchange information pointer, pointing to the key exchange information stored in the memory, which includes the temporary private key r. A The first temporary public key R A and a second temporary public key R B The second temporary public key R B It is provided by the responder in the key exchange, whose processor executes a second elliptic curve cryptography instruction to perform a second key exchange procedure operation of the elliptic curve cryptography algorithm, generating the second temporary public key R. B And based on the first temporary public key R A And the second temporary public key R B And generate a shared key K for the responders. B For a third elliptic curve cryptography instruction, the first register (EDI) is updated to store a shared key pointer, indicating an initiator's shared key K. A The processor stores the key in memory. In response to the third elliptic curve cryptography instruction, it performs a key exchange operation for the elliptic curve cryptography algorithm, obtaining the second temporary public key R through the second register (EAX). B Based on this temporary private key r A The first temporary public key R A and the second temporary public key R B Generate the initiator's shared key K A And through this first register (EDI) the initiator's shared key K A Write to this memory.

[0188] In summary, the responder designed according to one embodiment of the present invention uses a first register (EDI) and a second register (EAX). The second register (EAX) stores a key exchange information pointer, pointing to key exchange information stored in memory, the key exchange information including a first temporary public key R. A The first temporary public key R A The first temporary public key R is provided by the initiator of the key exchange. The initiator's processor executes the first elliptic curve cryptography instruction of an instruction set architecture to perform a first program operation of a key exchange using an elliptic curve cryptography algorithm to generate the first temporary public key R. A The first register stores a shared key pointer, indicating a responder's shared key K. Band a second temporary public key R B The processor stores the data in memory. In response to a second elliptic curve cryptography (ECC) instruction, it performs a second key exchange operation for the ECC algorithm, generating a random number as a temporary private key r. B With the temporary private key r B The second temporary public key R is generated by processing an elliptic curve base point G. B The first temporary public key R is obtained through the second register (EAX). A Based on the first temporary public key R A And the second temporary public key R B And generate a shared key K for the responders. B And through the first register (EDI) the second temporary public key R B and the responder's shared key K B Stored in this memory. The second temporary public key R B The processor supplied to the initiator executes a third elliptic curve cryptography (ECC) instruction, performs a key exchange operation of the ECC algorithm, and generates an initiator shared key K. A .

[0189] This invention completes key exchange for the SM2 cryptographic algorithm with just three simple ISA instructions. Compared to using the SM2 engine 626 alone to implement key exchange operations for elliptic curve cryptography, using both the SM2 engine 626 and the SM3 engine 126 simultaneously improves both computational speed and security. Besides implementations assisted by specialized hardware (SM3 engine 126 and SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0190] The following paragraphs detail the first and second preprocessing operations applied to hash value calculation.

[0191] Figure 23 Table 2304 illustrates the microcode design for the corresponding first preprocessing operation, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b 100000 is pre-stored in the input register EDX to indicate that the single SM2 cryptographic algorithm instruction performs the first preprocessing operation. In addition to the input register EDX, Table 2304 also lists registers EAX, EBX, ECX, ESI, and EDI, all of which serve as input registers for the first preprocessing operation. The completion of the first preprocessing operation indicated by an ISA's SM2 cryptographic algorithm instruction also includes managing the output register EDI. Other implementations are also possible for the application of input or output registers.

[0192] When used as an input register, register EAX stores a user identifier ID. A A pointer that points to a storage location for a user identifier ID. A A memory space (which may follow ES segmentation technology). Register EBX stores a public key (x). A ,y A A pointer to a public key (x) is provided. A ,y A A memory space (which may follow ES segmentation technology). The ECX register stores the user identifier ID. A Bit length ENTL A The EDX register stores the control word cw (6'b100000) indicating the first preprocessing operation code. The ESI register stores a pointer to an intermediate variable, pointing to a memory space (also known as scratch space, which can temporarily store existing high-security intermediate variables, can be 8K in size, can follow ES segmentation technology, can be initialized to all zeros, and can be requested by the software from the operating system). The EDI register stores a preprocessing hash value Z. A A pointer to a memory space (which may follow Elasticsearch segmentation techniques) for storing a preprocessed hash value Z. A .

[0193] As the first preprocessing operation indicated by the SM2 cryptographic algorithm instruction of this ISA is completed, the output register EDI is incremented by one displacement, which is the preprocessed hash value Z. A The number of 32-byte blocks.

[0194] Figure 24 The flowchart illustrates, according to one embodiment of the present invention, the first preprocessing operation triggered by an SM2 cryptographic algorithm instruction, and the multiple micro-instructions converted from the corresponding SM2 cryptographic algorithm instruction.

[0195] Step S2402: Based on the user identifier ID stored in the input register EAX A The pointer retrieves the user identifier ID from memory. A Loaded into processor 600 and user identifier ID A Length ENTL A Load data from input register ECX into processor 600. Step S2404 assembles the data S.

[0196] S = ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A

[0197] a and b are elliptic curve parameters, (x G ,y G Let G be the base point of an elliptic curve, and (x) A ,y A ) is the public key, and S is a one-bit string.

[0198] Step S2406 performs message stuffing on the bit string S. Step S2408 inputs the hardware operation control word, the cycle size (number of bytes in bit string S), and the stuffed value of bit string S into the SM2 engine 626, using its preprocessing hardware, and performs preprocessing hash value calculation through the SM3 engine 126.

[0199] Z A =Hash(ENTL) A ||ID A ||a||b||x G ||y G ||x A ||y A ),

[0200] The formula for calculating the loop size is: 2 + ECX / 8 + 32 + 32 + 32 + 32 + 32 + 32, where ECX is the user identifier ID. A Bit length ENTL A .

[0201] Step S2408 may include a preprocessed hardware operation microinstruction, or even an SM3 engine operation microinstruction. In step S2410, the SM2 engine 626 returns the preprocessed hash value Z. A Step S2412 uses the preprocessed hash value Z stored in the input register EDI. A The pointer will hold the preprocessed hash value Z A Load into memory. Step S2414 completes the first preprocessing operation triggered by an SM2 cryptographic algorithm instruction.

[0202] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor obtains a user identifier ID through a first register (EAX). A The public key (x) is obtained through a second register (EBX). A ,y A ), for the public key (x) A ,y A ), the user identifier ID A and a user identifier length ENTL A A preprocessed hash value Z is generated by performing a first preprocessing operation of an elliptic curve cryptography algorithm.A And the preprocessed hash value Z A The data is written into memory for use in subsequent second preprocessing operations. This invention completes the first preprocessing operation of the SM2 cryptographic algorithm with a single ISA instruction. Besides implementations assisted by special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0203] Figure 25 Table 2504 illustrates the microcode design for the corresponding second preprocessing operation, showing how the microinstructions generated by a single SM2 cryptographic algorithm instruction interpret the contents of architecture register 124. The aforementioned control word (cw) 6'b100001 is pre-stored in the input register EDX to indicate that it is used for the second preprocessing operation. In addition to the input register EDX, Table 2504 also lists the input registers EAX, EBX, ECX, and EDI, all of which serve as input registers for the second preprocessing operation. The completion of the second preprocessing operation indicated by an ISA's SM2 cryptographic algorithm instruction also includes managing the output register EDI. Other implementations of the input or output registers are also possible.

[0204] When used as an input register, register EAX stores a preprocessed hash value Z. A The pointer points to the preprocessed hash value Z generated and stored in the earlier first preprocessing operation. A Register EBX records a pointer to input data M, pointing to a memory space (following ES segmentation techniques) that stores the input data M (e.g., data to be signed in a signature operation, or signed data in a signature verification operation). Register ECX records the number of bytes of the input data M. Register EDX stores the control word cw (6'b 100001) indicating the code for the second preprocessing operation. Register EDI stores a pointer to a hash value e, indicating a memory space (following ES segmentation techniques) used to store the hash value e.

[0205] As the second preprocessing operation indicated by the SM2 cryptographic algorithm instruction of the ISA is completed, the output register EDI is incremented by one displacement, which is the number of 32-byte blocks of hash value e.

[0206] Figure 26 The flowchart illustrates a second preprocessing operation triggered by an SM2 cryptographic algorithm instruction, according to one embodiment of the present invention, and the multiple micro-instructions converted from the SM2 cryptographic algorithm instruction.

[0207] Step S2602 uses the preprocessed hash value Z stored in the input register EAX. A The pointer will retrieve a preprocessed hash value Z from system memory. AAnd input data M is loaded into processor 600. Step S2604 assembles preprocessed data. Step S2606 preprocesses the data Populate the message.

[0208] Step S2608 will use a hardware operation control word and a cycle size (preprocessed data) (number of bytes), and preprocessed data The padded result is input into the SM2 engine 626, where the preprocessing hardware is used to implement the hash value through the SM3 engine 126. The operation involves calculating the loop size using the formula: 32 + ECX, where ECX is the number of bytes in the input data M. Step S2608 may include a preprocessing hardware operation microinstruction, or even an SM3 engine operation microinstruction. In step S2610, the SM2 engine 626 returns the hash value e. Step S2612 loads the hash value e into system memory based on the pointer to the hash value e stored in the input register EDI. Step S2614 terminates the second preprocessing operation triggered by the SM2 cryptographic algorithm instruction.

[0209] In summary, in response to an elliptic curve cryptography instruction (SM2 cryptographic instruction) of an instruction set architecture (ISA), a processor retrieves a preprocessed hash value Z from memory via a first register (EAX). A An input data M is retrieved from memory via a second register (EBX), and the preprocessed hash value Z is... A The input data M undergoes a second preprocessing operation using the elliptic curve cryptography algorithm to generate preprocessed data. And based on this preprocessed data The hash value e is converted and stored in memory. This invention completes the second preprocessing operation of the SM2 cryptographic algorithm with a single ISA instruction. In addition to implementation with special hardware (SM3 engine 126, SM2 engine 626), there are also embodiments implemented entirely in microcode.

[0210] The above preprocessing design implements the hash value operation using two SM2 cryptographic algorithm instructions, converting the input data M into a hash value e. The first SM2 cryptographic algorithm instruction performs this first preprocessing operation, generating a preprocessed hash value Z associated with the user's identity. A =Hash(ENTL) A ||ID A ||a||b||x G ||y G ||x A ||y A The second SM2 cryptographic algorithm instruction performs the second preprocessing operation, based on the input data M and the preprocessed hash value Z.A Generating the hash value e includes the following operations: as well as Before the signature operation, a hash value can be prepared for the data to be signed using the first and second preprocessing operations. Before the signature verification, a hash value can also be prepared for the data to be verified using the first and second preprocessing operations.

[0211] Furthermore, taking key exchange as an example, the aforementioned first preprocessing operation can also be used to implement the identity hash value Z. B The calculation of the identity hash value Z. A Unlike other methods, the identity hash value Z is calculated using the first preprocessing operation. B At that time, the EAX register contains a user identifier ID. B A pointer to a location that stores a user identifier ID. B A memory space (which may follow the ESsegmentation technique). Register EBX stores a public key (x... B ,y B A pointer to a public key (x) is used to point to a location where a public key is stored. B ,y B A memory space (which may follow ES segmentation technology). The ECX register stores the user identifier ID. B Bit length ENTL B The EDI register stores a preprocessed hash value Z. B A pointer to a memory space (which may follow ES segmentation techniques) used to store the preprocessed hash value Z. B Furthermore, in Figure 24 The flowchart shown also uses steps to calculate the preprocessed hash value Z. B The relevant data will not be elaborated here.

[0212] The following paragraphs describe in detail the hardware implementation of the present invention.

[0213] Figure 27 The present invention illustrates a detailed hardware architecture of an SM2 engine 626 according to one embodiment, including a control logic hardware 2702, a dot multiplication hardware 2704, a preprocessing hardware 2706, a modular multiplication hardware 2708, and a modular inverse hardware 2710. The cryptographic execution unit 618 further includes a random number generator 2712. The SM2 engine 626 is also coupled to the random number generator 2712 and the SM3 engine 126.

[0214] According to a hardware operation control word 2714, the control logic hardware 2702 outputs a control signal pnt_mul to drive the dot multiplication hardware 2704, or outputs a control signal pre_process to drive the preprocessing hardware 2706, or outputs a control signal modular_mul to drive the modular multiplication hardware 2708, or outputs a control signal modular_inverse to drive the modular inverse hardware 2710. Input data 2716 can be obtained based on the contents of the input registers for each operation. The return data for each operation of the SM2 engine 626 is output data 2718.

[0215] Figure 28 According to one embodiment of the present invention, a dot product hardware 2704 driven by a microinstruction for hardware operation is illustrated, wherein a first coordinate system transformation hardware 2802, a multi-point calculation hardware 2804, and a second coordinate system transformation hardware 2806 are implemented. The dot product hardware 2704 is also coupled to modular multiplication hardware 2708 and modular inverse hardware 2710. After an elliptic curve input point 2808 and an input large number 2810 are input into the dot product hardware 2704, an elliptic curve output point 2812 is generated by using the modular multiplication hardware 2708 and modular inverse hardware 2710.

[0216] In one embodiment, the first coordinate system conversion hardware 2802 converts the elliptic curve input point 2808, which is an affine coordinate point, into a first intermediate point, which is an emphasized projective coordinate point. The multiplier point calculation hardware 2804 performs multiplier point calculation on the first intermediate point using the input large number 2810 to generate a second intermediate point. The second coordinate system conversion hardware 2806 converts the second intermediate point, which is an emphasized projective coordinate point, into the elliptic curve output point 2812. The elliptic curve output point 2812 is an affine coordinate point.

[0217] Figure 29 According to one embodiment of the present invention, a preprocessing hardware 2706 driven by a preprocessing hardware operation microinstruction is illustrated. Message grouping is performed, converting an input data 2902 after message padding into n groups of input messages B(0)...B(n-1), which are then sequentially passed to the SM3 engine 126 for message expansion and iterative compression, generating instantaneous hash values ​​sequentially, ultimately resulting in a converted hash value 2904. Specifically, the preprocessing hardware 2706 passes the first group of input messages B(0) and the initial hash constant V(0) to the SM3 engine 126 to generate an instantaneous hash value V(1), then passes the second group of input messages B(1) and the instantaneous hash value V(1) to the SM3 engine 126 to generate an instantaneous hash value V(2), and so on, until a converted hash value V(n) is generated.

[0218] Figure 30According to one embodiment of the present invention, a modular multiplication hardware 2708 driven by a hardware operation microinstruction is illustrated, which performs the operation based on hardware input:

[0219] Output product = (Input multiplier #1) * (Input multiplier #2) mod (Input modulus)

[0220] The input multiplier #1, input multiplier #2, and input modulus can be referred to as the first, second, and third modular multiplication inputs, respectively. The output product is the modular multiplication output.

[0221] Figure 31 According to one embodiment of the present invention, the analog inverse hardware 2710 driven by a microinstruction of analog inverse hardware operation is illustrated, which performs operations based on hardware input:

[0222] Modulo inverse output = (input large number) -1 mod(input modulus)

[0223] Inputting a large number can be called the first modulo inverse input. Inputting a modulus can be called the second modulo inverse input.

[0224] The hardware and microcode design of this invention may have many variations.

[0225] In one implementation, the cryptographic execution unit 118 does not specifically design the SM2 engine 626. Instead, it plans the microcode content to convert a single ISA SM2 cryptographic algorithm instruction into multiple microinstruction operation logic units (ALUs), thereby completing the SM2 cryptographic algorithm.

[0226] In one implementation, the SM2 engine has fewer functional modules than the SM2 engine 626, and the missing functional modules (e.g., the modular multiplication hardware 2708) are implemented using microcode to configure the microinstruction operation logic unit (ALU).

[0227] As can be seen from the above, in known technologies, the SM2 cryptographic algorithm is implemented using software and / or specialized hardware (such as external cryptographic cards). Software implementation cannot effectively guarantee data security, while specialized hardware implementation requires the purchase of additional hardware during deployment, thus increasing deployment costs. However, the processor and processing method for the elliptic curve cryptography algorithm (SM2) provided by this invention can implement the elliptic curve cryptography algorithm using only a single instruction set architecture. Intermediate data generated during the implementation of the elliptic curve cryptography algorithm can be stored in the processor's internal hardware storage space, making this intermediate data inaccessible outside the processor and greatly improving security. Furthermore, since no additional specialized hardware needs to be purchased during deployment, deployment costs are reduced.

[0228] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

[0229] [Symbol Explanation]

[0230] 100: Processor;

[0231] 102: Branch predictor;

[0232] 104: Instruction cache;

[0233] 106: Instruction Buffer (XIB);

[0234] 108: Formatted Instruction Queue (FIQ);

[0235] 110: Decoder;

[0236] 112: Instruction Queue (XIQ);

[0237] 114: Rename the unit;

[0238] 116: Sequential memory cache;

[0239] 118: Cryptographic Execution Unit;

[0240] 120: Data cache;

[0241] 122: Reorder the cache;

[0242] 124: Architecture register;

[0243] 126: SM3 engine (hash cryptography algorithm accelerator);

[0244] 202, 212, 222, 232: Format of SM3 cryptographic algorithm instructions;

[0245] 204, 214, 224, 234: Tables, with corresponding microcode designs in formats 202, 212, 222, and 232;

[0246] 300: Program code;

[0247] 302: SM3 cryptographic algorithm instruction;

[0248] 304: At least one register set instruction;

[0249] 500: SM3 engine;

[0250] 502: Hardware used for message extension;

[0251] 504: Hardware used for iterative compression;

[0252] 506: Function hardware, implementing Boolean functions FFj and GGj, and the permutation function P0(.);

[0253] 508: Initial hash value V(0);

[0254] 600: Processor;

[0255] 618: Cryptographic Execution Unit;

[0256] 626: SM2 engine;

[0257] 702: Format of SM2 cryptographic algorithm instructions;

[0258] 804: Table, corresponding encryption operations of the SM2 cryptographic algorithm;

[0259] 1004: Table, showing the decryption operations for the corresponding SM2 cryptographic algorithm;

[0260] 1204: Table, corresponding to the signature operation of the SM2 cryptographic algorithm;

[0261] 1404: Table, corresponding to the signature verification operation of the SM2 cryptographic algorithm;

[0262] 1604: Table, corresponding to the first procedure operation of key exchange for the SM2 cryptographic algorithm;

[0263] 1804: Table, corresponding to the second procedure operation of key exchange for the SM2 cryptographic algorithm;

[0264] 2004: Table, corresponding SM2 cryptographic algorithm key exchange third procedure operation;

[0265] 2304: Table, corresponding to the first preprocessing operation of the SM2 cryptographic algorithm;

[0266] 2504: Table, corresponding to the second preprocessing operation of the SM2 cryptographic algorithm;

[0267] 2702: Control logic hardware;

[0268] 2704: Dot product hardware;

[0269] 2706: Preprocessing hardware;

[0270] 2708: Analog multiplication hardware;

[0271] 2710: Analog Reverse Hardware;

[0272] 2712: Random number generator;

[0273] 2714: Hardware operation control word;

[0274] 2716: Input data;

[0275] 2718: Output data;

[0276] 2802: First coordinate system transformation hardware;

[0277] 2804: Multi-point computing hardware;

[0278] 2806: Second coordinate system conversion hardware;

[0279] 2808: Elliptic curve input point;

[0280] 2810: Enter a large number;

[0281] 2812: Elliptic curve output point;

[0282] 2902: Input data

[0283] 2904: The converted hash value;

[0284] A…H: Parameters;

[0285] AGU: Address Generation Unit;

[0286] ALU: Arithmetic Logic Unit;

[0287] DTLB: Data Translation Backup Buffer;

[0288] EAX, ECX, ESI, EDI – registers;

[0289] Fadd, Fmul, Fmisc, MMX: The corresponding hardware for various instructions;

[0290] ITLB: Instruction Translation Backup Buffer;

[0291] M1…M3 – Internal storage space of the accelerator;

[0292] Opcode, ModR / M, SIB, Displacement, and Immediate:

[0293] Format fields of SM3 cryptographic algorithm instructions;

[0294] pnt_mul, pre_process, modular_mu, modular_inverse: Hardware control signals;

[0295] RS: Reserved Station;

[0296] S402…S418, S902…S920, S1102…S1126, S1302…S1314, S1502…S1520, S1702…S1710, S1902…S1928, S2102…S2128, S2202…S2216, S2402…S2414, S2602…S2614: Steps;

[0297] ucode: microcode;

[0298] V(i+1): Hash value;

[0299] as well as Each input message B(i) expands into 132 words.

Claims

1. A processor with elliptic curve cryptography (ECC) algorithm, comprising: a first register storing a hash pointer pointing to a first memory space storing a hash value of data to be signed; and a second register storing a private key pointer pointing to a private key of a signer; wherein, in response to a first ECC instruction of an instruction set architecture, the processor fetches the hash value of the data to be signed from the first memory space via the first register, fetches the private key via the second register, performs an ECC signing operation on the hash value with the private key to generate a signature, and writes the signature into a second memory space; a cryptographic execution unit; a set of architectural registers including the first register and the second register; a decoder decoding a plurality of microinstructions in response to the first ECC instruction; wherein the plurality of microinstructions generated in response to the first ECC instruction includes accessing and managing contents of the set of architectural registers; the cryptographic execution unit includes an ECC accelerator, wherein point multiplication hardware receives an ECC input point and an input large number and generates an ECC output point therefrom; the plurality of microinstructions includes a point multiplication hardware operation microinstruction.

2. The processor with ECC algorithm as claimed in claim 1, wherein: parameters of the first ECC instruction include the hash pointer, the private key pointer, and a signature pointer pointing to the second memory space.

3. The processor with ECC algorithm as claimed in claim 1, further comprising: a third register storing an intermediate variable pointer pointing to a third memory space; wherein an intermediate variable generated by the processor in performing the signing operation on the hash value is temporarily stored in the third memory space according to the intermediate variable pointer stored in the third register.

4. The processor with ECC algorithm as claimed in claim 3, wherein: before performing the signing operation on the hash value, the processor stores a first address of the third memory space into the third register and sets all bytes in the third memory space to zero.

5. The processor with ECC algorithm as claimed in claim 4, wherein: the third memory space is applied to an operating system via software.

6. The processor with ECC algorithm as claimed in claim 1, further comprising: a fourth register filled with a length of the signature after performing the signing operation on the hash value.

7. The processor with ECC algorithm as claimed in claim 1, further comprising: a fifth register storing a signature pointer pointing to the second memory space; wherein, after performing the signing operation on the hash value, the processor increases the content of the fifth register by a bit displacement; the bit displacement is the length of the signature.

8. The processor with ECC algorithm as claimed in claim 1, further comprising: a sixth register storing a control word indicating that the first ECC instruction performs the signing operation.

9. The processor with ECC algorithm as claimed in claim 1, further comprising: a microcode storage storing microcode. ​ ​ In response to the point multiplication hardware operation micro-instruction, the point multiplication hardware performs the operation, wherein k as the input large number is a random number, G as the elliptic curve input point is an elliptic curve base point, and (x1, y1) is an elliptic curve output point converted by the point multiplication hardware. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ wherein the decoder decodes the plurality of microinstructions from the microcode in response to the first elliptic curve cryptographic instruction; and the cryptographic execution unit is operated to perform the signature operation on the hash value with the private key when a control word read from one of the set of architectural registers indicates a signature code.

10. The processor with elliptic curve cryptographic capability of claim 9, wherein: the plurality of microinstructions further comprise a modulo operation, r = (e + xi) mod n, e is the hash value, n is the order of G, and r is the modulo result; the plurality of microinstructions comprise a determination of whether r is zero and whether r + k is n; and when r is zero and / or r + k is n, the plurality of microinstructions update the random number and re-execute the point multiplication hardware operation microinstruction.

11. The processor with elliptic curve cryptographic capability of claim 10, wherein: the elliptic curve cryptographic accelerator further comprises a modular inverse hardware that receives a first modular inverse input and a second modular inverse input and generates a modular inverse output; the elliptic curve cryptographic accelerator further comprises a modular multiplication hardware that receives a first modular multiplication input, a second modular multiplication input, and a third modular multiplication input and generates a modular multiplication output; when r is not zero and r + k is not n, the processor executes a modular inverse hardware operation microinstruction and a modular multiplication hardware operation microinstruction provided by the plurality of microinstructions; In response to the modular inverse hardware operation micro-instruction, the modular inverse hardware performs a modular inverse operation, s' = (1 + d A ) -1 mod n, d A is the private key, (1 + d A ) is the first modular inverse input, n is the second modular inverse input, and s' is the modular inverse output. In response to the modular multiplication hardware operation micro-instruction, the modular multiplication hardware performs a modular multiplication operation s' is the first modular multiplication input, is the second modular multiplication input, n is the third modular multiplication input, and s is the modular multiplication output the plurality of microinstructions comprise a determination of whether s is zero and, when s is zero, update the random number and re-execute the point multiplication hardware operation microinstruction; when s is not zero, the plurality of microinstructions provide (r, s) as the signature.

12. The processor with elliptic curve cryptographic capability of claim 10, wherein the point multiplication hardware comprises: first coordinate system conversion hardware that converts the elliptic curve input point, which is an affine coordinate point, into a first intermediate point, which is a weighted projective coordinate point; multiple point computation hardware that performs a multiple point computation on the first intermediate point with the input large number to generate a second intermediate point; and second coordinate system conversion hardware that converts the second intermediate point, which is a weighted projective coordinate point, into the elliptic curve output point, which is an affine coordinate point.

13. The processor with elliptic curve cryptographic capability of claim 1, wherein: the processor further executes a second elliptic curve cryptographic instruction prior to the first elliptic curve cryptographic instruction; the first register stores a user identifier pointer that points to a fourth memory space storing a user identifier in response to the second elliptic curve cryptographic instruction executed prior to the first elliptic curve cryptographic instruction; and the second register stores a public key pointer that points to a public key in response to the second elliptic curve cryptographic instruction executed prior to the first elliptic curve cryptographic instruction. ​ ​ In response to the second elliptic curve cryptography instruction, the processor fetches the user identifier from the fourth memory space via the first register, fetches the public key via the second register, performs a first preprocessing operation on the user identifier and a user identifier length using the public key to generate a preprocessing hash value, and writes the preprocessing hash value to a fifth memory space, which is later converted into the hash value for use by the first elliptic curve cryptography instruction.

14. The processor with elliptic curve cryptography as recited in claim 13, wherein: the parameters of the second elliptic curve cryptography instruction include the user identifier pointer, the public key pointer, the user identifier pointer, the user identifier length, and a preprocessing hash value pointer pointing to the fifth memory space.

15. The processor with elliptic curve cryptography as recited in claim 13, further comprising: a third register storing an intermediate variable pointer pointing to a third memory space; wherein the intermediate variable generated by the processor performing the first preprocessing operation is temporarily stored in the third memory space according to the intermediate variable pointer stored in the third register.

16. The processor with elliptic curve cryptography as recited in claim 13, further comprising: a fourth register storing the user identifier length.

17. The processor with elliptic curve cryptography as recited in claim 13, further comprising: a fifth register storing a preprocessing hash value pointer pointing to the fifth memory space; wherein the content of the fifth register is increased by a bit displacement after the processor performs the first preprocessing operation; the bit displacement is a preprocessing hash value length.

18. The processor with elliptic curve cryptography as recited in claim 13, further comprising: a sixth register storing a control word indicating that the second elliptic curve cryptography instruction performs the first preprocessing operation.

19. The processor with elliptic curve cryptography as recited in claim 13, further comprising: a microcode storage storing microcode, wherein the decoder decodes a plurality of microinstructions from the microcode in response to the second elliptic curve cryptography instruction; wherein the plurality of microinstructions generated in response to the second elliptic curve cryptography instruction includes accessing and managing the content of the set of architectural registers, and operating the cryptographic execution unit to perform the first preprocessing operation when a control word read from one of the set of architectural registers indicates a first preprocessing code.

20. The processor with elliptic curve cryptography as recited in claim 19, wherein: the plurality of microinstructions includes an instruction operation. S = ENTL A ||ID A ||a||b||x G ||y G ||x A ||y A ENTL A is the length of the user identifier, IDAis the user identifier, a, b are elliptic curve parameters, (x G , y G ) is an elliptic curve base point, (x A , y A ) are the coordinates of the public key, and S is a bit string.

21. The processor with elliptic curve cryptography as recited in claim 20, wherein: the cryptographic execution unit includes an elliptic curve cryptography accelerator having a preprocessing hardware therein; the cryptographic execution unit further includes a hash cryptographic accelerator; the plurality of microinstructions further includes a preprocessing hardware operation microinstruction that causes the preprocessing hardware to implement a S block after a message padding of the S is completed to provide a block message to the hash cryptographic accelerator for hash value conversion; and The pre-processing hardware also has an execution unit internal storage space, which temporarily stores an initial hash constant for use by the hash password algorithm accelerator, and then is updated by the hash password algorithm accelerator until Hash(S) is filled in as the pre-processing hash value.

22. The processor with elliptic curve cryptography as claimed in claim 13, wherein: The processor further executes a third elliptic curve cryptography instruction before the first elliptic curve cryptography instruction and after the second elliptic curve cryptography instruction; For the third elliptic curve cryptography instruction, the first register stores a pre-processing hash value pointer pointing to the fifth memory space; and For the third elliptic curve cryptography instruction, the second register stores a data-to-sign pointer pointing to a sixth memory space storing the data-to-sign. In response to the third elliptic curve cryptography instruction, the processor obtains the pre-processing hash value from the fifth memory space through the first register, obtains the data-to-sign from the sixth memory space through the second register, performs a second pre-processing operation of the elliptic curve cryptography on the pre-processing hash value and the data-to-sign to generate pre-processing data and convert the hash value based on the pre-processing data, and stores the hash value in the first memory space for use by the first elliptic curve cryptography instruction.

23. The processor with elliptic curve cryptography as claimed in claim 22, wherein: The parameters of the third elliptic curve cryptography instruction include the pre-processing hash value pointer and the data-to-sign.

24. The processor with elliptic curve cryptography as claimed in claim 22, further comprising: A third register storing an intermediate variable pointer pointing to a third memory space; wherein the intermediate variable generated by the processor in the second pre-processing operation is temporarily stored in the third memory space according to the intermediate variable pointer stored in the third register.

25. The processor with elliptic curve cryptography as claimed in claim 22, further comprising: A fourth register storing a data-to-sign length.

26. The processor with elliptic curve cryptography as claimed in claim 22, further comprising: A fifth register storing a hash value pointer pointing to the first memory space; wherein the processor increases the content of the fifth register by one bit displacement after performing the second pre-processing operation; The bit displacement is the length of the hash value.

27. The processor with elliptic curve cryptography as claimed in claim 22, further comprising: A sixth register storing a control word indicating that the third elliptic curve cryptography instruction performs the second pre-processing operation.

28. The processor with elliptic curve cryptography as claimed in claim 22, further comprising: A microcode storage device storing microcode, wherein the decoder decodes a plurality of microinstructions from the microcode in response to the third elliptic curve cryptography instruction. The plurality of microinstructions generated in response to the third elliptic curve cryptography instruction includes accessing and managing contents of the set of architectural registers, and when a control word read from one of the set of architectural registers indicates a second pre-processing code, operating the cryptographic execution unit to perform the second pre-processing operation.

29. The processor with elliptic curve cryptography as recited in claim 28, wherein: the plurality of microinstructions includes an indication of an operation, =Z A ||M Z A For the pre-processing hash value, M is the data to be signed, and is the pre-processed data.

30. The processor with elliptic curve cryptography as recited in claim 29, wherein: the cryptographic execution unit includes an elliptic curve cryptography accelerator with pre-processing hardware; the cryptographic execution unit further includes a hash cryptography accelerator; The plurality of micro-instructions further includes a pre-processing hardware operation micro-instruction, in after the message padding is completed, causing the pre-processing hardware to implement a packet to provide a packet message to the hash cryptographic algorithm accelerator for hash value conversion; and The pre-processing hardware also has an execution unit internal storage space to temporarily store initial hash constants for use by the hash password algorithm accelerator, which are then updated by the hash password algorithm accelerator until the Hash( ) is filled in as the hash value.

31. A processing method of a processor, comprising: in response to a first elliptic curve cryptography instruction of an instruction set architecture, the processor retrieving a hash value of data to be signed from a first memory space, retrieving a private key, operating a cryptographic execution unit to perform a signature operation of an elliptic curve cryptography on the hash value with the private key to produce a signature, and writing the signature to a second memory space, wherein the plurality of microinstructions is decoded by a decoder in response to the first elliptic curve cryptography instruction; the plurality of microinstructions generated in response to the first elliptic curve cryptography instruction includes accessing and managing contents of a set of architectural registers; wherein the cryptographic execution unit includes an elliptic curve cryptography accelerator with point multiplication hardware that receives an elliptic curve input point and an input large number and produces an elliptic curve output point therefrom; the plurality of microinstructions includes a point multiplication hardware operation microinstruction; in response to the point multiplication hardware operation microinstruction, the point multiplication hardware performs an operation, (x1, y1) = [k]G, where k is a random number as the input large number, G is an elliptic curve base point as the elliptic curve input point, and (x1, y1) is the elliptic curve output point converted by the point multiplication hardware.

32. The processing method as recited in claim 31, wherein: the parameters of the first elliptic curve cryptography instruction include a hash value pointer pointing to the hash value, a private key pointer pointing to the private key, and a signature pointer pointing to the second memory space.

33. The processing method as recited in claim 31, further comprising: temporarily storing intermediate variables produced in the signature operation in a third memory space; and before the signature operation, zeroing all bytes in the third memory space.

34. The processing method as recited in claim 33, wherein: the third memory space is requested from an operating system by software.

35. The processing method as recited in claim 31, further comprising: in response to the first elliptic curve cryptography instruction, decoding the plurality of microinstructions from microcode and the plurality of microinstructions generated in response to the first elliptic curve cryptography instruction performs the signature operation on the hash value with the private key when a control word indicates a signature code.

36. The processing method as recited in claim 31, further comprising: the processor further executes a second elliptic curve cryptography instruction before the first elliptic curve cryptography instruction; and In response to the second elliptic curve cryptography instruction, the processor obtains the user identifier from the fourth memory space, obtains the public key, performs a first preprocessing operation of the elliptic curve cryptography on the user identifier and the length of the user identifier using the public key to generate a preprocessing hash value, and writes the preprocessing hash value to the fifth memory space, to be converted into the hash value for use by the first elliptic curve cryptography instruction later.

37. The processing method of claim 36, further comprising: in response to the second elliptic curve cryptography instruction, decoding a plurality of microinstructions from the microcode; and in response to the plurality of microinstructions generated by the second elliptic curve cryptography instruction, performing the first preprocessing operation when the control word indicates a first preprocessing code.

38. The processing method of claim 36, further comprising: executing a third elliptic curve cryptography instruction before the first elliptic curve cryptography instruction and after the second elliptic curve cryptography instruction; and in response to the third elliptic curve cryptography instruction, obtaining the preprocessing hash value from the fifth memory space, obtaining a data to be signed from a sixth memory space, performing a second preprocessing operation of the elliptic curve cryptography on the preprocessing hash value and the data to be signed to generate preprocessing data, converting the hash value based on the preprocessing data, and storing the hash value in the first memory space for use by the first elliptic curve cryptography instruction.

39. The processing method of claim 38, further comprising: in response to the third elliptic curve cryptography instruction, decoding a plurality of microinstructions from the microcode; and in response to the plurality of microinstructions generated by the third elliptic curve cryptography instruction, performing the second preprocessing operation when the control word indicates a second preprocessing code. ​

Images