SM2 / NIST algorithm implementation method and device

Abstract

The embodiment of the application discloses an SM2 / NIST algorithm implementation method and device. The method comprises the following steps: implementing SM2 / NIST fast modular multiplication operation based on a pipeline; performing point addition and point multiplication operation in a preset coordinate system; wherein the point addition and point multiplication operation comprises modular multiplication and modular addition and subtraction, and the calculation process of the modular addition and subtraction is integrated into the calculation process of the modular multiplication; and performing a simultaneous multiple point multiplication algorithm; wherein the input data of the simultaneous multiple point multiplication algorithm comprises a random number. Through the embodiment scheme, the number of registers is reduced, and the operation speed is improved.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to encryption algorithm technology, in particular to an SM2 / NIST algorithm implementation method and device. BACKGROUND

[0002] With the popularity of computers and the development of Internet technology, society enters the information age, and information exchange plays an increasingly important role. In order to ensure the security of information transmission in public channels, information needs to be encrypted. The key short advantage of public key cryptography itself makes the related public key cryptography more and more popular, and the elliptic cryptography algorithm is a public key encryption algorithm with outstanding features compared with other public key algorithms. Compared with other public key algorithms under the same security level, it has the characteristics of short key, small calculation amount and fast speed. The SM2 / NIST algorithm is an elliptic curve encryption algorithm, which is simpler to implement in hardware and is suitable for some high-speed scenarios. At the same time, SM2 / NIST has broad market prospects. SUMMARY

[0003] The embodiment of the present application provides an SM2 / NIST algorithm implementation method and device, which can reduce the number of registers and improve the operation speed.

[0004] The embodiment of the present application provides an SM2 / NIST algorithm implementation method, which can include:

[0005] Implementing SM2 / NIST fast modular multiplication operation based on pipelining;

[0006] Performing point addition and point multiplication operations in a preset coordinate system; wherein the point addition and point multiplication operations include modular multiplication and modular addition and subtraction, and the calculation process of the modular addition and subtraction is integrated into the calculation process of the modular multiplication;

[0007] Executing a simultaneous multiple point multiplication algorithm; wherein the input data of the simultaneous multiple point multiplication algorithm contains a random number.

[0008] In the exemplary embodiment of the present application, the SM2 / NIST fast modular multiplication operation based on pipelining can include:

[0009] Based on pipelining, KOA algorithm is used to complete multiplication of two large numbers, and fast modular reduction algorithm is used to complete modular operation of the multiplication result; the large number refers to a data greater than a preset bit value.

[0010] In the exemplary embodiment of the present application, the SM2 / NIST fast modular multiplication operation based on pipelining, KOA algorithm is used to complete multiplication of two large numbers, and fast modular reduction algorithm is used to complete modular operation of the multiplication result can include:

[0011] The combination of the KOA algorithm and the fast modular reduction algorithm in the pipelining process includes different periods, and the KOA algorithm and the fast modular reduction algorithm are different in different periods.

[0012] In the example embodiments of the present application, the multiple periods include 2 periods; the combination of the KOA algorithm and the fast modular reduction algorithm in the pipelining process can include:

[0013] In each period, the KOA algorithm is used to perform a multiplication operation a times and then perform a combination calculation in the KOA algorithm, and the fast modular reduction algorithm is used to perform a modulo operation b times after the KOA algorithm is completed; a and b are positive integers.

[0014] In the example embodiments of the present application, the preset coordinate system includes a Jacobian coordinate system.

[0015] In the example embodiments of the present application, the order of the modulo multiplication and the modulo addition and subtraction in the point addition and point multiplication operation can include:

[0016]

[0017]

[0018] wherein X1, Y1, Z1 are input and output parameters, X2, Y2, Z2 are input parameters, T1, T2, T3, T4 and T5 are preset intermediate variables.

[0019] In the example embodiments of the present application, the simultaneous multiple point multiplication algorithm can include:

[0020] Input data: window size w = 1, k = (k t-1 ,k t-2 ,…,k1,k0)2, l = (l t-1 ,l t-2 ,…,l1,l0)2, G, P, Q ∈ E(F q );

[0021] Output data: R = kG + lP;

[0022] The steps include:

[0023] 701, coordinate randomization: G, P, Q; wherein Q is a point randomly selected on an elliptic curve;

[0024] 702, pre-computation: iG + jP + Q, wherein i, j ∈ {0, 1};

[0025] 703, scalar randomization: k' = k + r1*(#E), l' = l + r2*(#E), k', l' length is t'; #E represents the order of the elliptic curve;

[0026] 704, R = k' t′-1 G + l' t′-1 P + Q;

[0027] 705, repeat for m from t'-2 to 0:

[0028] 705.1 R = 2R;

[0029] 705.2 R = R + (k' m G + l' m P + Q);

[0030] 706, calculate R = R - (2 t′ -1)Q;

[0031] 707, return R.

[0032] In the exemplary embodiments of the present application, the method can further comprise:

[0033] When calculating kG, let kG = k'G + l'P.

[0034] In the exemplary embodiments of the present application, the method can further comprise:

[0035] When Q = G or P is taken, step 706 is advanced to step 703 calculation, reducing one point addition operation.

[0036] Embodiments of the present application also provide an SM2 / NIST algorithm implementation device, which can include a processor and a computer readable storage medium, and the computer readable storage medium stores instructions, when the instructions are executed by the processor, the SM2 / NIST algorithm implementation method is realized.

[0037] Compared with the related art, the embodiments of the present application can include: implementing SM2 / NIST fast modular multiplication operation based on pipelining; performing point addition and point multiplication operations in a preset coordinate system; wherein the point addition and point multiplication operations include modular multiplication and modular addition and subtraction, and the calculation processes of the modular addition and subtraction are all integrated into the calculation process of the modular multiplication; executing a simultaneous multiple point multiplication algorithm; wherein the input data of the simultaneous multiple point multiplication algorithm contains random numbers. Through the embodiment scheme, the number of registers is reduced, and the operation speed is improved.

[0038] Other features and advantages of the present application will be set forth in the description that follows, and in part will be apparent from the description, or can be learned by practice of the application. Other advantages of the application will be realized and attained by the methods and solutions particularly pointed out in the written description and claims hereof. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the principles of the application. The drawings are included are intended to explain the principles of the application and are not intended to limit the application to particular embodiments.

[0040] Figure 1 Flow chart of the SM2 / NIST algorithm implementation method of the embodiments of the present application;

[0041] Figure 2 Scheme diagram of the modular multiplication implemented by the related art;

[0042] Figure 3 Fast modular multiplication flow chart of the embodiments of the present application;

[0043] Figure 4 Point addition and point multiplication flow chart of the embodiments of the present application;

[0044] Figure 5 Block diagram of the SM2 / NIST algorithm implementation device of the embodiments of the present application. DETAILED DESCRIPTION

[0045] The present application describes a plurality of embodiments, but the description is exemplary rather than limiting, and it is obvious to those skilled in the art that there can be more embodiments and implementation solutions within the scope of the embodiments described in the present application. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are possible. Unless specifically limited, any feature or element of any embodiment can be used with any other feature or element of any other embodiment, or can replace any other feature or element of any other embodiment.

[0046] This application includes and contemplates combinations of features and elements known to those of ordinary skill in the art. The embodiments, features, and elements disclosed herein can also be combined with any conventional feature or element to form a unique application that is within the scope of the claims. Any feature or element of any embodiment can also be combined with features or elements from other application to form another unique application that is within the scope of the claims. Therefore, it is to be understood that any feature shown and / or discussed in this application can be implemented alone or in any appropriate combination. Embodiments are, therefore, not to be limited to the specific embodiments presented herein. Rather, claims and their equivalents are intended to cover any implementation falling within the scope of the claims and their equivalents. Moreover, various modifications and changes can be made within the scope of the claims.

[0047] Furthermore, in describing representative embodiments, the specification can have presented the method and / or process as a particular sequence of steps. However, to the extent that the method or process depends on more than one step, the method or process should not be limited to the particular sequence of steps described. Other sequences of steps can be possible, depending on the implementation, and are within the scope of the present application. Therefore, the particular order in which the steps are presented is not limiting. Moreover, the specification can present the steps of the method and / or process in a particular order, which is not limiting. Rather, the steps can be performed in any order, and the claims should not be interpreted as being limited to the particular order presented in the specification.

[0048] The embodiments of the present application provide an SM2 / NIST algorithm implementation method, as shown in the following table: Figure 1 The method can include steps S101-S103:

[0049] S101, based on the flow implementation of the SM2 / NIST fast multiplication operation; wherein, compared with the current flow scheme, the order of multiple multiplications is adjusted;

[0050] S102, in a preset coordinate system, point addition and point multiplication operations are performed; wherein, the point addition and point multiplication operations include multiplication and modulus addition and subtraction, and the calculation process of the modulus addition and subtraction is integrated into the calculation process of the multiplication;

[0051] S103, execute simultaneous multiple point multiplication algorithm; wherein, the input data of the simultaneous multiple point multiplication algorithm contains random numbers.

[0052] The elliptic curve multiplication algorithm is a core operation of the SM2 / NIST algorithm, and the basic operation is a large number modular multiplication operation, which directly affects the execution efficiency of the algorithm. Improving the speed of the modular multiplication operation and selecting a suitable multiplication algorithm have a profound significance for the promotion and execution of the SM2 / NIST. Therefore, an embodiment of the present application proposes a modular multiplication algorithm based on pipelining, and a fast multiplication algorithm resistant to SPA based on the modular multiplication algorithm.

[0053] The modular multiplication implemented by the current scheme using pipelining is as shown in the following figure: Figure 2 The scheme uses a 3-cycle multiplication to obtain a result. The current scheme has the following defects: (1) a large number of registers are required for the implementation of the pipelining modular multiplication, and the area is large; (2) 4 modular multiplications are calculated in an average of 14 cycles; (3) in the pipelining calculation process of point addition and point doubling, there is a situation that the modular multiplication is calculated and the modular addition operation is still needed to be calculated, which leads to the need to wait for multiple cycles to calculate the next modular multiplication.

[0054] In the exemplary embodiments of the present application, the modular multiplication pipelining is redesigned, the number of registers is reduced, and nearly half of the registers can be reduced; 3 modular multiplications are calculated in an average of 9 cycles; the result of the first modular multiplication is output in advance, which has an advantage for the implementation of point addition and point doubling; a method of resisting SPA and simultaneously multiplying multiple points is used to speed up the multiplication operation.

[0055] In the exemplary embodiments of the present application, first, a fast modular multiplication operation of SM2 / NIST based on pipelining is proposed, then a point addition and point doubling operation is calculated in a suitable coordinate system, and finally a fast simultaneous multiple point multiplication algorithm resistant to SPA is given. The scheme of the embodiments of the present application is described in detail below.

[0056] In the exemplary embodiments of the present application, the fast modular multiplication operation of SM2 / NIST based on pipelining can include:

[0057] Based on pipelining, the multiplication of two large numbers is completed by the KOA algorithm, and the modular operation of the multiplication result is completed by the fast modular reduction algorithm; the large number refers to a data greater than a preset bit value.

[0058] In the exemplary embodiments of the present application, the fast modular multiplication is implemented by KOA multiplication and fast modular reduction, the multiplication of two large numbers is first completed by the KOA algorithm, and then the modular operation of the result is completed by the fast modular reduction algorithm.

[0059] In the exemplary embodiments of the present application, the KOA algorithm is the Karastuba algorithm, and the core idea of the KOA algorithm is "divide and conquer", which converts the multiplication of two large numbers with a length of 2k bits into a k-bit large number multiplication operation.

[0060] In the exemplary embodiments of the present application, the KOA algorithm can include:

[0061] Input: 2kbit X, Y;

[0062] Output: Z = X * Y;

[0063] 1, Let X = 2 k X1+X0,Y = 2 k Y1+Y0;

[0064] 2, Then Z = X * Y = 2 2k Z2+2 k Z1+Z0, where Z2 = X1Y1, Z1 = X0Y1+X1Y0, Z0 = X0Y0;

[0065] 3, Z1 = X0Y1+X1Y0 = (X0+X1)(Y0+Y1)-(Z2+Z0).

[0066] In the exemplary embodiments of the present application, it can be known from the above algorithm description that the original four-time kbit large number multiplication can be converted into 3-time (k+1) bit large number multiplication.

[0067] In the exemplary embodiments of the present application, since the SM2 / NIST algorithm is modulo P which is a Mersenne prime number, a fast modulo reduction algorithm for modulo P can be derived. Here, the derivation process is omitted, and a suitable modulo reduction algorithm is directly given.

[0068] In the exemplary embodiments of the present application, the fast modulo reduction algorithm can include:

[0069] Let Z = X * Y and 0≤X, Y≤P, modulo P is a Mersenne prime number, then 0≤Z≤P 2 , Z is expressed as:

[0070] Z = 2 480 Z 15 +2 448 Z 14 +2 416 Z 13 +2 384 Z 12 +2 352 Z 11 +2 320 Z 10 +2 288 Z9+2 256 Z8+2 224 Z7+2 192 Z6+2 160 Z5+2 128 Z4+2 96 Z3+2 64 Z2+2 32 Z1+Z0;

[0071] wherein Zi∈ [0, 2 32 ), i = 0, 1,..., 15.

[0072] The SM2 fast modular reduction algorithm can include:

[0073] Input: Z = (Z 15 , Z 14 , Z 13 , Z 12 , Z 11 , Z 10 , Z9, Z8, Z7, Z6, Z5, Z4, Z3, Z2, Z1, Z0), Z i ∈ [0, 2 32 ), modulus P SM2 ;

[0074] Output: res = Z mod P SM2 ;

[0075] 1. Define 256-bit arrays S0, S1,..., S9:

[0076] S0 = (Z7, Z6, Z5, Z4, Z3, Z2, Z1, Z0);

[0077] S1 = (Z8, Z 14 , Z 13 , Z 12 , Z8, 0, Z9, Z8);

[0078] S2 = (Z9, Z 15 , Z 14 , Z9, Z 11 , 0, Z 10 , Z9);

[0079] S3 = (Z 10 , Z 11 , Z 10 , Z 13 , Z 12 , 0, Z 11 , Z 10 );

[0080] S4 = (Z 15 , 0, 0, Z 15 , Z 15 , 0, Z 13 , Z 12 );

[0081] S5 = (Z 11 , 0, 0, 0, Z 14 , 0, Z 12 , Z 11 );

[0082] S6 = (Z 15 , 0, Z 15 , Z 14， ) ; 13 15 15 ) ;

[0083] S7 = (Z 14 , 0, 0, 0, 0, 0, Z 14 , Z 14 ) ;

[0084] S8 = (Z 13 , 0, 0, 0, 0, 0, 0, Z 13 ) ;

[0085] S9 = (Z 12 , 0, 0, 0, 0, 0, 0, 0) ;

[0086] 2, sum = S0 + S1 + S2 + S3 + S4 + S5 + 2 * (S6 + S7 + S8 + S9) - 2 64 (Z8 + Z9 + Z 13 + Z 14 ) ;

[0087] 3, res = sum mod P SM2 ;

[0088] 3.1 z = sum [259:256] ;

[0089] 3.2 S = sum [255:0] + {0, z, 96'd0, z, 64'd0, z} - (z « 64) ;

[0090] 3.3 if S < P SM2 , res = S;

[0091] Else res = S - P SM2 .

[0092] The NIST fast modular reduction algorithm can include:

[0093] Input: Z = (Z 15 , Z 14 , Z 13 , Z 12 , Z 11 , Z 10 , Z9, Z8, Z7, Z6, Z5, Z4, Z3, Z2, Z1, Z0), Z i ∈ [0, 2 32 ), modulus P NIST ; ​​

[0094] Output: res = Z mod P NIST ;

[0095] 1. Define 256-bit arrays S0, S1,..., S9:

[0096] S0 = (Z7, Z6, Z5, Z4, Z3, Z2, Z1, Z0);

[0097] S1 = (Z8, Z 13 , 0, 0, Z 13 , Z 10 , Z 10 , Z8);

[0098] S2 = (Z 15 , Z 15 , Z 13 , Z 13 , Z 12 , 0, 0, 0);

[0099] S3 = (0, Z 14 , Z 14 , Z 12 , Z 11 , 0, 0, 0);

[0100] S4 = (Z 15 , Z 14 , Z 15 , Z 14 , 0, Z 11 , Z9, Z9);

[0101] S5 = (Z 11 , Z8, Z 11 , Z 10 , Z8, Z 13 , Z 13 , Z 12 );

[0102] S6 = (Z 12 , 0, 0, 0, Z 15 , Z 14 , Z 14 , Z 13 );

[0103] S7 = (Z 13 , 0, 0, 0, 0, 0, Z 12 , Z 14 );

[0104] S8 = (Z 10 , Z9, Z 10 , Z9, Z9, Z 15 , Z 15 , Z11 );

[0105] 2. sum=S0+S1+2S2+2S3+S4-(S5+S6+S7+S8)+4P NIST ;

[0106] 3. res = sum mod P NIST ;

[0107] 3.1z = sum[259:256];

[0108] 3.2S=sum[255:0]+{0,z,192′d0,z}-{32′d0,z,64′d0,z,96′d0};

[0109] 3.3if S <P NIST , res = S;

[0110] Else res=SP NIST .

[0111] In an exemplary embodiment of this application, the step of performing the multiplication of two large numbers based on pipelined computation using the KOA algorithm and the modulo operation of the multiplication result using the fast modulo reduction algorithm may include:

[0112] In the flow process, a combination of the KOA algorithm and the fast modular reduction algorithm is used in multiple cycles, wherein the KOA algorithm and the fast modular reduction algorithm are different in different cycles.

[0113] In an exemplary embodiment of this application, the multi-cycle method includes two cycles; the combination of the KOA algorithm with the fast modulo reduction algorithm used in the flow process may include:

[0114] In each cycle, the KOA algorithm is used to perform a multiplications, followed by the combination calculations in the KOA algorithm. After the KOA algorithm is completed, the fast modulo reduction algorithm is used to perform b modulo operations; a and b are positive integers.

[0115] In exemplary embodiments of this application, as Figure 3 As shown, the fast modular multiplication pipeline uses a 2-cycle multiplication logic, combining modular addition / subtraction with multiplication. M1, M2, and M3 represent multiplication, K represents the KOA combination part, and R1, R2, and R3 represent the fast reduction part. Different background colors represent different modular multiplication operations.

[0116] In an exemplary embodiment of this application, the KOA algorithm can be used to perform 3 multiplications in each cycle (e.g., Figure 3M1, M2, M3) and then perform the combination calculation in the KOA algorithm (as shown in R1, R2, R3) after the KOA algorithm is executed. Figure 3 K) and then perform three modulo operations using the fast modulo reduction algorithm (as shown in R1, R2, R3) after the KOA algorithm is executed. Figure 3

[0117] In the exemplary embodiments of the present application, the point addition and point multiplication operation in the preset coordinate system can include:

[0118] In the Jacobian coordinate system, R = 2R + T is calculated by point addition and point multiplication operation.

[0119] In the exemplary embodiments of the present application, the point multiplication operation can include:

[0120] Input: R = (X1, Y1, Z1);

[0121] Output: 2R = (X3, Y3, Z3);

[0122] X3 = M 2 -2S, Z3 = 2Y1Z1, wherein

[0123] The point addition operation can include:

[0124] Input: R = (X1, Y1, Z1) T = (X3, y3, Z3);

[0125] Output: R + T = (X3, Y3, Z3);

[0126] X3 = r 2 -H 3 -2X1H 2 , Y3 = r(X1H 2 -X3)-Y1H 3 , Z3 = Z1Z2H;

[0127] wherein

[0128] In the exemplary embodiments of the present application, a = -3 is used in the point addition and point multiplication pipelining because the curve parameters are determined after the selected modulus P.

[0129] In the exemplary embodiments of the present application, the modulo addition and subtraction are all implemented by combination logic, and the result can be obtained in one cycle.

[0130] In the exemplary embodiments of the present application, the modulo multiplication in the point addition and point multiplication pipelining can be implemented by point multiplication (i.e., point multiplication) operation, and the modulo addition and subtraction can be implemented by point addition operation.

[0131] ​In the exemplary embodiments of the present application, the point addition and point multiplication operation first calculates the point multiplication and then calculates the point addition.

[0132] In the exemplary embodiments of the present application, as shown in Figure 4 the order of the modular multiplication and the modular addition and subtraction in the point addition and point multiplication operation can include:

[0133]

[0134]

[0135] wherein X1, Y1, Z1 are input and output parameters, X2, Y2, Z2 are input parameters, T1, T2, T3, T4 and T5 are preset intermediate variables.

[0136] In the exemplary embodiments of the present application, it is known by statistics that, in addition to the input and output parameters (X1, Y1, Z1, X2, Y2, Z2), a total of 5 intermediate variables are used, and 86 cycles are required for one point multiplication and point addition calculation.

[0137] In the exemplary embodiments of the present application, the core operation of the SM2 / NIST signature / verification is the elliptic curve multiplication operation, and the multiplication operation is quite time-consuming. In order to accelerate the multiplication operation, the embodiments of the present application relate to a simultaneous multiple point multiplication algorithm resistant to SPA.

[0138] In the exemplary embodiments of the present application, the simultaneous multiple point multiplication algorithm can include:

[0139] Input: window size w = 1, k = (k t-1 ,k t-2 ,…,k1,k0)2, l = (l t-1 ,l t-2 ,…,l1,l0)2, G, P, Q ∈ E(F q );

[0140] Output: R = kG + lP;

[0141] 701, coordinate randomization: G, P, Q;

[0142] 702, pre-computation: iG + jP + Q, where i, j ∈ {0, 1};

[0143] 703, scalar randomization: k' = k + r1*(#E), l' = l + r2*(#E), the length of k', l' is t'; #E represents the order of the elliptic curve;

[0144] 704, R = k' t′-1 G + l' t′-1 P + Q;

[0145] 705、for m from t'-2 to 0, repeat:

[0146] 705.1 R = 2R;

[0147] 705.2 R = R + (k' m G + l' m P + Q);

[0148] 706、compute R = R - (2 t '-1)Q;

[0149] 707、return R.

[0150] In the exemplary embodiments of the present application, it is necessary to note that:

[0151] (1) when calculating kG, let i.e. kG = k'G + l'P.

[0152] (2) when taking Q = G or P, step 706 is advanced to step 703 calculation, reducing one point addition operation.

[0153] In the exemplary embodiments of the present application, the simultaneous multiple point multiplication is mainly to call the point addition and point multiplication pipeline implementation.

[0154] In the exemplary embodiments of the present application, the following takes SM2 as an example to illustrate the implementation of SPA-resistant simultaneous multiple point multiplication.

[0155] In the exemplary embodiments of the present application, the SPA-resistant simultaneous multiple point multiplication algorithm of SM2 algorithm can include:

[0156] 1) select the 256-bit security curve recommended in the SM2 algorithm standard, the parameter P of the security curve SM2 : P SM2 = 0xFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00000000FFFFFFFFFFFFFFFF;

[0157] 2) input P, G, Q, wherein Q is a point randomly selected on an elliptic curve;

[0158] 3) pre-compute: use the pipeline calculation and store Q, P+Q, G+Q, P+G+Q of point addition and point multiplication.

[0159] 4) select the pre-computed value corresponding to the highest bit value of the scalar as the initial value R;

[0160] 5) main loop: select the corresponding pre-computed value as T according to the bit value corresponding to the scalar, participate in the point multiplication and point addition pipeline operation R = 2R + T;

[0161] 6) obtain a calculation result R = R - (2 t′ -1)Q, wherein (2 t′ -1)Q is pre-calculated.

[0162] In the exemplary embodiments of the present application, the embodiment schemes of the present application at least include the following advantages:

[0163] (1) The Montgomery multiplication pipeline is redesigned. In the fast Montgomery multiplication algorithm implemented by the pipeline of the present application, the order of several multiplications is adjusted, and the number of registers is reduced, so that the number of registers can be reduced by half;

[0164] (2) The result of the first Montgomery multiplication is output in advance, which is advantageous to the implementation of point addition and point multiplication;

[0165] (3) Three Montgomery multiplications are calculated on average in 9 cycles;

[0166] (4) The point multiplication and point addition pipeline is designed according to the fast Montgomery multiplication pipeline. The calculation processes of Montgomery addition and subtraction are integrated into the calculation process of Montgomery multiplication, which can speed up the calculation process, and the number of registers is as small as possible. Only 5 intermediate registers are used in the design, and only 86 cycles are required to calculate a point multiplication and a point addition. Note that the order of some calculation processes in the point multiplication and point addition pipeline can be adjusted;

[0167] (5) The SPA-resistant multi-point multiplication algorithm can improve the efficiency of kG+lP or kG by nearly one time.

[0168] The embodiment of the present application also provides an SM2 / NIST algorithm implementation device 1, as shown in the figure, which can include a processor 11 and a computer readable storage medium 12, and the computer readable storage medium 12 stores instructions, when the instructions are executed by the processor 11, the SM2 / NIST algorithm implementation method is realized. Figure 5

[0169] In the exemplary embodiments of the present application, any embodiment of the aforementioned SM2 / NIST algorithm implementation method is applicable to the SM2 / NIST algorithm implementation device 1 embodiment, and will not be described one by one here.

[0170] ​Those of ordinary skill in the art will realize and understand that all or some of the steps in the methods disclosed above and the functional modules / units in the systems and devices can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on computer-readable media, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Furthermore, it is common and well understood by those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and can include any information delivery media.

Claims

1. A method for implementing an SM2 / NIST algorithm, the SM2 / NIST algorithm being an elliptic curve encryption algorithm, characterized in that, The method includes: Fast modular multiplication of SM2 / NIST based on pipelined implementation; In a preset coordinate system, point addition and multiplication operations are performed; wherein, the point addition and multiplication operations include modular multiplication and modular addition and subtraction, and the calculation process of modular addition and subtraction is integrated into the calculation process of modular multiplication; Perform a simultaneous multiplication algorithm; wherein the input data of the simultaneous multiplication algorithm contains random numbers; The pipelined implementation of fast modular multiplication for SM2 / NIST includes: using the KOA algorithm to multiply two large numbers, and using a fast modular reduction algorithm to perform the modulo operation on the multiplication result; the large numbers refer to data larger than a preset bit value. The process of multiplying two large numbers using the KOA algorithm and performing the modulo operation of the multiplication result using the fast modular reduction algorithm, based on pipelined flow, includes using a combination of the KOA algorithm and the fast modular reduction algorithm in multiple cycles during the pipelined flow. The KOA algorithm and the fast modular reduction algorithm are different in different cycles.

2. The method of claim 1, wherein, The multi-cycle method includes two cycles; the combination of the KOA algorithm and the fast modular reduction algorithm used in the flow process includes: In each cycle, the KOA algorithm is used to perform a multiplications, followed by the combination calculations in the KOA algorithm. After the KOA algorithm is completed, the fast modulo reduction algorithm is used to perform b modulo operations; a and b are positive integers.

3. The method of claim 2, wherein, The fast modular multiplication pipeline is implemented using a 2-cycle multiplication logic that combines modular addition / subtraction with multiplication. In each cycle, the KOA algorithm is used to perform 3 multiplications, followed by the combination calculation in the KOA algorithm. After the KOA algorithm is completed, the fast modulo reduction algorithm is used to perform 3 modulo operations.

4. The method of claim 1, wherein, The preset coordinate system is the Jacobian coordinate system, and the order of modular multiplication and modular addition / subtraction in the point addition / multiplication operation in the Jacobian coordinate system includes: Where X1, Y1, and Z1 are input and output parameters, X2, Y2, and Z2 are input parameters, and T1, T2, T3, T4, and T5 are preset intermediate variables.

5. The method of claim 1, wherein, The simultaneous multi-point multiplication algorithm includes: Input data: window size w = 1, k = (k t-1 ,k t-2 ,…,k1,k0)2, l = (l t-1 ,l t-2 ,…,l1,l0)2, G, P, Q ∈ E(F q ); Output data: R = kG + lP; The steps include:

701. Coordinate randomization: G, P, Q; where Q is a point randomly selected on the elliptic curve; 702. Pre-calculate: iG+jP+Q, where i,j∈{0,1}; 703、Scalar randomization: k ′ = k + r1 * (#E), l ′ = l + r2 * (#E), k ′ , l ′ Length is denoted t'; #E represents the order of the elliptic curve. 704、R = k ′t′-1 G + 1 ′t′-1 P + Q; 705. Repeat the following steps for m from t′-2 to 0: 705.1R = 2R; 705.2R = R + (k' m G + l' m P + Q); 706、Compute R = R - (2 t '-1) Q; 707. Return to R.

6. The method of claim 5, wherein, The method further includes: When calculating kG, let kG = k'G + l'P.

7. The method of claim 5, wherein, The method further includes: When Q = G or P, step 706 is performed in advance to step 703, reducing one point addition operation.

8. An SM2 / NIST algorithm implementation apparatus comprising a processor and a computer readable storage medium having instructions stored therein, the apparatus being characterized by, When the instruction is executed by the processor, the SM2 / NIST algorithm implementation method as described in any one of claims 1-7 is implemented.

Images