Modulus addition modulus subtraction acceleration device based on carry-save adder and encryption device

Abstract

The application relates to a modulus addition and modulus subtraction acceleration device based on a carry-save adder and an encryption device, wherein the modulus addition and modulus subtraction acceleration device comprises a modulus addition acceleration module and a modulus subtraction acceleration module; the modulus addition acceleration module carries out modulus addition on input addends and addends through three-stage cascaded data compression circuits to output a modulus addition result with a modulus P, wherein a four-input CSA unit is used for modulus addition compression processing in the first-stage data compression circuit, and three-input CSA units are used for modulus addition compression processing in the second-stage and third-stage data compression circuits; the modulus subtraction acceleration module carries out bitwise inversion on a minuend, and then carries out modulus addition on the inverted minuend and the subtrahend through four-stage cascaded data compression circuits to output a modulus subtraction result with the modulus P, wherein a four-input CSA unit is used for modulus addition compression processing in the first-stage data compression circuit, and three-input CSA units are used for modulus addition compression processing in the second-stage, third-stage and fourth-stage data compression circuits. The application realizes modulus addition and modulus subtraction operation acceleration, and improves circuit frequency.

Description

Technical Field

[0001] This invention belongs to the fields of information security technology and electronic technology, and specifically relates to a modulo addition and modulo subtraction acceleration device and encryption device based on a carry-retaining adder. Background Technology

[0002] In encryption devices, especially during elliptic curve cryptography operations, numerous modular addition and subtraction operations are used. However, traditional adders with carry chains for modular addition suffer from low synchronization circuit frequencies due to their multi-stage adder chains, reducing algorithm efficiency. To improve algorithm efficiency, it is necessary to increase the circuit frequency. Summary of the Invention

[0003] Based on the above analysis, the present invention aims to disclose a modulo addition and modulo subtraction acceleration device and encryption device based on a carry-retaining adder, to solve the problem of solving traditional adders with carry chains.

[0004] This invention discloses a modulo addition and modulo subtraction acceleration device based on a carry-retaining adder, which accelerates the modulo addition and modulo subtraction of encrypted data in the data processing of encryption devices, including: a modulo addition acceleration module and a modulo subtraction acceleration module;

[0005] The modulo acceleration module, through a three-stage cascaded data compression circuit, adds the input addends X(Sx,Cx) and Y(Sy,Cy) modulo a value P, and outputs the modulo addition result (S). + z,C + z), wherein the first-stage data compression circuit uses a four-input CSA unit for analog-to-analog compression processing, and the second and third-stage data compression circuits use a three-input CSA unit for analog-to-analog compression processing;

[0006] The modulus-to-subtraction acceleration module: after bitwise inversion of the subtrahend Y(Sy,Cy), obtain ~Y(~Sy,~Cy); then, through a four-stage cascaded data compression circuit, the input minuend X(Sx,Cx) and ~Y(~Sy,~Cy) are added modulo P, and the modulo-subtraction result (S-z,C-z) is output. The first-stage data compression circuit uses a four-input CSA unit for modulo-addition compression processing, while the second, third, and fourth-stage data compression circuits use a three-input CSA unit for modulo-addition compression processing.

[0007] Furthermore, the three-input CSA unit is a three-input N-bit adder with carry retention, used to add the output result of the previous stage and three N-bit numbers composed of a constant preset according to the modulus value P, and output the carry part and the sum part.

[0008] Specifically, it includes:

[0009] Three sets of N-bit addend input terminals, each set corresponding to one N-bit addend; used to connect three N-bit addends P1, P2 and P3 respectively;

[0010] A set of N-bit sum output terminals is used to output the sum S of three N-bit addends. 0～N-1 ;

[0011] A set of N+1 bit carry-out outputs; used to output the carry-out C after adding three N-bit addends. 0～N Wherein, C0 is set to 0 through the reset circuit; C0 = 0;

[0012] N CSA32 modules are used for parallel data addition; each CSA32 module is a three-input one-bit adder with carry retention, including three adder inputs, one sum output, and one carry output.

[0013] Among them, the three adder input terminals X of CSA32 module i i Y i and Z i Introduce the i-th bit P1 of each of the three N-bit addends into the input. i P2 i and P3 i ; One and output terminal output A carry-out terminal outputs C i+1 =P1 i P2 i ∨P2 i P3 i ∨P2 i P3 i ; i = 0, ..., N-1, ∨ represents the OR operation.

[0014] Furthermore, the four-input CSA unit is a four-input N-bit adder with carry retention, used to add four N-bit inputs and output the carry part and the sum part;

[0015] Specifically, it includes:

[0016] The system has four sets of N-bit addend input terminals, each corresponding to an N-bit addend; these are used to connect four N-bit addends P1, P2, P3, and P4 respectively.

[0017] A set of N+1 bit sum output terminals is used to output the sum S of the four N-bit addends. 0～N ;

[0018] A set of N+1 bit carry-out outputs; used to output the carry-out C after adding four N-bit addends. 0～N Wherein, C0 is set to 0 through the reset circuit; C0 = 0;

[0019] N CSA42 modules are used for parallel data addition; each CSA42 module is a four-input one-bit adder with carry-holding, including four adder inputs, one Cin data input, one sum output, one carry output, one Cout data output, a flag output, and two CSA32 modules; each CSA32 module is a three-input one-bit adder with carry-holding.

[0020] In CSA42 module i,

[0021] The three adder inputs of the first CSA32 module are respectively input to the i-th bit P1 of the first three N-bit adders of the four adders. i P2 i and P3 i The carry output of the first CSA32 module is output as Cout data from the Cout data output terminal of CSA42 module i; the sum output of the first CSA32 module is input as an addend to the second CSA32 module.

[0022] The three adder inputs of the second CSA32 module are respectively input to the sum output of the first CSA32 module and the i-th bit P4 of the fourth N-bit adder. i The sum of the Cout data input from the Cin data input terminal and the output of the CSA42 module i-1; the sum of the output of the second CSA32 module as the sum of the output S of the i-th CSA42 module. i The carry output from the output terminal of CSA42 module i is used as the carry output C of the i-th CSA42 module. i+1 Output from the carry output terminal of CSA42 module i;

[0023] In this case, the Cin data input terminal in CSA42 module 0 is set to 0 by a reset circuit; the Cout data output from CSA42 module N-1 is used as the highest bit S of the output and number part of the four-input CSA unit. N Output i = 0, ..., N-1;

[0024] The flag output terminal is used to output the flag bit F; the flag bit F is the sum of the highest bit data of the sum part and the carry part output by the four-input CSA unit; F = S N +C N .

[0025] Furthermore, the module acceleration module includes:

[0026] A modulus addition constant preset circuit is used to generate a first modulus addition constant PS and a second modulus addition constant P2S based on the modulus value P.

[0027] The first-stage compression circuit for analog-to-digital addition is used to input four addends Sx, Cx, Sy, and Cy into the four-input CSA unit for analog-to-digital data compression operations, and output the first-stage compressed analog-to-digital data (S). + 1,C + 1); and based on the first-level module compression data S + 1. C + The highest-order bit data in step 1 is used to calculate the flag F of the four-input CSA unit. + ;

[0028] The second-stage compression circuit is added to the mold, used to adjust the compression according to F. + The value of F is used for data compression calculation; when F + When the value is not zero, the highest-order bit of the first-level modulo-compressed data (S) will be removed. + 1,C + 1) Each of the three addends is formed with either the first modulus addend PS or the second modulus addend P2S. A three-input CSA unit is used for data compression operations, outputting two-stage modulus-compressed data (S). + 2,C + 2); When F + When it is zero, the first-level module is compressed (S) + 1,C + 1) Directly assign values ​​to the second-level module and compress the data (S) + 2,C + 2);

[0029] The third-stage compression circuit is added to the mold, used according to C + The value of 2 is used for data compression operations; when C + When the highest bit of 2 is 1, the second-level modulus is compressed (S). + 2,C + 2) Together with the first modulus addition constant PS, three addends are formed. A three-input CSA unit is used for data compression calculation, and the output is three-level modulus-compressed data (S). + 3,C + 3); When C + When the highest bit of 2 is zero, the second-level modulus is compressed (S). + 2,C + 2) Directly assign values ​​to the three-level module and compress the data (S) + 3,C + 3);

[0030] The analog-to-digital output circuit is used to extract the third-stage analog-to-digital compressed data (S) after removing the most significant bit. + 3,C + 3) Output the modulus-based output data (S) + z,C + z).

[0031] Furthermore, in the preset circuit for the modulus constant, the formulas for calculating the first modulus constant PS and the second modulus constant P2S are as follows:

[0032] The first modulus constant PS = (2 N -P);

[0033] The second modulus constant is P2S = (2*PS) mod P.

[0034] Furthermore, in the second-stage compression circuit of the mold,

[0035] When F + When == 2,

[0036] Execute operation {S + 2,C + 2}=CSA32(S + 1[N-1:0],C + 1[N-1:0],P2S) Output secondary model-compressed data S + 2. C + 2;

[0037] When F + When == 1,

[0038] Execute operation {S + 2,C + 2}=CSA32(S + 1[N-1:0],C + 1[N-1:0],PS) Output secondary model-compressed data S + 2. C + 2;

[0039] When F + When == 0,

[0040] Execute operation {S + 2,C + 2}={S + 1,C + 1} Output secondary-level modulated compressed data S + 2. C + 2;

[0041] In the third stage compression circuit of the mold addition

[0042] When C + When 2[N]==1,

[0043] Execute operation {S + 3,C + 3}=CSA32(S + 2[N-1:0],C +2[N-1:0],PS) Output three-level modulated compressed data S + 3. C + 3;

[0044] When C + When 2[N]==0,

[0045] Execute operation {S + 3,C + 3}={S + 2,C + 2} Output three-level modulated compressed data S + 3. C + 3;

[0046] The CSA32() operation is a carry-preserving addition operation performed by the three-input CSA unit.

[0047] Furthermore, the modular subtraction operation module includes:

[0048] The modulus reduction constant preset circuit is used to generate the first modulus reduction constant T1, the second modulus reduction constant T2, and the third modulus reduction constant T3 based on the modulus value P, the first modulus addition constant PS, and the second modulus addition constant P2S.

[0049] The inverting circuit is used to invert the subtrahend Y(Sy,Cy) bit by bit to obtain ~Y(~Sy,~Cy);

[0050] The first-stage compression circuit for analog-to-digital conversion is used to input Sx, Cx, ~Sy, ~Cy into the four-input CSA unit for analog-to-digital data compression calculation, and output the first-stage analog-to-digital compressed data (S). — 1,C — 1); and based on the first-level modulus reduction compression data S — 1. C — The highest-order bit data in step 1 is used to calculate the flag F of the four-input CSA unit. — ;

[0051] The second-stage compression circuit is used to reduce the size of the module according to the flag F. — Data compression operations are performed based on the value of F; — The value will be the first-level modulus reduction compression data after removing the highest bit (S). — 1,C — 1) Combined with the first modulus reduction constant T1, the second modulus reduction constant T2, or the third modulus reduction constant T3 to form three addends, and perform data compression operations using a three-input CSA unit to output two-level modulus-reduced compressed data (S). — 2,C — 2);

[0052] The third-stage compression circuit is used to reduce the compression ratio according to C. —The value of 2 is used for data compression operations; when C — When the highest bit is 1, the secondary module is reduced and compressed (S) — 2,C — 2) Together with the first modulus addition constant PS, three addends are formed. A three-input CSA unit is used for data compression calculation, and the output is three-level modulus-compressed data (S). — 3,C — 3); When C - When the highest bit of 2 is zero, the second-level modulus is compressed (S). — 2,C — 2) Directly assign values ​​to the three-level module and compress the data (S) — 3,C — 3);

[0053] The fourth-stage compression circuit is used to reduce the compression ratio according to C. — The value of 3 is used for data compression operations; when C — When the highest bit is 1, the three-level modulus compression data (S) is reduced. — 3,C — 3) Together with the first modulus addition constant PS, three addends are formed. A three-input CSA unit is used for data compression operations, and the output is four-level modulus-subtractive compressed data (S). — 4,C — 4); When C — When the highest bit of 3 is zero, the three-level modulus-reduced compressed data (S) will be used. — 3,C — 3) Directly assign values ​​to the fourth-level module compressed data (S) — 4,C — 4);

[0054] The analog-to-digital output circuit is used to convert the four-level analog-to-digital compressed data (S) after removing the most significant bit. — 4,C — 4) Output the modulo-subtractive output data (S) — z,C — z).

[0055] Furthermore, in the modulus reduction constant preset circuit, the calculation formulas for the first modulus reduction constant T1, the second modulus reduction constant T2, and the third modulus reduction constant T3 are as follows:

[0056] The first modulus reduction constant T1 = (2*((P*2-2)) N )+1)+P2S)mod P;

[0057] The second modulus reduction constant T2 = (2*((P*2-2)) N )+1)+PS)mod P;

[0058] The third modulus reduction constant T3 = (2*((P*2-2))N )+1))mod P.

[0059] Furthermore, in the second-stage compression circuit of the module reduction,

[0060] When F — When == 2,

[0061] Execute operation {S - 2,C - 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T1) Output secondary modulus reduction and compression data S — 2. C — 2;

[0062] When F — When == 1,

[0063] Execute operation {S - 2,C - 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T2) Output secondary modulus reduction compression data S — 2. C — 2;

[0064] When F — When == 0,

[0065] Execute operation {S - 2,C - 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T3) Output secondary modulus reduction compression data S — 2. C — 2;

[0066] In the third stage of compression circuit for module reduction

[0067] When C — When 2[N]==1,

[0068] Execute operation {S - 3,C - 3}=CSA32(S - 2[N-1:0],C - 2[N-1:0],PS) Output three-level modulus reduction compression data S — 3. C — 3;

[0069] When C — When 2[N]==0,

[0070] Execute operation {S - 3,C - 3}={S - 2,C - 2} Output three-stage modulus reduction compression data S — 3. C — 3;

[0071] In the fourth stage of the compression circuit of the mold addition

[0072] When C — When 3[N]==1,

[0073] Execute operation {S - 4,C - 4}=CSA32(S - 3[N-1:0],C - 3[N-1:0],PS) Output four-level modulus-reduction compressed data S — 4. C — 4;

[0074] When C — When 3[N]==0,

[0075] Execute operation {S - 4,C - 4}={S - 3,C - 3} Output four-level modulus reduction compression data S — 4. C — 4.

[0076] The present invention also discloses an encryption device, which includes the modulo addition and modulo subtraction acceleration device based on the carry-retaining adder as described above, thereby accelerating the processing of modulo addition and modulo subtraction in cryptographic data processing.

[0077] This invention can achieve at least one of the following beneficial effects:

[0078] This invention discloses a modulo addition / subtraction acceleration device and encryption equipment based on a carry-preserving adder, which is highly efficient in the implementation of cryptographic operations (such as elliptic curve cryptography). Traditional addition for modulo addition and subtraction uses multi-level addition chains, which leads to very low synchronization circuit frequencies. With this invention, all intermediate results are represented using (S, C) data pairs, making intermediate data storage more convenient. Addition chains no longer appear in any synchronization circuits, significantly increasing the circuit frequency and accelerating modulo addition and subtraction operations. This is one of the key technologies for large-scale, high-speed elliptic curve hardware implementation. Attached Figure Description

[0079] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0080] Figure 1 This is a schematic block diagram of the mold addition and reduction acceleration device in an embodiment of the present invention;

[0081] Figure 2 This is a block diagram of the three-input CSA unit in an embodiment of the present invention;

[0082] Figure 3 This is a block diagram of the four-input CSA unit in an embodiment of the present invention;

[0083] Figure 4 This is a schematic diagram showing the connection of the module acceleration module in an embodiment of the present invention.

[0084] Figure 5 This is a schematic diagram showing the connection of the deceleration and acceleration module in an embodiment of the present invention. Detailed Implementation

[0085] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and, together with the embodiments of the present invention, serve to illustrate the principles of the present invention.

[0086] One embodiment of the present invention discloses a modulo addition and modulo subtraction acceleration device based on a carry-retaining adder, which accelerates the modulo addition and modulo subtraction of encrypted data in the cryptographic data processing of an encryption device, such as... Figure 1 As shown, it includes: a module acceleration module and a module deceleration module;

[0087] The modulo acceleration module, through a three-stage cascaded data compression circuit, adds the input addends X(Sx,Cx) and Y(Sy,Cy) modulo a value P, and outputs the modulo addition result (S). + z,C + z); Implemented the modular addition algorithm (S + z,C + z) = ((Sx,Cx) + (Sy,Cy)) mod P;

[0088] The first-stage data compression circuit uses a four-input CSA unit for analog-to-analog compression processing, while the second and third-stage data compression circuits use a three-input CSA unit for analog-to-analog compression processing.

[0089] The modulo-subtraction acceleration module: Inverts the subtrahend Y(Sy,Cy) bit-by-bit to obtain ~Y(~Sy,~Cy); then, through a four-stage cascaded data compression circuit, adds the input minuend X(Sx,Cx) and ~Y(~Sy,~Cy) modulo P, outputting the modulo-subtraction result (S-z,C-z), thus realizing the modulo-subtraction algorithm (S...). - z,C - z) = ((Sx,Cx)-(Sy,Cy))modP;

[0090] The first-stage data compression circuit uses a four-input CSA unit for analog-to-analog compression, while the second, third, and fourth-stage data compression circuits use a three-input CSA unit for analog-to-analog compression.

[0091] Specifically, such as Figure 2 As shown, the three-input CSA unit is a three-input N-bit adder with carry retention, used to add the output result of the previous stage and three N-bit numbers composed of a constant preset according to the modulus value P, and output the carry part and the sum part.

[0092] Specifically, it includes:

[0093] The system has three sets of N-bit addend input terminals, each corresponding to an N-bit addend; these are used to connect three N-bit addends P1, P2, and P3 respectively; for example, P1 and P2 are the sum and carry parts output from the previous stage, and P3 is a preset modulo addition or subtraction constant based on the modulo value P.

[0094] A set of N-bit sum output terminals is used to output the sum S of three N-bit addends. 0～N-1 ;

[0095] A set of N+1 bit carry-out outputs; used to output the carry-out C after adding three N-bit addends. 0～N Wherein, C0 is set to 0 through the reset circuit; C0 = 0;

[0096] N CSA32 modules are used for parallel data addition; each CSA32 module is a three-input one-bit adder with carry retention, including three adder inputs, one sum output, and one carry output.

[0097] Among them, the three adder input terminals X of CSA32 module i i Y i and Z i Introduce the i-th bit P1 of each of the three N-bit addends into the input. i P2 i and P3 i ; One output terminal outputs S i =P1 i ⊕P2i ⊕P3 i A carry-out terminal outputs C. i+1 =P1 i P2 i ∨P2 i P3 i ∨P2 i P3 i ; i = 0, ..., N-1, ∨ represents the OR operation.

[0098] In this embodiment, the function representation of carry-preserving addition in the three-input CSA unit is {S,C}=CAS32(a,b,c); a, b, and c are the three addends, S is the sum part, and C is the carry part.

[0099] like Figure 3 As shown, the four-input CSA unit is a four-input N-bit adder with carry retention, used to add four N-bit inputs and output the carry part and the sum part;

[0100] Specifically, it includes:

[0101] The system has four sets of N-bit addend input terminals, each corresponding to an N-bit addend; these are used to connect four N-bit addends P1, P2, P3, and P4 respectively.

[0102] A set of N+1 bit sum output terminals is used to output the sum S of the four N-bit addends. 0～N ;

[0103] A set of N+1 bit carry-out outputs; used to output the carry-out C after adding four N-bit addends. 0～N Wherein, C0 is set to 0 through the reset circuit; C0 = 0;

[0104] N CSA42 modules are used for parallel data addition; each CSA42 module is a four-input one-bit adder with carry-holding, including four adder inputs, one Cin data input, one sum output, one carry output, one Cout data output, a flag output, and two CSA32 modules; each CSA32 module is a three-input one-bit adder with carry-holding.

[0105] In CSA42 module i,

[0106] The three adder inputs of the first CSA32 module are respectively input to the i-th bit P1 of the first three N-bit adders of the four adders. i P2 i and P3 iThe carry output of the first CSA32 module is output as Cout data from the Cout data output terminal of CSA42 module i; the sum output of the first CSA32 module is input as an addend to the second CSA32 module.

[0107] The three adder inputs of the second CSA32 module are respectively input to the sum output of the first CSA32 module and the i-th bit P4 of the fourth N-bit adder. i The sum of the Cout data input from the Cin data input terminal and the output of the CSA42 module i-1; the sum of the output of the second CSA32 module as the sum of the output S of the i-th CSA42 module. i The carry output from the output terminal of CSA42 module i is used as the carry output C of the i-th CSA42 module. i+1 Output from the carry-out terminal of CSA42 module i;

[0108] In this case, the Cin data input terminal in CSA42 module 0 is set to 0 by a reset circuit; the Cout data output from CSA42 module N-1 is used as the highest bit S of the output and number part of the four-input CSA unit. N Output i = 0, ..., N-1;

[0109] The flag output terminal is used to output flag F; flag F is the sum of the highest bit data of the sum part and carry part output by the four-input CSA unit; F = S N +C N .

[0110] In this embodiment, the function representation of carry-preserving addition in the four-input CSA unit is {S,C}=CAS42(a,b,c,d); a, b, c, and d are the four addends; S is the sum part, and C is the carry part.

[0111] Specifically, such as Figure 4 As shown, the module acceleration module includes:

[0112] A modulus addition constant preset circuit is used to generate a first modulus addition constant PS and a second modulus addition constant P2S based on the modulus value P.

[0113] Specifically, the modulus P and the number of bits for Sx, Cx, Sy, and Cy are all N; the calculation formulas for the first modulus constant PS and the second modulus constant P2S in the modulus constant preset circuit are as follows:

[0114] The first modulus constant PS = (2 N -P);

[0115] The second modulus constant is P2S = (2*PS) mod P.

[0116] The first-stage compression circuit for analog-to-digital conversion is used to input four addends Sx, Cx, Sy, and Cy into the four-input CSA unit for analog-to-digital data compression operations, and output the first-stage compressed analog-to-digital data S. + 1. C + 1; and based on the first-level compression data S + 1. C + The highest bit data in step 1 is used to calculate the flag F of the four-input CSA unit. + ;

[0117] Specifically, in the first stage of the compression circuit,

[0118] Execute operation {S + 1,C + 1} = CSA42(Sx,Cx,Sy,Cy) outputs first-level modulus compressed data S + 1. C + 1;

[0119] The flag F of the four-input CSA unit + =S + 1[N]+C + 1[N];

[0120] The four addends have N bits, and the output sum part S + 1 and carry part C + The number of digits in each 1 is N+1.

[0121] The second-stage compression circuit is added to the mold, used to adjust the compression according to F. + The value of F is used for data compression calculation; when F + When the value is not zero, the highest-order bit of the first-level modulus compressed data S will be removed. + 1. C + 1. Each of these three numbers is combined with either the first modulus addition constant PS or the second modulus addition constant P2S to form three addends. A three-input CSA unit is used for data compression operations, and the output is two-level modulus-compressed data S. + 2. C + 2; when F + When the value is zero, compress the first-level module data S. + 1. C + 1. Directly assign the value to the secondary module and compress the data S + 2. C + 2;

[0122] In the second-stage compression circuit of the mold addition...

[0123] When F + When == 2,

[0124] Execute operation {S + 2,C +2}=CSA32(S + 1[N-1:0],C + 1[N-1:0],P2S) Output secondary model-compressed data S + 2. C + 2;

[0125] When F + When == 1,

[0126] Execute operation {S + 2,C + 2}=CSA32(S + 1[N-1:0],C + 1[N-1:0],PS) Output secondary model-compressed data S + 2. C + 2;

[0127] When F + When == 0,

[0128] Execute operation {S + 2,C + 2}={S + 1,C + 1} Output secondary-level modulated compressed data S + 2. C + 2.

[0129] The third-stage compression circuit is added to the mold, used according to C + The value of 2 is used for data compression operations; when C + When the highest bit of 2 is 1, compress the secondary module data S. + 2. C + The first modulus addition constant PS forms three addends, which are then used in a three-input CSA unit for data compression operations, outputting three-level modulus-compressed data S. + 3. C + 3; When C + When the highest bit of 2 is zero, compress the secondary modulus data S. + 2. C + 2. Directly assign the value to the three-level module and compress the data S + 3. C + 2;

[0130] In the third stage compression circuit of the mold addition

[0131] When C + When 2[N]==1,

[0132] Execute operation {S + 3,C + 3}=CSA32(S + 2[N-1:0],C+ 2[N-1:0],PS) Output three-level modulated compressed data S + 3. C + 3;

[0133] When C + When 2[N]==0,

[0134] Execute operation {S + 3,C + 3}={S + 2,C + 2} Output three-level modulated compressed data S + 3. C + 3;

[0135] The analog-to-digital output circuit is used to extract the third-stage analog-to-digital compressed data S after removing the most significant bit. + 3. C + 3. Output data S (modulus input) + z、C + z.

[0136] In the analog-to-digital output circuit,

[0137] Execute operation {S + z,C + z}={S + 3[N-1:0],C + 3[N-1:0]} Output modulus plus output data S + z、C + z.

[0138] Specifically, as shown in Figure 5, the modular subtraction operation module includes:

[0139] The modulus reduction constant preset circuit is used to generate the first modulus reduction constant T1, the second modulus reduction constant T2, and the third modulus reduction constant T3 based on the modulus value P, the first modulus addition constant PS, and the second modulus addition constant P2S.

[0140] Specifically, the modulus P and the number of bits in Sx, Cx, Sy, and Cy are all N; the calculation formulas for the first modulus reduction constant T1, the second modulus reduction constant T2, and the third modulus reduction constant T3 in the modulus reduction constant preset circuit are as follows:

[0141] The first modulus reduction constant T1 = (2*((P*2-2)) N )+1)+P2S)mod P;

[0142] The second modulus reduction constant T2 = (2*((P*2-2)) N )+1)+PS)mod P;

[0143] The third modulus reduction constant T3 = (2*((P*2-2))N )+1))mod P.

[0144] The inverting circuit is used to invert the subtrahend Y(Sy,Cy) bit by bit to obtain ~Y(~Sy,~Cy).

[0145] The first-stage compression circuit for analog-to-digital conversion is used to input Sx, Cx, ~Sy, ~Cy into the four-input CSA unit for analog-to-digital data compression calculation, and output the first-stage analog-to-digital compression data S. — 1. C — 1; and based on the first-level modulus reduction compression data S — 1. C — The highest bit data in step 1 is used to calculate the flag F of the four-input CSA unit. — ;

[0146] Specifically, in the first stage of the compression circuit,

[0147] Execute operation {S - 1,C - 1} = CSA42(Sx,Cx,~Sy,~Cy) outputs first-level modulus reduction compression data S — 1. C — 1;

[0148] The flag F of the four-input CSA unit - =S - 1[N]+C - 1[N];

[0149] The four addends have N bits, and the output sum part S — 1 and carry part C — The number of digits in each 1 is N+1.

[0150] The second-stage compression circuit is used to reduce the compression ratio according to F. — Data compression operations are performed based on the value of flag F; — The value will remove the highest-order first-level modulus reduction compression data S. — 1. C — 1 is combined with the first modulus reduction constant T1, the second modulus reduction constant T2, or the third modulus reduction constant T3 to form three addends. A three-input CSA unit is used for data compression operation, and the output is two-stage modulus reduction compressed data S. — 2. C — 2;

[0151] In the second stage of compression circuit for module reduction

[0152] When F — When == 2,

[0153] Execute operation {S - 2,C- 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T1) Output secondary modulus reduction and compression data S — 2. C — 2;

[0154] When F — When == 1,

[0155] Execute operation {S - 2,C - 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T2) Output secondary modulus reduction compression data S — 2. C — 2;

[0156] When F — When == 0,

[0157] Execute operation {S - 2,C - 2}=CSA32(S - 1[N-1:0],C - 1[N-1:0],T3) Output secondary modulus reduction compression data S — 2. C — 2.

[0158] The third-stage compression circuit is used to reduce the compression ratio according to C. — The value of 2 is used for data compression operations; when C — When the highest bit is 1, the secondary module is reduced and compressed into data S. — 2. C — The first modulus addition constant PS forms three addends, which are then used in a three-input CSA unit for data compression operations, outputting three-level modulus-compressed data S. — 3. C — 3; When C — When the highest bit of 2 is zero, compress the secondary modulus data S. — 2. C — 2. Directly assign the value to the three-level module and compress the data S — 3. C — 3;

[0159] In the second stage of compression circuit for module reduction

[0160] When C — When 2[N]==1,

[0161] Execute operation {S - 3,C - 3}=CSA32(S- 2[N-1:0],C - 2[N-1:0],PS) Output three-level modulus reduction compression data S — 3. C — 3;

[0162] When C — When 2[N]==0,

[0163] Execute operation {S - 3,C - 3}={S - 2,C - 2} Output three-stage modulus reduction compression data S — 3. C — 3.

[0164] The fourth-stage compression circuit is used to reduce the compression ratio according to C. — The value of 3 is used for data compression operations; when C — When the highest bit is 1, the three-level modulus compression data S is reduced. — 3. C — The three addends, consisting of 3 and the first modulus constant PS, are used for data compression operations via a three-input CSA unit, outputting four-level modulus-subtractive compressed data S. — 4. C — 4; When C — When the highest bit of 3 is zero, the three-level modulus compression data S is reduced. — 3. C — 3. Directly assign the value to the fourth-level module and compress the data S — 4. C — 4;

[0165] In the fourth stage of the compression circuit of the mold addition

[0166] When C — When 3[N]==1,

[0167] Execute operation {S - 4,C - 4}=CSA32(S - 3[N-1:0],C - 3[N-1:0],PS) Output four-level modulus-reduction compressed data S — 4. C — 4;

[0168] When C — When 3[N]==0,

[0169] Execute operation {S - 4,C - 4}={S - 3,C - 3} Output four-level modulus reduction compression data S— 4. C — 4.

[0170] The analog-to-digital output circuit is used to convert the four-level analog-to-digital compressed data S (with the most significant bit removed) into its output. — 4. C — 4. Output to obtain modulo-subtraction output data S — z、C — z.

[0171] In the analog-to-digital output circuit, the operation {S} is performed. - z,C - z}={S - 4[N-1:0],C - 4[N-1:0]} Output modulo subtraction output data S — z、C — z.

[0172] In summary, the carry-preserving adder-based modular addition and subtraction acceleration device disclosed in this invention is highly efficient in the implementation of cryptographic operations (such as elliptic curve cryptography). Traditional addition for modular addition and subtraction uses multi-stage adder chains. Adders with carry chains solve for the modular addition of two N-digit numbers, requiring at least two additions. The longest path involves 2N stages of full adders, resulting in a lower overall circuit frequency. Using this invention, the paths for modular addition and subtraction are compressed to a maximum of 5 stages of CSA32 circuitry. Adder chains no longer appear in any synchronization circuits, significantly increasing the circuit frequency and accelerating modular addition and subtraction operations. This is one of the key technologies for large-scale high-speed elliptic curve hardware implementation. Furthermore, all intermediate results use (S, C) data pairs, making intermediate data storage more convenient.

[0173] Another embodiment of the present invention discloses an encryption device, which includes a modulo addition and modulo subtraction acceleration device based on a carry-retaining adder as disclosed in the previous embodiment, thereby accelerating the processing of modulo addition and modulo subtraction in cryptographic data processing.

[0174] The modular addition and subtraction acceleration device of this embodiment compresses the modular addition and subtraction paths to a maximum of 5 CSA32 circuits, thereby greatly improving the algorithm's running frequency.

[0175] For more specific technical details and effects in this embodiment, please refer to the previous embodiment, which will not be repeated here.

[0176] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A modulo addition and subtraction acceleration device based on a carry-retaining adder, used in the data processing of an encryption device to accelerate the modulo addition and subtraction of encrypted data, characterized in that, include: Modular acceleration module and modular deceleration acceleration module; The modulus acceleration module, through a three-stage cascaded data compression circuit, processes the input addend. Addends Perform numerical To add the modulo terms, output the modulo addition result. S + z,C + z The first-stage data compression circuit uses a four-input CSA unit for analog-to-analog compression, while the second and third-stage data compression circuits use a three-input CSA unit for analog-to-analog compression. The subtraction acceleration module; for subtraction... After performing bitwise inversion, we get Then, through a four-stage cascaded data compression circuit, the input minuend is processed. and Perform numerical To add the modulo values, output the modulo subtraction result. S — z,C — z The first-stage data compression circuit uses a four-input CSA unit for analog-to-analog compression, while the second, third, and fourth-stage data compression circuits use a three-input CSA unit for analog-to-analog compression. The module acceleration module includes: Modulus addition constant preset circuit, used to preset the modulus value. Generate the first modulus addition constant. Second modulus addition constant ; The first-stage compression circuit is used to combine the four addends. , , , The data is input into a four-input CSA unit for analog-to-digital data compression, and outputs first-level analog-to-digital compressed data. S + 1, C + 1); and based on the primary module compression data S + 1. C + The highest bit data in step 1 is used to calculate the flag F of the four-input CSA unit. + ; The second-stage compression circuit is added to the mold, used to adjust the compression according to F. + The value of F is used for data compression calculation; when F + When the value is not zero, the highest-order bit of the first-level modulo-compressed data will be removed. S + 1, C + 1) Add constants to the first modulus respectively Or the second modulus plus constant The data is compressed using a three-input CSA unit, forming three addends, and outputting two-level modulo-compressed data. S + 2, C + 2) When F + When it is zero, the first-level module is compressed ( S + 1, C + 1) Directly assign values ​​to the secondary module and compress the data ( S + 2, C + 2); The third-stage compression circuit is used to adjust the compression ratio according to the compression ratio. C + The value of 2 is used for data compression operations; when C + When the highest bit of 2 is 1, compress the secondary modulus data ( S + 2, C + 2) and the first modulus plus constant The data is compressed using a three-input CSA unit, forming three addends, and outputting three-level modulo-compressed data. S + 3, C + 3); When C + When the highest bit of 2 is zero, compress the second-level modulus data ( S + 2, C + 2) Directly assign values ​​to the three-level module and compress the data ( S + 3, C + 3); The modulus output circuit is used to extract the third-stage modulus compressed data after removing the most significant bit. S + 3, C + 3) Output the modulus-based output data (S) + z,C + z).

2. The die-addition and die-reduction acceleration device according to claim 1, characterized in that, The three-input CSA unit is a three-input N-bit adder with carry-holding, used to add the output of the previous stage and the value based on the modulus. Add three N-digit numbers composed of preset constants, and output the carry and the sum. Specifically, it includes: Three sets of N-bit addend input terminals, each set corresponding to one N-bit addend; used to connect three N-bit addends P1, P2 and P3 respectively; A set of N-bit sum output terminals is used to output the sum S of three N-bit addends. 0~N-1 ; A set of N+1 bit carry-out outputs; used to output the carry-out C after adding three N-bit addends. 0~N C0 is set to 0 via a reset circuit; C0 = 0. N CSA32 modules are used for parallel data addition; each CSA32 module is a three-input one-bit adder with carry retention, including three adder inputs, one sum output, and one carry output. Among them, the three adder input terminals X of CSA32 module i i Y i and Z i Introduce the i-th bit P1 of each of the three N-bit addends into the input. i P2 i and P3 i ; One and output terminal output A carry-out terminal outputs... i=0,…,N-1 Representation or operation.

3. The die-addition / de-addition acceleration device according to claim 2, characterized in that, The four-input CSA unit is a four-input N-bit adder with carry retention, used to add four N-bit inputs and output the carry part and the sum part. Specifically, it includes: The system has four sets of N-bit addend input terminals, each corresponding to an N-bit addend; these are used to connect four N-bit addends P1, P2, P3, and P4 respectively. A set of N+1 bit sum output terminals is used to output the sum S of the four N-bit addends. 0~N ; A set of N+1 bit carry-out outputs; used to output the carry-out C after adding four N-bit addends. 0~N C0 is set to 0 via a reset circuit; C0 = 0. N CSA42 modules are used for parallel data addition; each CSA42 module is a four-input one-bit adder with carry-holding, including four adder inputs, one Cin data input, one sum output, one carry output, one Cout data output, a flag output, and two CSA32 modules; each CSA32 module is a three-input one-bit adder with carry-holding. In CSA42 module i, The three adder inputs of the first CSA32 module are respectively input to the i-th bit P1 of the first three N-bit adders of the four adders. i P2 i and P3 i The carry output of the first CSA32 module is output as Cout data from the Cout data output terminal of CSA42 module i; the sum output of the first CSA32 module is input as an addend to the second CSA32 module. The three adder inputs of the second CSA32 module are respectively input to the sum output of the first CSA32 module and the i-th bit P4 of the fourth N-bit adder. i The sum of the Cout data input from the Cin data input terminal and the output of the CSA42 module i-1; the sum of the output of the second CSA32 module as the sum of the output S of the i-th CSA42 module. i The carry output from the output terminal of CSA42 module i is used as the carry output C of the i-th CSA42 module. i+1 Output from the carry-out terminal of CSA42 module i; In this case, the Cin data input terminal in CSA42 module 0 is set to 0 by a reset circuit; the Cout data output from CSA42 module N-1 is used as the highest bit S of the output and number part of the four-input CSA unit. N Output i = 0, ..., N-1; The flag output terminal is used to output the flag bit F; the flag bit F is the sum of the highest bit data of the sum part and the carry part output by the four-input CSA unit; F=S N +C N .

4. The die-addition / de-addition acceleration device according to claim 1, characterized in that, The first modulus in the modulus constant preset circuit and the second modulus constant The formula for calculation is: First modulus constant ; The second modulus constant .

5. The die-addition and die-reduction acceleration device according to claim 4, characterized in that, In the second-stage compression circuit of the mold addition... When F + When == 2, Perform operation Output two-stage compression data S + 2. C + 2; When F + When == 1, Perform operations Output two-stage compression data S + 2. C + 2; When F + When == 0, Perform operations Output two-stage compression data S + 2. C + 2; In the third stage compression circuit of the mold addition When C + When 2[N] == 1, Perform operations Output three-level modulus compressed data S + 3. C + 3; When C + When 2[N] == 0, Perform operation Output three-level modulus compressed data S + 3. C + 3; The The operation is a carry-retaining addition operation performed by the three-input CSA unit.

6. The die-addition / decrease acceleration device according to claim 4 or 5, characterized in that, The acceleration / deceleration module includes: Modulus subtraction constant preset circuit, used to preset the modulus value. P First modulus plus constant Second modulus addition constant Generate the first modulus reduction constant. Second modulus reduction constant and the third modulus reduction constant ; Inverting circuit, used for subtraction After performing bitwise inversion, we get ; The first-stage compression circuit is used to reduce the... , , ~ , ~ The data is input into a four-input CSA unit for modulo-addition data compression, and outputs first-level modulo-subtraction compressed data. S — 1, C — 1); and based on the first-level modulus reduction compression data S — 1. C — The highest bit data in step 1 is used to calculate the flag F of the four-input CSA unit. — ; The second-stage compression circuit is used to reduce the size of the module according to the flag F. — Data compression operations are performed based on the value of F; — The value will be the first-level modulus reduction compressed data after removing the highest bit. S — 1, C — 1) Reducing constants of the first modulus respectively Second modulus reduction constant Or the third modulus reduction constant The data is composed of three addends, and a three-input CSA unit is used for data compression calculation to output two-level modulo-subtractive compressed data. S — 2, C — 2); The third-stage compression circuit is used to reduce the compression ratio according to... C — The value of 2 is used for data compression operations; when C — When the highest bit is 1, the secondary module is reduced and compressed ( S — 2, C — 2) and the first modulus plus constant The data is compressed using a three-input CSA unit, forming three addends, and outputting three-level modulo-compressed data. S — 3, C — 3); When C - When the highest bit of 2 is zero, compress the second-level modulus data ( S — 2, C — 2) Directly assign values ​​to the three-level module and compress the data ( S — 3, C — 3); The fourth-stage compression circuit is used to reduce the compression ratio according to... C — The value of 3 is used for data compression operations; when C — When the highest bit is 1, the three-level modulus is reduced and compressed ( S — 3, C — 3) and the first modulus plus constant The data is compressed using a three-input CSA unit, consisting of three addends, and outputs four-level modulo-subtractive compressed data. S — 4, C — 4); When C — When the highest bit of 3 is zero, the three-level modulus reduction and compression data will be performed. S — 3, C — 3) Directly assign values ​​to the fourth-level module and compress the data ( S — 4, C — 4); The analog-to-digital output circuit is used to extract the four-level analog-to-digital compressed data after removing the most significant bit. S — 4, C — 4) Output the modulo-subtracted output data (S) — z,C — z).

7. The die-addition / de-addition acceleration device according to claim 6, characterized in that, In the module reduction constant preset circuit, the first module reduction constant The second modulus reduction constant and the third modulus reduction constant The formula for calculation is: First modulus reduction constant ; The second modulus reduction constant ; The third modulus reduction constant .

8. The die-addition / de-addition acceleration device according to claim 6, characterized in that, In the second stage of compression circuit for module reduction When F — When == 2, Perform operation Output two-stage modulus compression data S — 2. C — 2; When F — When == 1, Perform operation Output two-stage modulus compression data S — 2. C — 2; When F — When == 0, Perform operation Output two-stage modulus compression data S — 2. C — 2; In the third stage of compression circuit for module reduction When C — When 2[N] == 1, Perform operation Output three-level modulus compression data S — 3. C — 3; When C — When 2[N] == 0, Perform operations Output three-level modulus compression data S — 3. C — 3; In the fourth stage of the compression circuit of the mold addition When C — When 3[N] == 1, Perform operations Output four-level modulus compression data S — 4. C — 4; When C — When 3[N] == 0, Perform operations Output four-level modulus compression data S — 4. C — 4.

9. An encryption device, characterized in that, The encryption device includes a modulo addition and modulo subtraction acceleration device based on a carry-retaining adder as described in any one of claims 1-8, which accelerates modulo addition and modulo subtraction in cryptographic data processing.

Images