A method and hardware architecture for obtaining the greatest common divisor of large numbers

Abstract

The present application relates to the field of computer application technology, and provides a method and hardware architecture for obtaining the greatest common divisor of large number expansion, including a control module, a GCD calculation unit, a Bézouté coefficient calculation unit, a first multiplexer, a second multiplexer, a termination module, and an input_valid signal. The GCD calculation unit and the Bézouté coefficient calculation unit are used to iteratively update intermediate variables according to the control signal of the control module. By introducing the δ parameter, the comparison of the sizes of the intermediate variables a and b is avoided. Based on the k-ary algorithm, the calculation and redundant form of the Bézouté coefficient are introduced. In hardware implementation, only simple addition, subtraction, and shift operations are required, which greatly reduces the time required for addition operations, thereby achieving the purpose of increasing the clock frequency, reducing the iteration cycle, and shortening the total running time.

Description

Technical Field

[0001] The present application relates to the field of computer application technology, and in particular to a method and hardware architecture for obtaining the greatest common divisor of large numbers. Background Art

[0002] With the development of the internet, ensuring information security during communications is crucial, and cryptographic technology is therefore receiving increasing attention. Cryptography, for security reasons, not only utilizes large-bitwidth data, but also includes encryption, decryption, and signature algorithms for data transmission, storage, and identity authentication. These include verifiable delay functions in binary quadratic forms (VDFs) and modular inversion. Among these operations, the extended greatest common divisor (XGCD) is a core unit due to its computational complexity.

[0003] In a public-key cryptosystem based on the RSA algorithm, the sender encrypts a plaintext file using a public key to obtain the ciphertext. The receiver decrypts the ciphertext using the private key corresponding to the public key. The public key consists of a modulus and a public key exponent, while the private key also consists of a modulus and a private key exponent. To generate the public-private key pair, two large prime numbers p and q are first selected to obtain the modulus. The first parameter is obtained by multiplying the coprime numbers of p and q. The public key exponent is then selected based on the first parameter. The private key exponent is the modular inverse of the public key exponent with respect to the first parameter. Therefore, the public key exponent and the first parameter can be used as inputs to the XGCD algorithm, and the corresponding Bézouté coefficient output is the private key exponent.

[0004] The prior art discloses an XGCD calculation method based on the Extended Euclidean algorithm (EEA) and its variants. This method requires a small number of iterations. Since the CPU frequency is fixed, a small number of iterations means that the calculation time is very short, so it is widely used in software implementations, such as the GNU Multiple Precision Arithmetic Library (GMP). However, in terms of hardware implementation, the above method requires the use of division, and the implementation of large number division is very complex, resulting in a long critical path. In addition, it has data dependencies and needs to be iterated serially. It is difficult to increase the calculation speed through parallel processing, resulting in high complexity and low computational efficiency in hardware implementation, which becomes a bottleneck in high-speed cryptographic applications and hardware implementation.

[0005] Prior art also discloses XGCD calculation methods based on the k-ary algorithm and the two-bit PM algorithm. The k-ary algorithm, by designing the k value, requires only simple operations. Compared to the PM algorithm and the two-bit PM algorithm, different k values ​​can achieve a good compromise between area and computational speed, making it more flexible and applicable to a wider range of design requirements. However, for the k-ary algorithm, most studies do not mention methods for calculating the Bézouté coefficients. The few methods for calculating the Bézouté coefficients based on the k-ary algorithm require modular multiplication and division, which are very complex for hardware implementation. Summary of the Invention

[0006] The present application provides a method and hardware architecture for obtaining the greatest common divisor of large number expansion, so as to reduce complexity and adapt to hardware implementation.

[0007] In a first aspect, the present application provides a method for obtaining the greatest common divisor of a large number, which is applied to the generation of a public-private key pair, comprising:

[0008] Obtain the first parameter and public key exponent in the process of generating the public-private key pair;

[0009] Obtaining a k value preset in the method, where k is a power of 2;

[0010] Initialize intermediate variables required in subsequent iterations according to the first parameter and the public key exponent, the intermediate variables including a first iteration variable, a second iteration variable, a third iteration variable, a fourth iteration variable, a fifth iteration variable, a sixth iteration variable, and a seventh iteration variable, wherein an initial value of the seventh iteration variable is 0; the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable satisfy xA+yB=a and zA+wB=b, and their initial values ​​are x=1, y=0, z=0, w=1, a=A, and b=B, wherein A is the first parameter, B is the public key exponent, a is the first iteration variable, b is the second iteration variable, x is the third iteration variable, y is the fourth iteration variable, z is the fifth iteration variable, and w is the sixth iteration variable;

[0011] Determine whether the first iteration variable or the second iteration variable is an even number;

[0012] If the first iteration variable is an even number, the first data is selected, and the first iteration variable is updated by dividing the first iteration variable by the value of the first data, the third iteration variable is updated by dividing the third iteration variable by the value of the first data, the fourth iteration variable is updated by dividing the fourth iteration variable by the value of the first data, and the seventh iteration variable is updated by subtracting log2u from the seventh iteration variable, where u is the first data, and the first data is the largest number in a data set of a power of 2 that is less than or equal to k and can be divided by the first iteration variable;

[0013] If the updated first iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the second iteration variable, the Bézouté coefficient corresponding to the first parameter is the fifth iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the sixth iteration variable.

[0014] Optionally, it also includes:

[0015] If the updated first iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

[0016] Optionally, after determining whether the first iteration variable or the second iteration variable is an even number, the method further includes:

[0017] If the second iteration variable is an even number, the second data is selected, and the second iteration variable is updated by dividing the second iteration variable by the value of the second data, the fifth iteration variable is updated by dividing the fifth iteration variable by the value of the second data, the sixth iteration variable is updated by dividing the sixth iteration variable by the value of the second data, and the seventh iteration variable is updated by adding log2v to the seventh iteration variable, where v is the second data, and the second data is the largest number in the data set of the power of 2 that is less than or equal to k and can be divided by the second iteration variable;

[0018] If the updated second iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the first iteration variable, the Bézouté coefficient corresponding to the first parameter is the third iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the fourth iteration variable.

[0019] Optionally, it also includes:

[0020] If the updated second iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

[0021] Optionally, after determining whether the first iteration variable or the second iteration variable is an even number, the method further includes:

[0022] If the first and second iteration variables are both odd numbers, select the third and fourth data and calculate c = (pa + qb) / k, α = (px + qz) / k, β = (py + qw) / k, where p is the third data, q is the fourth data, and the third and fourth data satisfy and pa+qb=0(mod k), and, according to the third data and the fourth data, the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, the sixth iteration variable, and the seventh iteration variable are updated, wherein: if the seventh iteration variable is a negative number, (c, α, β) is used to update (b, z, w), and the seventh iteration variable is added with log2k / q-1 to update the seventh iteration variable; if the seventh iteration variable is a non-negative number, (c, α, β) is used to update (a, x, y), and the seventh iteration variable is subtracted with log2k / q-1 to update the seventh iteration variable;

[0023] If the updated second iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the first iteration variable, the Bézouté coefficient corresponding to the first parameter is the third iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the fourth iteration variable.

[0024] A second aspect of the present application provides a hardware architecture for obtaining the greatest common divisor of large number expansion, which is used to calculate XA+YB=GCD(A, B)=G, wherein G, X, and Y are operation results, A is a first operand, B is a second operand, and both the first operand and the second operand are odd numbers. The architecture is characterized by comprising: a control module, a GCD calculation unit, a Bézout coefficient calculation unit, a first multiplexer, a second multiplexer, a termination module, and an input_valid signal;

[0025] a GCD calculation unit, wherein an input end of the GCD calculation unit is respectively connected to an output end of the first multiplexer and an output end of the control module, and an output end of the GCD calculation unit is respectively connected to an input end of the control module, an input end of the termination module, and an input end of the first multiplexer, the GCD calculation unit being configured to use an input first operand and a second operand as initial values ​​of a first iteration variable and a second iteration variable, respectively, and, based on a control signal from the control module, update the first iteration variable or the second iteration variable input each time, simultaneously update a seventh iteration variable whose initial value is 0, and output the first iteration variable, the second iteration variable, and the seventh iteration variable completed for the current iteration;

[0026] a Bézouté coefficient calculation unit, wherein an input end of the Bézouté coefficient calculation unit is respectively connected to an output end of the second multiplexer and an output end of the control module, and an output end of the Bézouté coefficient calculation unit is connected to an input end of the second multiplexer, the Bézouté coefficient calculation unit being configured to use input 1, 0, 0, and 1 as initial values ​​of a third iteration variable, a fourth iteration variable, a fifth iteration variable, and a sixth iteration variable, respectively, and, based on a control signal from the control module, update the third iteration variable, the fourth iteration variable, the fifth iteration variable, or the sixth iteration variable input each time, and output the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable completed in the current iteration, wherein the control signal from the control module received by the GCD calculation unit and the Bézouté coefficient calculation unit is a synchronization signal;

[0027] an input_valid signal, configured to transmit a signal to the first multiplexer and the second multiplexer, wherein the input_valid signal is configured to control the first multiplexer to select the first operand, the second operand, or the first iteration variable and the second iteration variable output from the previous iteration as inputs for each iterative calculation of the GCD calculation unit, and to control the second multiplexer to select 0, 1, or the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable output from the previous iteration as inputs for each iterative calculation of the Bézouté coefficient calculation unit;

[0028] a control module having a built-in k value, configured to receive a first iteration variable, a second iteration variable, and a seventh iteration variable completed in each iteration, and output a control signal to control calculation results of the GCD calculation unit and the Bézouté coefficient calculation unit based on the built-in k value, the first iteration variable, the second iteration variable, and the seventh iteration variable;

[0029] The termination module is used to receive the first iteration variable and the second iteration variable completed in each iteration, and, if the first iteration variable or the second iteration variable of the current iteration is equal to 0, terminate the iterative update of all variables; when the first iteration variable is 0, determine (G, X, Y) as the second iteration variable, the fifth iteration variable and the sixth iteration variable of the current iteration respectively; when the second iteration variable is 0, determine (G, X, Y) as the first iteration variable, the third iteration variable and the fourth iteration variable of the current iteration respectively.

[0030] Optionally, when the k value is 8, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a sixth shifter, a seventh shifter, an eighth shifter, a first GCD selector, and a second GCD selector, wherein an input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, the fourth shifter, the fifth shifter, and the first iteration variable, and an input end of the second GCD selector is respectively connected to the fourth shifter, the fifth shifter, the sixth shifter, the seventh shifter, the eighth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to a control signal of the control module, for selecting corresponding outputs according to the control signal;

[0031] The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable;

[0032] The second shifter inputs the first iteration variable and is used to complete a right shift operation of the first iteration variable by two bits;

[0033] The third shifter inputs the first iteration variable and is used to perform a right shift operation of the first iteration variable by three bits;

[0034] The fourth shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by three bits;

[0035] The fifth shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by two bits;

[0036] The sixth shifter inputs the second iteration variable, and is used to complete a right shift operation on the second iteration variable;

[0037] The seventh shifter inputs the second iteration variable and is used to complete a right shift operation of the second iteration variable by two bits;

[0038] The eighth shifter inputs the second iteration variable and is used to complete a three-bit right shift operation on the second iteration variable.

[0039] Optionally, when the k value is 4, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a first GCD selector, and a second GCD selector, wherein an input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, and the first iteration variable, and an input end of the second GCD selector is respectively connected to the third shifter, the fourth shifter, the fifth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to a control signal of a control module, for selecting corresponding outputs according to the control signal;

[0040] The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable;

[0041] The second shifter inputs the first iteration variable and is used to complete a right shift operation of the first iteration variable by two bits;

[0042] The third shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by two bits;

[0043] The fourth shifter inputs the second iteration variable, and is used to complete a right shift operation on the second iteration variable;

[0044] The fifth shifter inputs the second iteration variable and is used to complete a right shift operation of the second iteration variable by two bits.

[0045] Optionally, when the k value is 2, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a first GCD selector, and a second GCD selector, wherein the input end of the first GCD selector is respectively connected to the first shifter, the second shifter, and the first iteration variable, and the input end of the second GCD selector is respectively connected to the second shifter, the third shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to a control signal of a control module, for selecting corresponding outputs according to the control signal;

[0046] The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable;

[0047] The second shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation on the sum or difference of the first iteration variable and the second iteration variable;

[0048] The third shifter inputs the second iteration variable and is used to complete a right shift operation on the second iteration variable.

[0049] Optionally, the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable and the sixth iteration variable are represented using redundancy.

[0050] From the above technical solutions, it can be seen that the method for obtaining the extended greatest common divisor of large numbers based on the improved k-ary algorithm provided by this application, as well as the XGCD hardware implementation of its redundant representation, compared with the existing technology:

[0051] (1) The introduction of the δ parameter avoids comparing the sizes of a and b, which is very effective for both redundant and non-redundant forms.

[0052] (2) The Bézout coefficient algorithm is introduced while calculating the greatest common divisor. The calculation of the Bézout coefficient only requires simple addition, subtraction and shift operations, and in each iteration it is guaranteed that xA+yB=a, zA+wB=b holds.

[0053] (3) The introduction of redundant forms greatly reduces the time required for addition operations, thereby achieving the goal of increasing the clock frequency.

[0054] In summary, the solution provided by the embodiments of this application avoids comparing two large-bitwidth data points a and b during each iteration by introducing the intermediate variable parameter δ. Furthermore, the calculation and redundant form of the Bézout coefficients are introduced to avoid delays caused by carry propagation during addition. The method and hardware architecture of the embodiments of this application can reduce iteration cycles, shorten the total runtime, significantly shorten the critical path, and achieve a significant speed improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a method for obtaining the greatest common divisor of a large number provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of the structure of the hardware architecture for obtaining the greatest common divisor of large numbers provided in an embodiment of the present application;

[0057] Figure 3 A schematic diagram of a partial structure of a GCD calculation unit provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of a partial structure of a Bézouté coefficient calculation unit provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] See also Figure 1 The embodiment of the present application is based on the k-ary algorithm, which is improved on the k-ary algorithm of the prior art, reduces the complexity and is suitable for hardware implementation. Figure 1, elaborates in detail the principle of the XGCD calculation process provided in the embodiment of this application.

[0060] To facilitate subsequent explanations, first define the symbols as follows:

[0061] A and B represent initial inputs, A is the first operand, B is the second operand, and both A and B are odd numbers. During the entire calculation process, A and B are constants.

[0062] The final output is G, X, and Y, satisfying XA+YB=GCD(A, B)=G.

[0063] x, y, z, w, a, and b are intermediate variables of the iteration, satisfying xA+yB=a, zA+wB=b respectively, and the initial values ​​are x=1, y=0, z=0, w=1, a=A, and b=B.

[0064] δ is an introduced parameter, and its initial value is 0.

[0065] k is a preset value, a power of 2, so that division by k can be replaced by shifts during calculations, eliminating division operations and significantly reducing hardware complexity and critical path length. A larger k reduces the number of bits in a and b after each iteration, reducing the number of cycles required. However, a larger k increases hardware area and wire delay.

[0066] The principle of the XGCD calculation process provided in the embodiment of this application is as follows:

[0067] After initializing the intermediate variables of the iteration, first determine the parity of a and b. If a is an even number, obtain the data u, where u is a power of 2 and ≤ k, and u is the largest number in the data set of powers of 2 that can be divided by a. Then use To update the replacement (a, x, y), and subtract log2u from the parameter δ to update the original δ; if b is an even number, get the data v, where v is a power of 2 and ≤ k, and v is the largest number in the data set of 2 that can be divided by a, and then use To update and replace (b, z, w), and add the parameter δ to log2u to update and replace the original δ. It should be noted that a and b cannot be even numbers at the same time; if a and b are both odd numbers, then obtain a set (p, q), where And satisfy pa+qb=0(mod k), then calculate c=(pa+q) / k, α=(px+qz) / k, β=(py+qw) / k. If the parameter δ is less than 0, (c, α, β) is used to update and replace (b, z, w), and the parameter δ is added with log2k / q-1 to update and replace the original δ. If the parameter δ is greater than or equal to 0, (c, α, β) is used to replace (a, x, y), and the parameter δ is subtracted with log2k / q-1 to update and replace the original δ. The above steps of determining the parity of a and b and updating the corresponding variables are executed cyclically until a or b is 0. At this time, the final output is obtained. If a is 0, then (G, X, Y)=(b, z, w), and if b is 0, then (G, X, Y)=(a, x, y).

[0068] The embodiment of the present application introduces the parameter δ to avoid comparing two large-bit-width data a and b in each iterative loop, so as to reduce delays and subsequent hardware resource consumption during hardware implementation, and simultaneously calculates the Bézout coefficient in the calculation of k-ary. In addition, in some preferred embodiments, a redundant form is introduced, and except for the parameter δ, the remaining variables are all represented redundantly. Since the operands are all large-bit-width data, the carry propagation delay of addition is often relatively large. In order to further reduce the critical path and avoid the delay caused by carry propagation in addition, the introduction of a redundant form is very effective in iterative large-number addition operations. The k-ary algorithm improved based on the redundant form only needs to perform addition and subtraction operations. When the number of iterations is large, the speed improvement brought by the use of the redundant form is very considerable.

[0069] This embodiment of the application uses C++ to model the XGCD calculation process for testing. When k = 8, for an input value of 1024 bits, an average XGCD calculation requires 908 iterations, which is approximately 25% less than the 1195 iterations required for two-bit PM. If k is smaller or the input is larger, the iteration period will increase.

[0070] Based on the principle of the above-mentioned XGCD calculation process, an embodiment of the present application provides a method for obtaining a private key exponent in a public-private key pair scenario, which includes steps S1 to S6.

[0071] S1. Obtain the first parameter and public key exponent in the process of generating the public-private key pair.

[0072] In the process of generating a public-private key pair, the public key consists of a modulus and a public key exponent, and the private key consists of a modulus and a private key exponent. First, two large prime numbers p and q are selected to obtain the modulus, and the first parameter is obtained by multiplying the coprime numbers of p and q. The public key exponent is selected based on the first parameter, where the private key exponent is the modular inverse element of the public key exponent with respect to the first parameter. Therefore, the public key exponent and the first parameter can be used as inputs of XGCD, and the corresponding Bézout coefficient output is the private key exponent.

[0073] S2. Obtain a k value preset in the method, where k is a power of 2.

[0074] k is a preset value, a power of 2, so that division by k can be replaced by shifts during calculations, eliminating division operations and significantly reducing hardware complexity and critical path length. A larger k reduces the number of bits in a and b after each iteration, reducing the number of cycles required. However, a larger k increases hardware area and wire delay.

[0075] S3. Generate a first iteration variable, a second iteration variable, a third iteration variable, a fourth iteration variable, a fifth iteration variable, a sixth iteration variable and a seventh iteration variable, wherein the initial value of the seventh iteration variable is 0; the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable and the sixth iteration variable satisfy xA+yB=a and zA+wB=b, wherein A is a first parameter, B is a public key exponent, a is a first iteration variable, b is a second iteration variable, x is a third iteration variable, y is a fourth iteration variable, z is a fifth iteration variable, and w is a sixth iteration variable.

[0076] Initialize intermediate variables that require subsequent iterations based on the first parameter and the public key exponent, including a first iteration variable, a second iteration variable, a third iteration variable, a fourth iteration variable, a fifth iteration variable, a sixth iteration variable, and a seventh iteration variable. Initialize the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable, where x=1, y=0, z=0, w=1, a=A, and b=B.

[0077] S4. Determine whether the first iteration variable or the second iteration variable is an even number.

[0078] It should be noted that the first iteration variable and the second iteration variable cannot both be even numbers.

[0079] S5. If the first iteration variable is an even number, select the first data, and update the first iteration variable by dividing the first iteration variable by the value of the first data, update the third iteration variable by dividing the third iteration variable by the value of the first data, update the fourth iteration variable by dividing the fourth iteration variable by the value of the first data, and update the seventh iteration variable by subtracting log2u from the seventh iteration variable, where u is the first data, and the first data is the largest number in a data set that is less than or equal to k and is a power of 2 that can be divided by the first iteration variable.

[0080] S6. If the updated first iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the second iteration variable, the Bézouté coefficient corresponding to the first parameter is the fifth iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the sixth iteration variable.

[0081] Furthermore, if the updated first iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

[0082] Further, when determining whether the first iteration variable or the second iteration variable is an even number, if the second iteration variable is an even number, the second data is selected, and the second iteration variable is updated by dividing the second iteration variable by the value of the second data, the fifth iteration variable is updated by dividing the fifth iteration variable by the value of the second data, the sixth iteration variable is updated by dividing the sixth iteration variable by the value of the second data, and the seventh iteration variable is updated by adding log2v to the seventh iteration variable, where v is the second data, and the second data is the largest number in a data set of powers of 2 that is less than or equal to k and can be divided by the second iteration variable.

[0083] Furthermore, if the updated second iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the first iteration variable, the Bézouté coefficient corresponding to the first parameter is the third iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the fourth iteration variable.

[0084] Furthermore, if the updated second iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

[0085] Furthermore, when judging whether the first iteration variable or the second iteration variable is an even number, if both the first iteration variable and the second iteration variable are odd numbers, the third data and the fourth data are selected, and c = (pa + qb) / k, α = (px + qz) / k, β = (py + qw) / k are calculated, where p is the third data, q is the fourth data, and the third data and the fourth data satisfy And pa+qb=0(mod k), and, according to the third data and the fourth data, the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, the sixth iteration variable, and the seventh iteration variable are updated, wherein: if the seventh iteration variable is a negative number, (c, α, β) is used to update (b, z, w), and the seventh iteration variable is updated by adding log2k / q-1 to the seventh iteration variable; if the seventh iteration variable is a non-negative number, (c, α, β) is used to update (a, x, y), and the seventh iteration variable is updated by subtracting log2k / q-1 from the seventh iteration variable. If the updated first iteration variable or the second iteration variable is 0, the iteration is terminated and the corresponding output is output using the above method. If the updated first iteration variable or the second iteration variable is not 0, it is continued to re-determine whether the first iteration variable or the second iteration variable is an even number, thereby iteratively updating the intermediate variable.

[0086] Furthermore, the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable and the sixth iteration variable are all represented using redundancy.

[0087] See also Figure 2 Regarding the XGCD calculation process provided above in the embodiment of the present application, the embodiment of the present application also provides a hardware architecture for obtaining the greatest common divisor of large number expansion, including a control module (control), a GCD calculation unit, a Bézout coefficient calculation unit, a first multiplexer, a second multiplexer, a termination module (termination) and an input_valid signal.

[0088] The GCD calculation unit is used to update the first iteration variable a, the second iteration variable b, and the seventh iteration variable δ. The input end of the GCD calculation unit is respectively connected to the output end of the first multiplexer and the output end of the control module, and the output end of the GCD calculation unit is respectively connected to the input end of the control module, the input end of the termination module, and the input end of the first multiplexer. The GCD calculation unit is used to use the input first operand A and the second operand B as the initial values ​​of the first iteration variable and the second iteration variable, respectively, and, according to the control signal of the control module, update the first iteration variable a each time it is input. i or the second iteration variable b i , where i is the current iteration number, and at the same time, the seventh iteration variable δ with an initial value of 0 is updated, and the first iteration variable a completed in the current iteration is output i+1 , second iteration variable b i+1 and the seventh iteration variable as input for the next iteration.

[0089] The Bézouté coefficient calculation unit is used to update the third iteration variable x, the fourth iteration variable y, the fifth iteration variable z, and the sixth iteration variable w. The input end of the Bézouté coefficient calculation unit is respectively connected to the output end of the second multiplexer and the output end of the control module, and the output end of the Bézouté coefficient calculation unit is connected to the input end of the second multiplexer. The Bézouté coefficient calculation unit is used to use the input 1, 0, 0, and 1 as the initial values ​​of the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable, respectively, and, according to the control signal of the control module, update the third iteration variable, the fourth iteration variable, the fifth iteration variable, or the sixth iteration variable input each time, and output the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable completed in the current iteration. The control signal of the control module received by the GCD calculation unit and the Bézouté coefficient calculation unit is a synchronization signal, and the GCD and Bézouté coefficients are calculated synchronously through cyclic iteration.

[0090] The input_valid signal is used to transmit signals to the first multiplexer and the second multiplexer, wherein the input_valid signal is used to control the first multiplexer to select the first operand, the second operand or the first iteration variable and the second iteration variable outputted from the previous iteration as the inputs for each iterative calculation of the GCD calculation unit, and is used to control the second multiplexer to select 0, 1 or the third iteration variable, the fourth iteration variable, the fifth iteration variable and the sixth iteration variable outputted from the previous iteration as the inputs for each iterative calculation of the Bézouté coefficient calculation unit.

[0091] For example, if the input_valid signal is 1, indicating a new set of input data, the GCD calculation unit and the Bézouté coefficient calculation unit are initialized. The first multiplexer selects the new inputs A and B as the inputs to the GCD calculation unit, and the second multiplexer selects 0 and 1 as the inputs to the Bézouté coefficient calculation unit, thereby initializing the intermediate variables. If the input_valid signal is 0, indicating no new data, the original GCD and Bézouté coefficient calculations continue to be iterated, and the output of the previous iteration is selected as the input of the current iteration.

[0092] The control module has a built-in k value, is used to receive the first iteration variable, the second iteration variable and the seventh iteration variable completed in each iteration, and, based on the built-in k value, the first iteration variable, the second iteration variable and the seventh iteration variable, outputs a control signal to determine the output result of each iteration of the GCD calculation unit and the Bézouté coefficient calculation unit.

[0093] The termination module is used to receive the first iteration variable and the second iteration variable completed in each iteration, and, if the first iteration variable or the second iteration variable of the current iteration is equal to 0, terminate the iterative update of all variables, and output an output_valid signal to indicate that when the first iteration variable is 0, (G, X, Y) are respectively determined to be the second iteration variable, the fifth iteration variable, and the sixth iteration variable of the current iteration; when the second iteration variable is 0, (G, X, Y) are respectively determined to be the first iteration variable, the third iteration variable, and the fourth iteration variable of the current iteration.

[0094] See also Figure 3 , exemplarily, when k=8, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a sixth shifter, a seventh shifter, an eighth shifter, a first GCD selector, and a second GCD selector, wherein the input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, the fourth shifter, the fifth shifter, and the first iteration variable, and the input end of the second GCD selector is respectively connected to the fourth shifter, the fifth shifter, the sixth shifter, the seventh shifter, the eighth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to the control signal of the control module, for selecting corresponding outputs according to the control signal.

[0095] The first shifter inputs the first iteration variable a and is used to perform a right shift operation on the first iteration variable a.

[0096] The second shifter inputs the first iteration variable a and is used to complete a right shift operation of the first iteration variable a by two bits.

[0097] The third shifter inputs the first iteration variable a and is used to complete a right shift operation of the first iteration variable a by three bits.

[0098] The fourth shifter inputs the sum or difference of the first iteration variable a and the second iteration variable b, and is used to perform a right shift operation of the sum or difference of the first iteration variable a and the second iteration variable b by three bits.

[0099] The fifth shifter inputs the sum or difference of the first iteration variable a and the second iteration variable b, and is used to perform a right shift operation of the sum or difference of the first iteration variable a and the second iteration variable b by two bits.

[0100] When k=8, according to the principle of the aforementioned XGCD calculation process, when a is an even number, obtain the data u, where u≤k, and u is the largest number in the data set of powers of 2 that can be divided by a. Therefore, the value of u may be 2, 4, or 8 during the iteration process, and then use To update and replace a, the first, second, and third shifters are designed in the hardware architecture of the GCD calculation unit. Similarly, when a and b are both odd numbers, the possible sets of (p, q) obtained are (1, 1), (1, -1), (2, 2), and (2, -2), so the fourth and fifth shifters are designed.

[0101] The update of the second iteration variable b is similar to this, and part of the hardware of the fourth shifter and the fifth shifter can be reused. The sixth shifter, the seventh shifter and the eighth shifter are designed in the GCD calculation unit to update the second iteration variable when the second iteration variable is an even number.

[0102] The sixth shifter inputs the second iteration variable b and is used to complete a right shift operation on the second iteration variable.

[0103] The seventh shifter inputs the second iteration variable b and is used to complete a right shift operation of the second iteration variable by two bits.

[0104] The eighth shifter inputs the second iteration variable b and is used to complete a right shift operation of the second iteration variable by three bits.

[0105] When the control module receives the first iteration variable, the second iteration variable and the seventh iteration variable completed in each iteration, and controls the first GCD selector and the second GCD selector in the GCD calculation unit to select corresponding outputs based on the built-in k value to update the first iteration variable and the second iteration variable. For example, in one case, the control module receives the first iteration variable completed as an even number, and the control module selects u as 4 based on the first iteration variable value and the k value. The control module then sends a control signal, which controls the first GCD selector in the GCD calculation unit of the next iteration to select the second shifter as the updated value output of the first iteration variable, and controls the second GCD selector to select the originally input second iteration variable value as the updated value output.

[0106] Exemplarily, when the k value is 4, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a first GCD selector, and a second GCD selector, wherein the input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, and the first iteration variable, and the input end of the second GCD selector is respectively connected to the third shifter, the fourth shifter, the fifth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to the control signal of the control module, for selecting corresponding outputs according to the control signal.

[0107] The first shifter inputs a first iteration variable and is used to perform a right shift operation on the first iteration variable.

[0108] The second shifter inputs the first iteration variable and is used to complete a right shift operation of the first iteration variable by two bits.

[0109] The third shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by two bits.

[0110] The fourth shifter inputs the second iteration variable and is used to complete a right shift operation on the second iteration variable.

[0111] The fifth shifter inputs the second iteration variable and is used to complete a right shift operation of the second iteration variable by two bits.

[0112] Exemplarily, when the k value is 2, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a first GCD selector, and a second GCD selector, wherein the input end of the first GCD selector is respectively connected to the first shifter, the second shifter, and the first iteration variable, and the input end of the second GCD selector is respectively connected to the second shifter, the third shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to the control signal of the control module, for selecting corresponding outputs according to the control signal.

[0113] The first shifter inputs a first iteration variable and is used to perform a right shift operation on the first iteration variable.

[0114] The second shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a one-bit right shift operation on the sum or difference of the first iteration variable and the second iteration variable.

[0115] The third shifter inputs the second iteration variable and is used to complete a right shift operation on the second iteration variable.

[0116] Furthermore, the hardware architecture for obtaining the greatest common divisor of large number expansion provided in the embodiment of the present application can introduce a redundant form, wherein the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable and the sixth iteration variable are all represented redundantly. It should be noted that the shift of the above-mentioned shifter in the embodiment of the present application represents the shift of the actual value, while in the redundant form, such as Figure 3As shown, the redundant form of shift is twice the actual value shift. For example, in the actual value case, when k=8, the first shifter is used to complete the right shift operation of the first iteration variable a by one bit, the second shifter is used to complete the right shift operation of the first iteration variable a by two bits, and the third shifter is used to complete the right shift operation of the first iteration variable a by three bits; then in the redundant form, when k=8, the first shifter is used to complete the right shift operation of the first iteration variable a by two bits, the second shifter is used to complete the right shift operation of the first iteration variable a by four bits, and the third shifter is used to complete the right shift operation of the first iteration variable a by six bits, and so on.

[0117] As can be seen from the above process, when k is a power of 2, the entire calculation process only involves simple addition, subtraction, and shift operations. By introducing a redundant form, carry propagation can be eliminated in addition and subtraction, which can further reduce the critical path and increase the calculation speed. In the redundant form, the critical path of addition is no longer related to the bit width, but is a fixed value. For example, in the Carry-Save form, the delay of addition is about two 1-bit full adders, which is hundreds of times faster than a 1024-bit full adder, greatly shortening the calculation time. The disadvantage of using a redundant form is that a redundant to non-redundant conversion is required after the calculation is completed, but no matter how many additions are performed in the middle, only one conversion is required. Compared to the benefits of using redundant addition in hundreds or thousands of iterations, the delay added by the redundant to non-redundant conversion after the calculation is completed is negligible. In the preferred embodiment of the present application, except for the seventh iteration variable δ, which uses a non-redundant representation, the remaining variables are all represented using redundant representation.

[0118] See also Figure 4 Regarding the Bézouté coefficient calculation unit, it is used to iteratively update the third iteration variable x, the fourth iteration variable y, the fifth iteration variable z, and the sixth iteration variable w. The calculation of the Bézouté coefficient is generally similar to the hardware architecture of the GCD calculation unit, except that the shift operation needs to be processed separately.

[0119] Unlike a and b, which are directly shifted and truncated, the coefficients x, y, z, and w cannot be truncated directly by shifting. The reason is that there is no guarantee that x, y, z, and w will maintain the same divisibility as a and b in each iteration. For example, in 1*A+1*B=a, if a is an even number, then the shift operation can be performed directly. Due to the redundant form, division by 2 becomes a shift to the right by 2 bits, but the coefficient 1 cannot be directly shifted to the right by two bits because 1 cannot divide 2. However, this problem can be effectively solved by adding and subtracting the initial inputs A and B. Taking k=4 as an example, x divided by 4 may be transformed into one of the following four cases:

[0120]

[0121] Because A and B are initial values ​​and don't change during the calculation, values ​​like 3B can be calculated and saved in advance. The hardware can then calculate these four values ​​simultaneously, ultimately selecting the correct result based on the low-order bits of x and B. For k = 8, eight values ​​must be calculated simultaneously, and the correct result is finally selected. Figure 4 This is an example of a hardware architecture, which is used to update the iteration x when k=8. The LUT inputs x[5:0] and B[5:0] and outputs the corresponding L, which is used to select the correct LB value and input it into the RSD adder so that x+L*B can divide 8. The value of L is determined based on x and B so that x+L*B can divide 8. The update of other coefficients is similar.

[0122] The present embodiment was implemented using the HDL hardware description language and simulated on an ASIC. When k = 8, using the redundant signed digit (RSD) format, the acceleration effect of this solution can be demonstrated by ASIC synthesis using the TSMC 28-nm library. Of course, to ensure fairness in the comparison, the results of solutions implemented using other technologies were adjusted proportionally. The results are shown in the following table:

[0123]

[0124] After adjusting the results according to the differences between the technologies, the technical solution of the embodiment of the present application is 18 times faster than the software implementation speed, 12 times faster than the existing technology (D. Zhu, Y. Song, J. Tian, ​​Z. Wang, and H. Yu, “Anefficient accelerator of the squaring for the verifiable delay function over a class group,” in 2020 IEEE Asia Pacific Conference on Circuits and Systems (APCCAS). IEEE, 2020, pp. 137–140.), and 1.5 times faster than the current fastest solution (K. Sreedhar, H. Mark, and C. Torng, “Afast large-integer extended gcd algorithm and hardware design for verifiable delay functions and modular inversion,” Cryptology ePrint Archive, Report 2021 / 1292, 2021.).

[0125] At the same time, the embodiment of the present application also performed ASIC synthesis using TSMC 28-nm for different k, and the results are shown in the following table:

[0126] k 2 4 8 Number of cycles 2151 1195 908 Clock frequency 3.03GHz 2.5GHz 1.9GHz area <![CDATA[0.201mm 2 ]]> <![CDATA[0.404mm 2 ]]> <![CDATA[0.316mm 2 ]]> Total time 709.83 478ns 472.16ns

[0127] Different k values ​​can be selected according to different design requirements. Compared with existing solutions, they not only have similar or even better performance but also have greater flexibility. It should be noted that similar effects can be achieved using different redundancy methods, but there may be some different minor issues that need to be addressed to adapt to this application. For example, in the RSD form, some adjustments need to be made to the number of bits before iterative addition operations to prevent unlimited growth of the number of bits. Using different k values ​​can improve certain performance parameters, such as iteration cycle, clock frequency, area, etc.

[0128] As can be seen from the above technical solutions, the embodiments of the present application provide a method for obtaining the greatest common divisor of large numbers based on an improved k-ary algorithm, and an XGCD hardware implementation of its redundant representation. Compared with the prior art:

[0129] (1) The introduction of the δ parameter avoids comparing the sizes of a and b, which is very effective for both redundant and non-redundant forms.

[0130] (2) The Bézout coefficient algorithm is introduced while calculating the greatest common divisor. The calculation of the Bézout coefficient only requires simple addition, subtraction and shift operations, and in each iteration it is guaranteed that xA+yB=a, zA+wB=b holds.

[0131] (3) The introduction of redundant forms greatly reduces the time required for addition operations, thereby achieving the goal of increasing the clock frequency.

[0132] (4) Special handling of the shift operation of the x, y, z, w coefficients because the divisibility of the coefficients cannot be guaranteed.

[0133] In summary, the solution provided by the embodiments of this application avoids comparing two large-bitwidth data points a and b during each iteration by introducing the intermediate variable parameter δ. Furthermore, the calculation and redundant form of the Bézout coefficients are introduced to avoid delays caused by carry propagation during addition. The method and hardware architecture of the embodiments of this application can reduce iteration cycles, shorten the total runtime, significantly shorten the critical path, and achieve a significant speed improvement.

[0134] The above-described embodiments of the present application do not constitute a limitation on the scope of protection of the present application.

Claims

1. A hardware architecture for obtaining the greatest common divisor of a large number, used to calculate XA+YB=GCD(A, B)=G, where G, X and Y are operation results, A is a first operand, B is a second operand, the first operand and the second operand are both odd numbers, and the method is characterized by comprising: a control module, a GCD calculation unit, a Bézout coefficient calculation unit, a first multiplexer, a second multiplexer, a termination module and an input_valid signal; a GCD calculation unit, wherein an input end of the GCD calculation unit is respectively connected to an output end of the first multiplexer and an output end of the control module, and an output end of the GCD calculation unit is respectively connected to an input end of the control module, an input end of the termination module, and an input end of the first multiplexer, the GCD calculation unit being configured to use an input first operand and a second operand as initial values ​​of a first iteration variable and a second iteration variable, respectively, and, based on a control signal from the control module, update the first iteration variable or the second iteration variable input each time, simultaneously update a seventh iteration variable whose initial value is 0, and output the first iteration variable, the second iteration variable, and the seventh iteration variable completed for the current iteration; a Bézouté coefficient calculation unit, wherein an input end of the Bézouté coefficient calculation unit is respectively connected to an output end of the second multiplexer and an output end of the control module, and an output end of the Bézouté coefficient calculation unit is connected to an input end of the second multiplexer, the Bézouté coefficient calculation unit being configured to use input 1, 0, 0, and 1 as initial values ​​of a third iteration variable, a fourth iteration variable, a fifth iteration variable, and a sixth iteration variable, respectively, and, based on a control signal from the control module, update the third iteration variable, the fourth iteration variable, the fifth iteration variable, or the sixth iteration variable input each time, and output the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable completed in the current iteration, wherein the control signal from the control module received by the GCD calculation unit and the Bézouté coefficient calculation unit is a synchronization signal; an input_valid signal, configured to transmit a signal to the first multiplexer and the second multiplexer, wherein the input_valid signal is configured to control the first multiplexer to select the first operand, the second operand, or the first iteration variable and the second iteration variable output from the previous iteration as inputs for each iterative calculation of the GCD calculation unit, and to control the second multiplexer to select 0, 1, or the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable output from the previous iteration as inputs for each iterative calculation of the Bézouté coefficient calculation unit; a control module having a built-in k value, configured to receive a first iteration variable, a second iteration variable, and a seventh iteration variable completed in each iteration, and output a control signal to control calculation results of the GCD calculation unit and the Bézouté coefficient calculation unit based on the built-in k value, the first iteration variable, the second iteration variable, and the seventh iteration variable; The termination module is used to receive the first iteration variable and the second iteration variable completed in each iteration, and, if the first iteration variable or the second iteration variable of the current iteration is equal to 0, terminate the iterative update of all variables; when the first iteration variable is 0, determine (G, X, Y) as the second iteration variable, the fifth iteration variable and the sixth iteration variable of the current iteration respectively; when the second iteration variable is 0, determine (G, X, Y) as the first iteration variable, the third iteration variable and the fourth iteration variable of the current iteration respectively.

2. The hardware architecture for obtaining the greatest common divisor of large number expansion according to claim 1, characterized in that: When the k value is 8, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a sixth shifter, a seventh shifter, an eighth shifter, a first GCD selector, and a second GCD selector, wherein an input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, the fourth shifter, the fifth shifter, and the first iteration variable, and an input end of the second GCD selector is respectively connected to the fourth shifter, the fifth shifter, the sixth shifter, the seventh shifter, the eighth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to a control signal of the control module, for selecting corresponding outputs according to the control signal; The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable; The second shifter inputs the first iteration variable and is used to complete a right shift operation of the first iteration variable by two bits; The third shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable by three bits; The fourth shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by three bits; The fifth shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by two bits; The sixth shifter inputs the second iteration variable, and is used to complete a right shift operation on the second iteration variable; The seventh shifter inputs the second iteration variable and is used to complete a right shift operation of the second iteration variable by two bits; The eighth shifter inputs the second iteration variable and is used to complete a three-bit right shift operation on the second iteration variable.

3. The hardware architecture for obtaining the greatest common divisor of large number expansion according to claim 1, characterized in that: When the k value is 4, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a fourth shifter, a fifth shifter, a first GCD selector, and a second GCD selector, wherein an input end of the first GCD selector is respectively connected to the first shifter, the second shifter, the third shifter, and the first iteration variable, and an input end of the second GCD selector is respectively connected to the third shifter, the fourth shifter, the fifth shifter, and the second iteration variable; the first GCD selector and the second GCD selector are connected to a control signal of a control module, for selecting corresponding outputs according to the control signal; The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable; The second shifter inputs the first iteration variable and is used to complete a right shift operation of the first iteration variable by two bits; The third shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation of the sum or difference of the first iteration variable and the second iteration variable by two bits; The fourth shifter inputs the second iteration variable, and is used to complete a right shift operation on the second iteration variable; The fifth shifter inputs the second iteration variable and is used to complete a right shift operation of the second iteration variable by two bits.

4. The hardware architecture for obtaining the greatest common divisor of large number expansion according to claim 1, characterized in that: When the k value is 2, the GCD calculation unit includes a first shifter, a second shifter, a third shifter, a first GCD selector, and a second GCD selector, wherein the input end of the first GCD selector is connected to the first shifter, the second shifter, and the first iteration variable, respectively, and the input end of the second GCD selector is connected to the second shifter, the third shifter, and the second iteration variable, respectively; the first GCD selector and the second GCD selector are connected to a control signal of a control module, for selecting corresponding outputs according to the control signal; The first shifter inputs the first iteration variable and is used to perform a right shift operation on the first iteration variable; The second shifter inputs the sum or difference of the first iteration variable and the second iteration variable, and is used to perform a right shift operation on the sum or difference of the first iteration variable and the second iteration variable; The third shifter inputs the second iteration variable and is used to complete a right shift operation on the second iteration variable.

5. The hardware architecture for obtaining the greatest common divisor of large number expansion according to claim 1, characterized in that: The first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable are represented using redundancy.

6. A method for obtaining the greatest common divisor of a large number expansion, applied to the generation of a public-private key pair, based on the hardware architecture for obtaining the greatest common divisor of a large number expansion according to claim 1, characterized in that: include: Obtain the first parameter and public key exponent in the process of generating the public-private key pair; Obtaining a k value preset in the method, where k is a power of 2; Initialize intermediate variables required in subsequent iterations according to the first parameter and the public key exponent, the intermediate variables including a first iteration variable, a second iteration variable, a third iteration variable, a fourth iteration variable, a fifth iteration variable, a sixth iteration variable, and a seventh iteration variable, wherein an initial value of the seventh iteration variable is 0; the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, and the sixth iteration variable satisfy xA+yB=a and zA+wB=b, and their initial values ​​are x=1, y=0, z=0, w=1, a=A, and b=B, wherein A is the first parameter, B is the public key exponent, a is the first iteration variable, b is the second iteration variable, x is the third iteration variable, y is the fourth iteration variable, z is the fifth iteration variable, and w is the sixth iteration variable; Determine whether the first iteration variable or the second iteration variable is an even number; If the first iteration variable is an even number, the first data is selected, and the first iteration variable is updated by dividing the first iteration variable by the value of the first data, the third iteration variable is updated by dividing the third iteration variable by the value of the first data, the fourth iteration variable is updated by dividing the fourth iteration variable by the value of the first data, and the seventh iteration variable is updated by subtracting log2 u from the seventh iteration variable, where u is the first data, and the first data is the largest number in a data set of a power of 2 that is less than or equal to k and can be divided by the first iteration variable. If the updated first iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the second iteration variable, the Bézouté coefficient corresponding to the first parameter is the fifth iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the sixth iteration variable; After determining whether the first iteration variable or the second iteration variable is an even number, the method further includes: If the second iteration variable is an even number, the second data is selected, and the second iteration variable is updated by dividing the second iteration variable by the value of the second data, the fifth iteration variable is updated by dividing the fifth iteration variable by the value of the second data, the sixth iteration variable is updated by dividing the sixth iteration variable by the value of the second data, and the seventh iteration variable is updated by adding log2 v to the seventh iteration variable, where v is the second data, and the second data is the largest number in the data set of the power of 2 that is less than or equal to k and can be divided by the second iteration variable; If the updated second iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the first iteration variable, the Bézouté coefficient corresponding to the first parameter is the third iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the fourth iteration variable; After determining whether the first iteration variable or the second iteration variable is an even number, the method further includes: If the first and second iteration variables are both odd numbers, select the third and fourth data and calculate c = (pa + qb) / k, α = (px + qz) / k, β = (py + qw) / k, where p is the third data, q is the fourth data, and the third and fourth data satisfy and pa+qb=0(modk), and, according to the third data and the fourth data, the first iteration variable, the second iteration variable, the third iteration variable, the fourth iteration variable, the fifth iteration variable, the sixth iteration variable and the seventh iteration variable are updated, wherein: if the seventh iteration variable is a negative number, (c, α, β) is used to update (b, z, w), and the seventh iteration variable is added with log2k / q-1 to update the seventh iteration variable; if the seventh iteration variable is a non-negative number, (c, α, β) is used to update (a, x, y), and the seventh iteration variable is subtracted with log2k / q-1 to update the seventh iteration variable; If the updated second iteration variable is 0, the greatest common divisor of the first parameter and the public key exponent is the first iteration variable, the Bézouté coefficient corresponding to the first parameter is the third iteration variable, and the Bézouté coefficient corresponding to the public key exponent is the fourth iteration variable.

7. The method for obtaining the greatest common divisor of large numbers according to claim 6, characterized in that: Also includes: If the updated first iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

8. The method for obtaining the greatest common divisor of large numbers according to claim 6, wherein: Also includes: If the updated second iteration variable is non-zero, it is re-determined whether the first iteration variable or the second iteration variable is an even number.

Images