Modular multiplier, secure chip, electronic device, and encryption method

Abstract

The application provides a modular multiplier applied to SM9, comprising: a multiplication circuit configured to perform a multiplication operation on two operators in the SM9 to obtain a product of the two operators, wherein the product is a binary number, and the number of bits of the product is m, and the m is an integer multiple of 2; and a modulus calculator connected with the multiplication circuit and configured to perform n times of modulus operation on the product in n clock cycles to obtain a final modular multiplication result, wherein each time of the modulus operation is performed in one clock cycle to obtain one modulus result, and the n is a positive integer less than m / 2. The application also provides a corresponding secure chip and encryption algorithm. The above scheme of the application avoids using the Montgomery modular multiplication algorithm, reduces unnecessary repeated modular multiplication, improves the speed of the entire modular multiplication operation in the SM9, and thus improves the overall performance of the SM9.

Description

TECHNICAL FIELD

[0001] The disclosed embodiments of the present application relate to the technical field of information security, and more particularly to a modular multiplier, a secure chip, an electronic device and an encryption method. BACKGROUND

[0002] With the development of information technology, the requirement of information encryption is also increasingly high. Among them, SM9 (Modular multiplication Encryption algorithm) is a national cryptographic algorithm issued by the National Cryptographic Administration in 2007. Compared with the general public key encryption method, the public key of SM9 is derived from the identity tag, which avoids the complex exchange process and improves the wireless network throughput. Therefore, at present, SM9 is widely used in various devices, and the demand is increasing.

[0003] SM9 is based on elliptic curve operation on an extended field, and the core algorithm is the calculation of a bilinear pair, mainly including modular addition, modular multiplication and modular inverse operation modules on the base field, quadratic extension field, quartic extension field and twelfth extension field, point addition and multiple point operation modules on the base field and quadratic extension field, Miller algorithm module, modular power module on the twelfth extension field and final modular power module. Among them, the modular multiplication operation is the most basic operation, and its calculation frequency is very high. Therefore, the speed of the modular multiplication operation is crucial to the overall performance of SM9.

[0004] At present, there are several ways to implement the modular multiplication operation as follows:

[0005] Method 1): repeatedly subtract the modulus from the product of the two multipliers until the difference obtained is less than the modulus, but this method is only suitable for the case where the operator bit number is small in the encryption algorithm. For the case where the operator bit number is large in SM9, using this method to calculate the modular multiplication will waste many clock cycles, which seriously affects the performance of the algorithm.

[0006] Method 2): directly use the product of the two multipliers divided by the modulus, and take the remainder as the result, which is applied in the encryption algorithm, that is, first multiply the two operators, and then directly divide the product by the modulus to get the remainder. However, in this method, the synthesized circuit of the divider is often too complex, and the operation time is long, so the shift method is often used instead of the division operation in the hardware circuit.

[0007] Method 3): double-add algorithm is used to convert multiplication into modular addition operation. In this way, 1 bit is calculated each time. However, when the bit number of the modulus is too large in the encryption algorithm, this method is too time-consuming, which affects the performance of the algorithm.

[0008] Method 4): Montgomery modular multiplication is used to calculate the modular multiplication without using division. The specific process is as follows: first, one Montgomery modular multiplication is performed to complete entering the Montgomery domain, then Montgomery modular multiplication is performed in the Montgomery domain to obtain the result, and finally, one Montgomery modular multiplication is performed to exit the Montgomery domain. This method is a commonly used method for calculating modular multiplication in current encryption algorithms, and is suitable for RSA algorithms with an operator bit number of up to 2048 bits, or modular exponentiation operations that need to be repeatedly performed. However, for the 256-bit modular multiplication operation in SM9, at least three Montgomery modular multiplications are required for each calculation of the modular multiplication, which consumes too many clock cycles and thus reduces the performance of SM9. SUMMARY

[0009] According to embodiments of the present application, the present application provides a modular multiplier, a secure chip, an electronic device and an encryption method.

[0010] According to a first aspect of the present application, an example modular multiplier applied to SM9 is disclosed, comprising: a multiplication circuit configured to perform a product operation on two operators in the SM9 to obtain a product of the two operators, wherein the product is a binary number and its bit number is m, and the m is an integer multiple of 2; and a modulus calculator connected with the multiplication circuit and configured to complete n times of modulus operation on the product in n clock cycles to obtain a final modular multiplication result, wherein each time the modulus operation is performed in one clock cycle to obtain a modulus result, and the n is a positive integer less than m / 2.

[0011] According to a second aspect of the present application, an example secure chip is disclosed, comprising the modular multiplier according to the first aspect.

[0012] According to a third aspect of the present application, an example electronic device is disclosed, comprising the secure chip according to the second aspect.

[0013] According to a fourth aspect of the present application, an example encryption method applied to SM9 is disclosed, comprising: performing a modular multiplication operation on two operators in the SM9 to obtain a modular multiplication result, thereby realizing encryption, wherein the modular multiplication operation is realized by the modular multiplier according to the first aspect.

[0014] The beneficial effects of the present application are: the multiplication circuit is used to perform multiplication operation on two operators in SM9 to obtain the product of the two operators, and the modulus operator performs n times of modulus operation on the product in n clock cycles to obtain the final modular multiplication result, wherein each modulus operation is performed in one clock cycle to obtain a modulus result, n is a positive integer less than m / 2, the Montgomery modular multiplication algorithm is avoided, unnecessary repeated modular multiplication is reduced, the speed of the entire modular multiplication operation in SM9 is improved, and the overall performance of SM9 is improved.

[0015] These and other objects of the present application will no doubt become apparent to those of ordinary skill in the art after reading the following detailed description of the preferred embodiments, illustrated in the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a structural schematic diagram of a modular multiplier according to an embodiment of the present application.

[0017] Figure 2 is a structural schematic diagram of a modular multiplier according to another embodiment of the present application.

[0018] Figure 3 is a state transition diagram of a state machine according to an embodiment of the present application.

[0019] Figure 4 is a structural schematic diagram of a secure chip according to an embodiment of the present application.

[0020] Figure 5 is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order for those skilled in the art to better understand the technical solutions of the present application, the technical solutions of the present application are further described in detail below in combination with the drawings and specific embodiments.

[0022] As shown in Figure 1 is a structural schematic diagram of a modular multiplier according to an embodiment of the present application. The modular multiplier 100 is applied to SM9, as described above, SM9 is based on elliptic curve operation on an extension field, and the core algorithm is the calculation of a bilinear pair, and the specific algorithm process or composition of SM9 is not specifically limited by the present application. Specifically, the modular multiplier 100 includes a multiplication circuit 110 and a modulus operator 120, wherein the modulus operator 120 is connected to the multiplication circuit 110.

[0023] The multiplication circuit 110 is used to perform multiplication operation on two operators in SM9 to obtain the product of the two operators, wherein the product is a binary number, and the number of bits is m, and m is an integer multiple of 2.

[0024] The modulus calculator 120 is configured to perform n times of modulus operation on the product in n clock cycles, where each time of modulus operation is performed in one clock cycle to obtain one time of modulus result, and n is a positive integer less than m / 2.

[0025] The multiplication circuit 110 is configured to perform the product operation by using Booth algorithm, and the two operands in SM9 are binary numbers, and the product obtained by performing the product operation is also a binary number. For example, assuming that the two operands in SM9 are a_mul and b_mul, and both of them are 256 bits, i.e., the number of bits of a_mul and b_mul is 256, and they can be represented as a_mul[255:0] and b_mul[255:0]. After performing the product operation by using Booth algorithm, the product of the two operands a_mul and b_mul is marked as ab_product, and the number of bits of ab_product is m, which is 512, and ab_product can be represented as ab_product[511:0].

[0026] The modulus calculator 120 is configured to perform n times of modulus operation on the product in n clock cycles, where each time of modulus operation is performed in one clock cycle to obtain one time of modulus result, and n is a positive integer less than m / 2.

[0027] In the embodiment, the multiplication circuit is configured to perform the product operation on the two operands in SM9 to obtain the product of the two operands, and the modulus calculator is configured to perform n times of modulus operation on the product in n clock cycles to obtain the final modular multiplication result, where each time of modulus operation is performed in one clock cycle to obtain one time of modulus result, and n is a positive integer less than m / 2. By avoiding using Montgomery modular multiplication algorithm, the unnecessary repeated modular multiplication is reduced, the speed of the entire modular multiplication operation in SM9 is improved, and the overall performance of SM9 is improved.

[0028] In some embodiments, the product of the two operands is sequentially divided into a first part and n-1 second parts, where the first part is located before the n-1 second parts, and the number of bits of the first part is equal to the sum of the number of bits of one second part and the number of bits of one time of modulus result.

[0029] At this time, the modulus calculator 120 performs modulus operation on the first part and the n-1 second parts respectively.

[0030] The first part is located before the n-1 second parts, and represents a binary number of a high bit part of the product, and the n-1 second parts respectively represent binary numbers of low bit parts of the product, i.e., the product is divided from high to low.

[0031] In addition, the number of bits of the first part is equal to the sum of the number of bits of one second part and the number of bits of the result of the modulo operation, and when the number of bits of the result of the modulo operation is known, the first part and the n-1 second parts are determined.

[0032] Taking the two operators a_mul and b_mul in the SM9 as an example, the product ab_product is sequentially divided into one first part and n-1 second parts, for example, the product ab_product is divided from high to low to obtain one first part and n-1 second parts.

[0033] For example, when n is 64, i.e., the product ab_product is sequentially divided into one first part and 63 second parts, and the number of bits of the result of the modulo operation is 256, the number of bits of the first part is 260, and the number of bits of each second part is 4, i.e., the first part is represented as ab_product[511:252], and the 63 second parts are ab_product[253:250], ab_product[249:246]…ab_product[3:0] in turn.

[0034] For another example, when n is 32, i.e., the product ab_product is sequentially divided into one first part and 31 second parts, and the number of bits of the result of the modulo operation is 256, the number of bits of the first part is 264, and the number of bits of each second part is 8, i.e., the first part is represented as ab_product[511:248], and the 31 second parts are ab_product[247:240], ab_product[239:232]…ab_product[7:0] in turn.

[0035] Further, in some examples, the modulo operator performs modulo operations on the first part and the n-1 second parts respectively, including: performing a modulo operation on the first part in a first clock cycle of n clock cycles; sequentially performing a modulo operation on a combination of the result of the modulo operation obtained in a previous clock cycle and an adjacent second part in the remaining n-1 clock cycles of the n clock cycles, so as to perform n-1 modulo operations.

[0036] In the first clock cycle of the n clock cycles, a modulo operation is performed on the first portion to obtain a first modulo result. Subsequently, in the next clock cycle, i.e., the second clock cycle of the n clock cycles, the first second portion is combined with the first modulo result, and a modulo operation is performed on the combined first second portion and the first modulo result. Subsequently, in the next clock cycle, i.e., the third clock cycle of the n clock cycles, the second second portion is combined with the second modulo result, and a modulo operation is performed on the combined second second portion and the second modulo result. In this way, in the n-th clock cycle of the n clock cycles, the (n-1)-th second portion is combined with the (n-1)-th modulo result, and a modulo operation is performed on the combined (n-1)-th second portion and the (n-1)-th modulo result.

[0037] Further, in some embodiments, performing a modulo operation on the first portion in the first clock cycle of the n clock cycles includes: in the first clock cycle, transmitting the first portion to the modulo unit 120 to obtain and register the first modulo result from the modulo unit 120.

[0038] In the remaining n-1 clock cycles of the n clock cycles, a modulo operation is sequentially performed on the combination of the modulo result obtained in the previous clock cycle and the adjacent second portion, including: in each of the remaining n-1 clock cycles of the n clock cycles, concatenating and transmitting the modulo result obtained in the previous clock cycle and the adjacent second portion to the modulo unit to obtain and register the modulo result from the modulo unit 120, wherein the last modulo result is the final modular multiplication result.

[0039] The first second portion is concatenated with the first modulo result, which is located before the first second portion, so as to obtain a concatenated number having the same number of bits as the first portion. Similarly, each second portion is concatenated with the previous modulo result, which is located before the second portion, so as to obtain a corresponding concatenated number having the same number of bits as the first portion.

[0040] In the first clock cycle of the n clock cycles, the first portion is transmitted to the modulo unit 120 to obtain and register a first modulo result from the modulo unit 120. Subsequently, in the next clock cycle, i.e., the second clock cycle of the n clock cycles, the first second portion is concatenated with the first modulo result and transmitted to the modulo unit 120 to obtain and register a second modulo result from the modulo unit 120. Subsequently, in the next clock cycle, i.e., the third clock cycle of the n clock cycles, the second second portion is concatenated with the second modulo result and transmitted to the modulo unit 120 to obtain and register a third modulo result from the modulo unit 120. In this way, in the n-th clock cycle of the n clock cycles, the (n-1)-th second portion is concatenated with the (n-1)-th modulo result and transmitted to the modulo unit 120 to obtain and register the n-th modulo result, i.e., the final modular multiplication result, from the modulo unit 120.

[0041] Continuing with the above example of the two operators a_mul and b_mul in SM9, in the case where n is 64, in the first clock cycle of the 64 clock cycles, the first portion ab_product[511:252] is moduloed to obtain and register a first modulo result. Subsequently, in the next clock cycle, i.e., the second clock cycle of the 64 clock cycles, the second portion ab_product[253:250] is concatenated with the first modulo result and moduloed to obtain and register a second modulo result. Subsequently, in the next clock cycle, i.e., the third clock cycle of the 64 clock cycles, the second portion ab_product[249:246] is concatenated with the second modulo result and moduloed to obtain and register a third modulo result. In this way, in the 64-th clock cycle of the 64 clock cycles, the second portion ab_product[3:0] is concatenated with the 63-rd modulo result and moduloed to obtain and register the 64-th modulo result. Thus, the 64-th modulo result is the final modular multiplication result.

[0042] In the example where n is 32, the first part ab_product[511:248] is modulo-divided in the first clock cycle of 32 clock cycles, and the first modulo result is obtained and stored. Then, in the next clock cycle (the second clock cycle of 32 clock cycles), the second part ab_product[247:240] is concatenated with the first modulo result and modulo-divided again, and the second modulo result is obtained and stored. Then, in the next clock cycle (the third clock cycle of 32 clock cycles), the second part ab_product[239:232] is concatenated with the second modulo result and modulo-divided again, and the third modulo result is obtained and stored. This process continues until the 32nd clock cycle of 32 clock cycles, when the second part ab_product[7:0] is concatenated with the 31st modulo result and modulo-divided. Thus, the 32nd modulo result is the final modular multiplication result.

[0043] like Figure 2 The diagram shown is a schematic diagram of the structure of a modular multiplier according to another embodiment of this application. Based on the above embodiment, the modulus taker 120 includes a state machine 121 and a modulus taker circuit 122. The modulus taker circuit 122 is connected to the state machine 121. The state machine 121 is used to instruct the modulus taker circuit 122 to perform n modulus taker operations on the product within n clock cycles. The modulus taker circuit 122 is used to perform one modulus taker operation in each clock cycle within the n clock cycles to obtain one modulus taker result.

[0044] Continuing with the example of the two operators a_mul and b_mul in SM9 above, state machine 121 controls modulo circuit 122 to perform n modulo operations on the product ab_product within n clock cycles. For example, it performs 64 modulo operations within 64 clock cycles to complete the modulo operation on the product ab_product. Modulo circuit 122 performs one modulo operation within one clock cycle to obtain one modulo result.

[0045] like Figure 3 The diagram shown is a state transition diagram of the state machine according to an embodiment of this application. The state machine 121 is used to instruct the modulus-taking circuit 122 to perform n modulus-taking operations on the product within n clock cycles. Specifically, the state machine 121 includes a first state, a second state, and a third state.

[0046] The first state is used to indicate that the fetching circuit 122 performs a fetching operation on the first part once in the first clock cycle of n clock cycles.

[0047] The second state is used to instruct the modulus circuit 122 to sequentially perform a modulus operation on the modulus result of the previous clock cycle and the adjacent n-1 second parts within the remaining n-1 clock cycles of the n clock cycles.

[0048] The third state is used to indicate that the control modulo circuit 122 is in an idle state, waiting for starting to perform n times of modulo operation or ending to perform n times of modulo operation.

[0049] The state machine 121 enters the first state when detecting the start signal.

[0050] When the state machine 121 is in the first state, it indicates that the modulo circuit 122 performs one time of modulo operation on the first part in the first clock cycle of n clock cycles. Subsequently, in the next clock cycle, i.e. the second clock cycle of n clock cycles, the state machine 121 is in the second state, which indicates that the modulo circuit 122 performs one time of modulo operation on the modulo result of the first clock cycle combined with the first second part in the second clock cycle. Subsequently, in the next clock cycle, i.e. the third clock cycle of n clock cycles, the state machine 121 is still in the second state, which indicates that the modulo circuit 122 performs one time of modulo operation on the modulo result of the second clock cycle combined with the second second part in the third clock cycle, and so on, until in the n-th clock cycle of n clock cycles, the state machine 121 is in the second state, which indicates that the modulo circuit 122 performs one time of modulo operation on the modulo result of the n-2-th clock cycle combined with the n-1-th second part in the n-th clock cycle. In this way, the state machine 121 is in the second state, which indicates that the modulo circuit 122 sequentially performs n-1 times of modulo operation on n-1 second parts in the remaining n-1 clock cycles.

[0051] When the state machine 121 is reset, the state machine 121 enters the third state, which indicates that the modulo circuit 122 is in an idle state, waiting for starting to perform n times of modulo operation or ending to perform n times of modulo operation, for example, waiting for starting to perform 64 times of modulo operation.

[0052] It should be noted that the result of the modulo operation in the first clock cycle combined with the first second part, the modulo result of the second clock cycle combined with the second second part, and so on, are described in the above embodiment and will not be described here.

[0053] In some embodiments, one time of modulo operation includes x times of subtraction operation in cascade, where the subtrahend in each time of subtraction operation is the modulus in SM9, x is a positive integer, and x is the difference between the number of bits of the modulo input of the modulo circuit 122 and the number of bits of the result of one time of modulo operation.

[0054] One time of modulo operation includes x times of subtraction operation in cascade, i.e. one time of modulo operation is decomposed into subtraction operations. In hardware implementation, the modulo circuit 122 can include subtractors and a multiplexer, but the specific structure of the modulo circuit 122 is not limited in the present application, as long as one time of modulo operation includes x times of subtraction operation in cascade.

[0055] Continuing with the example of the two operators a_mul and b_mul in SM9 above, in the example where n is 64, the input to the modulo circuit 122 is the first part of the product ab_product, ab_product[511:252], the first modulo result concatenated with the second part of the product ab_product, ab_product[253:250], the second modulo result concatenated with the second part of the product ab_product, ab_product[249:246],..., the (n-1)th modulo result concatenated with the second part of the product ab_product, ab_product[3:0], i.e., the modulo input to the modulo circuit 122 has 260 bits and the modulo result has 256 bits, and x is 4, indicating that the modulo operation includes 4 subtraction operations concatenated.

[0056] In the example where n is 32, the input to the modulo circuit 122 is the first part of the product ab_product, ab_product[511:248], the first modulo result concatenated with the second part of the product ab_product, ab_product[247:240], the second modulo result concatenated with the second part of the product ab_product, ab_product[239:232],..., the (n-1)th modulo result concatenated with the second part of the product ab_product, ab_product[7:0], i.e., the modulo input to the modulo circuit 122 has 264 bits and the modulo result has 256 bits, and x is 8, indicating that the modulo operation includes 8 subtraction operations concatenated.

[0057] In some embodiments, the modulo input is sequentially split into one first input part and x-1 second input parts, where the first input part is before the x-1 second input parts, and the number of bits of the first input part is equal to the sum of the number of bits of one second input part and the number of bits of the modulo result.

[0058] The first input part is before the x-1 second input parts, indicating that the first input part is the number of bits of the high part of the modulo input in binary, and the x-1 second input parts are the number of bits of the low part of the modulo input in binary, i.e., the modulo input is divided from high to low.

[0059] And, the number of bits of the first input part is equal to the sum of the number of bits of one second input part and the number of bits of the result of the modulo operation, when the number of bits of the result of the modulo operation is known, then the first input part and x-1 second input parts are determined.

[0060] Taking the two operators a_mul and b_mul in the above SM9 as an example, assuming that the modulo input of the modulo circuit 122 is mod_input, the following describes the modulo operation of different modulo inputs.

[0061] In the example of n being 64, the number of bits of the modulo input mod_input is 260, that is, the modulo input mod_input is 260 bits, and the modulo operation includes 4 cascaded subtraction operations. The modulo input mod_input is sequentially split into one first input part and three second input parts, wherein the number of bits of the result of the modulo operation is 256, the number of bits of the first input part is 257, and the number of bits of each second input part is 1, that is, the first input part is represented as mod_input[259:3], and the three second input parts are mod_input[2], mod_input[1] and mod_input[0] in turn.

[0062] In the example of n being 32, the number of bits of the modulo input mod_input is 264, that is, the modulo input mod_input is 264 bits, and the modulo operation includes 8 cascaded subtraction operations. The modulo input mod_input is sequentially split into one first input part and seven second input parts, wherein the number of bits of the result of the modulo operation is 256, the number of bits of the first input part is 257, and the number of bits of each second input part is 1, that is, the first input part is represented as mod_input[263:7], and the seven second input parts are mod_input[6], mod_input[5], mod_input[4], mod_input[3], mod_input[2], mod_input[1] and mod_input[0] in turn.

[0063] At this time, the modulo operation includes: taking the first input part as a first minuend, and performing a subtraction operation on the first minuend to obtain a first result; concatenating the previous result with the adjacent second input part to obtain a corresponding xth minuend, and performing a subtraction operation on the corresponding xth minuend to obtain a corresponding xth result, wherein the last result is the modulo result.

[0064] Continuing with the example of the modulo input of the modulo circuit 122 being mod_input, in the example where n is 64, performing one modulo operation, first, the first input portion mod_input[259:3] is taken as the first minuend, and one subtraction operation is performed on the first minuend to obtain a first result. Subsequently, the second input portion mod_input[2] (i.e., the first second input portion) is concatenated with the first result to obtain a second minuend, and one subtraction operation is performed on the second minuend to obtain a second result. Subsequently, the second input portion mod_input[1] (i.e., the second second input portion) is concatenated with the second result to obtain a third minuend, and one subtraction operation is performed on the third minuend to obtain a third result. Finally, the second input portion mod_input[0] (i.e., the third second input portion) is concatenated with the third result to obtain a fourth minuend, and one subtraction operation is performed on the fourth minuend to obtain a fourth result, which is the one modulo result, output from the modulo circuit 122.

[0065] In the example where n is 32, performing one modulo operation, first, the first input portion mod_input[263:7] is taken as the first minuend, and one subtraction operation is performed on the first minuend to obtain a first result. Subsequently, the second input portion mod_input[6] (i.e., the first second input portion) is concatenated with the first result to obtain a second minuend, and one subtraction operation is performed on the second minuend to obtain a second result. Subsequently, the second input portion mod_input[5] (i.e., the second second input portion) is concatenated with the second result to obtain a third minuend, and one subtraction operation is performed on the third minuend to obtain a third result. Subsequently, the second input portion mod_input[4] (i.e., the third second input portion) is concatenated with the third result to obtain a fourth minuend, and one subtraction operation is performed on the fourth minuend to obtain a fourth result. By analogy, finally, the second input portion mod_input[0] (i.e., the seventh second input portion) is concatenated with the seventh result to obtain an eighth minuend, and one subtraction operation is performed on the eighth minuend to obtain an eighth result, which is the one modulo result, output from the modulo circuit 122.

[0066] Further, in some embodiments, performing one subtraction operation on the first minuend to obtain a first result includes: subtracting the modulus from the first minuend to obtain a first subtraction result; wherein when the first subtraction result is positive, the first result is the first subtraction result; and when the first subtraction result is negative, the first result is the first minuend, i.e., the first input portion.

[0067] The second subtrahend is the last preset bit of the first result of splicing and the first second input part, wherein the first second input part is located after the last preset bit of the first result.

[0068] The second result is obtained by performing a subtraction operation on the second subtrahend, including: subtracting the modulus from the second subtrahend to obtain a second subtraction result; wherein when the second subtraction result is positive, the second result is the second subtraction result; and when the second subtraction result is negative, the second result is the second subtrahend.

[0069] The xth subtrahend is the last preset bit of the last result of splicing and the adjacent second input part, wherein the adjacent second input part is located after the last preset bit of the last result.

[0070] The xth result is obtained by performing a subtraction operation on the xth subtrahend, including: subtracting the modulus from the xth subtrahend to obtain a corresponding xth subtraction result; wherein when the corresponding xth subtraction result is positive, the corresponding xth result is the corresponding xth subtraction result; and when the corresponding xth subtraction result is negative, the corresponding xth result is the xth subtrahend.

[0071] Taking the modulus input of the above-mentioned modulus circuit 122 as mod_input as an example, the subtraction operation of different subtrahends is explained, wherein it is assumed that the modulus in SM9 is Q.

[0072] In the example where n is 64, first, the first subtrahend mod_input[259:3] is subtracted by the modulus Q to obtain the first subtraction result sub1; when the highest bit of the first subtraction result sub1 is 0, it indicates that the first subtraction result sub1 is positive, at this time, the first result step1_sel is the first subtraction result sub1; when the highest bit of the first subtraction result sub1 is 1, it indicates that the first subtraction result sub1 is negative, at this time, the first result step1_sel is the first subtrahend mod_input[259:3].

[0073] Subsequently, the last preset bits of the first result step1_sel, for example, the last 256 bits of the first result step1_sel, i.e., step1_sel[255:0], are spliced with the second input part mod_input[2] (i.e., the first second input part) to obtain a second minuend (i.e., step1_sel[255:0] and mod_input[2]), and the second minuend is subtracted by the modulus Q to obtain a second subtraction result sub2. When the highest bit of the second subtraction result sub2 is 0, it indicates that the second subtraction result sub2 is positive, at this time, the second result step2_sel is the second subtraction result sub2. When the highest bit of the second subtraction result sub2 is 1, it indicates that the second subtraction result sub2 is negative, at this time, the second result step2_sel is the second minuend, i.e., step1_sel[255:0] and mod_input[2].

[0074] Subsequently, the last preset bits of the second result step2_sel, for example, the last 256 bits of the second result step2_sel, i.e., step2_sel[255:0], are spliced with the second input part mod_input[1] (i.e., the second second input part) to obtain a third minuend (i.e., step2_sel[255:0] and mod_input[1]), and the third minuend is subtracted by the modulus Q to obtain a third subtraction result sub3. When the highest bit of the third subtraction result sub3 is 0, it indicates that the third subtraction result sub3 is positive, at this time, the third result step3_sel is the third subtraction result sub3. When the highest bit of the third subtraction result sub3 is 1, it indicates that the third subtraction result sub3 is negative, at this time, the third result step3_sel is the third minuend, i.e., step2_sel[255:0] and mod_input[1].

[0075] Finally, the last preset bits of the third result step3_sel, for example, the last 256 bits of the third result step3_sel, i.e., step3_sel[255:0], are spliced with the second input part mod_input[0] (i.e., the third second input part) to obtain a fourth minuend (i.e., step3_sel[255:0] and mod_input[0]), and the fourth minuend is subtracted by the modulus Q to obtain a fourth subtraction result sub4. When the highest bit of the fourth subtraction result sub4 is 0, it indicates that the fourth subtraction result sub4 is positive, and at this time, the fourth result step4_sel is the fourth subtraction result sub4. When the highest bit of the fourth subtraction result sub4 is 1, it indicates that the fourth subtraction result sub4 is negative, and at this time, the fourth result step4_sel is the fourth minuend, i.e., step3_sel[255:0] and mod_input[0]. In this way, the fourth result step4_sel is the one-time modulo result and is output from the modulo circuit 122.

[0076] In the example in which n is 32, first, the first minuend mod_input[263:7] is subtracted by the modulus Q to obtain a first subtraction result sub1. When the highest bit of the first subtraction result sub1 is 0, it indicates that the first subtraction result sub1 is positive, and at this time, the first result step1_sel is the first subtraction result sub1. When the highest bit of the first subtraction result sub1 is 1, it indicates that the first subtraction result sub1 is negative, and at this time, the first result step1_sel is the first minuend mod_input[263:7].

[0077] Subsequently, the last preset bits of the first result step1_sel, for example, the last 256 bits of the first result step1_sel, i.e., step1_sel[255:0], are spliced with the second input part mod_input[6] (i.e., the first second input part) to obtain a second minuend (i.e., step1_sel[255:0] and mod_input[6]), and the second minuend is subtracted by the modulus Q to obtain a second subtraction result sub2. When the highest bit of the second subtraction result sub2 is 0, it indicates that the second subtraction result sub2 is positive, and at this time, the second result step2_sel is the second subtraction result sub2. When the highest bit of the second subtraction result sub2 is 1, it indicates that the second subtraction result sub2 is negative, and at this time, the second result step2_sel is the second minuend, i.e., step1_sel[255:0] and mod_input[6].

[0078] Then, the preset bits at the back of the second result step2_sel, for example, the 256 bits at the back of the second result step2_sel, i.e. step2_sel[255:0], are spliced with the second input part mod_input[5] (i.e. the second second input part) to obtain a third minuend (i.e. step2_sel[255:0] and mod_input[5]), and the third minuend is subtracted by the modulus Q to obtain a third subtraction result sub3. When the highest bit of the third subtraction result sub3 is 0, it indicates that the third subtraction result sub3 is positive, and at this time, the third result step3_sel is the third subtraction result sub3. When the highest bit of the third subtraction result sub3 is 1, it indicates that the third subtraction result sub3 is negative, and at this time, the third result step3_sel is the third minuend, i.e. step2_sel[255:0] and mod_input[5].

[0079] By analogy, finally, the preset bits at the back of the seventh result step7_sel, for example, the 256 bits at the back of the seventh result step7_sel, i.e. step7_sel[255:0], are spliced with the second input part mod_input[0] (i.e. the seventh second input part) to obtain an eighth minuend (i.e. step7_sel[255:0] and mod_input[0]), and the eighth minuend is subtracted by the modulus Q to obtain an eighth subtraction result sub8. When the highest bit of the eighth subtraction result sub8 is 0, it indicates that the eighth subtraction result sub8 is positive, and at this time, the eighth result step8_sel is the eighth subtraction result sub8. When the highest bit of the eighth subtraction result sub8 is 1, it indicates that the eighth subtraction result sub8 is negative, and at this time, the eighth result step8_sel is the eighth minuend, i.e. step7_sel[255:0] and mod_input[0]. In this way, the eighth result step8_sel is the one-time modulo result and is output from the modulo circuit 122.

[0080] The application also provides a security chip. As shown in Figure 4 , it is a structural schematic diagram of the security chip of an embodiment of the application. The security chip 400 comprises a modulo multiplier 410, wherein the modulo multiplier 410 can be the modulo multiplier 100 as shown in Figure 1 or Figure 2 .

[0081] The application also provides an electronic device. As shown in Figure 5 , it is a structural schematic diagram of the electronic device of an embodiment of the application. The electronic device 500 comprises a security chip 510, wherein the security chip 510 can be the security chip 400 as shown in Figure 4 .

[0082] The application also provides an encryption method. The encryption method is applied to SM9 and includes the following steps: performing a modular multiplication operation on two operators in the SM9 to obtain a modular multiplication result, so as to realize encryption, wherein the modular multiplication operation is realized by a modular multiplier 100 as shown in Figure 1 or Figure 2 .

[0083] Many modifications and variations of the described devices and methods can be made in light of the above teachings. It is, therefore, to be understood that the above teachings should be considered as illustrative only and not restrictive of such devices and methods, as the scope of the claimed application is to be limited solely by the appended claims.

Claims

1. A modular multiplier, characterized by Applied to SM9, comprising: a multiplication circuit, configured to perform a multiplication operation on two operators in the SM9 to obtain a product of the two operators, wherein the product is a binary number and has a bit number m, and the m is an integer multiple of 2; and a modulus divider connected with the multiplication circuit, configured to complete n times of modulus operations on the product in n clock cycles to obtain a final modular multiplication result, wherein each time of the modulus operation is performed in one clock cycle to obtain one modulus result, and the n is a positive integer less than m / 2; the product is sequentially divided into a first part and n-1 second parts, wherein the first part is located before the n-1 second parts, and the bit number of the first part is equal to the sum of the bit number of one of the second parts and the bit number of the one modulus result; the modulus divider performs the modulus operation on the first part and the n-1 second parts respectively, comprising: performing one modulus operation on the first part in the first clock cycle of the n clock cycles; sequentially performing n-1 times of modulus operations on the combination of the modulus result obtained in the last clock cycle and the adjacent second part in the remaining n-1 clock cycles of the n clock cycles.

2. The modular multiplier of claim 1, wherein, the performing one modulus operation on the first part in the first clock cycle of the n clock cycles, comprising: in the first clock cycle, transmitting the first part to the modulus divider to obtain and register the first modulus result from the modulus divider; the sequentially performing n-1 times of modulus operations on the combination of the modulus result obtained in the last clock cycle and the adjacent second part in the remaining n-1 clock cycles of the n clock cycles, comprising: in each of the remaining n-1 clock cycles of the n clock cycles, splicing and transmitting the modulus result obtained in the last clock cycle and the adjacent second part to the modulus divider to obtain and register the modulus result from the modulus divider, wherein the last modulus result is the final modular multiplication result.

3. The modular multiplier of claim 1, wherein, the modulus divider comprises a state machine and a modulus circuit, the modulus circuit is connected with the state machine, and the state machine comprises a first state and a second state, wherein the first state is used to instruct the modulus circuit to perform one modulus operation on the first part in the first clock cycle of the n clock cycles; and the second state is used to instruct the modulus circuit to sequentially perform n-1 times of modulus operations on the n-1 second parts in the remaining n-1 clock cycles of the n clock cycles.

4. The modular multiplier of claim 2, wherein, the one modulus operation comprises x times of concatenated subtraction operations, wherein the subtrahend of each time of the subtraction operation is a modulus in the SM9, the x is a positive integer, and the x is the difference between the bit number of the modulus input of the modulus divider and the bit number of the one modulus result.

5. The modular multiplier of claim 4, wherein, The modulo input is sequentially split into a first input part and x-1 second input parts, wherein the first input part is located before the x-1 second input parts, and the number of bits of the first input part is equal to the sum of the number of bits of one of the second input parts and the number of bits of the one-time modulo result; and The one-time modulo operation includes: The first input part is taken as a first subtrahend, and a subtraction operation is performed on the first subtrahend to obtain a first result; The previous result is spliced with an adjacent second input part to obtain a corresponding xth subtrahend, and a subtraction operation is performed on the corresponding xth subtrahend to obtain a corresponding xth result, wherein the last result is the one-time modulo result.

6. The modular multiplier of claim 5, wherein, The first result is obtained by performing a subtraction operation on the first subtrahend, including: The first subtrahend is subtracted by the modulus to obtain a first subtraction result; When the first subtraction result is positive, the first result is the first subtraction result; when the first subtraction result is negative, the first result is the first subtrahend; The xth subtrahend is the last preset bit of the previous result spliced with an adjacent second input part, wherein the adjacent second input part is located after the last preset bit of the previous result; The corresponding xth result is obtained by performing a subtraction operation on the xth subtrahend, including: The xth subtrahend is subtracted by the modulus to obtain a corresponding xth subtraction result; When the corresponding xth subtraction result is positive, the corresponding xth result is the corresponding xth subtraction result; when the corresponding xth subtraction result is negative, the corresponding xth result is the xth subtrahend.

7. A secure chip, characterized by The modulo multiplier includes any one of claims 1-6.

8. An electronic device, comprising: The secure chip includes claim 7.

9. An encryption method characterized by, Applied to SM9, including: A modulo multiplication operation is performed on two operators in the SM9 to obtain a modulo multiplication result, thereby realizing encryption, wherein the modulo multiplication operation is realized by the modulo multiplier of any one of claims 1-6.

Images