Techniques, apparatuses, and instruction set architectures for efficient modular division and modular inversion

Abstract

Apparatuses, systems, and techniques are disclosed for performing and facilitating fast and efficient modular computation operations, such as modular division and modular inversion, using a shared platform that includes a hardware accelerator engine.

Description

Technical Field

[0001] At least one embodiment relates to techniques for performing and facilitating modular computation operations. For example, at least one embodiment relates to accelerated operations used in the context of public-key cryptography, elliptic curve cryptography, etc. Computational techniques, hardware accelerator devices, and instruction set architectures are disclosed for enabling fast and efficient execution of modular division and modular inversion on shared platforms. Background Technology

[0002] In public-key cryptography systems, computing devices can perform operations on large binary numbers as part of various algorithms, such as Rivest-Shamir-Adelman (RSA), Diffie-Hellman (DH), Elliptic Curve Cryptography (ECC) algorithms for encrypting and / or decrypting secret messages, and Digital Signature Algorithm (DSA) for authenticating messages. Cryptographic algorithms typically involve modular arithmetic operations, where integers are wrapped in a circle (Z-ring) of length M. M Therefore, any two numbers differing by M (or any other integer greater than M) are considered the same number. A typical multiplication of two numbers A and B produces a number AB that is much larger than M. The resulting number is then reduced back to the ring Z. M In this context, determining the residual of AB divided by M is equivalent to calculating the remainder, which can be a computationally expensive operation. Even the execution of a single instance of a cryptographic algorithm can involve numerous modulo operations of these or others (e.g., addition, subtraction, exponentiation, division, etc.). Furthermore, typical applications can include numerous encryption and decryption instances of large amounts of data, which can consume significant processing resources. Attached Figure Description

[0003] Figure 1 It is a block diagram of an example computer device that performs efficient modular division and modular inversion according to at least some embodiments;

[0004] Figure 2A A flowchart is depicted illustrating an example operation of modulo-4 that can be used to efficiently implement cryptographic operations according to at least some embodiments;

[0005] Figure 2B Modified example operations of modulo-4 with elimination branching operations are shown according to at least some embodiments;

[0006] Figure 3A Example operations of modular inverse, which can be used for efficient implementations of cryptographic operations according to at least some embodiments, are shown;

[0007] Figure 3B A modified example operation of modular inversion with eliminated branching operations is shown according to at least some embodiments;

[0008] Figure 4 An example accelerator circuit capable of performing modulo-4 division by four and modulo-inversion according to at least some embodiments is shown;

[0009] Figure 5 This is a flowchart of an example method for efficient and fast modulo-4 division according to at least some embodiments;

[0010] Figure 6 This is a flowchart of an example method for efficient and fast modular inversion according to at least some embodiments;

[0011] Figure 7 A block diagram of an example computer system operating according to some embodiments of the present disclosure is depicted. Detailed Implementation

[0012] Cryptographic applications typically deploy asymmetric public / private key algorithms, such as DH, RSA, and DSA. For example, a cryptographic application can generate a private / public key by choosing a pair of large prime numbers (e.g., p and q), selecting a public (encryption) exponent e, and then calculating a secret (decryption) exponent d based on the public (encryption) exponent e and the selected numbers p and q. The numbers e and M = p·q may then be revealed to other participants as part of the public key, while p, q, and d are stored by the recipient of future secret communications (as a secret private key). The sender can then use modular exponentiation c = m... e Modulo M calculates the ciphertext message c to encrypt the plaintext message m, and then transmits c (for example, publicly) to the receiver. The receiver can then use another modulo m = c to encrypt the plaintext message m. d Modulo M is used to decrypt the ciphertext. The original plaintext message can be recovered by performing a modulo operation on a properly chosen number, such as (p-1)·(q-1), as long as the value of the decryption exponent d is chosen such that e·d = 1.

[0013] Public / private key cryptography is a major component of modern computer software and hardware systems, used in a variety of applications, including secure communication, timestamping, non-repudiation protocols, and cryptocurrencies. In some systems, cryptographic applications can be instantiated during system startup and used for all secure data communication (e.g., between the processor and system memory). RSA and ECC are among the most popular cryptographic applications. In ECC applications, numbers are associated with points on elliptic curves (e.g., Weierstrass curves), and specific rules are defined for various arithmetic operations such as addition, subtraction, doubling, and multiplication. The properties of elliptic curves ensure that the product of two large numbers AB = C can be found virtually anywhere on the curve, making it an extremely difficult computational task to recover the unknown A from known numbers B and C. ECC calculations often involve multiple modular divisions; for example, the operation A / B = C mod M is equivalent to finding a number C whose modulo multiplication by B yields A:AC = B mod M. Modular division is typically performed using an extended binary algorithm based on the Euclidean greatest common denominator (GCD) method. The extended binary GCD algorithm simplifies modular division into several conditional addition, subtraction, and bit-shifting operations. The computational bottleneck of these operations is the need to perform a modulo division of the appropriately chosen number U by 4U / 4modM.

[0014] On the other hand, RSA applications involve a large number of modular multiplications, i.e., standard multiplication followed by modular covariance. To reduce the computational cost of modular covariance, the Montgomery modular covariance method is commonly used. More specifically, to calculate AB mod M, numbers A and B can first be converted to the Montgomery domain. Among them 2 n It is the auxiliary modulus (Montgomery cardinality). Due to the product... There is an extra factor 2. n Therefore, the number Montgomery representation of the product C = A·B They are not equal because they need to be divided by 2. n Additional division: In order to calculate efficiently A number S = -M -1 mod 2 n It was also selected; in other words, M·S+1=k·2 n Given a certain integer k, we can construct a number... Can be multiplied Adding them will not change the value of their modulus M:

[0015]

[0016] also, The existence of numbers It is 2 n Multiples of, because

[0017]

[0018] Divide by 2 n This can be easily done by right shifting by n bits. The result is the Montgomery representation of the product C = A·B mod M. (If the result exceeds M, then subtract M to obtain the result.) In Montgomery representation, any number of consecutive modular multiplications can be performed directly in the Montgomery field (only the final output is considered). Transferring from the Montgomery domain back to the standard domain ).

[0019] Even if the value S can be pre-computed once and stored in the computing device's memory, such storage can still consume significant memory resources. For example, a single value S may be as long as 2048 bits, 4096 bits, or even more, and may require storing a large number of values ​​(e.g., if the computing device uses multiple public / private key pairs).

[0020] The aspects and embodiments of this disclosure address technical challenges by providing concurrent computation support for cryptographic applications involving modulo division (e.g., the ECC algorithm) and applications involving modulo inversion (e.g., the RSA algorithm). The embodiments described below illustrate methods for performing both types of computation (e.g., U / 4 mod M and S = M) on an equivalent basis, such as a single accelerator engine. -1 mod 2 n The devices, technologies, and instruction set architectures of [the relevant entity / entity]. In one set of instances, the same (or similar) operating and accelerator engines can be used to efficiently facilitate modular division, and in another set of instances, modular inversion. As described in more detail below, optimizations are achieved by deploying multiple techniques. For example, a set of multiples of M can be computed and stored as operands M, 2M, 3M in different high-speed registers. In both the modular division and modular inversion cases, the operands can be chosen based on a subset of bits of operands M and 3M (e.g., the two least significant bits) and an additional subset of bits; in the case of modular division, this additional number might be the dividend U, and in the case of modular inversion, it might be some auxiliary number.

[0021] The advantages of the disclosed apparatus and techniques include, but are not limited to, fast and efficient computation of modular arithmetic at runtime. Because the same accelerator circuitry can be used for both types of modular arithmetic, the disclosed apparatus and techniques support different types of cryptographic applications. For example, the disclosed apparatus and techniques can switch from performing RSA computation to performing ECC computation at runtime, and vice versa. Furthermore, since the disclosed technique for computing modular inverses represents a substantial improvement over existing techniques, the need to pre-compute and store the modular inverse M for Montgomery multiplication can be eliminated. -1 mod 2 n This is necessary to save significant memory resources, improve overall computing efficiency, reduce the cost and size of computing devices, and so on.

[0022] System Architecture

[0023] Figure 1 This is a block diagram of an example computer device 100 that performs efficient modular division and modular inversion according to at least some embodiments. Figure 1 The example computer device 100 depicted may be a desktop computer, tablet, smartphone, server (local or remote), thin / thin client, cloud computing node, card reader, wireless sensor node, Internet of Things (IoT) node, embedded system dedicated to one or more specific applications, etc. One or more applications 102 may be executed on the computer device 100.

[0024] The computer device 100 may support one or more applications 102, including one or more machine learning applications, one or more graphics applications, one or more computing applications, one or more cryptographic applications (e.g., authentication, encryption, decryption, one or more secure storage applications, etc.), one or more embedded applications, one or more external applications, or any other type of application that can be executed by the computer device 100. One or more applications 102 may be instantiated on the same computer device 100, for example, an operating system executed by the computer device 100. Alternatively, one or more applications 102 may be one or more external applications instantiated by a guest operating system supported by a virtual machine monitor (hypervisor) running on the computer device 100. In some embodiments, the external applications may reside on a remote access client device or a remote server (not shown), wherein the computer device 100 provides cryptographic support for the client device and / or the remote server.

[0025] Computer device 100 may include one or more processors 110. A “processor” means any device capable of executing instructions encoded as arithmetic, logic, or I / O operations. In an illustrative example, the processor may follow the von Neumann architecture model. Processor 110 may include a central processing unit (CPU) 112, which may have any number of arithmetic logic units (ALU), floating-point units (FPU), control units, registers, etc. CPU 112 may perform at least some operations of one or more applications 102. CPU 112 may include one or more cores that can access single-level or multi-level caches 114. In some embodiments, each core may execute instructions to run multiple threads, also referred to as a logical core. Various logical cores may be assigned to one or more applications 102, although more than one logical core may be assigned to a specific application 102 for parallel processing. A multi-core CPU 112 can execute multiple instructions simultaneously. A single-core CPU 112 typically executes one instruction at a time (or processes a single instruction pipeline). CPU 112 can be implemented as a single integrated circuit, two or more integrated circuits, or it can be a component of a multi-chip module.

[0026] In some embodiments, some operations of one or more applications 102 may be performed by one or more graphics processing units (GPUs) 116. GPU 116 may include multiple cores, each capable of executing multiple threads. Each core may run multiple threads concurrently (e.g., in parallel). In some embodiments, GPU threads may access thread-specific (private) GPU registers. Furthermore, all threads of a GPU core may access one or more shared GPU registers. In at least one embodiment, each GPU core may include a scheduler to distribute computational tasks and processes among different GPU threads. GPU 116 may also have a dispatch unit to implement scheduled tasks on the appropriate GPU threads using the correct private and shared GPU registers. In some embodiments, GPU 116 may have a cache 118, and multiple GPU cores may share access to the cache 118. In some embodiments, CPU 112 may execute processes involving serial computational tasks, while GPU 116 may execute tasks suitable for parallel processing. In some embodiments, one or more applications 102 may determine which processes should be executed on GPU 116 and which processes should be executed on CPU 112. In other embodiments, CPU 112 may determine which processes should be executed on GPU 116 and which processes should be executed on GPU 112. In some embodiments, processor 110 may include one or more application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), finite state machines (FSMs), etc.

[0027] Processor 110 may access one or more system memory devices 140, for example, via system bus 108. System memory 140 may refer to any volatile or non-volatile memory and may include read-only memory (ROM) 142, random access memory (RAM) 144, and (not shown) electrically erasable programmable read-only memory (EEPROM), flash memory, trigger memory, or any other device capable of storing data. RAM 144 may be dynamic random access memory (DRAM), synchronous DRAM (SDRAM), static memory, such as static random access memory (SRAM), etc. In some implementations, processor 110 and system memory 140 may be implemented as a single controller, such as an FPGA.

[0028] Processor 110 may include accelerator circuitry (accelerator coprocessor, accelerator engine) 130. One or more applications 102 may perform cryptographic operations on processor 110, with accelerator circuitry 130 executing one or more functions, such as modular division / inversion functions 103. Accelerator circuitry 130 may include accelerator functional units, such as modular division / inversion units 133, to implement the computation of modular division / inversion functions 103 for one or more applications 102, as described in more detail below. Accelerator circuitry 130 may be communicatively coupled to CPU 112 and / or GPU 116 via accelerator circuitry interface (AC interface) 120. In some embodiments, accelerator circuitry 130 may perform a portion of the cryptographic computation performed by processor 110. For example, CPU 112 (and / or GPU 116) may perform the RSA algorithm while performing multiple Montgomery multiplications and reductions. During the Montgomery reduction of a specific number M, the CPU 112 (and / or GPU 116) can provide the value of the number M to the accelerator circuit 130, and the accelerator circuit 130 can calculate M. -1 mod 2 n (or -M) -1 mod 2 n The calculated value is then returned to CPU 112 (and / or GPU 116). In another example, CPU 112 (and / or GPU 116) can perform the ECC algorithm while performing multiple modulo divisions. During the execution of modulo division U / 4 mod M for a specific modulus M, CPU 112 (and / or GPU 116) can provide the values ​​of the dividend U and the modulus M to accelerator circuit 130, which can calculate U / 4 mod M and return the calculated value to CPU 112 (and / or GPU 116).

[0029] Accelerator circuit 130 may include decoding unit 132 (also called decoder), which may be coupled to instruction acquisition unit ( Figure 1 (Not depicted in the text). The decoding unit 132 can decode instructions and generate one or more micro-operations, microcode entry points, microinstructions, other instructions, or other control signals that are decoded from the original instructions, or otherwise reflect or originate from the original instructions. The decoding unit 132 can be implemented using various mechanisms, such as lookup tables, hardware implementations, programmable logic arrays (PLAs), microcode read-only memory (ROM), etc.

[0030] Decoding unit 132 can be coupled to execution unit 134, and execution unit 134 may include scheduler unit ( Figure 1 (Not depicted in the text). The decoding unit 132 and the execution unit 134 can be coupled to one or more registers 138 via the memory access unit 136. Each register 138 can store one or more different data types, such as scalar integers, scalar floating-point numbers, compressed integers, compressed floating-point numbers, vector integers, vector floating-point numbers, etc., status (e.g., instruction pointer, which is the address of the next instruction to be executed), etc.

[0031] In some embodiments, the decoding unit 132 may receive instructions from the CPU 112 (and / or GPU 116), which may include an identifier of the operation to be performed (e.g., modulo division, modulo inversion, etc.) and an input value (e.g., U and / or M). The decoding unit 132 may store the received input value in register 138. The decoding unit 132 may store (or access) some previously stored additional numbers (e.g., 2M and 3M), as described in more detail below. The decoding unit 132 may then use decoding circuitry (e.g., one or more multiplexers, as described below). Figure 4 (In more detail) determine one or more operations to be performed on the input value by execution unit 134, such as addition, division (e.g., bit shift), etc. During the execution of the operation by execution unit 134, intermediate values ​​may be stored in register 138. After completing the modular division or modular inversion calculation, the final output may be moved to CPU cache 114 (or GPU cache 118). In some embodiments, after the calculation is completed, memory access unit 136 may provide CPU 112 (or GPU 116) with an identifier of register 138 storing the final output, and CPU 112 (or GPU 116) may directly retrieve the final result from the corresponding register.

[0032] The computer device 100 may also include an input / output (I / O) component 104 to facilitate connection of the computer device 100 to various peripheral hardware devices (not shown), such as card readers, terminals, printers, scanners, IoT devices, etc. The computer device 100 may also include a network interface 106 to facilitate connection to various networks (Internet, wireless local area network (WLAN), personal area network (PAN), public network, private network, etc.), and may include a radio front-end module and other devices (amplifiers, digital-to-analog converters and analog-to-digital converters, dedicated logic units, etc.) to enable data transmission with the computer device 100.

[0033] Figure 2A A flowchart is described illustrating an example operation 200 of modulo-4 division, which, according to at least some embodiments, can be used to efficiently implement cryptographic operations. In some embodiments, example operation 200 can be implemented by various units of accelerator circuitry 130. In some implementations, example operation 200 can be implemented by a combination of CPU 112 (GPU 116) and accelerator 130, by a combination of accelerator 130 and software executed by CPU 112 (GPU 116), or by software executed solely by CPU 112 (GPU 116). More specifically, in the process of modulo division, for example, based on the extended binary Euclidean algorithm, a computationally intensive modulo-4 division operation, W = U / 4 mod M, may be encountered. The output of modulo-4 division, W, is a number multiplied by four to obtain a number U, up to an integer modulus M: m: 4W = U + mM. Since the numbers U and W are defined in ring Z... M In the range [0, M-1], the integer value m satisfies the condition 0 ≤ m ≤ 3. Therefore, to determine the desired output W, the accelerator circuit can first identify a value m such that U+mM is an integer of 4, or equivalently, the binary representation of U+mM has each of its two least significant bits equal to 0. Then, by shifting this value two bits to the right, the value W is obtained from the value U+mM: (U+mM) >> 2 → W.

[0034] As shown in the figure, the input to operation 200 (block 210) can include an odd modulus M and a dividend U, which can be either odd or even. If it is determined in block 220 that the 0th and 1st bits of U are zero (in other words, the value of these bits is U[1:0] = 0), then the number U is divisible by 4, and the output W = U / 4 is executed by shifting two bits to the right at block 290. If neither of the two least significant bits is zero, U[1:0] ≠ 0, then the process can continue to determine whether U is even by checking in block 240 whether the two least significant bits have a value of 2: U[1:0] = 2 (binary value 10). If so, then m = 2 is set and U + mM = U + 2M (in block 250) is added to produce a number divisible by four. (Because the sum of any two even numbers that are not divisible by four is divisible by four.) The process then proceeds to shift block 290, which produces the output 295.

[0035] If the number U is odd, then in block 260, the process continues to determine U[1:0] = 1 (binary value 01) or U[1:0] = 3 (binary value 11). Since the modulus M is odd, the values ​​1 and 3 are also the two possible values ​​that the last two significant bits M[1:0] of the modulus M can have. Therefore, if the bit pairs of U and M have different values, U[1:0] ≠ M[1:0], then in block 270 the value m = 1 is chosen because the (binary) sum of 11(3) and 01(1) is 100, and the resulting number U+M is divisible by 4. If the two bit pairs have the same value, U[1:0] = M[1:0] (regardless of whether the value is 1 or 3), then in block 280 the value m = 3 is chosen. For example, if U[1:0] = M[1:0] = 1 (binary value 01), the last two significant bits of 3M are 11, and U[1:0] + M[1:0] = 4 (binary value 100). If U[1:0] = M[1:0] = 3 (binary value 11), then the last two significant bits of 3M are 01 (because 3 × 3 = 1 mod 4). This ensures that the sum of U + 3M is divisible by 4.

[0036] One possible implementation of example operation 200 using the conditional case environment is shown in Table 1 below; gcd represents the greatest common denominator, the second number in each class of the case environment represents the value U[1:0], and the operation is performed in the corresponding row:

[0037]

[0038]

[0039] Table 1: Modulo division with branch instructions

[0040] This embodiment involves using the "if...else..." branching operation in a case environment. Processing branching operations involves additional computation cycles and reduces overall computational efficiency. Figure 2B A modified example operation 202, which eliminates the modulo-4 division of the branch operation according to at least some embodiments, is shown. More specifically, an operation 212 is added, which computes the auxiliary number TRI_M = 3 × M. In some embodiments, operation 212 computes only the two least significant bits TRI_M[1:0] of the product 3 × M. Figure 2B There are decision blocks 220, 240 and 260, which can be implemented in a single-case environment, as described below.

[0041] Processing in response to even values ​​of U[1:0] Figure 2A Blocks 220-250 in the example can be performed similarly to the individual blocks in example operation 200, while the processing of odd values ​​of U[1:0] is performed ( Figure 2A Blocks 260-280 in the code can be modified. Specifically, if it is determined in block 265 that U[1:0] = 3, then the processing moves to block 285, which calculates the new value U: = U + M[1:0] × M. This operation produces the correct value U because the product M[1:0] × M equals M when M[1:0] = 1 and equals 3M when M[1:0] = 3. If it is determined in block 265 that U[1:0] = 1, then the processing moves to block 275, which calculates the new value U: = U + TRI_M[1:0] × M. Again, this operation produces the correct value U because the product TRI_M[1:0] × M[1:0] equals 3M when M[1:0] = 1 and equals M when M[1:0] = 3.

[0042] Using a conditional CASE environment, example operation 202 can be executed as shown in Table 2 below:

[0043]

[0044] Table 2: Modulo division without branch instructions

[0045] Figure 3A An example operation 300 of modular inversion is shown, illustrating an efficient implementation of modular inversion for cryptographic operations according to at least some embodiments. For example, modular inversion can be used as part of Montgomery multiplication. Modular inversion might involve calculating S = -M for an odd number M. -1 mod 2 n (or S = M) -1 mod 2 n ), where the modulus 2 n It is an integer power of 2. The output S of the modulo inverse is a number, which is multiplied by M and added to the unit to obtain the integer k modulo: S × M = k × 2 n -1. Use two-letter S. n / 2-1…S1S0 represents the unknown S as S=…+S3·4 3 +S2·4 2 The equation for S above, +4·S1+S0, can be rewritten as:

[0046] (…+S3·4 3 +S2·4 2 +4·S1+S0)×M=…3·4 3 +3·4 2 +3·4+3. The first pair of bits S0 of the modular inverse can be determined according to the following condition (when iteration i=0).

[0047] S0×M[1:0]=3,

[0048] Furthermore, since for any odd number M, the last two significant bits M[1:0] = 1 (01 in binary representation) or 3 (11 in binary representation), S0 is either 3 or 1. An auxiliary quantity (partial sum) can then be calculated as follows:

[0049] U1 = S0 × M >> 2,

[0050] That is, the product S0×M is shifted two bits to the right (discarding the two least significant bits). In other words, the auxiliary number U1 occupies the carry from multiplying the multiplier S0≡S[1:0] and the multiplicand M. The next two bits of the modular inverse, S1≡S[3:2], can then be found during the next iteration (i=1) according to the following conditions.

[0051] S1×M[1:0]+U1=3+carry1·4,

[0052] The auxiliary number can be updated as follows:

[0053] U2 = S1 × M + U1 >> 2,

[0054] This interprets the carry (carry1) as the next iteration (i=2). This process can continue for subsequent iterations, including the final iteration (i=n / 2). As a result, the bits of the multiplier S are determined by forcing all n least significant bits of the product S×M to be equal to 1. Specifically, to determine the value S... i First, update the auxiliary value.

[0055] U i =S i-1 ×M+U i-1 >>2,

[0056] Then determine S based on the following conditions. i ,

[0057] S i ×M[1:0]+U i=3 + carry i ·4,

[0058] Among them, carry i This is the carry value generated in the i-th iteration. Now we will combine... Figure 3A Each block is used to describe the auxiliary value U. i Determined value S i .

[0059] If, during the i-th iteration, the current value of the two least significant bits of U in the determined part of block 315 is U[1:0] = 1 (binary value 01), then regardless of whether M[1:0] = 1 or 3, the value S in (block 318) can be confirmed. i =2. In fact, in both cases 2×M[1:0]=2mod 4, as in condition S i ×M[1:0]+1=3mod 4 as required. If the current value of the two least significant bits of the sum determined in block 325 is U[1:0]=3 (binary value 11), then regardless of whether M[1:0]=1 or 3, the value S i =0 (block 330), as in condition S i ×M[1:0]+3=3 mod 4 is required.

[0060] For other values ​​of U[1:0], the value S i Depends on M[1:0]. For example, if it is determined in block 335 that U[1:0] = 0 and M[1:0] = 1 (YES branch of block 340), then the value S i =3 (345 blocks), because S i ×M[1:0]+U[1:0]=3×1+0=3. On the other hand, if M[1:0]≠1 (the NO branch of block 340), it means M[1:0]=3, then the value S i =1 (block 355), because S i ×M[1:0]+U[1:0]=1×3+0=3. Similarly, if we determine that U[1:0]≠0 (the NO branch of block 335), it means that U[1:0]=2 and M[1:0]=1 (the YES branch of block 350), then the value S i =1 (block 355), because S i ×M[1:0]+U[1:0]=1×1+2=3. On the other hand, if M[1:0]≠1 (the NO branch of block 350), it means M[1:0]=3, then the value S i =3 (345 blocks), because S i×M[1:0]+U[1:0]=3×3+2=3 mod 4. In block 390, the process continues to determine whether the final iteration has just been performed (i=n / 2-1). If additional iterations are to be performed (the NO branch of block 390), the process can continue to update the partial sum U (as shown in block 392), replace the two least significant bits of the updated partial sum and increment the iteration counter (as shown in block 394) and return control to block 315 for the next iteration.

[0061] Table 3 below shows one possible implementation of example operation 300 using the conditional case environment:

[0062]

[0063] Table 3: Modular Inverse Operation with Branch Instructions

[0064] Similar to Figure 2A An embodiment of operation 200, and this embodiment of operation 300, relates to the use of the branching operation "if...else..." in a case context. Figure 3B A modified example operation 302 of modulo inversion with elimination branching operations according to at least some embodiments is shown. Another advantage of example operation 302 is that operation 302 is largely parallel to example operation 202 of modulo division, as combined below. Figure 4 The described solution can be implemented using the same hardware circuitry. More specifically, a new number N can be introduced such that N = -M mod 2. n =2 n -M(as long as M∈[0,2) n -1], then the following equations are valid). Equation S×M=k×2 n -1 can now be restated using N as follows: S×N+2 n -1 = k × 2 n Or unfolded form

[0065] (…+S3·4 3 +S2·4 2 +4·S1+S0)×N+2 n -1 = ... 0.4 3 +0.4 2 +0·4+0.

[0066] During iteration i=0, the first pair of positions S0 of the modulo inverse is determined by the following condition.

[0067] S0×N[1:0]+U0=0+carry0·4,

[0068] Where U0 is 2 n -1, the partial sum is calculated as follows:

[0069] U1 = S0 × N + U0 >> 2.

[0070] In subsequent iterations, after partial and updates based on the following,

[0071] U i =S i-1 ×N+U i-1 >>2,

[0072] The modular inverse S can be calculated using the following conditions. i Additional bit pairs,

[0073] S i ×N[1:0]+U i =0+carry i 4.

[0074] From the last equation, we can see that when U i When [1:0] = 0, the value S is... i =0, when U i When [1:0] = 2, regardless of whether N[1:0] = 1 or 3, the value S i =2, because in both cases 2×N[1:0]+2=0 mod 4. When U i When [1:0] = 3, the value S is... i =N[1:0]. Finally, when U i When [1:0] = 1, if N[1:0] = 3, then the value S i =1, if N[1:0]=1, then S i =3. The last condition can be equivalently reused as a form that does not require "if...else..." conditional branches, for example, by defining the auxiliary number TRI_N = 3 × N. Therefore, S i =TRI_N[1:0].

[0075] Figure 3B This demonstrates the use of the auxiliary number TRI_N to eliminate Figure 3A Decision blocks 340 and 350. Operation 312 was added, which computes the auxiliary number N and TRI_N. Operations 318, 320, 330, and 340 can be similar to... Figure 3A The corresponding operation is executed. If U[1:0] = 1 is determined at block 365, then the process moves to generate the value S. i = TRI_N[1:0] at block 375. Conversely, if U[1:0] = 3 is determined at block 365, then processing moves to generate value S. i =Block 385 of N[1:0]. Figure 3B The remaining operations 390, 392, 394, and 395 can be combined with... Figure 3A Each operation is executed in a similar manner.

[0076] The implementation of algorithm 302 using the conditional case environment is shown in Table 4 below:

[0077]

[0078]

[0079] Table 4: Modulo inverse operation without branch instructions. In some embodiments, the number N = -M mod 2 is not introduced. n And the calculation is based on the identity, S×M+1=k×2 n We can directly use the modulus M and set the initial value U to one, as shown in Table 5 below:

[0080]

[0081] Table 5: Another implementation of modular inverse operation without branch instructions

[0082] Figure 3B Operations 312-385 of the example algorithm 302 for modular inversion described in the text can be mapped to... Figure 2B The example algorithm 202 for modular division described in the text corresponds to operations 212-285 (numbers with the same last two digits). See below for further details. Figure 4 As mentioned above, both example operation 202 and example operation 302 can be performed by a common circuit (or a set of circuits).

[0083] The above embodiment determines a 2-bit group S in each iteration. i The output of the modular inverse. As mentioned above, this type of implementation utilizes a portion of the iteratively calculated sum to U. i =S i-1 ×M+U i-1 >>2, then determine S i For example, according to condition S i ×M[1:0]+U i =0+carry i 4. In some embodiments, the output of the modular inverse can utilize a portion of U. i =S i-1 ×M+U i-1 >>r, where S is determined for each group of r bits in each iteration. i Group, and simultaneously determine the continuous r-bit group S i For example, according to condition S i ×M[r-1:0]+U i =0+carry i ·2 rIn such an embodiment, the number of iterations performed within the for loop can be n / r. More specifically, the calculation can be performed as shown in Table 6 below:

[0084]

[0085] Table 6: Modular inverse operation of r-bit iteration without branch instructions

[0086] As stated in the first line of the algorithm, a 2 derived from the number M can be defined. r-1 Auxiliary numbers (and stored at the start of the calculation). For the specific instance r=3, the calculation can be performed as shown in Table 7 below:

[0087]

[0088] Table 7: Modulo inversion of 3-bit iteration without branch instructions. The modulo inversion of 2-bit iteration (as shown in Tables 4 and 5) utilizes the fact that the square of any odd number M equals the modulus of 4. 2 =1 (mod 2) 2 Similarly, any odd number M raised to the fourth power equals the modulus of 8, M 4 =1 (mod 2) 3 Therefore, the following identity is true: (Z×M) 3 )×M mod 8=Z, for Z=1,3,5,7, has been used in the operations listed in rows 5, 7, 9 and 11 of Table 7.

[0089] Modular inverse operation with r-bit iterations is mapped to modular division U / 2 r On mod M, it can therefore be performed in a similar way (e.g., using the same accelerator circuit), similar to how the operations in Tables 2, 4 and 5 are performed when r = 2.

[0090] Figure 4 An example accelerator circuit 400, according to at least some embodiments, is shown capable of performing modulo division by four and modulo inversion. Figure 4 The example values ​​for storing and inputting various registers and circuits are designated as example values ​​for modular division (the corresponding example values ​​for modular inversion are indicated in parentheses). Registers 402, 404, and 406 can store inputs into the calculation and can include any suitable memory device, such as integer registers (e.g., wide integer progress registers), fixed-point registers, floating-point registers, etc. At the start of the calculation, register 402 can store the initial value of U, for example, U = 0 for modular division (or U = 2 for modular inversion). n -1). During the modulo inverse calculation, the contents of register 402 can be updated after each calculation cycle. Register 404 can store the modulus M of the modulo division (or the value of the modulo inverse N = -M mod 2). nRegister 406 can store the pre-calculated value TRI_M of the modulo division (or the value TRI_N of the modulo inverse). Combined with the above... Figure 2B and Figure 3B The case environment described for the operation can be implemented using a first multiplexer 410 and a second multiplexer 416. The two least significant bits U[1:0] of register 402 can be used as control signals to enter the first multiplexer 410.

[0091] The four input signals entering the multiplexer 410 may include:

[0092] 0, selected when U[1:0]=0;

[0093] TRI_M[1:0], TRI_N[1:0], selected when U[1:0] = 1;

[0094] 2. When U[1:0] = 2, choose; and

[0095] M[1:0], N[1:0], are selected when U[1:0] = 3.

[0096] Inputs M[1:0], (N[1:0]) can be obtained from the last two significant bits of register 404, while inputs 3M[1:0], (3N[1:0]) can be obtained from the last two significant bits of register 406. In some embodiments, inputs TRI_M[1:0], (TRI_N[1:0]) can be obtained from a separate special-purpose register 408 (which may be a two-bit register), indicated by the dashed block. Similarly, in some embodiments, inputs M[1:0], N[1:0] can be obtained from a separate (e.g., two-bit) register ( Figure 4 (Not shown in the image) was obtained.

[0097] The two-bit output S[1:0] of multiplexer 410 can be used as control signals for input to the second multiplexer 416. The four input signals to the second multiplexer 416 can be 0, M(N), 2M(2N), and 3M(3N). The input value 2M(2N) can be obtained from register 404 using unit shifter 405. In some embodiments, the input 2M(2N) can be obtained from a dedicated register (not shown) storing the value 2M(2N). The output of the second multiplexer 416 is a product S[1:0] × M, selecting each output signal when the first multiplexer 410 outputs the corresponding value S[1:0].

[0098] In the example of modulo division, the value U can be provided to the instruction execution unit as operand OP1 421, and the product S[1:0]×M can be provided as operand OP2 422. Then, the adder circuit 424 can add these two operands to generate the value U+S[1:0]×M. This value can be obtained by two shifters (…). Figure 4 (not shown in the figure) is processed and stored in output register 409 as the final output U / 4 mod M of the modulo division method.

[0099] In the example of modular inversion, an additional sub-circuit can be used to collect the output value S = -M. -1 mod 2 n The bits. Specifically, the previously calculated (and cascaded) bit pair S output by the first multiplexer 410. i-1 …S1 and S0 can be stored in temporary buffer 414. During the i-th iteration, cascaded logic 412 can cause shifter 415 to shift the previously calculated bit pair S… i-1 …Shift S1 and S0 two bits to the right, and set the new bit pair S… i Append to the left, then add the new value: S i ,S i-1 …S1,S0 are stored in temporary buffer 414. Furthermore, as shown by the dashed arrow, the value U+S[1:0]×N generated by the adder circuit 422 can be used to overwrite the previously stored value U in register 402, and then its first two bits are used as control signals input to the first multiplexer 410 during the next (i+1)th processing iteration. At the end of the calculation, after all iterations have been completed, the value S… n / 2-1 …S1 and S0 can be moved from temporary buffer 414 to output register 409.

[0100] The following code illustrates a possible example instruction for performing a modular division calculation using accelerator circuit 400 (with comments following the double forward slashes / / ):

[0101] MOV REG1 U; / / Value U is stored in register 402

[0102] MOV REG2 M; / / Value M is stored in register 404

[0103] MOV REG3 M; / / Value M is copied to register 406

[0104] TRI REG3; / / Increase the value M by three times in register 406. M → M

[0105] MDIV4 REG1 REG2 REG3; / / Execution case environment

[0106] SRL REG1#2; / / Divide by 4 by right-shifting the value U in register 402 by two bits.

[0107] Similarly, the following code illustrates a possible example instruction for performing modular inverse calculations using accelerator circuit 400:

[0108] MOV REG0#0; / / Zero value is stored in register 0 (which may be output register 409 or...) Figure 4 (Some other registers not shown in the image)

[0109] SUB REG1 REG0#1; / / Value U = 2 n -1 is calculated and stored in register 402.

[0110] MOV REG3 M; / / Value M is stored in register 406

[0111] SUB REG2 REG0 REG3; / / Calculate the value N and store it in register 404

[0112] MOV REG3 REG2; / / Value N is copied to register 406

[0113] TRI REG3; / / Increase the value N in register 406 by a factor of three, N → 3N

[0114] MOV REG4 n; / / Counter n is stored in register 409

[0115] SRL REG4#1; / / Shift right by one bit to obtain n / 2 in register 409

[0116] _FOR_LOOP_BEGIN:

[0117] MDIV4 REG1 REG2 REG3; / / Execution of the case environment

[0118] SRL REG1#2; / / Shift right by two bits to get... U>>2

[0119] SUB REG4 REG4#1; / / Decrement the counter value in register 409 by 1

[0120] BNE_FOR_LOOP_BEGIN; / / Loop ends

[0121] SMOV REG4; / / Transfer the calculated value -M -1 mod 2 n Move from temporary buffer 414 to output register 409

[0122] Figure 5 and Figure 6 These are flowcharts of example methods 500 and 600 for fast and efficient modular computation according to at least some embodiments. In some embodiments, methods 500 and 600 may be provided by... Figure 1 The accelerator circuit 130 is executed by a processing unit of the accelerator circuit 130, which may include one or more memory devices (e.g., registers) (or communicate with them). In some embodiments, methods 500 and 600 may be executed in response to instructions from CPU 112 (or GPU 116). In some embodiments, methods 500 and 600 may be executed by one or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In some embodiments, the processing threads implementing each of methods 500 and 600 may be synchronous (e.g., using semaphores, critical sections, and / or other thread synchronization mechanisms). Alternatively, the processing threads implementing each of methods 500 and 600 may execute asynchronously relative to each other. Figure 5 and Figure 6 Compared to the order shown, the various operations of methods 500 and 600 can be executed in a different order. Some operations of methods 500 and 600 can be executed concurrently with other operations. In some embodiments, Figure 5 and Figure 6 One or more of the operations shown may be optional.

[0123] For the sake of simplicity, the structure and operation of the example accelerator circuit 400 are shown using modular inversion -- M. -1 mod 2 n This can be illustrated using a two-bit iteration of modulo-4 division by 4: U / 4 mod M. However, it should be understood that accelerator circuits with a fundamentally similar architecture and performing similar operations can be used for modulo-inverse division by 4. -1 mod 2 n and modulus divide U / 2 r The r-bit iteration mod M. Specifically, in the instance where r = 3, multiplexers 410 and 416 can be 8-input multiplexers (more generally 2-input multiplexers). r Input multiplexers, some of which may be previously computed and stored auxiliary numbers, as shown in Tables 6 and 7 above.

[0124] Figure 5 This is a flowchart of an efficient and fast example method 500 for modulo-4 division according to at least some embodiments. Method 500 can be executed by a dedicated accelerator engine, such as... Figure 1Accelerator circuit 130. In some embodiments, method 500 may be executed by a cryptographic engine configured to perform public / private key cryptographic calculations, or by a general-purpose CPU (or GPU). The processing unit executing method 500 may include decoding unit 132, execution unit 134, memory access unit 136, and other units of accelerator circuit 130 (e.g., acquisition unit, scheduler unit, etc.). In some embodiments, method 500 may include, at block 510, receiving an instruction to perform a modulo operation, such as modulo division, U / 4 mod M. The instruction may be issued by a CPU, GPU, or any other processing device or a device communicating with the accelerator circuit. At block 520, method 500 may continue to store a first number in a memory device, for example, in one of registers 138. The first number may be the modulus M of the modulo division operation. At block 530, method 500 may include storing a second number in a memory device. The second number may be the dividend of the modulo division, such as U. Although in Figure 5 In this embodiment, the operations of storing the first and second digits (blocks 520 and 530) are described as being performed after receiving the instruction (block 510), but in some embodiments, the order may be different. For example, it may be performed at startup or in the application using method 500 (e.g., Figure 1 During the initialization of application 102), the first number M is stored. Similarly, the second number U may be stored before or concurrently with the instruction received in block 510. In some embodiments, additional numbers, such as 2M, TRI_M, M[1:0], TRI_M[1:0], etc., may also be stored as part of the operation in block 530. In block 540, the processing unit executing method 500 may select a conditional operation to be performed. The conditional operation may include holding the second number (e.g., U→U) or modifying the second number, for example, by a multiple of the first number (e.g., U→U+M, U→U+2M, etc.).

[0125] This choice can come from multiple conditional operations, each depending on a subset of the bits of the second number, such as the two least significant bits of the second number U[1:0], but it can also depend on other numbers. For example, as Figure 5As shown in the annotation, the first conditional operation (block 541) can also depend on a first number, such as M, and a third number, such as TRI_M. The conditional operation can be selected based on a subset of the positions of the first, second, and third numbers, for example, based on a subset of the positions containing the two least significant bits of these respective numbers. More specifically, the first conditional operation can include modifying the second number with the third number, for example, U→U+3M, and can be selected if one of the following conditions is met: (1) the subset of positions of the second number U[1:0] and the subset of positions of the first number M[1:0] have a first value, for example, the value 3: U[1:0]=3, M[1:0]=3; or (2) the subset of positions of the second number has a second value, for example, the value 1, and the subset of positions of the third number has a first value: U[1:0]=1, TRI_M[1:0]=3. For example, as Figure 4 As described, control signal U[1:0] = 3 causes the first multiplexer 410 to select control signal M[1:0] for the second multiplexer 416, and then the second multiplexer 416 selects the number 3M for operand OP2 422 (because M[1:0] = 3). Similarly, control signal U[1:0] = 1 causes the first multiplexer 410 to select control signal TRI_M[1:0] for the second multiplexer 416, and then the second multiplexer 416 selects the number 3M for operand OP2 422 (because TRI_M[1:0] = 3). As a result, in both cases, adder circuit 424 calculates the sum U+3M.

[0126] As described in block 542, the second conditional operation may include modifying the second number with the first number, for example, U→U+M, and may be selected if one of the following conditions is met: (1) a subset of the bits of the second number U[1:0] and a subset of the bits of the third number TRI_M[1:0] have a second value, for example, U[1:0]=1, TRI_M[1:0]=1; or (2) a subset of the bits of the second number has a first value, U[1:0]=3, and a subset of the bits of the first number has a second value, M[1:0]=1. For example, as described in Figure 4, the control signal U[1:0]=1 causes the first multiplexer 410 to select the control signal TRI_M[1:0] for the second multiplexer 416, and then the second multiplexer 416 selects the number M for operand OP2 422 (because TRI_M[1:0]=1). Similarly, the control signal U[1:0] = 3 causes the first multiplexer 410 to select the control signal M[1:0] for the second multiplexer 416, and then the second multiplexer 416 selects the digital M for operand OP2 422 (because M[1:0] = 1). As a result, in both cases, the adder circuit 424 calculates the sum U+M.

[0127] As described in block 543, the third conditional operation can include modifying the second number by twice the first number, e.g., U → U + 2M, and can be selected if a subset of the positions of the second number has a third value, e.g., U[1:0] = 2. For example, as Figure 4 As described, the control signal U[1:0] = 2 causes the first multiplexer 410 to select control signal 2 for the second multiplexer 416, and then the second multiplexer 416 selects the digital 2M for operand OP2 422.

[0128] As described in block 544, the fourth conditional operation may include holding the second number and selecting the fourth conditional operation if a subset of the positions of the second number has a fourth value, such as U[1:0] = 0. For example, as Figure 4 As described, the control signal U[1:0] = 0 causes the first multiplexer 410 to select control signal 0 for the second multiplexer 416, and then the second multiplexer 416 selects zero for operand OP2422.

[0129] In block 550, method 500 can continue processing the unit to perform selected conditional operations to maintain or update the second number. For example, as Figure 4 As described, the second number stored as operand OP1 421 can be added to operand OP2 422, as selected above in conjunction with blocks 541-544. In some embodiments, holding the second number may include adding the second number stored as operand OP1 421 to a value of zero, and storing it as operand OP2 422.

[0130] In block 560, method 500 may continue processing the unit to generate the output of the modulo operation using the updated second number. For example, as described in optional block 570, generating the output of the modulo operation (e.g., dividing the second number by four pairs of the first number modulo) may include shifting the second number two bits to the right, U → U / 4.

[0131] Figure 6 This is a flowchart of an example method 600 for efficient and fast modular inversion operations according to at least some embodiments. Method 600 may be performed by a dedicated accelerator engine or an engine capable of executing... Figure 5 Method 500 may be performed by any other circuitry and / or device. Methods 600 and 500 may have multiple similar operations. Method 600 may include, in block 610, receiving instructions to perform a modulo operation, which may be the inverse of taking the modulus of a number that is a power of 2 (e.g., positive or negative inverse), for example, modulo inversion, S = -M. -1 mod 2 nThis instruction can be issued by the CPU (or GPU) of the processor communicating with the accelerator circuitry. In block 620, method 600 can continue by storing the first number in a memory device, for example, in one of registers 138. The first number can be an auxiliary number N = -M mod 2. n Or the modulus M. In block 630, method 600 can continue to store a second number, such as a partial sum U, in the storage device. The initial value of the partial sum can be U = 2. n -1 (if the auxiliary number used is N) or U = 1 (if the auxiliary number used is the modulus M itself). In some embodiments, additional numbers, such as 2N (2M), TRI_N (TRI_M), N[1:0] (M[1:0]), TRI_N[1:0] (TRI_M[1:0]), etc., may also be stored as part of the operation of block 630. In block 640, the processing unit executing method 600 may select the conditional operation to be performed. The execution of block 640 and the type of conditional operation used in the execution of block 640 may be the same as or similar to the execution of block 540 of method 500 (and the corresponding conditional operation), except that in method 600, the number M may (in some embodiments) be replaced by the number N.

[0132] In block 650, method 500 can continue processing the unit to perform selected conditional operations to maintain or update the second number. Similarly, block 650 can be executed similarly to block 550 of method 500. In block 660, in order to calculate the output of the modulo operation, the processing unit executing method 600 can repeat multiple iterations of blocks 640-650, each iteration identifying additional bits (e.g., two bits) of the output of the modulo operation, as combined above. Figure 3B More detailed description.

[0133] The above description is intended as an illustration of methods 500 and 600. Many variations and embodiments of methods 500 and 600 are also within the scope of this disclosure. In some embodiments, the inputs TRI_M[1:0] and M[1:0] (or inputs TRI_N[1:0] and N[1:0]) entering the first multiplexer 410 are swapped. To achieve the same output as methods 500 and 600, the inputs M and 3M (or N and 3N) entering the second multiplexer 416 can also be swapped.

[0134] It should be understood that Figure 4The accelerator circuits described herein do not exhaust all possible embodiments of the disclosed technology. For example, any accelerator circuit, coprocessor, CPU, GPU, FPGA, ASIC, FSM, or any similar device may be able to perform the disclosed technology, provided that the corresponding device is able to select one of a plurality of conditional operations, each of which is selected based on a subset of the bits of a second number, such as U[1:0], and includes (1) holding the second number, for example by not subjecting the second number to any operation or by performing one or more no-operations (e.g., no-addition), U→U+0, or (2) modifying the second number with a multiple of the first number, such as U→U+M(N), U→U+2M(N), etc. One of the plurality of conditional operations may include adding the number equal to the product of the bits of the first number and the third number to the second number, where the third number is three times the first number, such as U→U+TRI_M[1:0]·M (or U→U+TRI_N[1:0]·N). Another conditional operation in a plurality of conditional operations may include adding a number equal to the product of a subset of positions of the first and third numbers to a second number, for example, U→U+M[1:0]·M (or U→U+N[1:0]·N). Various embodiments that implement such conditional operations and thus avoid the use of “if…else…” conditional instructions are within the scope of this disclosure.

[0135] Figure 7 A block diagram depicts an example computer system 700 operating according to some embodiments of the present disclosure. In various illustrative examples, the example computer system 700 may be... Figure 1 The computer device 100 shown or including Figure 1 The computer device 100 is shown. The example computer system 700 can be connected to other computer systems in a LAN, intranet, extranet, and / or the Internet. The computer system 700 can operate as a server in a client-server network environment. The computer system 700 can be a personal computer (PC), a set-top box (STB), a server, a network router, a switch, or a bridge, or any device capable of executing a set of instructions (sequential or otherwise) specifying actions to be taken by that device. Furthermore, while only a single example computer system is illustrated, the term "computer" should also be understood to include any collection of computers that, individually or jointly, execute a set (or more) of instructions to perform any or more of the methods discussed herein.

[0136] Example computer system 700 may include processing device 702 (also called processor or CPU), main memory 704 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) (e.g., synchronous DRAM (SDRAM) etc.), static memory 706 (e.g., flash memory, static random access memory (SRAM) etc.) and auxiliary memory (e.g., data storage device 718), which can communicate with each other via bus 730.

[0137] Processing device 702 represents one or more general-purpose processing devices, such as microprocessors, central processing units, etc. More specifically, processing device 702 may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, a processor implementing other instruction sets, or a processor implementing combinations of instruction sets. Processing device 702 may also be one or more special-purpose processing devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), network processors, etc. According to one or more aspects of this disclosure, processing device 702 may be configured to execute instructions implementing efficient and fast modulo-4 division method 500 and efficient and fast modulo-inversion method 600.

[0138] The example computer system 700 may further include a network interface device 708 that can be communicatively coupled to a network 720. The example computer system 700 may further include a video display 710 (e.g., a liquid crystal display (LCD), a touch screen, or a cathode ray tube (CRT)), an alphanumeric input device 712 (e.g., a keyboard), a cursor control device 714 (e.g., a mouse), and a sound signal generation device 716 (e.g., a speaker).

[0139] Data storage device 718 may include a computer-readable storage medium (or more specifically, a non-transitory computer-readable storage medium) 728 thereon storing one or more sets of executable instructions 722. According to one or more aspects of this disclosure, the executable instructions 722 may include executable instructions for implementing an efficient and fast method 500 for modulo division by four and an efficient and fast method 600 for modulo inversion.

[0140] The executable instructions 722 may also reside wholly or at least partially within main memory 704 and / or processing device 702 during execution by the example computer system 700, which also constitute a computer-readable storage medium. The executable instructions 722 may also be transmitted or received over a network via network interface device 708.

[0141] Although the computer-readable storage medium 728 is Figure 7While the term "computer-readable storage medium" is used interchangeably with "single medium," it should be understood to include operations on a single medium or multiple media (e.g., centralized or distributed databases, and / or associated caches and servers) that store one or more sets of instructions. The term "computer-readable storage medium" should also be considered to include any medium capable of storing or encoding a set of machine-executable instructions that cause the machine to perform any or more of the methods described herein. The term "computer-readable storage medium" should be understood to include, but is not limited to, solid-state memory and optical and magnetic media. For example, "memory" includes random access memory (RAM), such as static RAM (SRAM) or dynamic RAM (DRAM); ROM; magnetic or optical storage media; flash memory devices; energy storage devices; optical storage devices; acoustic storage devices; and any type of tangible machine-readable medium suitable for storing or transmitting electronic instructions or information in a machine-readable form (such as a computer).

[0142] Other variations are within the spirit of this disclosure. Therefore, although the disclosed technology is readily adaptable to various modifications and alternative constructions, certain embodiments thereof are illustrated in the accompanying drawings and have been described in detail above. However, it should be understood that the disclosure is not intended to be limited to one or more specific forms disclosed, but rather, it is intended to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of this disclosure as defined in the appended claims.

[0143] In the context of describing the disclosed embodiments (particularly in the context of the following claims), the terms “a” and “an”, “the”, and similar designations should be interpreted as encompassing both singular and plural forms, unless otherwise stated herein or obviously contradicted by the context, and not as a definition of a term. Unless otherwise stated, the terms “comprising,” “having,” “including,” and “containing” should be interpreted as open-ended terms (meaning “including, but not limited to”). The term “connection” (referring to a physical connection where not modified) should be interpreted as partially or wholly contained, attached to, or joined together, even with some intervention. Unless otherwise indicated herein, references to numerical ranges herein are intended only as a way of abbreviating each individual value falling within that range, and each individual value is incorporated into the specification as if it were separately described herein. In at least one embodiment, unless otherwise indicated or contradicted by the context, the use of the terms “set” (e.g., “item set”) or “subset” should be interpreted as a non-empty set comprising one or more members. Furthermore, unless otherwise indicated or contradicted by the context, the term “subset” of the corresponding set does not necessarily mean an appropriate subset of the corresponding set, but rather that the subset and the corresponding set can be equal.

[0144] Unless otherwise explicitly stated or clearly contradicted by the context, connective phrases such as “at least one of A, B, and C” or “at least one of A, B, and C” are understood in the context to generally refer to items, terms, etc., which can be A or B or C, or any non-empty subset of the set A, B, and C. For example, in an illustrative example of a set with three members, the connective phrases “at least one of A, B, and C” and “at least one of A, B, and C” refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Therefore, such connective language is generally not intended to imply that some embodiments require the presence of at least one of A, at least one of B, and at least one of C. Additionally, unless otherwise stated or contradicted by the context, the term “multiple” indicates a plural state (e.g., “multiple items” means multiple items). In at least one embodiment, the number of items in the multiple items is at least two, but may be more if explicitly indicated or indicated by the context. Furthermore, unless otherwise stated or clearly understood from the context, the phrase “based on” means “at least partially based on” rather than “based on only”.

[0145] Unless otherwise stated herein or clearly contradicted by the context, the operations of the processes described herein may be performed in any suitable order. In at least one embodiment, processes such as those described herein (or variations thereof and / or combinations thereof) are executed under the control of one or more computer systems configured with executable instructions and are implemented as code (e.g., executable instructions, one or more computer programs, or one or more application programs) that are executed jointly on one or more processors via hardware or a combination thereof. In at least one embodiment, the code is stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. In at least one embodiment, the computer-readable storage medium is a non-transitory computer-readable storage medium that excludes transient signals (e.g., propagating transient electrical or electromagnetic transmissions) but includes non-transitory data storage circuitry (e.g., buffers, caches, and queues). In at least one embodiment, code (e.g., executable code or source code) is stored on one or more non-transitory computer-readable storage media (or other memory for storing executable instructions) on which executable instructions are stored, which, when executed by one or more processors of a computer system (i.e., as a result of execution), cause the computer system to perform the operations described herein. In at least one embodiment, the set of non-transitory computer-readable storage media comprises multiple non-transitory computer-readable storage media, and one or more of the individual non-transitory storage media lack all the code, but the multiple non-transitory computer-readable storage media collectively store all the code. In at least one embodiment, the executable instructions are executed such that different instructions are executed by different processors; for example, the non-transitory computer-readable storage media store the instructions, and the main central processing unit (“CPU”) executes some instructions while the graphics processing unit (“GPU”) executes other instructions. In at least one embodiment, different components of the computer system have separate processors, and the different processors execute different subsets of the instructions.

[0146] Therefore, in at least one embodiment, the computer system is configured to implement one or more services that perform the operations of the processes described herein, either individually or collectively, and such a computer system is configured with suitable hardware and / or software to enable the implementation of the operations. Furthermore, the computer system implementing at least one embodiment of this disclosure is a single device, and in another embodiment it is a distributed computer system comprising multiple devices operating in different ways, such that the distributed computer system performs the operations described herein, and that a single device does not perform all the operations.

[0147] The use of any and all examples or exemplary language (e.g., “such as”) provided herein is intended only to better illustrate embodiments of this disclosure and does not constitute a limitation on the scope of the disclosure unless otherwise required. No language in the specification should be construed as indicating that any unclaimed element is essential to the practice of the disclosure.

[0148] All references cited in this article, including publications, patent applications and patents, are incorporated herein by reference as if each reference were individually and specifically indicated to be incorporated herein by reference and the entire contents of which are described herein.

[0149] The terms “coupled” and “connected”, and their derivatives, may be used in the specification and claims. It should be understood that these terms may not be intended to be synonyms with each other. Rather, in certain examples, “connected” or “coupled” may be used to indicate that two or more elements are in direct or indirect physical or electrical contact with each other. “Coupled” may also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0150] Unless otherwise expressly stated, it will be understood that throughout this specification, terms such as “processing,” “operation,” “calculation,” “determine,” etc., refer to the actions and / or processes of a computer or computing system or similar electronic computing device that process and / or convert data represented as physical quantities (e.g., electrons) in the registers and / or memory of the computing system into other data represented as physical quantities in the memory, registers, or other such information storage, transmission, or display devices of the computing system.

[0151] Similarly, the term "processor" can refer to any device or part of memory that processes electronic data from registers and / or memory and converts that electronic data into other electronic data that can be stored in registers and / or memory. As a non-limiting example, a "processor" can be a CPU or a GPU. A "computing platform" can include one or more processors. As used herein, a "software" process can include, for example, software and / or hardware entities that perform work over time, such as tasks, threads, and intelligent agents. Likewise, each process can refer to multiple processes that execute instructions sequentially or intermittently, or in parallel. In at least one embodiment, the terms "system" and "method" are used interchangeably herein, provided that a system can embody one or more methods, and a method can be considered a system.

[0152] In this document, reference may be made to obtaining, acquiring, receiving, or inputting analog or digital data into a subsystem, computer system, or computer-implemented machine. In at least one embodiment, the process of obtaining, acquiring, receiving, or inputting analog and digital data can be accomplished in various ways, such as by receiving data as a parameter to a function call or a call to an application programming interface (API). In some implementations, the process of obtaining, acquiring, receiving, or inputting analog or digital data can be accomplished by transmitting data via a serial or parallel interface. In another implementation, the process of obtaining, acquiring, receiving, or inputting analog or digital data can be accomplished by transmitting data from a providing entity to an acquiring entity via a computer network. Reference may also be made to providing, outputting, transmitting, sending, or presenting analog or digital data. In various examples, the process of providing, outputting, transmitting, sending, or presenting analog or digital data can be implemented by transmitting data as an input or output parameter to a function call, an API, or an inter-process communication mechanism.

[0153] While the discussion above illustrates example implementations of the described technologies, other architectures can be used to implement the described functionality and are intended to fall within the scope of this disclosure. Furthermore, although specific assignments of responsibilities have been defined above for discussion purposes, various functions and responsibilities can be assigned and divided in different ways depending on the circumstances.

[0154] Furthermore, although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter claimed in the appended claims is not necessarily limited to the specific features or actions described. Rather, specific features and actions are disclosed as exemplary forms for implementing the claims.

Claims

1. A processor, comprising: Memory devices; as well as One or more circuits, communicatively coupled to the memory device, are used for: The first number is stored in the memory device, wherein the first number represents the input of the modulo operation; The second number is stored in the memory device; A CO is selected from a plurality of conditional operations CO, wherein each of the plurality of COs updates or retains the second number, wherein the selection of the first CO from the plurality of COs depends on: The subset of positions of the second digit and the subset of positions of the first digit having the first value, or The subset of positions of the second digit having a second value and the subset of positions of the third digit having a first value, wherein the third digit is three times the first digit; Execute the selected CO to maintain or update the second number; and The updated second number is used to generate the output of the modular calculation operation.

2. The processor of claim 1, wherein the selection of the second CO among the plurality of COs depends on: The subset of positions of the second digit and the subset of positions of the third digit having the second value, or The subset of positions of the second digit having the first value and the subset of positions of the first digit having the second value.

3. The processor of claim 2, wherein the one or more circuits comprise: An adder circuit for updating a second number by adding a first operand and a second operand, wherein the first operand includes the second number; as well as One or more multiplexers are used to select the second operand, wherein the second operand includes the third number for the first CO and the first number for the second CO.

4. The processor of claim 2, wherein the third CO of the plurality of COs is selected based on the subset of positions of the second number having a third value, and includes updating the second number by adding twice the first number to the second number, and wherein the fourth CO of the plurality of COs is selected based on the subset of positions of the second number having a fourth value, and includes maintaining the second number.

5. The processor of claim 1, wherein the modulo operation is the second number divided by four modulo operations on the first number, and wherein, in order to produce the output of the modulo operation, the one or more circuits shift the second number two bits to the right.

6. The processor of claim 1, wherein the modulo operation is the inverse of taking the modulo of the first number pair as an integer power of 2.

7. The processor of claim 6, wherein, in order to compute the output of the modular arithmetic operation, the one or more circuits are configured to select the CO and execute the selected CO for each of a plurality of iterations, wherein during each of the plurality of iterations, the one or more circuits are configured to identify a plurality of bits of the output of the modular arithmetic operation.

8. The processor of claim 1, wherein the subset of bits of each of the first number, the second number, and the third number comprises the two least significant bits of the respective number, wherein the first value is three, and wherein the second value is one.

9. A method for obtaining the output of a modular arithmetic operation, the method comprising: The processing device stores the first number in the memory device, wherein the first number represents the input to the modulo operation; The processing device stores the second number in the memory device; The processing device selects a CO from a plurality of conditional operations CO, each of which is selected based on a subset of the positions of the second digit, and includes: Keep the second number, or Modify the second number by a multiple of the first number. The first CO of the plurality of COs includes adding the second number to the product of a subset of positions equal to i) the first number and ii) the third number, wherein the third number is three times the first number; The processing device performs the selected CO to maintain or update the second number; and The processing device generates the output of the modular calculation operation using the updated second number.

10. The method of claim 9, wherein the modulo operation comprises dividing the second number by four modulo the first number, and wherein generating the output of the modulo operation comprises shifting the second number two bits to the right.

11. The method of claim 9, wherein the modulo operation is the inverse of taking the first number modulo a number that is an integer power of 2.

12. The method of claim 11, wherein calculating the output of the modulo operation includes multiple iterations using the selection and the execution, each iteration identifying multiple bits of the output of the modulo operation.

13. The method of claim 9, wherein the first CO depends on the subset of positions of the second number having a value of 1.

14. The method of claim 9, wherein the second CO of the plurality of COs depends on the subset of positions having the value 2, and comprises: Add the number, which is twice the first number, to the second number.

15. The method of claim 14, wherein the third CO of the plurality of COs depends on the subset of positions having the value 3 of the second number, and comprises: Add a number to the second number, and the number is equal to i) the product of the first number and ii) the set of positions of the first number; as well as Wherein, the fourth CO among the plurality of COs depends on the subset of positions of the second digit having a value of 0, and includes: Keep the second number.

16. The method of claim 9, wherein the subset of bits of the second number comprises the two least significant bits of the second number, and the subset of bits of the third number comprises the two least significant bits of the third number.

17. An accelerator circuit, comprising: A first register is used to store a first number, wherein the first number represents the input of the modulo operation; The second register is used to store the second number; A third register is used to store a third number, wherein the third number is three times the first number; Decoding unit, used for: The instruction to perform the modular arithmetic operation is received, wherein the instruction identifies a first operand stored in the first register, a second operand stored in the second register, and a third operand stored in the third register; as well as A CO is selected from a plurality of conditional operations COs, wherein each of the plurality of COs updates or preserves the second operand, wherein the selection of the first CO from the plurality of COs depends on: The bit subset of the second operand and the bit subset of the first operand having the first value, or The set of bits of the second operand having the second value and the set of bits of the third operand having the first value; as well as Execution unit, used for: Execute the selected CO to maintain or update the second operand; and The updated second operand is used to generate the output of the modular computation operation.

18. The accelerator circuit of claim 17, wherein the selection of the second CO among the plurality of COs depends on: The bit subset of the second operand and the bit subset of the third operand having the second value, or The set of bits of the second operand having a first value and the set of bits of the first operand having a second value.

19. The accelerator circuit of claim 18, wherein the execution unit comprises: An adder circuit for updating the second operand by adding the first operand and the second operand; as well as The decoding unit includes: One or more multiplexers are used to select the third operand for the first CO and the first operand for the second CO.

20. The accelerator circuit of claim 18, wherein the third CO of the plurality of COs is selected according to the subset of bits of the second operand having a third value, and includes: The second operand is updated by adding twice the first operand to the second operand, wherein the fourth CO of the plurality of COs is selected based on the subset of positions of the second digit having a fourth value, and the second operand is maintained.

Images