Dot product operation device, digital signature device, and system on chip

Abstract

Embodiments of the present application provide a point multiplication operation device, a digital signature device and a system on chip. The point multiplication operation device comprises: a shifter, which shifts a pair of current window positions in a random bit sequence with a window width of a first preset bit number; a double point operation device, which performs double point operation based on previous point multiplication results corresponding to a pair of previous window positions to obtain a current double point result; a point multiplication operation device, which performs point multiplication operation on a binary base point based on a first random number and a second random number to obtain a current point multiplication increment; and a point addition operation device, which obtains the current double point result from the double point operation device, performs point addition operation based on the current double point result and the current point multiplication increment to obtain a current point multiplication result. If the pair of current window positions reaches an ending window position of the random bit sequence, the point addition operation device outputs a point multiplication result of the random bit sequence. The scheme of the embodiments of the present application guarantees the security of the point multiplication operation and improves the efficiency of the point multiplication operation.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of encryption technology, and in particular to a dot multiplication device, a digital signature device, and a system-on-a-chip. Background Technology

[0002] Elliptic curve cryptography algorithms such as SM2 encryption / decryption, ECC signature, and CC encryption / decryption have advantages such as high security and fast processing speed. They can be used for encryption / decryption of data such as message packets or digital signature generation to reduce the risk of information leakage or tampering.

[0003] The most basic processing flow in elliptic curve cryptography is to calculate the dot product (scalar product) between the key and a point on the elliptic curve. After obtaining the dot product, subsequent signature generation operations are performed on the message message and other data based on the dot product result.

[0004] Existing digital signature schemes are vulnerable to side-channel attacks when calculating dot product results, resulting in poor security and slow processing time, leading to low digital signature efficiency. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a dot product operation device, a digital signature device, and a system-on-a-chip to at least partially solve the above-mentioned problems.

[0006] According to a first aspect of the present invention, a dot product operation apparatus is provided, comprising: a shifter, which shifts a random bit sequence to a pair of current window positions by a window width of a first preset number of bits, wherein a first current window position and a second current window position are spaced apart by a second preset number of bits; a doubling dot product operator, which performs a doubling dot product operation based on a previous dot product result corresponding to a pair of previous window positions to obtain a current doubling dot product result; a dot product operator, which obtains a first random number corresponding to the first current window position and a second random number corresponding to the second current window position from the shifter, and performs a dot product operation based on the first random number and the second random number with a binary base point to obtain a current dot product increment; and a dot addition operator, which obtains the current doubling dot product result from the doubling dot product operator, and performs a dot addition operation based on the current doubling dot product result and the current dot product increment to obtain a current dot product result corresponding to the pair of current window positions. If the pair of current window positions reaches the end window position of the random bit sequence, the dot addition operator outputs the current dot product result as the dot product result of the random bit sequence.

[0007] In another implementation of the invention, the dot product operation device further includes a register. The register stores the previous dot product result, and if the pair of current window positions has not reached the end window position of the random bit sequence, the register updates the previous dot product result based on the current dot product result.

[0008] In another implementation of the invention, if the pair of current window positions is the starting window position of the random bit sequence, then the register stores a zero value as the previous dot product result.

[0009] In another implementation of the invention, the dot product operator calculates k. d-1 As the first random number corresponding to the first current window position, and calculate k e-1 , which serves as the second random number corresponding to the second current window position. The number of window positions d = [t / w], where t represents the length of the random bit sequence, w represents the first preset number of bits, and the second preset number of bits e = [d / 2].

[0010] In another implementation of the invention, the dot product operator calculates (k i+e +1)G+(k) i +1)G, as the current dot product increment. 0≤i≤e-1, G represents the binary base point.

[0011] In another implementation of the present invention, the shifter acquires an initial random number k, and the shift compensation k-K0 is used as the random bit sequence, where K0 is 2. d The binary representation of -1.

[0012] According to a second aspect of the present invention, a digital signature apparatus is provided, comprising: a dot product operation device for acquiring a random bit sequence and outputting a dot product result of the random bit sequence; and a signature operation device for calculating a signature value of the dot product result.

[0013] In another implementation of the present invention, the signature calculation device includes: a signature value calculator for calculating a first signature value of the dot product result; and a clock signal generator for generating a first clock signal and a second clock signal; wherein the signature value calculator calculates a first verification value of the second signature value in response to the first clock signal, calculates a second verification value of the second signature value in response to the second clock signal, and outputs either the first verification value or the second verification value as the second signature value when the first verification value is equal to the second verification value.

[0014] According to a third aspect of the present invention, a system-on-a-chip is provided, including the digital signature device according to the second aspect.

[0015] In the scheme of this embodiment, the dot product operator calculates the increment of the dot product result of a pair of random numbers corresponding to the current window positions. Compared with the dot product increment of the entire random bit sequence, the calculation process of the dot product result for each pair of window positions has a high degree of similarity, effectively avoiding side-channel attacks and thus ensuring the security of the dot product operation. In addition, there is a predetermined second preset number of bits between a pair of current window positions, which reduces the number of shifts of a pair of windows in the random bit sequence and improves the efficiency of the dot product operation. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1A This is a schematic block diagram of an example on-chip system.

[0018] Figure 1B for Figure 1A A schematic block diagram of the SM2 computing device mounted on the system-on-a-chip.

[0019] Figure 1C To adopt Figure 1B A flowchart illustrating the steps of the computing device in this embodiment to execute the SM2 digital signature method.

[0020] Figure 2A This is a schematic block diagram of a dot product calculation device according to an embodiment of the present invention.

[0021] Figure 2B for Figure 2A A schematic block diagram of the digital signature device to which the embodiments apply.

[0022] Figure 3A According to Figure 2B A flowchart illustrating the steps of an example digital signature process in an embodiment.

[0023] Figure 3B for Figure 3A A schematic diagram of a pair of window positions in an example random bit sequence. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and thoroughly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0025] The specific implementation of the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0026] Figure 1A This is a schematic structural diagram of a system-on-a-chip (SoC) according to an example. The SoC 1000 includes a memory 1210, a processing unit cluster 1220, and an arithmetic unit cluster 1100 connected by a bus. The processing unit cluster 1220 includes multiple processing units 222. The arithmetic unit cluster 1100 includes multiple arithmetic units 100. The processing units 222 are units that perform conventional processing (data processing not based on the result of a dot product operation), and can take various forms such as a processor (CPU), an application-specific integrated circuit (ASIC), or a field-programmable gate matrix (FPGA). The arithmetic units 232 in this application are specialized arithmetic units designed primarily to improve the security of data processing based on the result of a dot product operation.

[0027] Figure 1B This is a schematic block diagram of an example SM2 computing device. As shown, the SM2 computing device is implemented on the computing unit 100, including an SM2 computing control module 10, a dot product computing control module 20, a binary field computing control module 30, a binary field computing module 40, and a key derivation module 50. The SM2 computing control module 10 receives control signals from the main control module, performs SM2 encryption / decryption operations, and schedules the underlying sub-modules (dot product computing control module 20 and SM2 key derivation module 50) to generate an SM2 session key through a series of control signals. Subsequently, the AES key is encrypted based on the SM2 session key.

[0028] The SM2 key derivation module 50 derives the session key required for further encryption from the dot product result calculated by the dot product operation control module 20, and then sends this key to the SM2 operation control module 10. The SM2 operation control module 10 performs encryption processing on the AES key Key, generating the key block Ckey. The dot product operation control module 20, the binary field operation control module 30, and the binary field operation module 40 work together to implement the dot product operation on the elliptic curve. The dot product operation control module 20 completes the data loading and output of the dot product operation, and transforms the coordinates of the base point P of the elliptic curve from the affine coordinate system to the projected coordinate system. By progressively scanning each bit of K, it calls the coordinate transformer 31, the dot addition operator 32, and the doubling operator 33 to perform the corresponding finite field operations, completing the dot product operation in the projected coordinate system. Before performing point addition and multiplication operations through point addition operator 32 and point multiplication operator 33, binary field operation control module 30 first performs coordinate transformation through coordinate transformer 31 to reduce inverse operations. After transformation, it calls the underlying modular addition operator 41, modular multiplication operator 43, modular inverse and modular squaring operator 42 to perform modular addition, modular multiplication, modular inverse and modular squaring operations to complete point addition and multiplication operations.

[0029] Specifically, the binary field operation module 40 includes a modular addition unit 41, a modular multiplication / squaring unit 43, and a modular inverse unit 42. The modular addition unit 41 simply performs a bitwise XOR operation on the operands. The modular multiplication / squaring unit 43 employs a hybrid serial-parallel binary field modular multiplication algorithm, dividing the multiplier into several segments. In each calculation, a segment of the multiplier is multiplied by the multiplicand to obtain a partial product, which serves as the data input for the next round of multiplication. This combined serial-parallel modular multiplication algorithm achieves a good balance between circuit area and computational speed. The modular inverse unit 42 utilizes Fermat's Little Theorem to convert modular inverse calculations into modular multiplication and modular squaring operations, which are implemented by scheduling the modular multiplication / squaring unit 43.

[0030] Furthermore, Figure 1C The SM2 digital signature method is shown according to an example. Figure 1C The SM2 digital signature method includes the following steps: S110: Configure M=Z||m, continue to step S120.

[0031] S120: Calculate e0 = Hv(M), convert e0 to an integer, and continue to execute step S130.

[0032] S130: Use a random number generator to generate a random number k, 1≤k≤n-1, and continue to execute step S140.

[0033] S140: Calculate the elliptic curve point (x1, y1) = [k]G, and continue to step S150.

[0034] S150: Calculate r = (e0 + x1) mod n, and determine whether r = 0 or r + k = n. If yes, return to step S130; otherwise, execute step S160.

[0035] S160: Calculate s = (1 + dA) (kr) dA))modn, determine if s=0. If yes, return to step S130; otherwise, execute step S170.

[0036] S170: Convert the data types of r and s into byte strings as the digital signature of M.

[0037] Where M represents the signed message; dA represents the user's private key; e0 represents the output value of the cryptographic hash function applied to message M; G represents the base point of the elliptic curve; Hv() represents the cryptographic hash function with a message digest length of v bits; Z represents the user's distinguishable representation; [k]G represents a point k times the value of point P on the elliptic curve.

[0038] In this example, calculating the elliptic curve point (x1, y1) = [k]G requires using... Figure 1B The dot multiplier 32 and the dot multiplier 33 in the middle perform dot addition and dot multiplication operations respectively. The time and energy consumed by the dot multiplier 32 to perform dot addition and the dot multiplier 33 to perform dot multiplication are different, making them vulnerable to side-channel attacks such as SPA, DPA, and FA, which can lead to the leakage of sensitive data.

[0039] Figure 2A A dot product calculation device according to an embodiment of the present invention is shown. The dot product calculation device 200 of this embodiment can correspond to… Figure 1B The binary domain operation control module 30 is physically implemented using analog and / or digital circuits (e.g., logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits, etc.) and may optionally be driven by firmware and / or software. For example, the circuit may be implemented in one or more semiconductor chips or on a substrate support such as a printed circuit board.

[0040] The dot multiplication device 200 in this embodiment includes a shifter 210, a dot multiplication unit 220, a dot multiplication unit 230, and a dot addition unit 240.

[0041] In a random bit sequence, shifter 210 shifts the bit by a window width of a first preset number of bits to a pair of current window positions, wherein the first current window position and the second current window position are spaced apart by a second preset number of bits.

[0042] For example, the first shift range shifted by the first window position and the second shift range shifted by the second window position are adjacent, forming a random bit sequence. In various embodiments of the present invention, the first shift range is in the higher bits and the second shift range is in the lower bits.

[0043] Furthermore, the length (i.e., number of bits) of the first shift range can be the same as or different from the length of the second shift range. For example, the length of the first shift range may differ from the length of the second shift range by no more than 1 bit. In one example, the number of bits between predetermined windows may be the same as the number of bits in the first shift range. The preset number of bits can be odd or even.

[0044] Furthermore, in the first window position of a pair of windows, the shift is from high digits to low digits within the first shift range, and the second window position is shifted from high digits to low digits within the second shift range.

[0045] More specifically, Figure 3B The given random bit sequence ABCDEFGHIJ is shown, where A, B, C, D, E, F, G, H, I, and J are units representing a predetermined number of bits, for example, 5 bits. Exemplarily, A represents 10101, and B, C, D, E, F, G, H, I, and J can be the same as A or different from each other. The first shift range is ABCDE, and the second shift range is FGHIJ. In this example, when i = 0, 1, 2, 3, 4, ki+e and ki represent the second window position 2 and the first window position 1, respectively. The predetermined number of bits between the second window position 2 and the first window position 1 is 5*5=25, d=10, and e=5.

[0046] The doubling point operator 220 performs a doubling point operation based on the previous dot product results corresponding to a pair of previous window positions to obtain the current doubling point result.

[0047] The dot product operator 230 obtains a first random number corresponding to the first current window position and a second random number corresponding to the second current window position from the shifter, and performs a dot product operation based on the first and second random numbers and the binary base point to obtain the current dot product increment. Specifically, the dot product operator 230 can call the dot multiplier operator 220 and the dot adder operator 240 to perform the dot product operation. The dot product result increment can be determined based on the Jacobian dot addition formula.

[0048] The dot addition unit 240 obtains the current dot multiplication result from the dot multiplication unit, performs dot addition operation based on the current dot multiplication result and the current dot multiplication increment, and obtains a pair of current dot multiplication results corresponding to the current window position.

[0049] If a pair of current window positions reaches the end window position of the random bit sequence, the dot addition unit 240 outputs the current dot product result as the dot product result of the random bit sequence.

[0050] It should be understood that the dot product operator 230 can correspond to Figure 1B The example dot multiplication control module 20, dot multiplier 220, and dot addition 240 can respectively correspond to Figure 1B Example of a doubling operator 33 and a dot addition operator 32.

[0051] In the scheme of this embodiment, the dot product operator calculates the increment of the dot product result of a pair of random numbers corresponding to the current window positions. Compared with the dot product increment of the entire random bit sequence, the calculation process of the dot product result for each pair of window positions has a high degree of similarity, effectively avoiding side-channel attacks and thus ensuring the security of the dot product operation. In addition, there is a predetermined second preset number of bits between a pair of current window positions, which reduces the number of shifts of a pair of windows in the random bit sequence and improves the efficiency of the dot product operation.

[0052] In one example, the dot product operation device also includes a register. The register stores previous dot product results, and if a pair of current window positions has not reached the end window position of the random bit sequence, the register updates the previous dot product results based on the current dot product results.

[0053] Alternatively, if a pair of current window positions is the starting window position of a random bit sequence, the register stores a zero value as the result of the previous dot product.

[0054] In other examples, the dot product operator calculates k. d-1 As the first random number corresponding to the first current window position, and calculate k e-1 , which serves as the second random number corresponding to the second current window position. The number of window positions d = [t / w], where t represents the length of the random bit sequence, w represents the first preset number of bits, and the second preset number of bits e = [d / 2].

[0055] In other examples, the dot product operator calculates (k i+e +1)G+(k) i +1)G, as the current dot product increment, where 0≤i≤e-1, and G represents the binary base point. (k i+e +1)G+(k) i +1) G compared to k i+e G+k iG avoids the situation where the first and second random numbers are both 0, which improves the reliability of the dot product calculation in this embodiment of the invention and brings about an increment in the result during the dot product calculation process. Correspondingly, the shifter obtains the initial random number k, and the shift compensation k-K0 is used as a random bit sequence. In this way, the initial random number k is compensated to obtain a random bit sequence, which cancels out the influence of the result increment and improves the accuracy of the dot product operation.

[0056] Figure 2B It shows Figure 2A The digital signature device 300 used in this embodiment, as shown in the figure, includes a dot multiplication operation device 200 and a signature operation device 3000.

[0057] The dot product operation device 200 acquires a random bit sequence and outputs the dot product result of the random bit sequence. For example, it can be used... Figure 2A The described solution implements the corresponding operations.

[0058] The signature processing unit 3000 calculates the signature value of the dot product result. For example, based on the dot product result, the r and s values ​​are determined. For other encryption algorithms, the corresponding signature value can be determined from the dot product result for signature processing.

[0059] In other examples, the signature processing device 3000 includes a signature value processor and a signature value arithmetic unit.

[0060] For SM2 signatures, the signature value operator calculates the first signature value r of the dot product result.

[0061] A clock signal generator generates a first clock signal and a second clock signal. For example, the clock signal generator randomly generates the first clock signal and the second clock signal. In this case, the signature value calculator responds to the first clock signal to calculate a first verification value s1 of the second signature value, and responds to the second clock signal to calculate a second verification value s2 of the second signature value. When the first verification value s1 and the second verification value s2 are equal, the calculator outputs either the first verification value or the second verification value as the second signature value s, thereby improving the reliability of the signature value and thus improving the reliability of the signing process.

[0062] In addition, embodiments of the present invention also provide a system-on-a-chip, including a digital signature device 300.

[0063] The following will combine Figure 3A and Figure 3B Describe in detail an example of the SM2 signing process. Figure 3B for Figure 3A The example shows the positions of the first and second windows in the random bit sequence. The following will combine... Figure 3B Schematic diagram description Figure 3AThe digital signature process is specifically executed by the digital signature device on the system-on-chip, and includes the following steps: S301: Configure M=Z||m, then proceed to step S302.

[0064] S302: Calculate e0 = Hv(M), convert e0 to an integer, and continue to step S303.

[0065] S303: Use a random number generator to generate t-bit random numbers k, 1≤k≤n-1, and continue to execute step S304, where t represents the number of bits in the random bit sequence.

[0066] It should be understood that the above steps S301-S303 can be executed using the random number generator in the dot product operation device, which will not be elaborated here.

[0067] S304: Generates 32-bit random numbers using a random number generator. , Then proceed to step S305. It should be understood that steps S301-S304 can serve as an example of obtaining an initial random number k. This step can also be performed using a random number generator.

[0068] S305: k = k - 111....1, where 111....1 is the binary representation of d ones, then proceed to step S306. This step can be used as an example to determine k-K0, that is, K0 is the binary representation of 2d-1, d = [t / w], w represents the preset number of bits, and e = [d / 2]. For example, an initial random number k is obtained through a shifter, and the shift compensation k-K0 is used as the random bit sequence.

[0069] S306: , to obtain k i+e and k i Continue executing S307. That is, by shifting the first window position and the second window position within the first shift range and the second shift range, each first random number and each second random number are obtained. i and k i+e Each first random number and each second random number can be generated separately, corresponding to a pair of window positions. This step can be performed by a shifter, and the first and second random numbers are output to the dot multiplier 220 and the dot multiplier 230.

[0070] Specifically, Figure 3BThe given random bit sequence ABCDEFGHIJ is shown, where A, B, C, D, E, F, G, H, I, and J are units representing a predetermined number of bits, for example, 5 bits. Exemplarily, A represents 10101, and B, C, D, E, F, G, H, I, and J can be the same as A or different from each other. The first shift range is ABCDE, and the second shift range is FGHIJ. In this example, when i = 0, 1, 2, 3, 4, k... i+e and k i These represent the second window position 2 and the first window position 1, respectively. The predetermined number of bits between the second window position 2 and the first window position 1 is 5*5=25, d=10, and e=5.

[0071] S307: Calculate the first initial dot product result of the starting window position of the first window position and the second initial dot product result of the starting window position of the second window position, and continue to execute S308. Specifically, the dot product operator 230 can call the dot multiplier operator 220 and the dot addition operator 240 to calculate Q1= Q2= G is the binary base point of the elliptic curve.

[0072] S308: Perform a dot addition operation on the first initial dot product result and the second initial dot product result, and continue to execute S309. Specifically, Q = Q1 + Q2, that is, when i = e-1, It should be understood that (k) i +1) and (k i+e +1) Avoided k i and k i+e The case of 0 improves the reliability of dot product operations. Correspondingly, determining the starting random number based on k-K0 ensures compatibility with existing standards.

[0073] S309: Check if point Q is on the elliptic curve. If not, proceed to S310; if yes, proceed to step S311.

[0074] S310: Clear sensitive information during the digital signature process and report an error.

[0075] S311: Determine if i > 0. If yes, execute S312; otherwise, execute S313.

[0076] S312: i = i - 1, perform doubling and dot addition operations. Specifically, a doubling calculator 220 can be used for calculation. Then, continue to use the dot-adder 240 to calculate. And execute S310. It should be understood that this step S312 can be used as an example of performing a dot product operation based on the dot product result of a pair of current window positions to obtain the increment of the dot product result of the next pair of window positions. For steps S311 and S312, without loss of generality, based on the initial dot product result of a pair of current window positions and the increment of the dot product result corresponding to a pair of current window positions, the dot product result of a pair of current window positions is determined until the pair of current window positions reaches the end window position of the first shift range and the end window position of the second shift range.

[0077] S313: Output And check if the point is on the elliptic curve. If yes, execute S314; if no, execute S309.

[0078] It should be understood that the following steps S314-S320 can be executed by the signature processing device 3000.

[0079] S314: Based on the dot product result Q of the random bit sequence, determine the first signature value r for signature processing, and continue to S315. Specifically, calculate... .

[0080] S315: Determine if... or If yes, return to step S303; if no, execute S316.

[0081] S316: At the first moment, determine the first verification value s1 of the second signature value based on the first signature value. Specifically, calculate... Determine whether If yes, return to step S303; if no, execute S317. The first time can be the time indicated by the first clock signal.

[0082] S317: At a random time after the first time, determine a second verification value s2 based on the first signature value. Specifically, calculate... Determine whether If yes, return to step S303; if no, execute S318. The random time after the second time can be the time indicated by the second clock signal.

[0083] S318: Determine whether the first verification value and the second verification value are equal. If they are equal, then determine either the first verification value or the second verification value as the second signature value. Specifically, determine... and Check if they are equal. If they are equal, execute S319; if they are not equal, execute S320.

[0084] S319: Set s=s1 or s=s2 and output the signature value. , as the signature of M.

[0085] S320: Delete s1 and s2, and continue with S303.

[0086] It should be noted that, depending on the implementation needs, the various components / steps described in the embodiments of the present invention can be broken down into more components / steps, or two or more components / steps or parts of the operation of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present invention.

[0087] The methods described above according to embodiments of the present invention can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded via a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for executing the methods shown herein.

[0088] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments of the present invention.

[0089] The above embodiments are only used to illustrate the embodiments of the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of the present invention. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of the present invention, and the patent protection scope of the embodiments of the present invention should be defined by the claims.

Claims

1. A dot product calculation device, comprising: A shifter, in a random bit sequence, shifts the bit by a window width of a first preset number of bits to a pair of current window positions, wherein the first current window position and the second current window position are spaced apart by a second preset number of bits. The doubling point operator performs a doubling point operation based on the previous dot product results corresponding to a pair of previous window positions, and obtains the current doubling point result; The dot product operator obtains a first random number corresponding to the first current window position and a second random number corresponding to the second current window position from the shifter, and performs a dot product operation with the binary base point based on the first random number and the second random number to obtain the current dot product increment; The dot addition operator obtains the current dot multiplication result from the dot multiplication operator, performs dot addition operation based on the current dot multiplication result and the current dot multiplication increment, and obtains the current dot multiplication result corresponding to the pair of current window positions; If the pair of current window positions reaches the end window position of the random bit sequence, the dot addition operator outputs the current dot product result as the dot product result of the random bit sequence.

2. The apparatus according to claim 1, wherein, The device further includes: The register stores the previous dot product result. If the pair of current window positions has not reached the end window position of the random bit sequence, the register updates the previous dot product result based on the current dot product result.

3. The apparatus according to claim 2, wherein, If the pair of current window positions is the starting window position of the random bit sequence, then the register stores a zero value as the previous dot product result.

4. The apparatus according to claim 1, wherein, The dot product operator calculates k d-1 As the first random number corresponding to the first current window position, and calculate k e-1 As the second random number corresponding to the second current window position, Wherein, the number of window positions d = [t / w], t represents the length of the random bit sequence, w represents the first preset number of bits, and the second preset number of bits e = [d / 2].

5. The apparatus according to claim 4, wherein, The dot product operator calculates (k) i+e +1)G+(k) i +1)G, as the current dot product increment, where 0≤i≤e-1, and G represents the binary base point.

6. The apparatus according to claim 5, wherein, The shifter acquires an initial random number k, and the shift compensation k-K0 is used as the random bit sequence, where K0 is 2. d The binary representation of -1.

7. A digital signature device, comprising: A dot product operation device acquires a random bit sequence and outputs the dot product result of the random bit sequence, wherein the dot product operation device is the dot product operation device according to any one of claims 1-6; A signature calculation device calculates the signature value of the dot product result.

8. The apparatus according to claim 7, wherein, The signature processing device includes: A signature value calculator calculates the first signature value of the dot product result; A clock signal generator generates a first clock signal and a second clock signal. The signature value calculator calculates a first verification value of the second signature value in response to the first clock signal, calculates a second verification value of the second signature value in response to the second clock signal, and outputs either the first verification value or the second verification value as the second signature value when the first verification value is equal to the second verification value.

9. A system-on-a-chip, comprising: The digital signature device according to claim 7 or 8.

Images