Modular multiplication circuit and method of calculating modular multiplication
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- IND TECH RES INST
- Filing Date
- 2021-12-16
- Publication Date
- 2026-08-07
AI Technical Summary
然而，终端装置上所提供的电力资源经常是有限的
Smart Images
Figure CN116149605B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a modulo multiplication circuit and a corresponding method for calculating modulo multiplication. Background Art
[0002] With the development of the Internet of Things, it has become a trend of the times to equip terminal devices with limited energy supply with security chips to achieve hardware security. Most of the cryptographic algorithms used in security chips require modulo multiplication operations. However, the power resources provided on terminal devices are often limited. Therefore, the above cryptographic algorithms need to be combined with a low-power hardware architecture design to extend the usage time of terminal devices under limited power supply.
[0003] Therefore, how to improve the hardware operation efficiency while taking into account the two characteristics of low power consumption and low area of the hardware, so as to meet the physical environment on Internet of Things terminal devices, is one of the directions that the industry is working on. Summary of the Invention
[0004] According to a first aspect of the present invention, a modulo multiplication circuit is provided, which includes a main operation circuit, a lookup table, and an addition unit. The main operation circuit is used to update the sum value and the carry value according to 2 i A of the first operation value A and m bits of the second operation value B currently being operated, where m is a positive integer and i is an integer from 0 to m-1. The lookup table is used to record multiple values related to the modulus and select one of these values as the lookup table output value according to the sum value. The addition unit is used to update the sum value and the carry value according to the lookup table output value and output them to the main operation circuit. Among them, the modulo multiplication circuit performs the above operations in a recursive manner by using different m bits of the second operation value B to update the sum value and the carry value until all M bits of the second operation value B have been operated, where m<M and M is a positive integer.
[0005] According to a second aspect of the present invention, a method for calculating modulo multiplication is provided, which includes the following steps. Update the sum value and the carry value according to 2 i A of the first operation value A and m bits of the second operation value B currently being operated, where m is a positive integer and i is an integer from 0 to m-1. By using a lookup table, record multiple values related to the modulus and select one of these values as the lookup table output value according to the sum value. By using an addition unit, update the sum value and the carry value according to the lookup table output value. Among them, this method for calculating modulo multiplication repeats the above steps in a recursive manner by using different m bits of the second operation value B to update the sum value and the carry value until all M bits of the second operation value B have been operated, where m<M and M is a positive integer.
[0006] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the present invention. Attached Figure Description
[0007] Figure 1 A block diagram of a modular multiplication circuit according to an embodiment of the present invention is shown;
[0008] Figure 2 A flowchart illustrating a method for calculating modular multiplication according to an embodiment of the present invention is shown;
[0009] Figure 3 A flowchart illustrating a method for calculating modular multiplication according to another embodiment of the present invention is shown; and
[0010] Figure 4 Illustration according to the present invention Figure 1 The block diagram of the modular multiplication circuit in the embodiment, where m equals 4.
[0011] In the attached figures, the following labels are used:
[0012] 100, 400: Modular-to-digital multiplication circuit
[0013] 102,402: Main operational circuits
[0014] 104,404: Search table
[0015] 106,406: Addition unit
[0016] 108,408: Multiplication circuit
[0017] 110(0)~110(m-1),410(0)~410(3),118,120,418,420: multiplexer
[0018] 112(1)~112(m-1),130,132,136,412(1)~412(3),430,432,436: shifters
[0019] 114,414: Addition circuit
[0020] 116,416: Counter
[0021] 122,124,134,422,424,434: Temporary registers
[0022] 126,426: Carry-incrementing adder
[0023] 128,428: Modular number arithmetic unit
[0024] 202~206, 302~314: Process Steps Detailed implementation manners
[0025] To achieve hardware security, the present invention proposes a modular multiplication circuit and a corresponding method for calculating modular multiplication, which can be applied to the modular multiplication operation of a digital signature system. While improving the operation efficiency, it also takes into account the two characteristics of low power consumption and low area, so as to conform to the physical environment on the terminal device of the Internet of Things.
[0026] The present invention uses the Montgomery algorithm (Montgomery modular multiplication / Montgomery reduction) (P.L. Montgomery, “Modular multiplication without trial division,” Mathematics of Computation, vol. 44, no. 170, pp. 519 - 519, 1985.) to reduce the complexity of modular operations, and can reduce the number of additions performed recursively in the 256 - bit multiplication without using a memory. At the same time, it can also increase the clock frequency, so that the modular multiplication operation of the present invention can effectively reduce power consumption.
[0027] The Montgomery algorithm is a modular multiplication algorithm with good hardware implementability. The Montgomery algorithm can avoid the consumption of registers and memories, especially when the numbers of the multiplicand and the multiplier are quite large. For example, based on the Montgomery algorithm, the modular multiplication circuit and the corresponding method for calculating modular multiplication designed according to the embodiments of the present invention are suitable for low - power modular multiplication operations in a digital signature system of model Ed25519.
[0028] The Montgomery algorithm is outlined as follows. Let the integer N>1, and select a radix R, where R is an integer and R is coprime with N, and R>N. Let R -1 and N' be integers, and satisfy the following relationship: 0<R -1 <N and 0<N'<R and RR -1 -NN' = 1. When calculating t = TR -1 mod N, the value of t can be obtained by substituting the parameter w defined by the following (Equation 1) into (Equation 2):
[0029] w = (T mod R)N′ mod R (Equation 1)
[0030]
[0031] where the value T is the value to be subjected to the Montgomery operation (TR -1The value of TR is (mod N), where t is the result of performing the Montgomery operation on the value T, and w is an intermediate value needed to calculate t. If t is greater than or equal to N, then tN is used as TR. -1 The result of the modulo operation modulo N. If t is less than N, then t is taken as TR. -1 The result of modulo operation mod N.
[0032] Substituting (Equation 1) into (Equation 2), we get:
[0033]
[0034] Through derivation, we can obtain the following (Equation 4):
[0035]
[0036] The reasons why equations (3) and (4) are equivalent are as follows. Modulo data has the following property: (a × b) mod c = (a mod c) × (b mod c) mod c. a, b, and c are integers. Since 0 ≤ N′ < R, therefore (T × N′) mod R = (T mod R) × (N′ mod R) mod R = (T mod R) × N′ mod R. Furthermore, since RR... -1 -NN′=1, after performing modulo operations on both sides of R, we can obtain RR. -1 mod R - NN′ mod R = 1 mod R. Therefore, N′ = -N. -1 (mod R).
[0037] Therefore, N′=-N -1 Substituting (mod R) into equation (4), we get:
[0038]
[0039] Next, let T = k and R = 2. m , Substituting N=P into equation (5), we get:
[0040]
[0041] Where P is the modulus, and m and k are integers. PP -1 Satisfy the following formula: PP -1 =1 mod 2 m P -1 For P in 2 m The multiplicative inverse in the array. m represents the number of bits.
[0042] Substituting k = a × b into equation (6), we get:
[0043]
[0044] According to the characteristics of Montgomery's algorithm (T+wN=0(mod R) in Equation 2), therefore, the numerator of Equation 7 is (a×b+(a×b×(P)). -1 mod 2 m ))×P)mod 2 m =0, so the numerator can be divided by the denominator.
[0045] Taking a security chip used in a digital signature system, such as the Ed25519, as an example, parameters a and b are 256-bit integers. The modulo-digital arithmetic of the Ed25519 digital signature system, for example, needs to complete... The operation modulo P. The operation mod P can be achieved using the following formula:
[0046]
[0047] Next, we will explain the multi-limb Montgomery multiplication operation. Let... b i For the i*m to (i+1)m-1th bits of b, b[i] represents the i-th bit of b, where b is a binary value. b can be represented as:
[0048]
[0049] Equation 8 can be rewritten as:
[0050]
[0051] Equation 10 can be calculated n times using the following recursive formula to obtain the same result (i.e., value). n-1 ):
[0052]
[0053] Using parameters and sum i and carry i To represent value i =sum i +carry i Then, according to (Equation 11), (Equation 10) can be rewritten as the following iterative expression:
[0054]
[0055] The embodiments of the present invention will be achieved by the following formula. By removing the mod P term from (Equation 12) using (Equation 7), we obtain:
[0056]
[0057] When using a circuit to implement the above equations, the (-P) of the molecule -1 )mod 2 m ×P only with The sum is related to the sum value output by the m-th carry-save adder (CSA). Therefore, the numerator (sum) can be obtained directly by looking up the table using the sum value output by the m-th carry-save adder. m +carry m )×(-P -1 )mod 2 m The value of ×P is LT, that is:
[0058]
[0059] Here, LT represents the value obtained after looking up the table. Since the modulus is 2... m Modulo operation mod 2 m The value can be 0 to (2). m A value from (-1) will be used to select 0 to (2). m -1) Multiplying by P gives the value of LT, that is, the possible values of LT are 0×P~(2) m -1)×P(2 m One value in each of the combinations. And because... Always able to be 2 m Divisible by integer, therefore 0×P~(2 m -1)×P is discarded, and 2 is added. m (Except when LT=0). And with When adding, the terms can be automatically omitted. The rightmost m bits (that is, the rightmost m bits of the sum value output by the m-th carry-hold adder).
[0060] Therefore, the actual value of LT is And based on the sum value output by the m-th carry-holding adder, return one of the LT values, so that the final sum is That is, it can be 2 m Divisible by.
[0061] The derivation process of the above LT value, and the method of finding the corresponding LT value from the input to the sum value in the table, are further explained below. Based on observations during practical circuit operation, after m addition operations, the rightmost m bits of the carry value will all be 0. Therefore, the sum of the rightmost m bits of sum, the rightmost m bits of carry, and the rightmost m bits of LT will equal the sum of the rightmost m bits of sum and the rightmost m bits of LT. Thus, the rightmost 4 bits of carry can be ignored. Therefore, only the operation of sum and LT needs to be considered here, and the carry value does not need to be considered.
[0062] Assuming m = 4 and sum = (...0, 0111)², we need to find a value LT such that sum + LT can be increased by 2. m Integer division means setting the rightmost m bits of sum + LT to 0. Through calculation, we can obtain that when LT = (...0, 1111)², sum + LT = (..., 0000)². Excluding the case where the rightmost m bits of sum are all 0, the sum of the rightmost 4 bits of sum + LT will carry over to the 5th bit from the right. Therefore, when the rightmost m bits of sum are not all 0, we can directly set the rightmost m bits of all LT values to 0, and also set the rightmost m bits of sum to 0, and directly carry over the 5th bit of the LT value, for example, adjusting LT to LT' = (...1, 0000)². This operation also yields the same result. Therefore, although the possible values of LT are 0 × P ~ (2... m -1)×P, however, the actual value of LT can also be... The same objective of the present invention can be achieved. Here, "+1" is the carry value of the 5th bit of the above-mentioned LT value.
[0063] Please refer to Figure 1 The diagram illustrates a block diagram of a modular multiplication circuit according to an embodiment of the present invention. The modular multiplication circuit 100 includes a main arithmetic circuit 102, a lookup table 104, and an addition unit 106. The main arithmetic circuit 102 is used to calculate the multiplication value A corresponding to a 2... i The sum D_Sum and carry D_Carry are updated using m bits of the first operand A and the second operand B currently being operated on, where m is a positive integer and i is an integer from 0 to m-1. The first operand A and the second operand B are, for example, inputs to a modular multiplication circuit 100, and the first operand A and the second operand B are, for example, n (n≤256)-bit positive integers.
[0064] The lookup table 104 records multiple values associated with a modulus P and selects one of these values as the lookup table output value, Lout, based on the sum D_Sum. The addition unit 106 updates the sum D_Sum and carry D_Carry based on the lookup table output value Lout and outputs them to the main arithmetic circuit 102. In the modular multiplication of the Ed25519 digital signature system, the value of the modulus P is, for example, equal to 2. 255 -19.
[0065] The modular multiplication circuit 100 recursively performs the above operations by using different m bits of the second operand B to update the sum value D_Sum and the carry value D_Carry until all the operations corresponding to the M bits of the second operand B have been completed, where m < M and M is a positive integer.
[0066] Hereby Figure 1 The modular multiplication circuit 100 shown is described in detail below. In the main arithmetic circuit 102, the main arithmetic circuit 102 calculates each bit of the m bits of the second operand B currently being operated on, and compares it with the corresponding 2... i The sum of the products of A is used to update the total sum D_Sum and the carry D_Carry. For example, the main operational circuit 102 calculates... The value of .
[0067] Furthermore, the main arithmetic circuit 102 includes a multiplication circuit 108. The multiplication circuit 108 includes a 0th multiplexer 110(0) to a (m-1)th multiplexer 110(m-1) and a 0th temporary register R(0) to a (m-1)th temporary register R(m-1). Each of the 0th temporary register R(0) to the (m-1)th temporary register R(m-1) stores one of the m bits of the second operation value B currently being operated on. Assuming the second operand B is a 256-bit value, and is temporarily stored in register 134, the second operand B can be represented as (B
[255] , B
[254] , ..., B[m], B[m-1], ..., B[2], B[1], B[0])2. Then, the 0th register R(0) to the (m-1)th register R(m-1) currently store bits B[0] to B[m-1] of the second operand B currently being operated on. The selection terminals of the 0th multiplexer 110(0) to the (m-1)th multiplexer 110(m-1) are controlled by the output values of the 0th register R(0) to the (m-1)th register R(m-1), such as bits B[0] to B[m-1]. The first input terminals of the 0th multiplexer 110(0) to the (m-1)th multiplexer 110(m-1) receive the digital value 0. The second input terminals of the 0th multiplexer 110(0) to the (m-1)th multiplexer 110(m-1) receive the digital value 2 respectively.0 A to 2 m-1 A. The sum D_Sum and the carry D_Carry are determined by the output values of the 0th multiplexer 110(0) to the (m-1)th multiplexer 110(m-1).
[0068] The following explanation uses the 0th temporary register R(0) as an example. When the bit B[0] stored in the 0th temporary register R(0) is 0, the 0th multiplexer 110(0) outputs the digital value 0 from the first input, that is, it outputs the digital value 0. At this time, the output of the 0th multiplexer 110(0) is equal to B[0]*2. 0 *A=0*2 0 *A = 0. When the bit B[0] stored in the 0th temporary register R(0) is 1, then the 0th multiplexer 110(0) is connected to the second input terminal 2. 0 *A is the output, which is output 2. 0 The value of A. At this time, the output of the 0th multiplexer 110(0) is equal to B[0]*2. 0 *A=1*2 0 *A=2 0 *A. That is, the value of bit B[0] stored in the 0th temporary register R(0) can be used to determine whether to let 2 0 *A is the output of multiplexer 110(0).
[0069] Let's take the (m-1)th temporary register R(m-1) as an example for further explanation. When the bit B[m-1] stored in the (m-1)th temporary register R(m-1) is 0, then the (m-1)th multiplexer 110(m-1) uses the digital value 0 at its first input as its output, that is, it outputs the digital value 0. At this time, the output of the (m-1)th multiplexer 110(m-1) is equal to B[m-1]*2. m-1 *A=0*2 m-1 *A = 0. When the bit B[m-1] stored in the (m-1)th temporary register R(m-1) is 1, then the (m-1)th multiplexer 110(m-1) is connected to the second input terminal 2. m-1 *A is the output, which is output 2. m-1 The value of A. At this point, the output of the (m-1)th multiplexer 110(m-1) is equal to B[m-1]*2. m-1 *A=1*2 m-1 *A=2 m-1 *A. That is, the value of bit B[m-1] stored in the (m-1)th temporary register R(m-1) can be used to determine whether to let 2... m-1 *A is the output of the (m-1)th multiplexer 110(m-1).
[0070] After the operations corresponding to the m bits of the second operation value B (i.e., bits B[0] to B[m - 1]) are completed, the 0th register R(0) to the (m - 1)th register R(m - 1) respectively store the other m bits of the second operation value B that will then be operated on, to repeat the above actions. The other m bits of the second operation value B are, for example, the bits obtained by shifting the second operation value B to the right by m bits and taking the m bits located at the rightmost side, such as B[m] to B[2m - 1] as the other m bits of the second operation value B that will then be operated on. The other m bits of the second operation value B will be written into the 0th register R(0) to the (m - 1)th register R(m - 1) to perform the next recursive operation. The method of shifting the second operation value B to the right by m bits as described above is, for example, to shift the second operation value B to the right by m bits (denoted by the symbol ">>m") by means of a right shift arithmetic unit. The right shift arithmetic unit is, for example, implemented by a shifter 136.
[0071] Where 2 0 A to 2 m-1 A is implemented by shifting the first operation value A to the left (shift left) by 0 to m - 1 bits respectively. The left shift is, for example, completed by m - 1 left shift arithmetic units. The m - 1 left shift arithmetic units are, for example, shifters 112(1) to shifter 112(m - 1). For example, by inputting the first operation value A to the shifter 112(1) that performs a left shift of 1 bit (denoted by the symbol "<<1"), the shifter 112(1) will output the value 21A which is 21 times A. By inputting the first operation value A to the shifter 112(2) that performs a left shift of 2 bits (denoted by the symbol "<<2"), the shifter 112(2) will output 2 2 times A's value 2 2 A. By inputting the first operation value A to the shifter 112(m - 1) that performs a left shift of m - 1 bits (denoted by the symbol "<<m - 1"), the shifter 112(m - 1) will output 2 m-1 times A's value 2 m-1 A.
[0072] In the multiplication operation circuit 108, by using a plurality of multiplexers and a plurality of shifters, the operation of calculating the sum of the products of the m bits of the second operation value B and the corresponding 2 i A can be achieved without a complex circuit, that is, the value of can be calculated, which is quite efficient, saves circuit area, and reduces the power consumption.
[0073] The main arithmetic circuit 102 may further include an addition circuit 114. The addition circuit 114 includes a first carry-save adder (CSA) CSA(1) to a m-th carry-save adder CSA(m). The first carry-save adder CSA(1) receives the initial sum value Sum(0), the initial carry value Carry(0), and the output value of the 0th multiplexer 110(0), and outputs the first sum value Sum(1) and the first carry value Carry(1). The second carry-save adder CSA(2) receives the first sum value Sum(1), the first carry value Carry(1), and the output value of the first multiplexer 110(1), and outputs the second sum value Sum(2) and the second carry value Carry(2). And so on. The m-th carry-holding adder CSA(m) receives the (m-1)-th sum value Sum(m-1), the (m-1)-th carry value Carry(m-1), and the output value of the (m-1)-th multiplexer 110(m-1), and outputs the m-th sum value Sum(m) and the m-th carry value Carry(m). The m-th sum value Sum(m) and the m-th carry value Carry(m) are the sum value D_Sum and the carry value D_Carry output by the main arithmetic circuit 102. At this time, one recursive operation is completed.
[0074] The addition unit 106 is used to add the lookup table output value Lout from the lookup table 104 to the sum value D_Sum and carry value D_Carry output from the main arithmetic circuit 102, and represents the sum as the updated sum value D_Sum' and carry value D_Carry', and outputs the updated sum value D_Sum' and carry value D_Carry' to the main arithmetic circuit 102. The addition unit 106 is implemented, for example, with a carry-holding adder. After the operation corresponding to the m bits of the second operand B is completed, the updated sum value D_Sum' and carry value D_Carry' output by the addition unit 106 are shifted right by m bits (for example, through the processing of two right shift operators, such as shifters 130 and 132) and input to the main arithmetic circuit 102. For example, the updated sum value D_Sum' and carry value D_Carry' are shifted right by m bits to obtain the sum value D_Sum" and carry value D_Carry" which are then input to the main arithmetic circuit 102. For example, under the control of the count value output by counter 116, multiplexer 118 selects either the digital value 0 or the sum value D_Sum" to output to register 122 as the initial sum value D_Sum0. Multiplexer 120, under the control of the count value output by counter 116, selects either the digital value 0 or the carry value D_Carry" to output to register 124 as the initial carry value D_Carry0. Registers 122 and 124 are implemented, for example, using D-type flip-flops. When the count value output by counter 116 is 0, multiplexers 118 and 120 select the digital value 0 as the output. When the count value output by counter 116 is not 0, multiplexers 118 and 120 select the sum value D_Sum” and carry value D_Carry” as outputs, respectively. The initial sum value D_Sum0 and the initial carry value D_Carry0 are used as the initial sum operation value Sum(0) and the initial carry operation value Carry(0), respectively, and are input to the first carry-holding adder CSA(1) to repeat the above steps. In this way, the next recursive operation begins.
[0075] The modular multiplication circuit 100 may further include, for example, a carry propagate adder (CPA) 126 and a modulo-digital operator (MoD) 128. The carry propagate adder 126 adds the updated sum value D_Sum' to the carry value D_Carry' after all the operations corresponding to the M bits of the second operand B have been performed, to obtain a first result value Rt1. That is, it adds the recursively obtained sum value D_Sum' to the carry value D_Carry' to obtain a temporary first result value Rt1. The modulo-digital operator 128 performs modulo operations on the first result value Rt1 to obtain a second result value Rt2, and uses the second result value Rt2 as the output of the modular multiplication circuit 100. The modulo-digital operator 128 performs modulo operations on the first result value Rt1 within a fixed time period to obtain the second result value Rt2, i.e., Rt2 = Rt1 mod P. The obtained Rt2 is the final output of the modular multiplication circuit 100 in this embodiment, which is the second result value Rt2 = AB / 2. 256 The modulo-digital arithmetic unit 128 is used to ensure that when the first result value Rt1 is greater than P (for example, when a carry occurs), a second result value Rt2 less than P can be obtained by using the modulo-digital arithmetic unit 128. If the first result value Rt1 is not greater than P, the first result value Rt1 can also be used as the output of the modulo-digital multiplication circuit 100 in this embodiment, that is, as AB / 2. 256 The value modulo P.
[0076] In other words, after completing one recursive operation, that is, after the multiplication circuit 108 (including the 0th multiplexer 110(0) to the (m-1)th multiplexer 110(m-1) and the 0th temporary register R(0) to the (m-1)th temporary register R(m-1)), the addition circuit 114 (the 1st carry-holding adder CSA(1) to the mth carry-holding adder CSA(m)), the lookup table 104, and the addition unit 106 have completed the above operations corresponding to the m bits of the second operand B, the analog-to-digital circuit 100 will perform the next recursive operation for the remaining m bits of the second operand B. After repeating the recursive operation multiple times to complete the operation on all bits of the second operand B, the sum value D_Sum' and the carry value D_Carry' are input to the carry-incrementing adder 126. The carry-increment adder 126 adds the sum D_Sum' obtained after performing all bit operations on the second operand B to the carry value D_Carry' to obtain the first result value Rt1.
[0077] Furthermore, in the search table 104, for example, there are records related to the modulus P. m One value, 2m Each of the numerical systems can be 2 m Integer division. The hardware architecture for the lookup table 104 can be implemented simply using combinational logic without the need for memory storage units, thus reducing the hardware area required for memory storage units and the longer memory access time. The adder unit 106 adds the sum value D_Sum and carry value D_Carry output from the main arithmetic circuit 102 to the lookup table output value Lout to output the updated sum value D_Sum' and carry value D_Carry'.
[0078] In other words, to achieve the update in (Equation 14), m carry-holding adders (the first carry-holding adder CSA(1) to the mth carry-holding adder CSA(m)) are needed to convert the current sum (D_Sum) and carry (D_Carry) according to the bits stored in the temporary register R(i) (e.g., B[i]) and 2. i A is added together, where i = 0 to (m-1). At the same time, in order to ensure that the numerator in (Equation 14) can be divided by the denominator, a value related to the modulus P (corresponding to LT) must be found from the search table 104 by the addition unit 106 (that is, another carry-holding adder (the (m+1)th carry-holding adder)) and added.
[0079] Find the 2 related to the modulus P recorded in Table 104. m For example, a value of 0, in, This is a floor function. The lookup table 104 includes, for example, a combinational logic circuit (not shown). The combinational logic circuit includes, for example, an AND gate, an OR gate, and a NOT gate. The aforementioned values related to the modulus P are recorded by electrically coupling at least one terminal of the combinational logic circuit to a high or low potential (e.g., high potential representing the digital value 1, and low potential representing the digital value 0). This combinational logic circuit then obtains one of these modulus P-related values corresponding to the sum D_Sum input to the lookup table.
[0080] The above carry-save adder is an adder architecture that reduces the time required for addition by increasing the number of registers. When performing a series of additions, this architecture can reduce the critical path, significantly increase the clock frequency, and has the advantage of lower hardware complexity compared to general adders. The critical path is the path that a signal needs to pass through when it is processed once, for example, the circuit path that the sum value needs to pass through when it is recursively processed once. Assuming the inputs are three values sum, carry, then the carry-save adder will output the sum (sum new ) and the carry (carry new ), and satisfy sum new +carry new = sum + carry + Z. For example, if sum = (00...0,0111)2, carry = (00...0,0****)2, Z = (00...0,1111)2, then sum new = (00...0,1000)2, carry new = (00...0,1110)2.
[0081] The carry-propagate adder is a general term for a type of adder with higher computational complexity than the carry-save adder. When the inputs of the carry-propagate adder are two values X, Y, the output is the value result, and satisfy result = X + Y. For example, if X = (00...0,0111)2, Y = (00...0,1111)2, then result = (00...1,0110)2.
[0082] Please refer to Figure 2 , which shows a flowchart of a method for calculating modular multiplication according to an embodiment of the present invention, including the following steps. First, in step 202, according to the 2 i A corresponding to the first operand A and the m bits of the second operand B currently being operated on, update the sum value and the carry value. m is a positive integer, and i is an integer from 0 to m - 1. Then, in step 204, by using a lookup table, record multiple values related to the modulus, and select one of these values as the lookup table output value according to the sum value and output it. After that, enter step 206, and by using an adder unit, update the sum value and the carry value according to the lookup table output value. Among them, the method for calculating modular multiplication is recursive, and by using different m bits of the second operand B, repeat the above steps to update the sum value and the carry value until all M bits of the second operand B have been operated on, where m < M, and M is a positive integer.
[0083] Please refer to Figure 3The diagram illustrates a flowchart of a method for calculating modular multiplication according to another embodiment of the present invention. First, in step 302, two n-bit positive integer input values are received, namely, the first operand A and the second operand B. Here, n ≦ 256. When n is not 256, bits in the first operand A and the second operand B that are less than 256 bits are padded with 0. Next, in step 304, the sum value D_Sum0 and the carry value D_Carry0 are initially set to 0. Then, in step 306, the current recursion count is recorded (for example, using counter 116 to record the current recursion operation number), and it is determined whether the current recursion count is less than 256 / m. If yes, step 308 is executed; otherwise, step 310 is executed. Here, m is the number of bits processed in one recursion operation of the second operand B, and 256 / m is a positive integer.
[0084] In step 308, the sum value D_Sum and the carry value D_Carry are updated according to (Equation 14) using (m+1) carry-holding adders and a lookup table. This is achieved through:
[0085]
[0086] Where P is the modulus (P = 2) 255 -19), ">>" is a right shift operation, and "LT" is the value obtained by looking up the lookup table based on the D_Sum value output by the m-th carry-holding adder. After performing an operation with the (m+1)-th carry-holding adder and the lookup table to update the sum value D_Sum and the carry value D_Carry, the count value recorded by counter 116 is incremented by 1, and the second operation value B is shifted to the right by m bits.
[0087] Then, step 310 is executed. After 256 / m recursive operations, the sum value D_Sum and the carry value D_Carry are input into the carry increment adder to perform the addition operation (that is, the sum value D_Sum and the carry value D_Carry are added together) to obtain a temporary value (the first result value Rt1).
[0088] Next, step 312 is executed, performing a modulo operation on the first result value Rt1 modulo P. Then, step 314 is executed to obtain the final modulo result, which is (the second result value Rt2 = AB / 2). 256 (mod P).
[0089] Please refer to Figure 4 Its illustration is in accordance with the present invention Figure 1 The block diagram of the modular multiplication circuit in the embodiment, where m equals 4. m is the number of bits processed in one recursive operation. Figure 4The number of recursive additions in 256-bit multiplication can be reduced to 256 / m = 64.
[0090] At Figure 4 In the middle, parameter P = 2 255 -19. The first operand A and the second operand B input to the analog-to-digital multiplication circuit 400 are two n-bit positive integers, where n ≦ 256. When n is not 256 bits, the padding for bits less than 256 bits is 0. Figure 4 The output of the 400 modular multiplication circuit is a 256-bit positive integer, which is the second result value Rt2 = AB / 2. 256 (mod P).
[0091] The modular multiplication circuit 400 includes component registers 422 and 424, implemented for example by D-type flip-flops, to record the current sum and carry values. Multiplexers 418 and 420 initially set the initial sum value D_Sum0 and initial carry value D_Carry0 stored in registers 422 and 424 to 0, and then update the sum value D_Sum and carry value D_Carry output by the main arithmetic circuit 402 according to the following (Equation 16):
[0092]
[0093] Wherein, the numerical sum is the current sum value (e.g., the initial sum value D_Sum0), the numerical carry is the current carry value (e.g., the initial carry value D_Carry0), and the updated sum value D_Sum is the numerical sum. new The updated carry value D_Carry is the numerical carry. new After updating the sum D_Sum and carry D_Carry once, the second operand B is shifted 4 bits to the right and updated to B. new .
[0094] Counter 416 is used to record the current recursion count. To implement the update in (Equation 16), four multiplexers 410(0) to 410(3) are needed to receive the four bits of the second operation value B temporarily stored in register 434, in order to determine whether to update 2. i A is added to the current sum (e.g., the initial sum D_Sum0) and the current carry (e.g., the initial carry D_Carry0). In one recursive operation, the second operand B is processed by 4 bits. After one recursive operation is completed, the second operand B is shifted right by 4 bits using shifter 436.
[0095] Carry-holding adders CSA(1) to CSA(4) add the current sum (e.g., the initial sum D_Sum0) and the current carry (e.g., the initial carry D_Carry0) to A, 2A, 4A, and 8A respectively, based on the four bits of the second operand B stored in registers R(0) to R(3). The values of 2A, 4A, and 8A are obtained by shifting the first operand A to the left by 1 to 3 bits respectively through shifters 412(1) to 412(3). Then, the adder unit 406 (another carry-holding adder) searches for the modulus P (P=2) in the lookup table 404. 255 The value (LT) related to -19) is added to the fourth sum operation value Sum(4) and the fourth carry operation value Carry(4) output by the carry-holding adder CSA(4) to obtain the updated sum value D_Carry' and carry value D_Sum'.
[0096] Find record 2 in table 404 m (in this example, it equals 2) 4 =16) values related to P, namely: That is to say in This is the floor function.
[0097] The lookup table 404 will find a record as the lookup table output value Lout based on the fourth sum operation value Sum(4) output by the fourth carry-holding adder CSA(4), which is also the LT value in (Equation 16). The lookup table output value (LT), the fourth sum operation value Sum(4) output by the fourth carry-holding adder CSA(4), and the fourth carry operation value Carry(4) are added by the addition unit 406 (which can be the fifth carry-holding adder).
[0098] The carry-incrementing adder 426 adds the sum D_Sum' obtained after 64 recursions to the carry value D_Carry' to obtain the first result value Rt1. The modulo-digital arithmetic unit 428 modulo P (P=2) the first result value Rt1. 255 -19) operation, to obtain the second result value Rt2 (Rt2=AB / 2) 256 (mod P)).
[0099] This invention utilizes the Montgomery algorithm to reduce the complexity of modular arithmetic and, without using memory, reduces the number of recursive additions in a 256-bit multiplication to 64 (using an embodiment of this invention where m=4, where m is the number of bits processed in one recursive operation). This invention can complete complex modular multiplication operations using only adders, multiplexers, shifters, and other circuit elements, eliminating the need for complex multiplication circuits and thus saving circuit area and reducing energy consumption. Furthermore, this invention can simultaneously increase the clock frequency, thereby improving the circuit's processing speed.
[0100] The present invention requires only a number of values related to the modulus P (i.e., a number of values related to the modulus P in the lookup table), and the preprocessed data does not need to change with the multiplicand and multiplier. Therefore, for a modular multiplication circuit with a fixed modulus P, the contents of the lookup table for the preprocessed data in this invention can be implemented using a truth table, decoder, or other combinational logic circuits on the circuit, without the need for additional temporary registers and memory, thus solving the problem of needing to calculate preprocessed data in other related prior art.
[0101] In summary, the effects achieved by this implementation include: (i) No need for memory storage units: Since the contents of the lookup table are only related to parameter P, it can be implemented by a truth table, decoder, or other combinational logic circuits on the circuit, without the need for additional memory storage units. (ii) Increased operation speed: By using a carry-hold adder, the critical length can be shortened and the number of recursions reduced, which can increase the clock frequency and improve the operation speed. (iii) Low power consumption: Since no memory storage units are required and the core recursion is completed by the carry-hold adder, the energy consumption during execution can be reduced. The embodiments of the present invention achieve the above-mentioned effects when m=4.
[0102] The effects of the embodiments of the present invention will now be compared with the following prior art 1 to prior art 4.
[0103] Existing technology one: MAMehrabi and C.Doche, "Low-Cost, Low-Power FPGAImplementation of ED25519 and CURVE25519 Point Multiplication," Information, vol.10, no.9, p.285, 2019.
[0104] Prior Art II: Rahimzadeh, L.; Eshghi, M.; Timarchi, S. Radix-4 implementation of redundant interleaved modular multiplication on FPGA. In Proceedings of the 2014 22nd Iranian Conference on Electrical Engineering (ICEE), Tehran, Iran, 20–22 May 2014; pp. 523–526.
[0105] Prior Art III: Javeed, K.; Wang, X. Radix-4 and radix-8 booth encoded interleaved modular multipliers over general Fp. In Proceedings of the 2014 24th International Conference on Field Programmable Logic and Applications (FPL), Munich, Germany, 2–4 September 2014. [[ID=【5】]]
[0106] Prior Art IV: Nassar, M. A.; El-Sayed, L. A. Efficient Interleaved Modular Multiplication Based on Sign Detection. In Proceedings of the 2015 IEEE / ACS 12th International Conference of Computer Systems and Applications (AICCSA), Marrakech, Morocco, 17–20 November 2015.
[0107] Note: There seems to be a formatting issue with the "【5】" in the original text which is not clear what it is supposed to be. I've translated it as it is but it might need to be corrected in the original source for proper understanding.Existing technology one uses radix-8 interleaved modulomultiplication. The drawback of existing technology one is that it requires data preprocessing before each calculation and additional memory to store the preprocessed data. Existing technology two is similar to existing technology one, but uses radix-4 instead of radix-8. While this reduces the amount of preprocessed data, it increases the number of recursive additions in the 256-bit multiplication. Existing technology three does not preprocess the data, resulting in a longer criticality and lower clock frequency. Existing technology four uses the EIMM (Efficient Interleaved Modular Multiplication Based on Sign Detection) algorithm, which reduces the complexity of modulo operations through sign detection. However, it does not reduce the number of recursive additions in the 256-bit multiplication, maintaining the original 256, resulting in a higher overall computational load.
[0108] The embodiments of the present invention are compared with the prior art 1 to 4, which describe low-power modular multiplication architectures related to model Ed25519. The results are shown in Table 1 below. Both the embodiments of the present invention and prior art 1 to 4 can implement modular multiplication operations in model Ed25519. Table 1 lists a comparison of the computing platform, latency, clock frequency, and power of the first embodiment of the present invention with an m value of 4, the second embodiment of the present invention with an m value of 8, and prior art 1 to 4. As can be seen from Table 1, the power consumption of the first and second embodiments of the present invention is significantly lower than that of prior art 1 to 4, demonstrating indeed low power consumption characteristics.
[0109]
[0110] Table 1
[0111] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.
Claims
1. A modular multiplication circuit, characterized in that, Comprising: The main operational circuit is used to calculate the value A corresponding to 2. i A and the m bits of the second operand B currently being operated on are used to update the sum and carry value, where m is a positive integer and i is an integer from 0 to m-1; A lookup table for recording a plurality of values related to a modulus, and selecting one of these values as the lookup table output value according to the sum value for output; And An addition unit for updating the sum value and the carry value according to the lookup table output value and outputting them to the main arithmetic circuit; The main arithmetic circuit uses multiple multiplexers, multiple shifters, and multiple adders to generate the m bits of the second operational value B currently being processed, and the corresponding 2... i The sum of the products of A is used to update the total value and the carry value; Wherein, the modular multiplication circuit performs the above operations in a recursive manner by using different m bits of the second operation value B to update the sum value and the carry value again until the operations corresponding to all M bits of the second operation value B are completed, where m < M and M is a positive integer.
2. The modular multiplication circuit as described in claim 1, characterized in that, Where the main arithmetic circuit includes: The multiplication circuit includes multiplexers 0 through m-1 and registers 0 through m-1. Each of the registers stores one of the m bits of the second operand B currently being operated on. The selection terminals of the multiplexers 0 through m-1 are respectively controlled by the output values of the registers 0 through m-1. The first input terminal of each of the multiplexers 0 through m-1 receives the digital value 0, and the second input terminals of each multiplexer 0 through m-1 receive the digital value 2. 0 A to 2 m-1 A, the sum and the carry value are determined by the output values of the 0th multiplexer to the (m-1)th multiplexer; Wherein, after the operations corresponding to the m bits of the second operation value B are completed, the 0th register to the (m - 1)th register respectively store the next m bits of the second operation value B to be operated on to repeat the above actions.
3. The modular multiplication circuit as described in claim 2, characterized in that, Among them 2 0 A to 2 m-1 A is achieved by shifting the first operand A to the left by 0 to m-1 bits respectively.
4. The modular multiplication circuit as described in claim 2, characterized in that, Where the main arithmetic circuit further includes: An addition operation circuit including a 1st carry save adder (CSA) to an mth carry save adder. The 1st carry save adder receives an initial sum operation value Sum(0), an initial carry operation value Carry(0), and the output value of the 0th multiplexer, and outputs a 1st sum operation value Sum(1) and a 1st carry operation value Carry(1). The 2nd carry save adder receives the 1st sum operation value Sum(1), the 1st carry operation value Carry(1), and the output value of the 1st multiplexer, and outputs a 2nd sum operation value Sum(2) and a 2nd carry operation value Carry(2). The mth carry save adder receives the (m - 1)th sum operation value Sum(m - 1), the (m - 1)th carry operation value Carry(m - 1), and the output value of the (m - 1)th multiplexer, and outputs an mth sum operation value Sum(m) and an mth carry operation value Carry(m). The mth sum operation value Sum(m) and the mth carry operation value Carry(m) are used as the sum value and the carry value output by the main arithmetic circuit.
5. The modular multiplication circuit as described in claim 2, characterized in that, Wherein, after the operations corresponding to the m bits of the second operation value B are completed, the updated sum value and carry value output by the addition unit are shifted right by m bits and then input to the main arithmetic circuit. After the second operation value B is shifted right by m bits, m bits are taken as the next m bits of the second operation value B to be operated on and stored in the 0th register to the (m - 1)th register.
6. The modular multiplication circuit as described in claim 1, characterized in that, The lookup table records 2 items related to the modulus. m The number 2 m Each of the values can be represented by 2. m The divisibility lookup table is implemented through combinational logic circuits. The addition unit adds the sum and carry value output by the main arithmetic circuit to the output value of the lookup table to output the updated sum and carry value.
7. The modular multiplication circuit as described in claim 1, characterized in that, Further comprising: A carry propagate adder (CPA) for adding the updated sum value and the carry value when the operations corresponding to all M bits of the second operation value B are completed to obtain a first result value; and A Mod operator is used to perform a modulo operation on the first result value to obtain a second result value, and the second result value is used as the output of the modulo multiplication circuit.
8. The modular multiplication circuit as described in claim 1, characterized in that, The lookup table records 2 items related to the modulus. m The value associated with the modulus is 2. m The values include ,in This is the floor function.
9. The modular multiplication circuit as described in claim 1, characterized in that, The look-up table includes combinational logic. By electrically coupling at least one endpoint of the combinational logic to a high potential or a low potential, values related to the modulus are recorded, and one of the values related to the modulus corresponding to the sum value input to the look-up table is obtained through the combinational logic.
10. A method for calculating modular multiplication, characterized in that, Including: Based on the first operational value A corresponding to 2 i A and the m bits of the second operand B currently being operated on are used to update the sum and carry value, where m is a positive integer and i is an integer from 0 to m-1; By using a look-up table, multiple values related to the modulus are recorded, and one of these values is selected as the look-up table output value according to the sum value and output; And By using an adder unit, the sum value and the carry value are updated according to the look-up table output value; The method for calculating modular multiplication uses multiple multiplexers, multiple shifters, and multiple adders to generate the m bits of the second operand B currently being calculated, and the corresponding 2... i The sum of the products of A is used to update the total value and the carry value; Among them, the method for calculating the modulo multiplication recursively uses different m bits of the second operand B to repeat the above steps to update the sum value and the carry value again until the operations corresponding to all M bits of the second operand B are completed, where m < M and M is a positive integer.
11. The method for calculating modular multiplication as described in claim 10, characterized in that, Among them, Based on the first operational value A, corresponding to 2 i The step of updating the sum value and the carry value by taking m bits of the second operation value B currently being operated on from A is accomplished by the main operation circuit, which includes: The multiplication circuit includes multiplexers 0 through m-1 and registers 0 through m-1. Each of the registers stores one of the m bits of the second operand B currently being operated on. The selection terminals of the multiplexers 0 through m-1 are respectively controlled by the output values of the registers 0 through m-1. The first input terminal of each of the multiplexers 0 through m-1 receives the digital value 0, and the second input terminals of each multiplexer 0 through m-1 receive the digital value 2. 0 A to 2 m-1 A, the sum and the carry value are determined by the output values of the 0th multiplexer to the (m-1)th multiplexer; After the operations corresponding to the m bits of the second operand B are completed, the 0th register to the (m - 1)th register respectively store the next m bits of the second operand B to be operated on to repeat the above actions.
12. The method for calculating modular multiplication as described in claim 11, characterized in that, Among them 2 0 A to 2 m-1 A is achieved by shifting the first operand A to the left by 0 to m-1 bits respectively.
13. The method for calculating modular multiplication as described in claim 11, characterized in that, The main arithmetic circuit further includes: An addition arithmetic circuit includes a 1st carry-save adder to an mth carry-save adder. The 1st carry-save adder receives an initial sum operation value Sum(0), an initial carry operation value Carry(0), and the output value of the 0th multiplexer, and outputs a 1st sum operation value Sum(1) and a 1st carry operation value Carry(1). The 2nd carry-save adder receives the 1st sum operation value Sum(1), the 1st carry operation value Carry(1), and the output value of the 1st multiplexer, and outputs a 2nd sum operation value Sum(2) and a 2nd carry operation value Carry(2). The mth carry-save adder receives the (m - 1)th sum operation value Sum(m - 1), the (m - 1)th carry operation value Carry(m - 1), and the output value of the (m - 1)th multiplexer, and outputs an mth sum operation value Sum(m) and an mth carry operation value Carry(m). The mth sum operation value Sum(m) and the mth carry operation value Carry(m) are used as the sum value and the carry value output by the main arithmetic circuit.
14. The method for calculating modular multiplication as described in claim 11, characterized in that, After the operations corresponding to the m bits of the second operand B are completed, the updated sum value and carry value output by the adder unit are shifted right by m bits and then input to the main arithmetic circuit. After the second operand B is shifted right by m bits, m bits are taken as the next m bits of the second operand B to be operated on and stored in the 0th register to the (m - 1)th register.
15. The method for calculating modular multiplication as described in claim 10, characterized in that, The lookup table records 2 items related to the modulus. m The number 2 m Each of the values can be represented by 2. m For integer division, the addition unit adds the sum and the carry to the lookup table output value to output the updated sum and carry.
16. The method for calculating modular multiplication as described in claim 10, characterized in that, Further including: When all operations corresponding to the M bits of the second operand B have been performed, the updated sum is added to the carry value to obtain the first result value; and The first result value is subjected to a modulo operation to obtain a second result value, which is then used as the output of the modulo multiplication.
17. The method for calculating modular multiplication as described in claim 10, characterized in that, The lookup table records 2 items related to the modulus. m Values, including ,in This is the floor function.
18. The method for calculating modular multiplication as described in claim 10, characterized in that, The lookup table includes combinational logic circuitry, which records values related to the modulus by electrically coupling at least one terminal of the combinational logic circuitry to a high or low potential, and obtains one of the values related to the modulus corresponding to the sum value input to the lookup table through the combinational logic circuitry.
Citation Information
Patent Citations
Extending the range of computational fields of integers
CN1449519A
Address generation apparatus and method for quadratic permutation polynomial interleaver de-interleaver
TW201110566A